Resubmissions

07/09/2026, 20:18

260907-y3jless1fx4

07/09/2026, 20:17

260907-y21hjsvfmd4

07/09/2026, 20:10

260907-yx72tss1ct4

Analysis

  • user interaction
    yes
  • max time kernel
    193s
  • max time network
    194s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/09/2026, 20:18

General

  • Target
    irrealix.Bundle.260903.1nv3rt.CE.exe
  • Size 11.1MB
  • Sample260907-y3jless1fx
  • SHA256 03d4252e1362c40df7eefdda1de6e20e61a15fc622e8aadb9208f39e0c922ed7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 37 IoCs
  • Checks processor information in registry 2 TTPs 30 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\irrealix.Bundle.260903.1nv3rt.CE.exe
    "C:\Users\Admin\AppData\Local\Temp\irrealix.Bundle.260903.1nv3rt.CE.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    PID:4912
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5428
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {59e71a7a-716e-4bbe-84d9-3daf8d801880} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:2948
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {462c4970-fa45-462c-a53f-122f5437bf4c} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
            • Checks processor information in registry
            PID:5344
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27323 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {6ea59165-01dd-436c-a63a-f195648cdd1d} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:5304
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27323 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 3980 -initialChannelId {b6317fc7-a342-4191-b5c1-52fac302c982} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:5280
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4456 -prefsLen 34822 -prefMapHandle 4460 -prefMapSize 270279 -jsInitHandle 4464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4472 -initialChannelId {b60a868f-2c5b-4b37-bb1a-3142bef7058c} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:1584
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2936 -prefsLen 34903 -prefMapHandle 3388 -prefMapSize 270279 -ipcHandle 2924 -initialChannelId {93b9f370-df90-420d-a5d0-9e998c4a5dc3} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:2848
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3052 -prefsLen 32793 -prefMapHandle 5036 -prefMapSize 270279 -jsInitHandle 5040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5048 -initialChannelId {43e258ce-22e7-487d-a556-e2b8d6d8f64c} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:4564
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 32793 -prefMapHandle 5068 -prefMapSize 270279 -jsInitHandle 5072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {ca6d06b2-8cff-4df5-a3c6-ec6a5d4986ca} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:4640
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5444 -prefsLen 32793 -prefMapHandle 5440 -prefMapSize 270279 -jsInitHandle 5436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {c2f1914d-d593-496d-87be-3d80348663d5} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:4804
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6304 -prefsLen 33071 -prefMapHandle 6416 -prefMapSize 270279 -jsInitHandle 6336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6408 -initialChannelId {ac08b866-dadf-4439-b047-70063d41930e} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:5432
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5136 -prefsLen 33071 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6276 -initialChannelId {fc128d04-9418-4a3a-88af-849ab0d108ca} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
              3⤵
              • Checks processor information in registry
              PID:4676
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6640 -prefsLen 33071 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 4640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {ba14aeae-a7dc-4740-bb8e-c7f48c778aa1} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
              3⤵
              • Checks processor information in registry
              PID:1228
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7060 -prefsLen 33071 -prefMapHandle 7064 -prefMapSize 270279 -jsInitHandle 7068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6736 -initialChannelId {a0c73337-29a0-40a1-89a9-fb27fae1cfda} -parentPid 4452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
              3⤵
              • Checks processor information in registry
              PID:4248

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              1nv3rt.nfo

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\1nv3rt.nfo
              • Size 1KB
              • SHA256 ad6d5682973d22c9e9ef98dc1fae16b0c47f39b08d0781367cb466a35049eac9
              • MD5 SHA1 SHA512 TLSH

              DustTransition.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\DustTransition.aex
              • Size 3.6MB
              • SHA256 d1b38f2030c9a3873bd4930c0bec068bde31a8884206a382d4a72edfdbae0260
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Flowr.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\Flowr.aex
              • Size 5.1MB
              • SHA256 4bebf463c354371fa4c4234a9d1e45880e9601937e99e27f7ea121475961ff40
              • MD5 SHA1 SHA512 SSDEEP TLSH

              GaussianSplatting.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\GaussianSplatting.aex
              • Size 6.4MB
              • SHA256 3ac08c724b06615cb0d6aaa1b8ad3fb2a472bd758359f39b08811ec03c9d2069
              • MD5 SHA1 SHA512 SSDEEP TLSH

              LoopFlow.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\LoopFlow.aex
              • Size 2.4MB
              • SHA256 33c86877a9caeb63893119bd66d5f85e7f7b5d943a829addb005b1232764c487
              • MD5 SHA1 SHA512 SSDEEP TLSH

