ba10dff05605b142dbbe945ec266bde32e8be23d631e1b59cd1bd42915139149

Analysis

user interaction
yes
max time kernel
542s
max time network
607s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/09/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Size 999.7MB
Sample260916-wmhm3stdmd
SHA256 ba10dff05605b142dbbe945ec266bde32e8be23d631e1b59cd1bd42915139149
MD5 07b0cfe55f5b7529805a5068b116e56d
SHA1 b50343747afaed590bc08fd1086a986abd0ee6d7
SHA512 b69354a858272c7fe7843fcd7ba9ee2e5d4f6813efb725b67bf5b2af50a82a5ded417778c1669f6a13e8aa1e93e83d8ac279cf02695419aa05f28429b0429536
SSDEEP 25165824:Hzbtogml9FRpPjmxtWkIH+o71E7ByMblktnc:HnziXPiPpIf1El1bGc
TLSH
T160B9224E7580C7B708A113952D66D8C9F33BA3573AEF1584349EF39B672687882F3894
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
56	1764	firefox.exe
56	1764	firefox.exe

Executes dropped EXE 2 IoCs

pid	Process
5496	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
3228	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
752	vlc.exe
6832	vlc.exe
4936	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1544	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
1544	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
1544	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
1544	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
5496	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
5496	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
5496	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
5496	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
3228	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
3228	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
3228	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
3228	South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
752	vlc.exe
6832	vlc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
752	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
6832	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe
4936	vlc.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
752	vlc.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
6644	OpenWith.exe
6744	OpenWith.exe
6784	OpenWith.exe
6784	OpenWith.exe
6784	OpenWith.exe
6832	vlc.exe
4936	vlc.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1764	1456	firefox.exe	83
PID 1456 wrote to memory of 1764	1456	firefox.exe	83
PID 1764 wrote to memory of 3296	1764	firefox.exe	84
PID 1764 wrote to memory of 3296	1764	firefox.exe	84
PID 1764 wrote to memory of 3296	1764	firefox.exe	84
PID 1764 wrote to memory of 360	1764	firefox.exe	85
PID 1764 wrote to memory of 360	1764	firefox.exe	85
PID 1764 wrote to memory of 360	1764	firefox.exe	85
PID 1764 wrote to memory of 360	1764	firefox.exe	85
PID 1764 wrote to memory of 4540	1764	firefox.exe	86
PID 1764 wrote to memory of 4540	1764	firefox.exe	86
PID 1764 wrote to memory of 4540	1764	firefox.exe	86
PID 1764 wrote to memory of 4540	1764	firefox.exe	86
PID 1764 wrote to memory of 1508	1764	firefox.exe	87
PID 1764 wrote to memory of 1508	1764	firefox.exe	87
PID 1764 wrote to memory of 1508	1764	firefox.exe	87
PID 1764 wrote to memory of 2988	1764	firefox.exe	88
PID 1764 wrote to memory of 2988	1764	firefox.exe	88
PID 1764 wrote to memory of 2988	1764	firefox.exe	88
PID 1764 wrote to memory of 2988	1764	firefox.exe	88
PID 1764 wrote to memory of 924	1764	firefox.exe	89
PID 1764 wrote to memory of 924	1764	firefox.exe	89
PID 1764 wrote to memory of 924	1764	firefox.exe	89
PID 1764 wrote to memory of 924	1764	firefox.exe	89
PID 1764 wrote to memory of 2052	1764	firefox.exe	90
PID 1764 wrote to memory of 2052	1764	firefox.exe	90
PID 1764 wrote to memory of 2052	1764	firefox.exe	90
PID 1764 wrote to memory of 2052	1764	firefox.exe	90
PID 1764 wrote to memory of 2632	1764	firefox.exe	91
PID 1764 wrote to memory of 2632	1764	firefox.exe	91
PID 1764 wrote to memory of 2632	1764	firefox.exe	91
PID 1764 wrote to memory of 2632	1764	firefox.exe	91
PID 1764 wrote to memory of 824	1764	firefox.exe	92
PID 1764 wrote to memory of 824	1764	firefox.exe	92
PID 1764 wrote to memory of 824	1764	firefox.exe	92
PID 1764 wrote to memory of 824	1764	firefox.exe	92
PID 1764 wrote to memory of 1904	1764	firefox.exe	93
PID 1764 wrote to memory of 1904	1764	firefox.exe	93
PID 1764 wrote to memory of 1904	1764	firefox.exe	93
PID 1764 wrote to memory of 1904	1764	firefox.exe	93
PID 1764 wrote to memory of 412	1764	firefox.exe	94
PID 1764 wrote to memory of 412	1764	firefox.exe	94
PID 1764 wrote to memory of 412	1764	firefox.exe	94
PID 1764 wrote to memory of 412	1764	firefox.exe	94
PID 1764 wrote to memory of 5160	1764	firefox.exe	98
PID 1764 wrote to memory of 5160	1764	firefox.exe	98
PID 1764 wrote to memory of 5160	1764	firefox.exe	98
PID 1764 wrote to memory of 5160	1764	firefox.exe	98
PID 1764 wrote to memory of 5176	1764	firefox.exe	99
PID 1764 wrote to memory of 5176	1764	firefox.exe	99
PID 1764 wrote to memory of 5176	1764	firefox.exe	99
PID 1764 wrote to memory of 5176	1764	firefox.exe	99
PID 1764 wrote to memory of 5184	1764	firefox.exe	100
PID 1764 wrote to memory of 5184	1764	firefox.exe	100
PID 1764 wrote to memory of 5184	1764	firefox.exe	100
PID 1764 wrote to memory of 5184	1764	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
"C:\Users\Admin\AppData\Local\Temp\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1544

