82e106f2c3f12655ef75b5838b74c0381566740d1454ccd3d5424af153d0394b

Analysis

user interaction
yes
max time kernel
364s
max time network
361s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SoleHack ALPHA.jar
Size 2.0MB
Sample260910-mz2r2ssaph
SHA256 82e106f2c3f12655ef75b5838b74c0381566740d1454ccd3d5424af153d0394b
MD5 b9a11a3a0ef2843ddace68d0427299cc
SHA1 7710aa9d5c21690cdd075c85a01bac56f1a1e3f1
SHA512 cb5a6a4113109e209077aceb8cdf3962b8b0ef5c5ef9080271f3f76fa8c2b6dee70688957fa05e67c3670c72fe4da171e278d6ec4250a212463e00f0b4d2f1fe
SSDEEP 49152:lUdg8y+n3ZmmNsf5XY1aONofHbZCjKReztJmKKGJ0heOdqEs:lyl33hNa21C1CjPztJY+/Es
TLSH
T1F9A5330A81DD8C32D82B0977BAC1C555BA4CE2BC9306A63DA95C6FDD20BDA401356FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1168	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335116548713314"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	firefox.exe
Token: SeDebugPrivilege	2976	firefox.exe
Token: SeDebugPrivilege	2976	firefox.exe
Token: SeDebugPrivilege	2976	firefox.exe
Token: SeDebugPrivilege	2976	firefox.exe
Token: SeDebugPrivilege	2976	firefox.exe
Token: SeDebugPrivilege	2976	firefox.exe
Token: SeDebugPrivilege	2976	firefox.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe
Token: SeShutdownPrivilege	4556	chrome.exe
Token: SeCreatePagefilePrivilege	4556	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe
4556	chrome.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe
2976	firefox.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2976	5028	firefox.exe	89
PID 5028 wrote to memory of 2976	5028	firefox.exe	89
PID 2976 wrote to memory of 4336	2976	firefox.exe	90
PID 2976 wrote to memory of 4336	2976	firefox.exe	90
PID 2976 wrote to memory of 4336	2976	firefox.exe	90
PID 2976 wrote to memory of 2868	2976	firefox.exe	91
PID 2976 wrote to memory of 2868	2976	firefox.exe	91
PID 2976 wrote to memory of 2868	2976	firefox.exe	91
PID 2976 wrote to memory of 2868	2976	firefox.exe	91
PID 2976 wrote to memory of 2856	2976	firefox.exe	92
PID 2976 wrote to memory of 2856	2976	firefox.exe	92
PID 2976 wrote to memory of 2856	2976	firefox.exe	92
PID 2976 wrote to memory of 2856	2976	firefox.exe	92
PID 2976 wrote to memory of 2120	2976	firefox.exe	93
PID 2976 wrote to memory of 2120	2976	firefox.exe	93
PID 2976 wrote to memory of 2120	2976	firefox.exe	93
PID 2976 wrote to memory of 116	2976	firefox.exe	94
PID 2976 wrote to memory of 116	2976	firefox.exe	94
PID 2976 wrote to memory of 116	2976	firefox.exe	94
PID 2976 wrote to memory of 116	2976	firefox.exe	94
PID 2976 wrote to memory of 3120	2976	firefox.exe	95
PID 2976 wrote to memory of 3120	2976	firefox.exe	95
PID 2976 wrote to memory of 3120	2976	firefox.exe	95
PID 2976 wrote to memory of 3120	2976	firefox.exe	95
PID 2976 wrote to memory of 312	2976	firefox.exe	96
PID 2976 wrote to memory of 312	2976	firefox.exe	96
PID 2976 wrote to memory of 312	2976	firefox.exe	96
PID 2976 wrote to memory of 312	2976	firefox.exe	96
PID 2976 wrote to memory of 4764	2976	firefox.exe	97
PID 2976 wrote to memory of 4764	2976	firefox.exe	97
PID 2976 wrote to memory of 4764	2976	firefox.exe	97
PID 2976 wrote to memory of 4764	2976	firefox.exe	97
PID 2976 wrote to memory of 4632	2976	firefox.exe	98
PID 2976 wrote to memory of 4632	2976	firefox.exe	98
PID 2976 wrote to memory of 4632	2976	firefox.exe	98
PID 2976 wrote to memory of 4632	2976	firefox.exe	98
PID 2976 wrote to memory of 2264	2976	firefox.exe	108
PID 2976 wrote to memory of 2264	2976	firefox.exe	108
PID 2976 wrote to memory of 2264	2976	firefox.exe	108
PID 2976 wrote to memory of 2264	2976	firefox.exe	108
PID 4556 wrote to memory of 2488	4556	chrome.exe	110
PID 4556 wrote to memory of 3372	4556	chrome.exe	111
PID 4556 wrote to memory of 3372	4556	chrome.exe	111
PID 4556 wrote to memory of 1168	4556	chrome.exe	112
PID 4556 wrote to memory of 1948	4556	chrome.exe	113
PID 4556 wrote to memory of 1948	4556	chrome.exe	113
PID 4556 wrote to memory of 1228	4556	chrome.exe	115
PID 4556 wrote to memory of 1228	4556	chrome.exe	115
PID 4556 wrote to memory of 436	4556	chrome.exe	116
PID 4556 wrote to memory of 436	4556	chrome.exe	116
PID 4556 wrote to memory of 3084	4556	chrome.exe	117
PID 4556 wrote to memory of 3084	4556	chrome.exe	117
PID 4556 wrote to memory of 4368	4556	chrome.exe	118