              MosaicArt.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\MosaicArt.aex
              • Size 3.2MB
              • SHA256 f65192ed664997665d7069694d95e7b3132e4d55bc9ddb2ace5ee89b3cbc64df
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Nebulosity.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\Nebulosity.aex
              • Size 2.6MB
              • SHA256 35be4f510d23ff518f17ead5a9c7b26e565b2ad93990fedadbee11ff1c51dc97
              • MD5 SHA1 SHA512 SSDEEP TLSH

              PlyImporter.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\PlyImporter.aex
              • Size 1.0MB
              • SHA256 e146fe4775669c37a09a119d7f598d08f4c167c657e8029fb6364b962cab3100
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Potok.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\Potok.aex
              • Size 2.4MB
              • SHA256 1829c3b26cea5a7d4a3577351c61ad0e365e8527d2521215d25fdb04309b0aff
              • MD5 SHA1 SHA512 SSDEEP TLSH

              RayProjector.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\RayProjector.aex
              • Size 7.1MB
              • SHA256 9864475805c37cb53757a73bcbd28bd66bdd8815df56c8d87f7af2571163db42
              • MD5 SHA1 SHA512 SSDEEP TLSH

              RekaGrid.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\RekaGrid.aex
              • Size 3.3MB
              • SHA256 5037f001773031699be0f324787288489bcc9a99c915f8cea057f37aa4994735
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Stretch.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\Stretch.aex
              • Size 2.4MB
              • SHA256 a0c47093a3bae83313d5cd2d900078a61694bc15ab93dad075a592987533787d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Volna.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\Volna.aex
              • Size 2.5MB
              • SHA256 9809cfbae2df31abaf3523ef140b0d591eea8d399f339c058b8022d2a757f44c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              freeGradient.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\freeGradient.aex
              • Size 2.3MB
              • SHA256 26be14b32b461a75ab7343a7e62f5f7d519805fb975801c1aab815b4a671117a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              proGradient.aex

              • Path C:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\irrealix\proGradient.aex
              • Size 7.3MB
              • SHA256 8d402780848f851b568a78a03b0b24e337eb0aad7a0c5c8cdb5d5c3ea6644a8d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              10038

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\10038
              • Size 14KB
              • SHA256 a5cccbd0ad407f5aa6c41c1addef3d21a3ae1e2aec0167a1e161cd270e772b7c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              11624

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\11624
              • Size 14KB
              • SHA256 70515b5852576d2357ec19abf97aa9fa18ac73d15094805c8acd84ba77f51419
              • MD5 SHA1 SHA512 SSDEEP TLSH

              1258

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\1258
              • Size 14KB
              • SHA256 6606fe71c51c8b1c29c850248f3e7b8890ec3871e3e2c016cf0c86a7e8c498cb
              • MD5 SHA1 SHA512 SSDEEP TLSH

              13124

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\13124
              • Size 14KB
              • SHA256 db9df27c33f3b70391313301ff5b77d2391c99ccf3fa0face7d5998a3a07556f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              14017

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\14017
              • Size 14KB
              • SHA256 8323207e1db0e0742fdbb3149ceffba11736478e80a9e127dfe0c8a655d56398
              • MD5 SHA1 SHA512 SSDEEP TLSH

              14831

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\14831
              • Size 14KB
              • SHA256 c1f6ff3f5ff5f3c1ab9cbbc91f59eecfa19ee6bf7ffa894c5787a68c1464bc04
              • MD5 SHA1 SHA512 SSDEEP TLSH

              15031

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\15031
              • Size 14KB
              • SHA256 31dac3b317a5fc8bd633b05ac20685bcaeae5291658ecbc185641dfb769d1df5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              19314

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\19314
              • Size 14KB
              • SHA256 05614c1e789cb06fac56363c68cb00366de1a8422d42b2ff3c61917be6e46f9e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              19711

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\19711
              • Size 13KB
              • SHA256 ea7f83c343f6b1c6afdf94f9a634515cd40cd9e7dba471651872d06296ba4d3d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              20820

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\20820
              • Size 19KB
              • SHA256 5e871871f782cbe399a1331a5940c7826162eb88c84a69cdbdf12d5a767658e4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              22055

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\22055
              • Size 14KB
              • SHA256 b296bbdeb8e6089fa0a5591c5fcadc2d4c4d306bf2d9badace539867b385dcba
              • MD5 SHA1 SHA512 SSDEEP TLSH