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\MoveBackup.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 1948 -initialChannelId {b0ced514-6ff5-45d1-9596-0891840ba5f5} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {2a996233-2a10-496e-af5b-f39c2b6c55b3} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27274 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {9c97bacf-56ea-4dbf-893d-21135f60582f} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27274 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 3952 -initialChannelId {07cb1bd0-2cb7-4b19-8856-c8a9b2258c19} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4476 -prefsLen 34773 -prefMapHandle 4480 -prefMapSize 270279 -jsInitHandle 4484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4492 -initialChannelId {cfe21bf8-d634-42f0-8ee9-907eaa93e7fe} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2556 -prefsLen 34903 -prefMapHandle 3076 -prefMapSize 270279 -ipcHandle 3084 -initialChannelId {951a9a4a-79ed-4819-a302-ad8e8cf5f3ab} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32793 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5036 -initialChannelId {1cd0132e-c65d-43b3-a787-06ef9112438b} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5296 -prefsLen 32793 -prefMapHandle 5300 -prefMapSize 270279 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5308 -initialChannelId {4e61b6ff-fb71-449d-b95c-457883b4284b} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32845 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {3eb6a931-734f-4b6f-b9e7-844df9999efa} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 32924 -prefMapHandle 4360 -prefMapSize 270279 -jsInitHandle 4364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {64854f06-e152-46b9-9d5f-45d485ae6547} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4632 -prefsLen 32924 -prefMapHandle 4628 -prefMapSize 270279 -jsInitHandle 6376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4348 -initialChannelId {a6b756f2-95b5-4144-a10a-7a55158b96d5} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6244 -prefsLen 37424 -prefMapHandle 2884 -prefMapSize 270279 -jsInitHandle 4852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13308 -initialChannelId {a20b35d1-793d-486d-8071-917412bdcd8a} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 22256 -prefsLen 37424 -prefMapHandle 14508 -prefMapSize 270279 -jsInitHandle 22268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10132 -initialChannelId {a4497f0b-8342-4f87-bb58-148dd63a5866} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10092 -prefsLen 37424 -prefMapHandle 10036 -prefMapSize 270279 -jsInitHandle 9940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21752 -initialChannelId {72d62171-c18a-4f79-8654-072fa6138bea} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5184

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6784

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6832

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Users\Admin\Downloads\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
"C:\Users\Admin\Downloads\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5496

C:\Users\Admin\Downloads\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe
"C:\Users\Admin\Downloads\South Park S29E01 1080p WEB-DL DDP5 1 x265 FLUX.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\activity-stream.contile.json
Size 5KB
SHA256 b41246b0397f7e408225a4a41b674e554ff651ea738da6c8080dec1833f9cefc
MD5 acb2c726e903cfc97c6fc2c517b8383e
SHA1 1b44033bb8494024c8bfe0fa57d11098f8822450
SHA512 e81d7cb962ae3de0ed72a3080ba312fda803d869faae06cb1f7862d7bd12f13941682af70f1b358e47f1d5692cc1820fe4e9b0c0b42c428f43e363f3ca4d93e2
SSDEEP 48:Yd17ISCJ9reDkfxGRUZLf9Dx2r1stQp39AVJ9reDqfrSG2n9ZaeAXDjjzbioTQUG:AIVxGRcf9xGNpCfOGDuUccUCG7etsJbb
TLSH
T11AB1086BC8A088976363AAD43D5737B9E117311BC9DCCA6DA3C2BC00415872A82FD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 d6bdeeb896aea36a2c28f04ca305c25be93fd5cc1bccd986ea9c340a4dc250a6
MD5 87063b3111a1eaab19e1f78a044039c4
SHA1 67d7451221c8c8fe2dc8dd18770dd6cc51b7fec3
SHA512 c8c0185b266d2272938acd0415f2cde6e290a33b2f94c0f5c49a49e53cccb3fbc5bf1858c9c1c6c3b3cc799c8952309e64a017a6215f47eaad0df1da5109f873
SSDEEP 384:HkCjiO024YZDL84KKDL849B7SOEAd9KVRaAcP+AWRMA/:EzZYZDL8lKDL8CB7S/AmVAf+hRMu
TLSH
T113729E3D5F013CBD15A7C0E8C5F9929A8D18B7A7CFE6806D21583D0DC698A69B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 16KB
SHA256 0e68b2e9c55c204a23f1b6183cd9dd6b85dbc9220163f96e0e19e3e71166e42c
MD5 0166c71d85ff3df391fe5535817d1c6d
SHA1 0a72dffd4c3451853ed2944a0250c3e91f893183
SHA512 4b198fc790c156896bb5278c0a690248df30daa6092228e001f1b7b5319cd00917af82c57afeca55dfbaf94cb10c5b83b21bd999c2b81bc4b5a6c052be281276
SSDEEP 384:PI5IqP+fjgJ4IlP61hu1wdvNd9KVRaAcP+AWRMAm:7n0J4IlP61hiwdvNmVAf+hRMT
TLSH
T1C6729D3A9F605CDA0B13A4F45D3A6BE55C06B257DBDCCAAC17593900C14DBAA92FC0C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 5bdf7d3a30d2d45c908028540e03df640dd23f8c719deb2d85c63352f34046d7
MD5 12cfac1e752a3fc7ae33c4efc80f59ae
SHA1 087899f1ebd29b595e540820ed578fc470818fa6
SHA512 00c69864c9316e697874617484464ec324bff1c0b015057952fb2b6e770f2e984a80be861e9fdb1a68a21095cf6433a814bfef6f513826be1f0281f0b1ed41af
SSDEEP 384:HalwSiO024YcDL84KKDL849B7SOEAd9KVRaAcP+AWRMAFL+3S+X:6l8ZYcDL8lKDL8CB7S/AmVAf+hRMCLG3
TLSH
T104728E394F003CEC15A7C0E8C4B943A98D18B797DFE6806D21683D0DCB98A6DA5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eef450cd-dec9-4140-ab9e-be49d066fd9f.zip