PID 4556 wrote to memory of 4368	4556	chrome.exe	118
PID 4556 wrote to memory of 2580	4556	chrome.exe	119
PID 4556 wrote to memory of 3152	4556	chrome.exe	128
PID 4556 wrote to memory of 2396	4556	chrome.exe	129
PID 4556 wrote to memory of 4100	4556	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\SoleHack ALPHA.jar"
1⤵
PID:1564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {7b0f7433-baff-4c03-9494-5648dcbf9afa} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27135 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {a489cbe3-36ce-4361-a2a2-efeff4a98f31} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3552 -prefsLen 27276 -prefMapHandle 3556 -prefMapSize 270279 -jsInitHandle 3560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3568 -initialChannelId {d147d8f4-4a49-4d46-bd8a-4f5205d9a33b} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3720 -prefsLen 27276 -prefMapHandle 3724 -prefMapSize 270279 -ipcHandle 3808 -initialChannelId {a711bc33-095b-48a6-b6b8-15ec7402ddfd} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34775 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4380 -initialChannelId {0349b960-ee19-4470-8f1a-e4f6254a7690} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4556 -prefsLen 34878 -prefMapHandle 4768 -prefMapSize 270279 -ipcHandle 4824 -initialChannelId {03dc7564-3598-47e8-92ef-b54ecad43a87} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5052 -prefsLen 32952 -prefMapHandle 5056 -prefMapSize 270279 -jsInitHandle 5060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5068 -initialChannelId {d7586ed0-348c-41c6-8e5b-0a264ff56671} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32952 -prefMapHandle 5092 -prefMapSize 270279 -jsInitHandle 5096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {c0068b4a-6f5f-41f0-960c-ffb3063c5087} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5452 -prefsLen 32952 -prefMapHandle 5456 -prefMapSize 270279 -jsInitHandle 5460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {afc2c9d3-0c6e-45cb-bde8-643685a55964} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6304 -prefsLen 36718 -prefMapHandle 4744 -prefMapSize 270279 -jsInitHandle 1056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6432 -initialChannelId {6ca2eb4b-db90-490d-bf5f-83a32abcd979} -parentPid 2976 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2976" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8dc97c728,0x7ff8dc97c734,0x7ff8dc97c740
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1800,i,3142078770396190531,13209500969121004905,262144 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,10952897402308365909,5246776006286971795,524288 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,1717684061237412125,18311422844155134348,524288 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,2840508875216384119,12247996903687896329,2097152 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3424,i,14648526943174378641,2095005713136017612,2097152 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,9222716945287161826,9493832767748727241,2097152 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4784,i,10486505531113716676,12057279195442912595,2097152 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,4570840220893034243,14666551465697002692,524288 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,17931739163431800750,6702465062430757238,524288 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,12984224365683935630,12876328364103215087,524288 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,462855571035932807,16460933793790970366,524288 --field-trial-handle=1984,i,16667136597772703230,9305368789822667872,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dda88c1fc4933a51403ea420504fe0698fd1c0dc5e1b720d96fe99fc874d3090
MD5 7fc7d564b37e6a23e102886d061f9bde
SHA1 f4ed19574c03c973058220838442f2f9afdfc739
SHA512 b86ebf30d06a12b02443c24eee29c4168147af657503b061427b54370133d70356bf37839ebd33729547e1a37ac2f2c31a78c721d69e38f57da751654c9d1342
TLSH
T16AE022A9C921BC2B0CFE07599014168AF750135B2E815A0F3A3E920CCFB1A3A41C6CEC
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 892e2518167253ae0facc2845f33c889b36f89f5f7fe593f15eabde7677e3c76
MD5 3ca9dabf604ed80d7e2547e8fd9827b8
SHA1 ab61478742df50d7516df867c630454541c386d8
