e57a095ba23f59ed0364693adf730c3be16d46fda1b0a0d24d43498afe1f2e51

Analysis

user interaction
yes
max time kernel
159s
max time network
158s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/09/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VMProtect.exe
Size 33.4MB
Sample260925-3bc2sazv3r
SHA256 e57a095ba23f59ed0364693adf730c3be16d46fda1b0a0d24d43498afe1f2e51
MD5 54373f55c886595f36606121d7a5f34c
SHA1 25993a59df26b7aaf5390fe026090e9b6f1df413
SHA512 ed533ff599a8854d473e11cd57880f7b74669c1be367b3d63a732fc74ec0e232a2c1886472cc6d447260c357b316e34fb129f21c57f9a031314314713577186c
SSDEEP 786432:cnOdy3k5En6Q4RaqwLR2ITNktGTTASjimIWpGyg:cUy3aCFqWR2BtGSlWpGyg
TLSH
T17B7722D76CE446ACC49AC631D28A0BFDD2D97D984D76181B7BC628012E33D63DCF2926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
64	1408	firefox.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2856	VMProtect.exe
2856	VMProtect.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\kotonoha-launcher.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\kotonoha-launcher.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2856	VMProtect.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2856	VMProtect.exe
2856	VMProtect.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	VMProtect.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	firefox.exe
Token: SeDebugPrivilege	1408	firefox.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2856	VMProtect.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1408	firefox.exe
1408	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2856	VMProtect.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe
1408	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1408	5076	firefox.exe	93
PID 5076 wrote to memory of 1408	5076	firefox.exe	93
PID 1408 wrote to memory of 4184	1408	firefox.exe	94
PID 1408 wrote to memory of 4184	1408	firefox.exe	94
PID 1408 wrote to memory of 4184	1408	firefox.exe	94
PID 1408 wrote to memory of 896	1408	firefox.exe	95
PID 1408 wrote to memory of 896	1408	firefox.exe	95
PID 1408 wrote to memory of 896	1408	firefox.exe	95
PID 1408 wrote to memory of 896	1408	firefox.exe	95
PID 1408 wrote to memory of 5920	1408	firefox.exe	96
PID 1408 wrote to memory of 5920	1408	firefox.exe	96
PID 1408 wrote to memory of 5920	1408	firefox.exe	96
PID 1408 wrote to memory of 5920	1408	firefox.exe	96
PID 1408 wrote to memory of 3340	1408	firefox.exe	97
PID 1408 wrote to memory of 3340	1408	firefox.exe	97
PID 1408 wrote to memory of 3340	1408	firefox.exe	97
PID 1408 wrote to memory of 2768	1408	firefox.exe	98
PID 1408 wrote to memory of 2768	1408	firefox.exe	98
PID 1408 wrote to memory of 2768	1408	firefox.exe	98
PID 1408 wrote to memory of 2768	1408	firefox.exe	98
PID 1408 wrote to memory of 4124	1408	firefox.exe	99
PID 1408 wrote to memory of 4124	1408	firefox.exe	99
PID 1408 wrote to memory of 4124	1408	firefox.exe	99
PID 1408 wrote to memory of 4124	1408	firefox.exe	99
PID 1408 wrote to memory of 4520	1408	firefox.exe	100
PID 1408 wrote to memory of 4520	1408	firefox.exe	100
PID 1408 wrote to memory of 4520	1408	firefox.exe	100
PID 1408 wrote to memory of 4520	1408	firefox.exe	100
PID 1408 wrote to memory of 3980	1408	firefox.exe	101
PID 1408 wrote to memory of 3980	1408	firefox.exe	101
PID 1408 wrote to memory of 3980	1408	firefox.exe	101
PID 1408 wrote to memory of 3980	1408	firefox.exe	101
PID 1408 wrote to memory of 4984	1408	firefox.exe	102
PID 1408 wrote to memory of 4984	1408	firefox.exe	102
PID 1408 wrote to memory of 4984	1408	firefox.exe	102
PID 1408 wrote to memory of 4984	1408	firefox.exe	102
PID 1408 wrote to memory of 3336	1408	firefox.exe	103
PID 1408 wrote to memory of 3336	1408	firefox.exe	103
PID 1408 wrote to memory of 3336	1408	firefox.exe	103
PID 1408 wrote to memory of 3336	1408	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VMProtect.exe