Path C:\Users\Admin\AppData\Local\Temp\eef450cd-dec9-4140-ab9e-be49d066fd9f.zip
Size 3.8MB
SHA256 3a5e0e3ef423465432da3d135fd7f95d6ba85c3a757e033b768e1114fd4cbc34
MD5 5f2ed53987e2d297b524878097e2e2cb
SHA1 be3dde5b23a4e265ec21cade974ded4d6fed0bbf
SHA512 d1dbb6841420d642a2f681b0be8b165406cb21230b5bce48923325d8c9a021b64e864c1250d45c6d82bf60ad6f5d7ff498e4d76fdd919c5b9146dcdba4765f74
SSDEEP 49152:GofTTXwMPZ1Lk5vPYaX+ONJdmLB56yP8OrleqmepQH2BeIOBq4hEa2685/M6E03a:G6TTyPY70mB5zs8pQHGeI4hrUt344t5g
TLSH
T12A06E035D65C1608C98F83BA850F2FCE8B0C4FA6B054BD6F6A6A95715FB31A11B7C84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 16KB
SHA256 ab23c23455224bc3dce7fc61a77d6030688d894f832ac4f14b9761b6b3ed40fd
MD5 4f36ae90598ffcba2bc96faba486d634
SHA1 569a6ae0c802ee741dc32a50f0de957a100304bd
SHA512 427a01e418189eb812c012fd4e96430385edac4c7119aa2364fc0381d6bc8ecf01163b16e8e22dbc4da121cbe2e2c057b59003a06565e71bef8a4c1c8db8d3ef
SSDEEP 192:kC+8L+M/j+nF5MfQ+97S+0+fO+Qpv+H9/dd+n:ksxCjMf7U+fMp8/dG
TLSH
T16B720F121BFB0E52F9F3AB313A716743A773F9414B1E4A1E818256450A33710D99EFAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 13KB
SHA256 ef6a666d1e312bceec3d07099c99486e98e7c017ff5cba01577a3a25187f6129
MD5 d15aac1f3f78a457c1ce28ea70092569
SHA1 f8da173e2d99f0a16500454f795b6a8e2f2e562d
SHA512 20264fb86453ef256a2798d089c9c6396909f143c9ba77b802c84cfa342b926f7e3e1914e31ed452638a92ee5f0e1a8fec1b4e95066f39c40d98404902de7a3f
SSDEEP 96:4BC+cB/T+MB/j+uBF5yvfO/+NB7S+kB+y8O+8B/kOrd+n:mC+qL+6/j+gF5MfQ+b7S+i+fO+K/dd+n
TLSH
T18F5221121BFB0E52F9F3AB313A716743A773F9414B1A4A1E818256450E33710D99EFAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\broadcast-listeners.json
Size 221B
SHA256 738b0ba5c04b0f8d831ead0579e95e83439f1f6d208aae2ce3831077cbd288a4
MD5 2b5e9b95ebdaac025dcc4961520af7df
SHA1 95ec8008ae9c06774f2e7158c08c5778eac439d8
SHA512 3a014d0c3d267c70e990d6ec3bab27691e50ac7748ca9806e6a22a442484770534908da6011cb3fe8b9a637fbe22245657707df2e720353d24686edee3cb6dae
TLSH
T1E3D0220E21133C7F4B48622AF00427950B9A200A32B0D03DD3AE36580A2AAEC80096A0
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b2f13fe017f37e6d9c284d81bc3ec41edd5843f2270c197443bd5899ca28341e
MD5 b92d315e85449ab7cec07724eab44c63
SHA1 e7dfe9fb2dc1190558c525af5e1935be982356c4
SHA512 f3a985b6da81c24417ecf7cabadd508bd2207fc0ede3397849c974dcf32395fb1021d0170f9a8ad7ec64dd4a1e5ef3a338770dcd06edf35b7abaf7ad94af5e21
SSDEEP 192:MJ1d66Joz0dzgCl6mc0dvv8Ov5zboHKZIQSyjxcI:MHd66JozQzgC1jBv/boqZIQSyjxb
TLSH
T189D1FD68F629463BC459423BCCA60B410F36398A984F7F29359C241D2C562DE7B8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\db\data.safe.tmp
Size 39KB
SHA256 b0fc7df853c2c2a6d4424607dfcd64447d152a0dfb16ffc39466e833ac02cabb
MD5 0c87964ac97954ff7d0f0c8319b2beec
SHA1 ef8ad723ed6546c4dce0d57c6f8e6de1efbd68f0
SHA512 fa008ba88659dd0bcd9af72a151e2ade06fb2341d262f38ac22f3cc541807905303b6a0a418906b55fea22b5592b492f8831eda72c4e6a01866a068f39b97595
SSDEEP 768:Hwme8SSK9Wbyo0Hgx17UGcmhumnUgKWrDQpyBwbZb9bHb7buETMqVSA:HkSK9W2oYgx1dnUgHzqVl
TLSH
T170030F80EB1E503FD42442BBECA51B142F39F885591A2FAB3A4C54692C872ED3D5E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\db\data.safe.tmp
Size 68KB
SHA256 2da4cabfec6c0269f51c5f51f9b0e76af50661821854549c1c36dc7a30676727
MD5 1bbe47f5bdf2a915dbdb0842515379ef
SHA1 69354794b24adc0f3db0a1c8c9df04e6c3615727
SHA512 161305e56f3618b41f29264daa971f753cd18bfe4a3a8d2ed8e81f9849c34314fed50f346446dc4a73812ebf43584acc8530071708590e6a50bb58fa94474244
SSDEEP 1536:H3KUwQXekUkRKQXlSjOQvVY+fgdtcSudgrgER0BM0YORu:H3KUXX8k712f9VO8tCNORu
TLSH
T19063F244EB1E553FD82802BAAC961B142F39F8894A1A2F5B375C54782CC73ED3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 4ab7cd7f36d863b49d6c5332d6ba1e5393df94a6f3a9299964036b304f9517cf
MD5 da187b347d6835a2fad7eb66ad2dc9ca
SHA1 b60977d8647698848473677ae294ac572baf6fd7
SHA512 496dd9940987c67776ed4354d28942353d3923b0d0ef8d017ab9fb03345cfa492945cdf8fc689b4157922f0a02d19d76cc88bb0d6240bfc49acc28c92bc9526f
SSDEEP 1536:vnw6Pe/xSRdHHNVNauVQCu8ScOFJx7llFVPWFQHORCH:vnpPmSHncCuXb1LrkaORCH
TLSH
T119630344EB1E553FD82402BBAC921B142F39F8855A192F6B3B5C54782C873EE3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\db\data.safe.tmp
Size 68KB
SHA256 e5744e51c5f521e116d0a067a46c2308e57b9e3543a359124d3f94d2442290aa
MD5 bc04b7aac7eadb829a8ea94a5546ab66
SHA1 142eee6f35f20fd0ddb101ddf26200693f0b6130
SHA512 65958a6d3a544a6cf1a4b630b6657a77d380d596ec3306c473df2c14612639e24a9e28f87009d81fcbe72dd2c0f0e541b7ae83a059397bc0294d5e9feae0f0b9
SSDEEP 1536:2KUwQXekUkRKQXlSjOQvVY+fgdtcSudgrgER0BM0YORCY:2KUXX8k712f9VO8tCNORCY
TLSH
T1A863F244EB1E553FD82802BAAC961B142F39F8894A1A2F5B375C54782CC73ED3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a3e738f1078aa944083041e551fa37776333c1bc873955a7b0f56c17d810524e
MD5 0e8d6570fff212524987000c044d6a63
SHA1 aee88e40f38a10a4d132317ceab65df3c14fcdef
SHA512 59da67df468b1b4f232d9285479618f8ef777434af39b037b1ae03079b01df79a7492cf04df92473c60cfb96f225e0d6d85bac8cbf18c303551cc9d20ca813cd
SSDEEP 96:NF22F/FfAFEFt/dd66Joz0dzgClKtmc0d/UUyNv8SdF95/7bkW6QXjrcEIQSyUR7:HJ1d66Joz0dzgCl6mc0d6v8Ov5zboobk
TLSH
T150C1EC28F7384A3BC489423BCCA60B410F36399B984E7F29359D641D2D562DE778D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\events\events
Size 1KB
SHA256 255e666628f6abea8f4544f42e1fbc7954ef850830dd3e409fa4b99608f0378e
MD5 c55ca4fc6172fd246367d2639f5dddf9
SHA1 d1133c75cd93dce50584402094e996d109425b11
SHA512 e100834c07a0a3c689a70f814a19518953fc66fdbb2b7b0830fc6d160b5901a09d3066c45007519008f3e70555a99c30ab7123e65ea5ff6f10d023108540e959
TLSH
T1F121A98C39F84D6B9887F79DB490028E93918E0755871C430E52EF8CCE85ADD326A538
MD5 SHA1 SHA512 TLSH