SHA512 c411b02f7d43004f42e7e2576174abce39892214550e7519fb546076555b4bafe8fe89593b0919bfdb98547204be071d2dd344d0219e8e12810bd0d85e61daad
SSDEEP 192:PR5wcyI0OfRzz1ov7shAPRp22F9wHsb+WNn8U0vnje+2IglCisVyIsnAUgtaJ:PR5wcyDOfRl0Y8X/FKwr0vr2IglCP8
TLSH
T17D52E82EFA14697B6CDBC329F9227B53D3F5102565941E84E6FC892C18E79CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9825309da9c61824b1a52759d83d91eb6bf95d467bd40833af8709aa1c592f90
MD5 6639de0efa261c71306b1809b5546e1a
SHA1 24c4c93a3494f5bfc16a18a7c84f18680840e3d0
SHA512 71c2c20adda279fe65b9568a1276efecab84273416cfcb0b0d8332fbcf9919f7df76a22371028a1c41cffa0d91d5eabdc16ba0464f7e7f1d4fbd410c5f917eb0
SSDEEP 192:PR5wcyI0OfRzz1ov7sIAPRp22F9wHsb+WNnsUtLnje+2IglCisVyIsnAUgraJ:PR5wcyDOfRl0YJX/FKw3tLr2IglCfe
TLSH
T1D352F92EFA15297B6CDBC229F9227B53E3F5102561C01E44E6FC8A2C15E79CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 efc709e86734a1834ca1753f4b214d1e036c67f159f58fd822d3e713579ed6e6
MD5 b27ee9a7f6553fb5c510d28351cec411
SHA1 ec66cee29ee8d5e22a7f09225a22ca053e113eaa
SHA512 46d411705f708675802318bc12873a37d7159d61feb664647e90072ff160548d44d14ba01b78c203d8fcfca9c4064d48b4710a689d3a220995144051167dcd2b
TLSH
T17BB0121080029211C04202B4254314D871185F55E70F1701C3E4ABE2C825171C119150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d72b2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d72b2.TMP
Size 96B
SHA256 3036e3ff6157400d335c0e3fee1980e0f65e973e8ff71abf08aaaa039c17386a
MD5 9dd31fb7f7f3d7308f3b4d3226b9fded
SHA1 a1e02440afbb216f1fbf55d46c4be15e5e740cee
SHA512 82f124a025f8285b8ac4feb08031bb3b87b5de84c17f510958ca9a75e409f7ce5ab38b3f4d347a51337413d8aae2183eb9e1828df1d6f7fc003ccee15d0867fb
TLSH
T1ABB02208C00AA202C00A03B03AC8A8C83020CF30C303020282E00BAAEC20A300A380A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 e78e63331fc5a4fb7021bbfcc227280f36dac1602387a9c7cecee9cc2dc40861
MD5 f0e5b6af5fc4b369dcf949025ed7768a
SHA1 227648c8bd027e33a7b636fe39bc7ea853f506ab
SHA512 6e639cc9348e6a2e7b28011c58c38ddb67572b9cf9ea84a5a93d318b7692dc2cc6008ce99df9c24649ce2c9ed3398e6d9157fb6be9b4f79a7689c4bfc7791373
SSDEEP 6144:zsG5YHsGUEk36I5GIWFQC0lm7Rkm1tYpBeh2BAou:zGUEoGIBCl9oBGcAou
TLSH
T17A3423299EBACC3BCABA7745A04B951E1FF389958401E5EE85D06F0127FABCE0104D7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 114b188fee98bd132ee92ec619a5a8d3153e26a1378dc3f51cb1f35d76424df7
MD5 baa389b8a2cc04e8379d8deffd62954e
SHA1 9fd244edb893a1dcc708cdcd5327cfd28491367d
SHA512 98ff34bd50a0d4554f43a004a73ed23d4b50f86799396d734b58a57518cb9a1ef3882fa1301dc589dc362183fce23950810cfb360416f98df251ab12a9814fa0
SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:3m7Rkm1tYpBeh2BAoK
TLSH
T174C3123B5D75E9779979A70EB08E0B1F1EF149A2C920DE52C8D85A0437EA7CD0A04D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 a9cc5d75888517665036464d05762a40a519ce7de31d098cfd6bea3b37ee695a
MD5 6f41a2144acf9559f18d1e105278e2ba
SHA1 6f66daaf9f6d4c7ea64e3aee11e2c5e3bb82922c
SHA512 be66db0b2469303dbea2f875fc56e910f3abbe4034231047e05667058005a2a0293511b7e8de0ccbee3d9ac2b9a4373649226d586ecab07d6d85c0c0e26d48d0
SSDEEP 6144:ssG5YHsGUEk36I5GIWFQC0lm7Rkm1tYpBeh2BAou:sGUEoGIBCl9oBGcAou
TLSH
T1C63423299EBACC3BCABA7745A04B951E1FF389958401E5EE85D06F0127FABCE0104D7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\activity-stream.contile.json
Size 5KB
SHA256 d80150b8eb2751d859ffebe1dc6ed17c339dfc09c711454a832845adb7439264
MD5 e0b733f4b45c232cedbcba07b61e2328
SHA1 4ce8cab817cd2b557fb10b2e2bae6a45f5eb8e3b
SHA512 17a6c75824d05479990368dc088c4e83ac73493dd0a2d612486a3532cf0729281482b666bfe2f2db3b250806b90b795dbf47fe5faa9e88d1e28cdd45ae637e88
SSDEEP 96:T69OpJN4xzEV6dD3uCptN4H7c3vVT+TAp+NwlY1T+mRxxV/b:jJgEV6dDxtz3vVTz+qlfmRxxV/b
TLSH
T1DDB1098FD894C99367539ED12D1A2B68B1837043C9DCC6ADD3E56A2111DC31E42AE8C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 eb244ba78e17d76e8ba95b4f4e1c84d4d0d1b7332ce0badf2d8460f20817a635
MD5 4a4d3db7fe0e4b84d09a32163d557eb9
SHA1 0763fb7da3c82b81c8c1eedb9b441ab531be6c90
SHA512 b8917f7eaba39fbc00630aaecff42ccb7b7f636556b5ad16436f1d84a7f03f8e187b2768ed008c04f90174b8165d4a2dd812988aa5e7f8e1aa0492f65ebe9772
SSDEEP 384:HkCjiO024YuODL84KKDL849B7SOEAd9KVRaAcP+AWRMAhQO:EzZYuODL8lKDL8CB7S/AmVAf+hRMg
TLSH
T1A0729E395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FCC72E31A8006161871F4F5DA4D363FDEBE97886