              22842

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\22842
              • Size 14KB
              • SHA256 8a16bb30ce567a686c9764eedab3ae12241df6a2fa9cf4477a875cdfa271a317
              • MD5 SHA1 SHA512 SSDEEP TLSH

              2431

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\2431
              • Size 14KB
              • SHA256 ba1c0673e6a4178f41f0c16c99011b50411d7bbe11764e542d5d0d80db7e58c4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              25390

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\25390
              • Size 14KB
              • SHA256 e9d4e4c4c257c01286de79fc3ff72ba43139a2df0ddf46e7e736e09883f268aa
              • MD5 SHA1 SHA512 SSDEEP TLSH

              25414

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\25414
              • Size 14KB
              • SHA256 fab47ee227406b14e30aee32bfb0156c5b9c2a3186a10207cf534acf9d640f0c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              29957

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\29957
              • Size 15KB
              • SHA256 1268ce8e7b82f3a6c048337fd92586c2931f45649b1261fd211f9d255d334dbd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              30667

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\30667
              • Size 14KB
              • SHA256 126376f6c59ae20c21ff95bd0a51337f0baeaba1a1488562cc4b2adc3242e555
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3235

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\3235
              • Size 14KB
              • SHA256 c3dd067ff71c87aa56ab5cf70dcd45654ff5a7bcb7a7d5ea96470b97902c1266
              • MD5 SHA1 SHA512 SSDEEP TLSH

              32412

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\32412
              • Size 15KB
              • SHA256 6605938dba4995f7a75644f6bd82faafe1428f3408fb1564c07bf3de62e29f6a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              4111

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\4111
              • Size 14KB
              • SHA256 25f48e9ecfddc9c025f7bf3a4a9960d34508d86cfbecb5ed47084952242fc6fa
              • MD5 SHA1 SHA512 SSDEEP TLSH

              5177

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\5177
              • Size 14KB
              • SHA256 7f1fdeb5970c82572f60eb95c197ebfcb3aec274f7f466db92aa2456b04d6d96
              • MD5 SHA1 SHA512 SSDEEP TLSH

              6941

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\6941
              • Size 14KB
              • SHA256 34c459298c973ce89d249cfbe016f4cd4a2521357bd34253777b6f9d73a66388
              • MD5 SHA1 SHA512 SSDEEP TLSH

              7590

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\doomed\7590
              • Size 14KB
              • SHA256 e3ad43b81d22051c8969c1cfcc1d5867f96ee407adf8d87d62d99272c7090da2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              2DEB3B81EB96245D9BC1CF71DE19C61850835DAB

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\2DEB3B81EB96245D9BC1CF71DE19C61850835DAB
              • Size 60KB
              • SHA256 674f300c65a3655e0c13335b287016ca4f084f3252871e1b0dc0482386bafb00
              • MD5 SHA1 SHA512 SSDEEP TLSH

              5537FE2818117524DCC8904FACC86AA5C2CEC986

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\5537FE2818117524DCC8904FACC86AA5C2CEC986
              • Size 15KB
              • SHA256 827e574e216c8d89f925ac76bf7ad1fe360686a556262c3ee191c8c4f9ff5b8f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
              • Size 16KB
              • SHA256 c0d268c1e9d78e12f10748ceba2fd0406554010f4091e88a46da45a042920af5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              6805431D053C9BDD9E51592139541A9E50ED97A5

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\6805431D053C9BDD9E51592139541A9E50ED97A5
              • Size 17KB
              • SHA256 d2114dd49e368478a449e0ba64fe89a0a2d4d8ab93d1592b7710e3c4a27af99c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              7DD4D2E1E7BC3AB107510C94AEC93065037285AC

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\7DD4D2E1E7BC3AB107510C94AEC93065037285AC
              • Size 17KB
              • SHA256 f064770df4c0e43dd01afddd358539e84c9753beb4ab543ca68faf5156be0f9d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              9505B992CCCB8F1D5228BAB13844DCE8E7FB11F4

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\9505B992CCCB8F1D5228BAB13844DCE8E7FB11F4
              • Size 17KB
              • SHA256 e9f7212c0070d52a55d5a3fe4ed33b03f52f3c52ce15f3ca829674e0b5d47111
              • MD5 SHA1 SHA512 SSDEEP TLSH