Submit Download

2e6fb992-a002-4765-9fbc-94a28d7ead14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\2e6fb992-a002-4765-9fbc-94a28d7ead14
Size 883B
SHA256 ed8d290d6ebb4f5d4ea6d068f71fc87d3c3373843856182fb1c56f2862c6fd1e
MD5 f02d366fe875a28a7ae2c4bc2e2904c0
SHA1 bef47fa5058d69754aae7f104ea13cbafed6c534
SHA512 a450a2a1009ec3a0266e6921eb38e0969b8d3035e5e7e9b93900f46df97bc907e600402aabb354aa066fa0f3c4d10ef11342d1880f5e7172a220ee6b9f56eae9
TLSH
T174110040A77579B2CCBCD24EC4A6770647B8751380CA941C2D7589180C7E55EA36770B
MD5 SHA1 SHA512 TLSH

Submit Download

6d27afdf-bf2f-467c-a6cc-8bab73bf6447

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\6d27afdf-bf2f-467c-a6cc-8bab73bf6447
Size 2KB
SHA256 3d026a3b506bc016b02d81f021ec042ac229347f46ed1bde02b49fec0a4f7100
MD5 70f8de6ec50cdbeb9153b58795fbd1e7
SHA1 6d4ab162031eb41f272d74be36911a8db0bd4695
SHA512 d86ad334cc6519349891e8bd65e315c207003635836aa82510ab38406b9cc7ac3a7ef5fd7f4bb996d1215e643c191f520d09fd7379bc6b508556b8f40b64089f
TLSH
T1E241645C79B85C37DCDAE58CD0D227CE53608A0300862C9B6D55DE0CCD917AE336A62B
MD5 SHA1 SHA512 TLSH