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\FCC72E31A8006161871F4F5DA4D363FDEBE97886
Size 73KB
SHA256 dbac993b038af2aa7416daee5ee6904a5800c34309f6964b1e54d71153b38486
MD5 90616873c26f962e0528713735b0c8b0
SHA1 3ae28d09d2e07499e95876f32c925f1e7c65c74c
SHA512 0b22aa0f93ab5f69e19bfe9b19b7307433990ec0aa015053985b00281d403d6efcf72ca78acf854f623be0a612619a07a08d7b37ce5248d38d1f3fd5fc4175b6
SSDEEP 1536:2aImKJXJ5rZNKKY6NbRLegA5A3T5Lwng8cJR0YBfWY1ElDIr95pCHdHKyF4:2aImkzZNKKY6Ro5QT5L226vlI7Kqyu
TLSH
T19B73D0F4A8732A6817335C25EE2A32C82831E154C1D5C8FF8839F59AE465B7732D53B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1TDMP365S9PBHJD1B3C8.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1TDMP365S9PBHJD1B3C8.temp
Size 9KB
SHA256 586590ea4616721f330e08a83610d2c5df4799287cecc4a593a453c98d70255a
MD5 693736e4f2303bfefd0fa92c09e5e5c2
SHA1 5c1013f8d7f48442ec02d5c6260f6b69f41a6660
SHA512 2ad553fee902feb380159859cab490d7396927c74e2bcd6385fb701def57cbcb38a5ed3f30f59fbc074db45b672e965e7ee6d30e98621f6f9033ac26b54a2acf
SSDEEP 48:yGLxddJJ5Ugdwl3zHG2xddJJ/6BdwlxHGgxddJJ/adwlTliGRxddJJmFqSiIdwlJ:JO/X/HIGkoUS
TLSH
T14E12FE020BF70996F5F382313A3167426773FE25679F525FC186A3480A7235499AEFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.bin
Size 67KB
SHA256 e9d62eb068256a34b996cf3b210d6e0b71f6b189ddc7398a057d9822ced97578
MD5 8a8f62b1f091da94d970f0affa7822e6
SHA1 9dbd1f8cb0b349b16a472670553fd6e87cd635f0
SHA512 7f47ab5acc7b3afd96bc62d0e596bcd008199abe36b3b144ec83432da73e60923663f456198339cc51db17cebdcd85f076997d7ed251f4f51fed01c283e3fa9f
SSDEEP 1536:cbdnPVrCPTsXFRl+MleHJSEZ3hy2V9EkD4niNI9DJZy:chPpCr2Rl9Q0a3BsEo19Xy
TLSH
T1FB631144EB1A953FD92803BA9CD21B003F78F8895A1A2B67375C64782D873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a91a61343b8d0d1264a6ec7122a49dce7819a9880c377c118fe7ab6e105dd56f
MD5 a84e4b674f3ad20da271afbe0ef6b426
SHA1 fa2a67456fcf21d4b8f0a4615e0ebf61cced2017
SHA512 f03c45076265e3862a8d9ecbd1ccdba0e0ec75febea3e944958541bd77a78bbbf9f56aaca31cb4dff0e0d98be889e11c111eaf807268c311fa8a3d164d6bdd61
SSDEEP 192:f1d66JozGzgCl6mc0dnOv5zbowZVtyjlx:td66JozGzgC1jObowZVtyj
TLSH
T124D1CD28E728863BC444023BCDA61F400E36799A984E7F2932EC640D2D576DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 67KB
SHA256 52d57748ab95680050fdd37e9ae6597e3315082f1dff4ed27129c21646afd73e
MD5 caa003968848922ed2041d7844d7011e
SHA1 3e22b4e12315d6a5238adad12ba155a442b88712
SHA512 894aea94bb501e5551f51fdfafe3eff8f99cae7fee208a50fad232afc6c396d05a050c2911bb089c834b329f9f8fe1e21e4b3d1fc6f9a96117bf55852bcd62d1
SSDEEP 1536:8bdtNqrHPSsc3Yl+MleHJSEZeylWp2EYDxnr/uhzDa:8hPCH6/Il9Q0aebjIhzy3a
TLSH
T16C631044EB1A953FD92802BA9CD21B003F78F8895A1A2B67375C64783D873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 67KB
SHA256 1cbb484a28a2f0ed4338c9a22eea12084247bae4053f83aa2fc8a209d025cfed
MD5 f717831715a3de57ecc8993c2c02631e
SHA1 8dbdb00483a8d57f8c0e3d7c038c22204f53e663
SHA512 756246ab61a4dcfe855b728204c9a40c339402b0be3ebb1ddd6607241ac820e3f7c247971ddb82f35ac5ef7514c89990278580e271f948b1b20d027860245264
SSDEEP 1536:lmeYkPVrCPHsQl5knMleHJSEZ99FKJV9EkD4niNI9DJZB:lm5wpC/R5kMQ0a9YsEo19XB
TLSH
T19E631144EB1A953FD92803BA9CD21B003F78F8895A1A2B67375C64782D873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 67KB
SHA256 f2ac5b69fcbca74ceebf5c407feee3ca01f9721174980b1ce72b99fc20739b9c
MD5 4563d06e7b9e556beb71294e0e8aec9b
SHA1 c75031d3191a09a1c80ee3b9045bbe2ae82fb4c8
SHA512 37e732bf7eeb629f3f01958314a232afe9bb7001a8706c3b67ec389238ddd65d2b3b36b9cf85f72a481858670127864ef33498325b3a465c5327f3479f44b2c3
SSDEEP 1536:CmeYkPVrCPHsQl5knMleHJSEZ99FKJV9EkD4niNI9DJZo:Cm5wpC/R5kMQ0a9YsEo19Xo
TLSH
T1CF631144EB1A953FD92803BA9CD21B003F78F8895A1A2B67375C64782D873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 146d52e4001c0c692d115dbdba1b489844250d144af2c2687dc6ed73a6e14a39
MD5 ff80332ce787993fad40620a6b34f705
SHA1 3b24d6b6d3c3d9855a995fbb13f0e1ed4df89edc
SHA512 f6b0b6789e37858c5fb2a3f6c7388ceaf4444b2c9a37cb5d3690113f937c63b23233258ea388eecc4f825ec23f7736b25d79f0f5e475a52687938d578e7012e9
SSDEEP 1536:kmeYkPVrCPHsQl5knMleHJSEZ99FKJV9EkD4niNI9DJZI:km5wpC/R5kMQ0a9YsEo19XI
TLSH
T13E63F144EB1A953FD92802BA9CD21B003F78F8895A1A2B67375C64783D873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 3c2c4c99c2280df600f469fa6e229fe134778e34d1eb9edaec2a32f07748f329
MD5 ad0a8b4f1c67eab0a5b51ee218d08295
SHA1 be0091a9ffb821f31a2c4874e58e2afdd8829900
SHA512 e7546bca137401c3eb579c8f2265348e30026d71fb52b777b7ae3b74db0a4a8ed22e2456643d42e831df0c7ec2d90e7cf8ac14b518a0852e780244271fce090c
TLSH
T1F6619758F6298A3EE4844139CC925F411F347856A8AE7F2A35AC604D1E5B3CE768D13D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 5KB
SHA256 42fec221882f0ec41459ffd970d9c29fb3ed107323d18403c3d070042c42501c
MD5 9ad807abf647e75a485a453feaab2960
SHA1 6c3b51af4b35bedd2eeb0821bf8c108b5e129be2
SHA512 501c97f5e769b8a79df1510b1867a45d62dbc7b4ea8c904622727c163e1b8a2ce1799459606f4e721903aa4fc395fc4a659705f77155dca2060d963c302cf42c
SSDEEP 48:YeeMbYAG6++N/3kbEae/FUT68kbLMPxydCteTWZFf2KZp3ZiV3wM8wUyri/1zNQv:/zNJ0h8LQx+Ye02tJHkBqHKNTZsWZo5
TLSH
T11DC1E21C31BA0C7F5AD793E9AA5F024C85D54B42CC8A2D874DD5DE488ECAB95331F129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fa710d178ad338ef2dc63b875f875865fc824a5d7c38f99c7fb316db1867fb1f
MD5 de45f9244796d6b725919940049045f4
SHA1 ac100c21ec2a7cc2e834f5a93435ef14821fffc1
SHA512 0d72554922a1bc6ec471f868795cd21f57047c0a46ab8d8e73147c6e3f3ec610019dcc0b2d57484182fa9d17d701f6ec190a5f00375cb4449d2c0a6197e6968c
TLSH
T15E216A5C39B94E2EA887E69C7540128E5B554E0708871C834D53EF8CCF91AE932BF538
MD5 SHA1 SHA512 TLSH