              C0DC3CE6293B77541C4CFEAC00DD25A0C25D618C

              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\cache2\entries\C0DC3CE6293B77541C4CFEAC00DD25A0C25D618C
              • Size 36KB
              • SHA256 9b3663053b7df150601369ea22dfa1fb554b50685c719632bebdb18b5dedb2b4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tmpaddon

              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tmpaddon

              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH

              AlternateServices.bin

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\AlternateServices.bin
              • Size 10KB
              • SHA256 1a789dd5674b6ef7560d31b87e7c5b97ba8f857cba4d433236bbe93b817989a7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              AlternateServices.bin

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\AlternateServices.bin
              • Size 23KB
              • SHA256 fd8dfea8968a3f84af39d8fd3c629824b072eeda4a662dcaad87e43e69a7cf66
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
              • Size 3KB
              • SHA256 1661ac06d2c2277ef90996f70840b02301b7685cb3ea79507602f26349636520
              • MD5 SHA1 SHA512 TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
              • Size 6KB
              • SHA256 ae5ccc6b077b0ac45a2cd81120a73f7a7ada8d6d25ba1cba3cdcfb1bea251ec5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 84287733c3a9872898aa98b248d8a6ccbfc4472bb901a3a1224f8fba4ec4cdac
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 06f4e3ff6549aeeef809952d650fb77c98401e1b0fa53e6c49a8f6cab9a29d97
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 a754f50e36ff6f43ba02091ce0d3a3a8daf89dc8fa8a4923c34c236488c4fac0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              data.safe.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 cea9eead01aeb0875d29acfd75ee6ee386984a3eb2814f7263f89919e5b69541
              • MD5 SHA1 SHA512 SSDEEP TLSH

              events

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 e0687b6bcdd51fe85cad9bd4063e5a7bc7d0aaf6fa6d25743edc91bbb7f11fe6
              • MD5 SHA1 SHA512 TLSH

              events

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\events\events
              • Size 4KB
              • SHA256 b824772ae5d42c86fd50751c72f1a9c4c903f9e393314c0d7d366089bbd8f2b1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              0035dbc1-18fb-46b4-8696-b5b0e6a6754b

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\0035dbc1-18fb-46b4-8696-b5b0e6a6754b
              • Size 281B
              • SHA256 7aeee951ed2101d8f6c39c9d854eb810d9c2d6cb1ba760d5f45f55aaf32ac4cc
              • MD5 SHA1 SHA512 TLSH

              23bba969-aa59-4822-8371-f200853e71df

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\23bba969-aa59-4822-8371-f200853e71df
              • Size 2KB
              • SHA256 7fa58a5b8916474b43eac83d0f2d020fad4da5019cd8424da641b0b2e6bd9446
              • MD5 SHA1 SHA512 TLSH

              6d3d7f54-2837-4b34-a045-937f8ea70cdc

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\6d3d7f54-2837-4b34-a045-937f8ea70cdc
              • Size 1008B
              • SHA256 fc349b976cd1e1de3d7759a0d3e53c0c7e30071708a6f7dec80c948b947f240a
              • MD5 SHA1 SHA512 TLSH

              8f3cc910-8ec4-42b0-8f0f-a526a445feb7

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\8f3cc910-8ec4-42b0-8f0f-a526a445feb7
              • Size 883B
              • SHA256 91270d7b7305a9a98503360bfaa88b8950759ccc289df4cd0b1ff552d033a123
              • MD5 SHA1 SHA512 TLSH

              8faf04af-e7fd-4405-8691-e5aa53f90bdb

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\8faf04af-e7fd-4405-8691-e5aa53f90bdb
              • Size 2KB
              • SHA256 29dd6aa75bbbe23d82a124f1711c8e4e8ef7592dac93de47d2047438bc74b668
              • MD5 SHA1 SHA512 TLSH

              8fed4c9c-c187-4fb0-bc3c-7a4ce4996bf4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\8fed4c9c-c187-4fb0-bc3c-7a4ce4996bf4
              • Size 5KB
              • SHA256 3f6ebf81c7b10d935ab5113c8df0b370dbbfb88d6c4b73e64c50609a8ff5736e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              c465b569-9aed-48c5-9f75-34bed9e1a993