Submit Download

831b70c3-b927-4c56-825e-41e9f2ba5946

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\831b70c3-b927-4c56-825e-41e9f2ba5946
Size 235B
SHA256 618de61f3c432075ed9f8a32378e82c40f2cb9ad482d388b485a4688fb14edea
MD5 7715d0a33673583fb8d7f0041e90255c
SHA1 a8c7ac636d8a1ca4e99618a18757154aa0519524
SHA512 3c2633f8f98a1d4f0173362de713b40a46486db8a7a60a346ab77a75d874a310834cf428f090a53511e9dc0506d4f59a6cf9179e822aaccbd3ed28a3e1da7b43
TLSH
T155D0A7D028A9675D08141F07F0E5A9D771584C3754B45820FA528679DEBA9C8429185A
MD5 SHA1 SHA512 TLSH

Submit Download

9a486d9e-c416-4b86-98a5-174133482dd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\9a486d9e-c416-4b86-98a5-174133482dd5
Size 886B
SHA256 11399e71e6e7fb0a99b48263ba8e8fea08fd09fb160a0ed0f4ed29663eb9904f
MD5 1b0b2c4f263cae6134ebbe361cccf2be
SHA1 93d3e00a84216aba6b38b16f6439ceec6ac298a9
SHA512 6f6091946a10b5b765c5088c8479d6ef579f3b96d4687e3e0433d2ef40eda5e7b3fb048c253dd65d1186408d19047b1316ee7c4dcccbdd1316620e04a35bfd89
TLSH
T140110441A7687D72CCECE28BC492B74387A47117C0CA591C2D554A180DBA55FA397307
MD5 SHA1 SHA512 TLSH

Submit Download

c368410b-153e-4d19-b499-f9b5aeb79b06

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\c368410b-153e-4d19-b499-f9b5aeb79b06
Size 235B
SHA256 75f4c0afb81721fe13a193f8f021c428c085f8a7bb99eb0626a866bb4116d902
MD5 c4c80d02351ce868f96f2a4b37b373fe
SHA1 41e6d682366e954492504622c683349b477b19d2
SHA512 774f5e1d3591f1a32972560c9444ac359385821453a317d4e5ba9767b950e975a0e9d5d62aeac6d00e45fbd29bd21af6e52ab71be9a9ace6b9cb3b15d3b63b00
TLSH
T181D097802898A32D08180F07F0E06AC670A98C332070E820D67010348AF9DC842A1806
MD5 SHA1 SHA512 TLSH