Submit Download

0ad8ecf0-b40c-4e6a-897c-53a03f6a9d53

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\0ad8ecf0-b40c-4e6a-897c-53a03f6a9d53
Size 235B
SHA256 b4666ec9482cfff9c23138f425a56af0e3dbe67e254e7c8f5deff2ece5b015e3
MD5 4012256c0f69e99d5ac2f53c827fc8a3
SHA1 029577402ab59338b6d7df8832427a112da89b35
SHA512 f3e6727e3336a8df9430be7b76ca48b7b49eea642eb49f60cbc5b3359751f9e0055e61b498eb3ba4c66f4af6b3fa227804f270ce2c161c08c3f7c3a13ea46346
TLSH
T13BD097922CCC375D08140F06F0A0B9CA31884C7314A85810DAA105388DF99C8526291A
MD5 SHA1 SHA512 TLSH

Submit Download

0b40e29c-7e3d-4d0c-b8b5-e162a0ebabbe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\0b40e29c-7e3d-4d0c-b8b5-e162a0ebabbe
Size 15KB
SHA256 0ad216c5d5afd9be09b6b736566318f6a5d32724c27ba72df582ee4d01f7b7be
MD5 279ddbbcf3619abee2668badfb7f6b8f
SHA1 ee6e6bfdc375bfafe5614232f62f59a7d23fc36f
SHA512 2bcf587546f4484c17c249364ed7ef6e1b74a1ac434e24ae3d3a1b97da805c8e89a261711be4cda7667b96c3134ca7367334024037ea11cde1022c2dda2ae588
SSDEEP 192:s3rjS8wl+PjgwWUr9g7PZKe3fh3qTC7rfBFdHyCr1rVEnTkmCmz+Ri92ScKZAmaD:WemjTC7zTJVvmCmSRiAScKZA3D
TLSH
T1AD72CA166860557A8251E368D8F8BFC3E5F628CB4C019FCDDBE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e2777c7-1e02-4639-b1c7-700cca516652