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\c465b569-9aed-48c5-9f75-34bed9e1a993
              • Size 886B
              • SHA256 c25206cb4f99cae56d18d863e35755c776e01aa29260fee1b5eec083caff15d5
              • MD5 SHA1 SHA512 TLSH

              cd2adc2d-3097-4cf3-94e3-32307d5dafbf

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\cd2adc2d-3097-4cf3-94e3-32307d5dafbf
              • Size 235B
              • SHA256 dda6bae91d5f5d96f7eadcd469c0c51809817c02422ee4fe61cd7baecfaa6a33
              • MD5 SHA1 SHA512 TLSH

              d04db9d8-d69e-4520-800e-31494232936c

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\datareporting\glean\pending_pings\d04db9d8-d69e-4520-800e-31494232936c
              • Size 235B
              • SHA256 ec2453977b7929bfaed41357e3f49d1dcd18d286c12ff3513a61138e3ba19f50
              • MD5 SHA1 SHA512 TLSH

              extensions.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\extensions.json
              • Size 16KB
              • SHA256 c4f1c76c0c62c2be7bf7c6c6db0818b3eabac10662c5a4652a71955e11a129c5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gmpopenh264.dll

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gmpopenh264.info

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
              • Size 1002B
              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
              • MD5 SHA1 SHA512 TLSH

              widevinecdm.dll

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
              • Size 21.6MB
              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
              • Size 7KB
              • SHA256 f5a2e375d6020aac58d1c4c108194a785d7ea47fd6d39b2ab6a141403417ab2f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
              • Size 8KB
              • SHA256 050e51bccd49897284f066cfbb2c71a58725788f469d4b5a6b9d84fa39ca9b25
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs-1.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs-1.js
              • Size 6KB
              • SHA256 dfc2110e0fd01584547c49acffee370c8f9762ff60c21b1614f152bdbf31f71e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs.js
              • Size 6KB
              • SHA256 b3aeb5b786b7084b6e601e4e5638aba69364302cdf51856ca13a5c4c916d7e3b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs.js
              • Size 7KB
              • SHA256 12c49d3ee21cdc3022d1727e548bbc6913d0b66d5025b24fb96d95aa1114a272
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs.js

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\prefs.js
              • Size 6KB
              • SHA256 ac61c3c7d486c854c63a3d6e717086fbc1b041f7f26177edd09220c7a919420c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              sessionCheckpoints.json.tmp

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionCheckpoints.json.tmp
              • Size 288B
              • SHA256 3a0285c8233ef0324b269f7291094e19fd9b77259f9419861ad796f7e9c979f3
              • MD5 SHA1 SHA512 TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
              • Size 4KB
              • SHA256 88453a188d6674c8cad8bfccc96d02bb870ac0ca5fad500d5c20b3e220258a85
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
              • Size 5KB
              • SHA256 e6d78a713f97086cd07d77f7023c6ba32d76f51c441384e62c21b103d7e14e94
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
              • Size 4KB
              • SHA256 8075373720cf33dfd62446e6a7aaddcf7c1c28b81dae16e99711fe027784e2f6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
              • Size 1KB
              • SHA256 eba6f1932c0cf41d9cd573958c93766defd01189f0e701b9cbd44cac75d49cde
              • MD5 SHA1 SHA512 TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
              • Size 4KB
              • SHA256 6c71aa64d1b6d642882ff0bbdf3ace6fc7c6c02689ab8ceb16ed555740687ec2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
              • Size 4KB
              • SHA256 1d7caf17a8081345e35f679831cf607e5e8a6b28558d3ff1d7a967cd9cbc832b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              recovery.baklz4

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\sessionstore-backups\recovery.baklz4
              • Size 5KB
              • SHA256 b5083ab450478ca3cba58fa7341f0543d2729960c41b504274aee5e4f3ad1ca5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              {f35ae1d4-e3a8-47ad-93a0-68bb9a6377f3}.final

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\storage\default\https+++www.virustotal.com\cache\morgue\243\{f35ae1d4-e3a8-47ad-93a0-68bb9a6377f3}.final
              • Size 71KB
              • SHA256 5faa7a95cc7faa174c0972989fed78c17bdde411cf4c35474272621699429e81
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 4.2MB
              • SHA256 66a290d33a635edb28d948fcf15fdfbb720ed48157811c85c00224c16c938c12
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 4.6MB
              • SHA256 2da6071be4e379b10b255c4f533dc1b1ae8326567a2447236ca83b0e7203cb59
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 6.7MB
              • SHA256 853e22658b5fa89823474dbad74d45144bf1a17a96898e0f00682f493189c2de
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3870112724rsegmnoittet-es.sqlite

              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1ml9u8ox.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 6.7MB
              • SHA256 3cae944917e7a59fa275298bce8f28192d972bd983a3078957d8bb6edb3c807b
              • MD5 SHA1 SHA512 SSDEEP TLSH