Submit Download

dcd9f4ff-ed01-4aee-a59e-3cb56acfdaa6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\datareporting\glean\pending_pings\dcd9f4ff-ed01-4aee-a59e-3cb56acfdaa6
Size 16KB
SHA256 dba2385093c0034f5777692db4709dd690f62791638ca27853a024f1b7ed2b12
MD5 03b99b71ad2ad47bd26d82bcc2843acd
SHA1 3af982d44b650f9b156c5b0a50d62e4b249b0c1c
SHA512 490b35c78d876a832704bd20b9141c78ccddecaa6b04e50be4f91c7aa2dd4d8cb11bcb0938aa4ee9f163816cad677eb4a40a1ac942ef397c2f1b73afdf777e83
SSDEEP 192:MQjdb8BzRR5R16qemydBui81lu4NIQnkUEZnuqhjPCIYzVC0I/xV3QyfEWecRI3U:M2db8BNR5/6TdEiUu42xZNhjasgk
TLSH
T1FD72D8566820557A8291E3A998F87FC3E2F538CF4C019FCE9BE47D086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\extensions.json
Size 16KB
SHA256 eb49e4c11dadf738ac8e7fca12d92e10ac9cb32b4dd6ff9be5f7d66d47c3e259
MD5 77afd550015900cdff5bb55ecab941ee
SHA1 3abc68740e8f54bb8475621c06cb475ecc7529c4
SHA512 c3bf3fc5271be9aabbdeb29566878c0fab1aa071808830b3d44f53090adf18a276a148261058e1a0e485c568806ee97203fa6548c7dffc4d3daaf446eef53baa
SSDEEP 384:IkI4viUmldvg8dhWb94zB96oCL4HWL4PhL4HHL4HJL4Hs94hM:fI46RfZXC4z6D484h4L4B4Y4W
TLSH
T19F72631545049EB8294FA79BAA367E01C37D473B60845C38F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs-1.js
Size 12KB
SHA256 1baada577232bb64ebca7db1260b15e4da84f20b18bb5f1dc3810c2a1ded2b9e
MD5 0e3976a88639b22e4ef445cc9c42fd43
SHA1 850ca7ef32e66f79a70e64fa8922ef3e829c1797
SHA512 10c298620ff7304b25ff7d3872e9559f544528162ce876d63477169ea1dc732dbe9c4b45ecebdf56daf2b792e958fbeec3ed1cda91d84518f7192a282419525e
SSDEEP 192:BhCRmf8c3jSS2LRCz30OBw8856DT673wy:TSRCz3Pw4CAy
TLSH
T18A42DA385000CA3F20F3367DAC2549B45AA54627B7BFBCD309F98592855CF2541EAAF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs-1.js
Size 8KB
SHA256 371139e532e2ec4883852d22dde87e7b89255c4e7ef74743dd039ad9996e3da4
MD5 a0360dddab7a903d1387ead27ab35676
SHA1 cadda2145dd21687a1f048e7bb01eeea6b3706e7
SHA512 8afc2e04825b35062c67aecdc99959c8deb2b7b00f05dc4dddba729eb17c5a9827894863c7e033028b4ded8abd2a92ead150c6c286ce3cafca5598900cce2e58
SSDEEP 96:xHr81TU5qGqnf8c3ObzSwSSlldv9jdneWRD2zcmDFz0Bw8858C8L4cnBsVEGS:G5Rnf8c36SSfRCz30Bw882+y
TLSH
T19F021F389004CB7F64B236BCAC2489719A72063BB7BF68D714B944C5455CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 12KB
SHA256 39b0909fefc326caac03fbdaa922085f76ded25f664709404446858ebd7ef631
MD5 acef16be4ef8e3fe7d30457d9788e594
SHA1 40fd44c9076224e020b3353ec1ade6b36c0479ea
SHA512 49692d0fcbb9acb75574da3c6424daf1545641f3a36eb2ef32c6f8a51e9c8d225feef3fbca4f2af3f43d2dee0431d495723e65de19fe5e489e83a3cf35033763
SSDEEP 192:GhCRnf8c36SS2LRCz3MOBw88MmgPLSXLWy:pNRCz3nwmOay
TLSH
T18342DD3C50508B3F20B2327EBC2549B659654627B7BFBCD705B88582989CF2441F6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 7KB
SHA256 6ac7ad8d8f244f5f86f6cbef4847dbcbf834075b13db8abd466268d6e43134bc
MD5 aab29bc765ee36f9af034467007e49f2
SHA1 ea4d73e02cc8281bbfb2e010770451d2941d7d47
SHA512 4da5bcb2a52b0bc7b2935cb5aa8567beda1858f55e4512b120b172f7f5f0c766b77ababe137ece9aa39216285c0237fc170a5db8a4b7284986be60355d2379be
SSDEEP 96:xHr8UTU5qGqnfZc3ObzSwSSlldv9jdneHizcmDFCBw88H8L4cnBuVEGS:G0RnfZc36SSKizWBw883y
TLSH
T1C2E1417895088F7F64B677ACAC6888316AB2413BBBBF68C750B954C4010CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 12KB
SHA256 2bda4f314414cb14205c4cae784e52336434332a81daa1b38d05fa352275c1b7
MD5 9527b92c29239e808e383bba75c8cb9b
SHA1 81a03cc766b0b4ee007c44991e0211368c454778
SHA512 056784f02e2105be66afad779b4d3da4e082ded145b61c542098e89647432f0dc9db86a75a29788060a7a3826b032b394eea726935067250e1896f7db01219bb
SSDEEP 192:BhCRnf8c36SS2LRCz30OBw88eq0PLSXnpy:KNRCz3PwEOpy
TLSH
T13542CB3C50408A3F20B2327EBC2149B659A54627B7BFBCD305F88592885CF2441F6AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 7KB
SHA256 482597b972345bda8b63c4446686c73d1c024fcfff278147a14f94e583110896
MD5 ab45d6634a27a4dcdf80d4996e163090
SHA1 be66e69f20432c614bb81b690e5898df5e058f03
SHA512 840599323de34b9fbccfdd3b892771e242d543a6e55e94a421e5b6f8853b924e942658b793c83093d1c7403d7f3dee3a1994b0d53b5cf9632d0f6b9699c81c4a
SSDEEP 96:xHr8UTU5qGqnfZc3ObzSsSSlldv9jdneHizcmDFCBw88H8L4cnBuVEGS:G0RnfZc3ySSKizWBw883y
TLSH
T157E1307895088B7F64B677ACAC6888316AB2413B7BBF68D750B954C4010CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 6KB
SHA256 521019cb2931d45f9f047c7216dc4941c4b19638215c440bb7ba12fffe4016d7
MD5 55c36aed1a3e1012cf64a6a95986c510
SHA1 8bd3801da31aaff91a5947f15ed38a00fd580a1d
SHA512 e8f051e06bb2482843fda544a5b00830dac44cde3cd835c72865053e5c9eb4dfdc366d3393d086d5f5259496e46b11a2fc31ceebfa07fb17a3545d25f4945881
SSDEEP 96:xHr8UTU5qGqnfZc31zSsSSlldv9jdneHizcmDFCBw88H8L4cnBuVEGS:G0RnfZc3hSSKizWBw883y
TLSH
T1BBE1307890488B7F64B677ACAC688C316AB2413B7BBF68D750B954C4050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\prefs.js
Size 6KB
SHA256 3cd7b92dd7b575217a266af25c140a9686dc169fa94d695fa9f4f0a1092b2449
MD5 58d57ee2d0bccda4d1e1faf26514b032
SHA1 161f2403e3cc3368df173c25b5de65276352274a
SHA512 1f0193f2a8a014e93d5e45e1d8e322af95d29f354e0bc92a3a6dc139e98568f65c654e480acd5fae5589c8945a59ac6e892103b0e1afa02dc93285b5e8eee066
SSDEEP 96:xHr8UTU5qGqnfZIL1zSsSSlldv9jyneHizcmDFCBw88H8L4cnBuV5:G0RnfZILhSS9izWBw8835
TLSH
T1DDE12F7894488B7F64B677ACAC688C316AB2413B7BBF68D750B954C4050CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 1a8de76f7cca88d099f794d1ef8d861088596dc2fcdd56df4993bd3471a414b6
MD5 ed3c7cfa28cb398b2fabe2a757a0682f
SHA1 782622b24da528aa4a597c1c9ebb1a3682eba76d
SHA512 61e0279e6ce78f16c4d14e57c4f7b734d01ca9ac6880407055e5910d2901193c026c1b6ad69a8fa5effe1b44d019a5f6093e6e7d54fb5386b4b2059084956574
SSDEEP 192:9EUsMQHc9SAfjZtgxzg5iTgEGpqDduKwKgMEx69EjSxTn1:rQHcpMx+1HpqDdTwKMxQHZ
TLSH
T13EF19FC536157E76C228058087F927A91ABB0C010B93595EBE9EA85F482DF4D9BBF211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b7ee34a3b8328c48b38ae8862289445ae06d009e9592357ce00f1e576d913453
MD5 57444cea374016b9f20416f4d7fc3389
SHA1 30537f59ea59fa2f66b5cf04e49ba27a42197294
SHA512 5c2ba014e10d6de6c832f0d066c73c282ff7a18a46cf9efef41f339d6acd11b1d64bb3bc9f74529f6ac4963358fe0b373ad98837f0f8e41031b09dc36cb5727c
TLSH
T1FD21D785BDBF4CB93A78B367E0CE5BECC7270007036088E0CCC4D50813985897BAB21A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 b4ea6a027e8303363d8c2f3f779c79da586f70270e680f16fa239dafd4e41404
MD5 e5f5519a7c18c0f09756741067fb0cd2
SHA1 c5171bbe30d069e1004493bbaa27134a6980eca2
SHA512 b5c1a01c2d2d0e089c4e617b38bb89ec58330c46439fdb7317f90df9a8f9b57975245d40b66bae11a67b90ecf1240ebf7e6001fd3ff26d7b724bc7eeb5569e95
SSDEEP 192:oEUsMQHc9vAfjZtgxzg5iTgEGpqDduKwKgMEx69EjSSdc5uVvIN:AQHc+Mx+1HpqDdTwKMxQuiuVm
TLSH
T12BF19EC636117EB6C218184047FA22E50AFB0C011F93596AFEDED85B452CF4D9ABF211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\sessionstore-backups\recovery.jsonlz4
Size 8KB
SHA256 10a470e1f4d243f90c5ded75fcd5a47ecab5305965f82446b9bb8ca57cb98c20
MD5 8a44ab9aa53bcc9259d4493a664fe2d9
SHA1 281e7e5205c3a0c83de83826570e94de3e40169a
SHA512 0bd9f55cf04639a104fa7b0d0147643903a1190ec04b9ee1e6d78b12aa3cb7a7bd576b16697b5c16461077f656904462d433e58db389309a9eec4bea3b282847
SSDEEP 192:0EUsMQHc9SAfjZtgxzg5iTgEGpqDduKwKgMEx69EjS1NuQlJVC:MQHcpMx+1HpqDdTwKMxQLzw
TLSH
T1AC02AFC53711BDF6C268098446F927E916BB0C011B93196ABDDFD89F082CF5DAABF211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.3MB
SHA256 aa2e4d73ff2e22a17cb9c814f41ce5b82e5203274b6b76d4df3f25c082b7a18f
MD5 2664b2082f09dcac5d4e698889cb9ccf
SHA1 c17cfb9a920e78c634cc49c424dd056032915fd2
SHA512 db4ae915f0fe5694e718c47e8939254a722e5ad8c69b4d2d39b19b988fe905a399eb853c28e660aafc4d87878f63a1e758cf15e09c1bc1b2ae4175f0f02fcaac
SSDEEP 49152:tRHH1AKbjRYjDNkSXGRY/47ijfBlJblZMbDW1CxUGxb5ISlEqXbg01aSZPUZR4W2:3qDNkS2RYA+jJl
TLSH
T15A764CE460E1D253F38640B3718993EB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cdy1k0qh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 14.1MB
SHA256 0b03feb4f4dab92f4f50af2df68a5b8a29fea4d553de50a2adbc453f668bdac3
MD5 e62a60b5c904ea6450d633b613d08dfa
SHA1 0fb56934b79a556bc2061b9e242397298d2e773e
SHA512 24cb8b4f4eee41d2b507de7a881cfaa261c647e2aed48e57092965bcf27b1d07d74978a2cac8fd10c82f8ed1e5b567d3262cd5b83c894cbd7aa8155e4d11f6ab
SSDEEP 49152:g99yWkpn/X1oe4y2D3/YgxSWNTl7SrxUTxuAW8sk9u1VeVv6re6ESEGb1RYpkNkR:GRkNkS2RYHDq0PL+z5
TLSH
T108E63B9270E0D692EB0146F2B31F43EB317FC1DC20E589941678BA5C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.xspf