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\0e2777c7-1e02-4639-b1c7-700cca516652
Size 2KB
SHA256 a2ffbbf768f822db59f902faa4e521969aa51c16c97dddd9c9c4fd320a509370
MD5 703b98661405e40ad33df3c713ccc757
SHA1 c597241795db275c105652366025a13bd10c1827
SHA512 51ce7bb21e85230306ccf56f6baa4105156fe493ada7e8632ebaedda4b63828df4fb5ad5cfe69875b763757f9e196f4db1a1f186bae0627b4157f7e02b05bf45
TLSH
T15D41212C35785C7A8CAAE19DD4C2334E57A0CA0304C22C436E62EE0DCC96A9D236B43A
MD5 SHA1 SHA512 TLSH

Submit Download

27f07afc-64c2-4884-a772-bdb2eb1ff250

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\27f07afc-64c2-4884-a772-bdb2eb1ff250
Size 24KB
SHA256 2d2cef45f023d53a0dd0abaa4f58a55e7e9da97bced8d5a33969a8b855d1fb11
MD5 d4cd22bf638ddaa13c5466b42700e331
SHA1 558d4c0624dc5de34140feb55baca996eb78484c
SHA512 98d468f3a07768811e2cf2af2d8ebe54063c748f9313a87ea88f5abd84972ca7129517503876b59bbcbe43270c6162df017761ba5923dfad6d06a5782c7518d6
SSDEEP 768:3fKc0/djESTu0sw3shnmnbO70PC7a5dkYACZZcbsBdPsW1cwQN4NUNBvUZmR45QQ:8VEdrjNT3c8HGcq8JjvK
TLSH
T1DDB2ACFDCE13405B3E65E11EF2A6EDAA2057093209CCC79D68FC483A27D697B1227719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

366573fb-691c-447f-adbc-612621e2c8b7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\366573fb-691c-447f-adbc-612621e2c8b7
Size 886B
SHA256 c5c495919af835fae0c4c0e9aa60f3559a9808d28a7a147863bf9beadd51dbc2
MD5 aac0560afd879f68c42a500450e0f0bd
SHA1 5900cefd18c92ae20bda8c2100a1f62f8f06ebfb
SHA512 f0af2a02126e3accd15e6248b6e992e22d63b1fe29b0bdb711110dae8c3f53299732d48d613677e15d5a46f869eccd222101ba3e3d86c853640a048a4b608ec1
TLSH
T1C41127544778B9B2CCA4D24BD9A177014AE47923C0C558187FA51F180D7B91F9377307
MD5 SHA1 SHA512 TLSH

Submit Download

8cf704cf-8880-48bf-a3c7-36bf31329e75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\8cf704cf-8880-48bf-a3c7-36bf31329e75
Size 235B
SHA256 16e398ba4eb8cedc348853bf0c04eff724fbe7da7be238ce903c4b904f306c0d
MD5 40e2ed225c1416e20df75632ff3e743e
SHA1 964567c43317b7ffc4e111cf479f026f84d64472
SHA512 8bcf651d1a14e09e03728af6721225205a793bc09d0334357415e88cca792ba48308419b1bfabce9182ea4541a47408c12a478b9f738598cbc837a7880763022
TLSH
T179D097C0A888376E08208F02F4A028CA30488C3364E99C28F69042748ABDAC40261D0A
MD5 SHA1 SHA512 TLSH