Path C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
Size 304B
SHA256 81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d
MD5 781602441469750c3219c8c38b515ed4
SHA1 e885acd1cbd0b897ebcedbb145bef1c330f80595
SHA512 2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461
TLSH
T135E0CDAC3084DC1147D1E513BBFAC0447775A0495AE95985E7E326B385411F4B631254
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 587B
SHA256 5645c881c0110b1b510fa1e38456f8fc4803ae22fb98d70fc849a716f998512d
MD5 3eac209fdf4ff31b7a9a139372e66f6c
SHA1 ffef66d1fab0982005dca4673d149152c7e96785
SHA512 02d86666d065053e5b23877977d0c823b6fa4491b5709f55a454b5fd752d1a6df5c7a85026f7c079701629fac4faf0d697d690cf84485419025934621067c3e2
TLSH
T177F020120828406CC2E45F4A18FEE323A9BBD380FF327301F0082550780D6B668CBCDD
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 855B
SHA256 2a55c98adb40e2e8152100ce473fa19c58f1b2e396fd83a1b4ff1a817a2f454d
MD5 94965652d6c1ddade1171f0ca65e99c0
SHA1 1fe45b5dd19ac51ed32afaeb2c951fa15130c35c
SHA512 030454ad814721353f0f16b815097167825263d9d830a4cb4ea9968692602f5c253e33808bf9ef8297a35e7ba65395b198a38cff7625e580da414b309e01f449
TLSH
T1CE1120570869805DC1B59F4E25FEE32774FBD381EE217301F0042140B50C6B169CBC9D
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 547B
SHA256 a613398434b0f608000c16828b585a9f3f36646879e041047b7d56bf79cbc284
MD5 7af40578fc72c42c8cb4a38c687486ef
SHA1 b53a41d42f7fbebede96bbf20b9ddbf268bc5686
SHA512 651adde9e7e3ca123088e29715501129d0b04ac2795bb954ce88ae26c020da5a5ef2073f81331fcfa10f995298a0df335811c6ca6b0ba62931cc78095c7d7816
TLSH
T104F0C9520429406C82E49F0A29FED322AABBE381EE327301F4442520750D6A6A8CBCDD
MD5 SHA1 SHA512 TLSH

Submit Download

vlcrc

Path C:\Users\Admin\AppData\Roaming\vlc\vlcrc
Size 94KB
SHA256 ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e
MD5 7b37c4f352a44c8246bf685258f75045
SHA1 817dacb245334f10de0297e69c98b4c9470f083e
SHA512 1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02
SSDEEP 1536:XJDiGWjxYmJPHzV1vC334+DmV3LrCE2y5h8LwgLgG6H:XJGGWjxYmP1a339D0XCE95aLwKgR
TLSH
T1B393A4C46C6020940897884735D5F180B91A712A9EFF1AFAD1FEFC5923848DAC5B9DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-12-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-9-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-17-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-16-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-43-0x00007FFB436C0000-0x00007FFB436F4000-memory.dmp

Download

memory/752-15-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-19-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-14-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-13-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-20-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-45-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-33-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-42-0x00007FF6DF980000-0x00007FF6DFA78000-memory.dmp

Download

memory/752-11-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-10-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-18-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-6-0x000001648B72D000-0x000001648B72F000-memory.dmp

Download

memory/752-7-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/752-8-0x000001648B480000-0x000001648B736000-memory.dmp

Download

memory/1544-4-0x00007FFB281B0000-0x00007FFB29850000-memory.dmp

Download

memory/1544-1-0x00007FFB281B0000-0x00007FFB29850000-memory.dmp

Download

memory/1544-32-0x00007FFB281B0000-0x00007FFB29850000-memory.dmp

Download

memory/1544-0-0x0000020275C60000-0x0000020275C61000-memory.dmp

Download

memory/3228-4938-0x00007FFB244F0000-0x00007FFB25B90000-memory.dmp

Download

memory/4936-4769-0x00007FFB27880000-0x00007FFB27B36000-memory.dmp

Download

memory/4936-4767-0x00007FF6DF980000-0x00007FF6DFA78000-memory.dmp

Download

memory/4936-4768-0x00007FFB2FFC0000-0x00007FFB2FFF4000-memory.dmp

Download

memory/5496-4782-0x00007FFB244F0000-0x00007FFB25B90000-memory.dmp

Download

memory/6832-4734-0x00007FFB25300000-0x00007FFB2550B000-memory.dmp

Download

memory/6832-4730-0x00007FFB25530000-0x00007FFB2555D000-memory.dmp

Download

memory/6832-4729-0x00007FFB27510000-0x00007FFB27536000-memory.dmp

Download

memory/6832-4727-0x00007FFB27540000-0x00007FFB2756F000-memory.dmp

Download

memory/6832-4726-0x00007FFB27570000-0x00007FFB275B1000-memory.dmp

Download

memory/6832-4725-0x00007FFB275C0000-0x00007FFB276A3000-memory.dmp

Download

memory/6832-4724-0x00007FFB276B0000-0x00007FFB27798000-memory.dmp

Download

memory/6832-4722-0x00007FFB277A0000-0x00007FFB27872000-memory.dmp

Download

memory/6832-4720-0x00007FFB378D0000-0x00007FFB378E4000-memory.dmp

Download

memory/6832-4715-0x00007FFB397D0000-0x00007FFB397E1000-memory.dmp

Download

memory/6832-4712-0x00007FF6DF980000-0x00007FF6DFA78000-memory.dmp

Download

memory/6832-4713-0x00007FFB2FFC0000-0x00007FFB2FFF4000-memory.dmp

Download

memory/6832-4731-0x00007FFB2DDE0000-0x00007FFB2DDFA000-memory.dmp

Download

memory/6832-4752-0x00007FFB2FFC0000-0x00007FFB2FFF4000-memory.dmp

Download

memory/6832-4753-0x00007FFB27880000-0x00007FFB27B36000-memory.dmp

Download

memory/6832-4751-0x00007FF6DF980000-0x00007FF6DFA78000-memory.dmp

Download

memory/6832-4732-0x00007FFB296E0000-0x00007FFB296F1000-memory.dmp

Download

memory/6832-4733-0x00007FFB25510000-0x00007FFB25521000-memory.dmp

Download

memory/6832-4736-0x00007FFB25210000-0x00007FFB2525F000-memory.dmp

Download

memory/6832-4737-0x00007FFB251E0000-0x00007FFB25205000-memory.dmp

Download

memory/6832-4738-0x00007FFB1CB30000-0x00007FFB1CD75000-memory.dmp

Download

memory/6832-4735-0x00007FFB25260000-0x00007FFB252F8000-memory.dmp

Download

memory/6832-4728-0x00007FFB2DEB0000-0x00007FFB2DEC8000-memory.dmp

Download

memory/6832-4719-0x00007FFB25800000-0x00007FFB25B90000-memory.dmp

Download

memory/6832-4723-0x00007FFB25560000-0x00007FFB257F6000-memory.dmp

Download

memory/6832-4721-0x00007FFB2FE20000-0x00007FFB2FE31000-memory.dmp

Download

memory/6832-4714-0x00007FFB27880000-0x00007FFB27B36000-memory.dmp

Download

memory/6832-4717-0x00007FFB2F600000-0x00007FFB2F622000-memory.dmp

Download

memory/6832-4718-0x00007FFB298B0000-0x00007FFB298DB000-memory.dmp

Download

memory/6832-4716-0x00007FFB37AE0000-0x00007FFB37AF9000-memory.dmp

Download