Submit Download

cf3b4464-c85f-4116-b473-1eb56ffcbe11

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\cf3b4464-c85f-4116-b473-1eb56ffcbe11
Size 883B
SHA256 04e109e074261cfc95b9604368d2a2439f5a543d6c0d0e27af9c656f88e5f877
MD5 9fff3bab4f28552720b9915f11fd72d7
SHA1 1f6ea0d7925d207a6b1b79e09dea0005de804742
SHA512 278ee4ee74a0010b3c171ff79c29953d11f7703d1d74f7989b82dbb9690475071fe8797b73db572cb10f2e084851cc7d6a1226eb6185e87bb244eb2062928a0f
TLSH
T1561100A19734B9A2CD68920BC9513B025FF4A92380C994183FB55908497A92EA3AB30B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 114319981e0b5eebe148da9027147a9e07070ee9390b33f4dcaf914837c3d1e6
MD5 37d1259ad957c80a2bbe70b4b3171d2a
SHA1 68c2431882ade1796f466e0215fe3b34158ef865
SHA512 d59bde56337f5f8724d0cd5676fc2671e05fb79067412c5067fae1b9aea275314df4a600022f4e47eb42d8eb5b0d2430faf51bfd275d85c24dbfb6ac085490c3
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4H7p14h0:mI4dRfFXQ4d614d4D4J4+4bz4C
TLSH
T1A272521545048EB8294EA79AAA367E01C37D433B70845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 8KB
SHA256 ec5ad1f5ca79953b7deb220cf12e2dfc7c6083570b308e5babaaec0f566ab49d
MD5 c97a3537d854d553ab596724df819773
SHA1 9f302e40f0fade0ded2b93a728d7ff500105b7e4
SHA512 8394b129d57fe50a629e843ca5aae8b878d62dfe7b45c499f98350bd2391eab1b18c78e8b8cc62765a549fbd16d754cf82535817571ca2537525bbab71f22794
SSDEEP 96:xH4flTUOPqGqsWfDtcObzSASSladv9jvnIWRpKkQBw88jRj8L4cnTDOMGS:mfURsWfDtcqSS8RoLBw88w1
TLSH
T1AD02FF3C9548CF7F74B6376CAC2489315AA2063B7ABF68D710B99485050CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 6cd8697b2b1fe49ef061118d9676f9e4a5609c46586d88a249dab2936e2fff74
MD5 cce1d110eb1ef76eb13e4bfdc480d951
SHA1 788468e377258667259294c923efced554f09d54
SHA512 b5014a40fd21c049fe3fb6713f048a6b76175adf4c7ab7d344b7db04189138f3aaf2cd8c2ace2183f76f189d6d604556c2902e07b5e4a55ac58807747c6ef235
SSDEEP 96:xH4fUTUOPqGqsWf2tcObzSASSladv9jvnIHeABw88n8L4cnTDEMGS:mf5RsWf2tcqSS9eABw88qv
TLSH
T1BFE1117895188B7F74B5776CAC6488316AB2413B7BBF68D710B954C4011CF3442FA6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 12KB
SHA256 6153cbb8182b5f010ad52f28895c77470e5407dcfc344301c26e6b813c405412
MD5 46a21cce3ca53ac764afef2b2b294dcd
SHA1 7267a356bc9037d11398c0f05009190da0ac984b
SHA512 1e558dfbce2d92d3f32d6131d73ec973762d659147b9494d7782f02bbacb78f30af53c7fd9a3e9f6abb3b104ad8e0bd60f1f59804a324c7acbd97601861bcdc9
SSDEEP 96:xHTflTUOPqGqsWfDtcObzSFSSladv9jvnIpwoDRpKkfg2OBw88DH2SC/ED2W8L4u:VfURsWfDtcPSSXLRoJ2OBw88DfC/EDE1
TLSH
T1F942BB3D55488F3F24B2327DAC254AB01AA546277ABFBCE305B89481055CF7441FBAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 12KB
SHA256 0f2f29db07e763525cce63a0b01b5b1e0e67e314022017eb184fb1701bad6905
MD5 a21d9a341ba54071594fcb7b46022f67
SHA1 48ce2d218b4309d7c059bf6253850602d40ecea0
SHA512 29e8d27598be9b02d966fff41925f3a565ac399432c09a12a0a92e473e81c41728e58664a5453080a27d654a0216c5e652c34ee53d60480b88419404e8ebe906
SSDEEP 96:xHTflTUOPqGqsWfDtcObzSASSladv9jvnIpwoDRpKkfg2OBw88DH2SC/ED2W8L4u:VfURsWfDtcqSSXLRoJ2OBw88DfC/EDE1
TLSH
T1FE42CB3D55488F3F24B2327DAC254AB01AA546277ABFBCE305B89481055CF7441FBAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 b9bc841da367aaf62562f2831d38a4815fd6f3da405919dc468a792ff3dc9190
MD5 56392fdcf9050013fd0436792132307b
SHA1 5f5fb0a0a24cab337109e9f33deaa9213a0c2930
SHA512 28c5fe72e90b0f6341449cb4e11fa3c5851e9932ea936fb813195430cb740481dfa91f61a96a3156417d86d3259b65165f119e778f76279411d2961ab6404e5c
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSiSSladv9jInIHeABw88n8L4cnTDEx:mf5RsWf24PXSSGeABw88qY
TLSH
T123E12F7895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 69194bda310c44ead2fdcd468615ad694dbc737e2e24dbe64e3e4c1c73bc9153
MD5 500d45b30e69525e38223003665a277c
SHA1 221e0d7541538c85a67fec4c2ea7d4b59cdc7d66
SHA512 c6822bab6bb7c7976115d2810659f35ac53deb09523841fd3475e7a1d9e9282ebb92ff5835b67af833f02d1c75f08ae7b6860e1aa51b4e426c216b86c163f978
SSDEEP 96:xH4fUTUOPqGqsWf2tc1zSASSladv9jvnIHeABw88n8L4cnTDEx:mf5RsWf2tcFSS9eABw88qY
TLSH
T17DE1217895188B7F74B577ACAC6488316AB2413B7BBF68D710B95484010CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 c037fe34b9eeac472bf30537805303defb135650d19b420b9329eb1cea5cd9c8
MD5 bf031614ae66b2604453a1985d0926cd
SHA1 7fa7b1f0ec3ea1de74cd875ba468aad6084a8758
SHA512 d472939367511279a49966202ff2063d03be36376d8be02ee63182d895a65aea935e5c704ec5e97b08404356cd4a7f005a3e434deab6ce886f5fbdbcc4462e60
TLSH
T17C513D4AD53E356A8D2678A850C83F1D3ACA54B7797A4841E75C5E14450170D2A1F1CD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 933B
SHA256 a9429ad0106192b4a5cc6314602f928e2b092c88d3c002bb10ab1c0bb01d1d17
MD5 0e5294a63b5608e8f09a1e8d15aec3e7
SHA1 af04f7a39acaf5417b9334842b3f080c8cdd0c46
SHA512 96fbaadf893666b3270d4c28979128f6815f9677c3a8283a70d0877fe9b4737b685a32fc76775f885ab819abd3c5ae08b06de813fb91e6268e47129476608f78
TLSH
T1FD118881FA0B16B65E11A12E44CB57BB4ECA605646762891E1895E004A48B8B769F609
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 c55308a70390f32680df45a6ea5197fc2f03b508a8d986829a78c64f2526e3c8
MD5 86ea1fcd708da9a20d2d4c0b4fdf1ada
SHA1 9c9a40cc0c149a3d1f8e0ea37488812bc5ff30d7
SHA512 2a183ba82932178bf962c2283ee9361f5957d4fa4acc7e3012425105aaaa93c2390467c93f498c29666ad1adaeaea51898f33cd4af84373720904adb13d8ae53
TLSH
T1D1614D46D67E3A6A8E1A38BC84C83F2D1BCA54736A355981E61C5E344605B0C1D2F1ED
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 efe9d038ffeea95158631af434e94533ed09918759779d97d3250d49436dcd5a
MD5 acbb85b3146a9686b983e735fd6d8721
SHA1 d2e42c8e8d655c844516eaa58ae52b8a274ec90a
SHA512 bce9d20efc1c8f7a3fc0f6d0a0fb43b3053843ea308e968d4888b46b50008c5f5c553ac65123bced94be224c2f2e53eff723b0911f2e831d29fe282a5245736f
TLSH
T1D2717D8EB57E39A4CC5BB8FD84CC7F0926CA10676A555944D56CAF308409F0D056D02C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 d56f15dd89b71eb79c34a0714cbf6f00729108975a23d8e2903c10b6bfb2abdb
MD5 2f5e06222d797f141d68dc71bd11a438
SHA1 acc2223a92533dea562363f345fb42cd72c32cad
SHA512 54e6d5c7eff41a8d5822819a8da259f4d1d71e8156745535d13d8006f5d6c8885e46777e63ec8230f139091df0261189c87abf7b08aa8deca3e03432b4d394e1
TLSH
T136615F46D67E3A6A4E1A38BC84CC3F2D2BCA54736A355941E61C5E344605B0D1D2F1ED
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 864B
SHA256 79c1a2f164a3342ca8632edebdd44e0b6e1ed7212c5bd3793d10e51e4b5f2044
MD5 9d456cc44cb07e208a17c9be4a83b339
SHA1 fda4b4cbb5532301414af1fc0efee0e3444b3ea7
SHA512 fd88613d838bd08642d39c809676384bf2f0bdf2af611f2ac0b4fc780d580d34d2a30acdec24fca91de7227f9f280a944eafbb1f876a5733db2790908b6544ea
TLSH
T1F91156C26B5A0577DE46602FA4859FEB4FC8383A493D2850E28A7900469834FFADF54E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ab0b56f4da16f6747edee044c4081b4822073ca8f374b57c79fd1d94a79b3b94
MD5 64b6507e205a4098ee78843367222e72
SHA1 f73d3ecb26bfd4cb9d9afa406579ad3d05745b6b
SHA512 322f463600c45b1b1734e5e68a0d2fd412bd091608d32f1d15e72c131f51631d55c95d83fc9be3f9abcb855cd25d1d1fc5637b7dba38f7b023825da8b70ea9c8
TLSH
T13021C69399771FF9AE629125C4C84BF2C58C34358C75A8F0909E5D4652FE60EBB8F118
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 482b88fef4a00760db3337792ac09eeb20b8933897ca1bc982afd9679e77293e
MD5 c2a1553f79cb0edb99cb1b2b57f8c7ee
SHA1 0d45e8cff15698772d2b66d85686d7b50284f98d
SHA512 693b7ea27536a6042c041379b045a47ca1aa2c63e4ac1a50dd13bdf6181700f24d0ed9f78e88f99d82512777ecc604708a8a2d3496dd15fc6dc39558f7a2b587
TLSH
T1A1615F4AD67E3A6A4E1A38BC84CC3F2D1BCA54736A355941F61C5F344605B0C1D2F1ED
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 166d66191dc961b7e29958088d0f70518562c7fb343563a5ae79f6ff6727f71a
MD5 a2ab13ae2a5178d9e24fcc850f48a9fb
SHA1 d8f3a09e2e21de4b61cd0543b843dfa010953ccc
SHA512 04078ea85fe00953a7dbfd1a618bd06764cbf8801b25137ea1e1a0a1ecc44061777c1b5b04babcdbda4be7bfced94f991a0c306a4d972a4a0f4d343b27454700
SSDEEP 49152:WDmgkuOjA5lUT2loecNeaKvgmRBbFOYLg/:ympuO856T2KzeaKvgmk/
TLSH
T1021639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.6MB
SHA256 fce1370896a02abab9a7ecdeac28447a590b95e4b2aba47ee2fbb6be06b72ff4
MD5 6ee996a78362f3791975cc936d9a3015
SHA1 57cbf074ee82d08dd2a48fe74f6b99b43435d48c
SHA512 e9cf529baa4ca6790bccd7b484de0a15ec1a77894fdc3022b95c5aba6b52c4ae863c097c9ff90a1c719b0b5fb471ceee6bfc2f4cf2bf71e20205ca4ac5af3a6e
SSDEEP 49152:h9yWkun/X1he4y2D3/YHVrFBTlmsa1gwkXGOc6ifuAjZrNK3I+S/nXqA7V5xrsiV:XxnXP7trrMaGHq
TLSH
T122665BE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1564-2-0x000001E489550000-0x000001E4897C0000-memory.dmp

Download

memory/1564-12-0x000001E489550000-0x000001E4897C0000-memory.dmp

Download

memory/1564-11-0x000001E487CE0000-0x000001E487CE1000-memory.dmp

Download