"C:\Users\Admin\AppData\Local\Temp\VMProtect.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {85e09c9c-6c7a-478b-8069-23486cbced14} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27136 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {0978ac2c-d3a8-43be-bef4-69d00066ae03} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 27277 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {f68b06f1-4777-4580-bf96-dc7853e76de0} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27277 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 3940 -initialChannelId {0657c8fb-61e8-49ff-abbd-eb9a60968b2f} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4384 -prefsLen 34776 -prefMapHandle 4388 -prefMapSize 270279 -jsInitHandle 4444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4452 -initialChannelId {de616a99-c2b0-4299-b6b1-706560987bc4} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4792 -prefsLen 35013 -prefMapHandle 4832 -prefMapSize 270279 -ipcHandle 4896 -initialChannelId {cccf256c-9092-49b4-8126-9046819d9687} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32952 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {b638acde-b79a-4c70-8f68-ead2aa71de9a} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32952 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {c5e0bfd3-b315-445f-986f-87c88279fb78} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5312 -initialChannelId {d4e26577-40a4-4339-a116-df63822a304f} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1644 -prefsLen 33073 -prefMapHandle 6156 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4576 -initialChannelId {95a01844-bf43-4101-aeac-313661bc71a6} -parentPid 1408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iopj0gis.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 8f4c4acf129087e1e7cd7b20f5df1350e4daea0c6ae110045112d8a60fd9c9d0
MD5 35a4b3001aef21229e800268c89584bd
SHA1 49af722489654428372c927adeed85e37cf8ae91
SHA512 dff20e02b1b4bff667942e1842914465d6a6d8b82c7f2d18839298200433bdda6d6202ab967346f5ce7ee9cd3841601f54483f9bfa7d9a84589e616691940e2c
SSDEEP 384:HalwSiO024YCWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA8L+DS+r:6l8ZYCWTToXJWTTogB7S/AmVAf+hRMla
TLSH
T1E2727D7D8F013CAC265790E8C8BA43658D18B3E7DFF5C06D21983E09CA84A5A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49bca03512e025a91b370b1616312774.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iopj0gis.default-release\thumbnails\49bca03512e025a91b370b1616312774.png
Size 114KB
SHA256 3c07d819e2e821480660e158a7ebb3b69454bf825ea57a76fe404e53448d1fc7
MD5 e39571719fe49f55b9a29204354eca17
SHA1 63903b15e84d0e6b3ff04c91abf3ba77c05b3ae5
SHA512 744ab3d99498f67f000b7f2a2d0f3f353948118271cfc6c7c03d2cbcea188a142419516b39dd6d5238d73975fcd348e62688b36a8d9f2f3eb975998aed7504bb
SSDEEP 3072:effncwl9r0VVkAeCUU3612eVMLg/6jMVBh1FJCTZ:e3hl9rwVksUUqQeqWRzJ4
TLSH
T193B302F8C15B9C1CDC8FBC28C61449F8CC6BA2AD82122DA5738569643CD8F60C53BBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 2ad5eff06e2d60d5da522f62498a8434d85b282e906bcabf91b961e26032f55f
MD5 605532f3ed5341dbc6874f4806f4061b
SHA1 d440430d72edc679541bb37070b617a2dfa82718
SHA512 c0aea018927e8c71a6478136357d6301d71e79de99bbc5055de423b12cc9dce49d958a8a6cad2731341868874b281c0dd1c30f565f6be7d4d14b44c1c0a73f51
SSDEEP 768:coJL7ghGcmhu6oaRzrL0k8bSb6bIbKlPeK9:coJL0Ux+n
TLSH
T1B9C2F144EB2E553FD42912BBDCA54B002F79B88958192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\db\data.safe.tmp
Size 26KB
SHA256 a4edb4d5703f3893cdfad0b601427cdc2bf9e769fce9ecf664e29f61ea96046a
MD5 9e104668e757436394fc166023f91f03
SHA1 84df1b873a249d54f0d025f9f8860e43a99eb81f
SHA512 85059692f2c84b687ee23cb6e8b3dcc15c34f0faf9a053fe7b76e5ef4952aafb144c6fa576f47a65c9f0827b1dc717b6e928647944bc115ce49d05bd3f6325b4
SSDEEP 768:hPLoJL7ghGcmhu6oaRzrL0k8bSb6bIbKPz2:toJL0Ux+i
TLSH
T19EC2FF44EB1E953FD42912BADCA54B002F79B88958192FA73B4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 561c08923776e9b92290c83cea20a92b5d399a1983398efc23a1a212b96af98d
MD5 e27b1439208ba1605b6a2a5ff4c8c492
SHA1 b0a5f9e221c828b7bd5df2ab6050f217a1bc7b85
SHA512 b8231db31dd9b4393f522aaf03cd1e317f2eee7f09cea60461e0fd6d6f74b4073001b5a1d2bc15a97477f517b7c5af447f9fd43793415f415eef5aae3d63ddb0
SSDEEP 768:a+xoJL7ghGcmhu6oaRzrL0k8bSb6bIbKlP/:VoJL0Ux+9
TLSH
T13AD20144EB2A953FC42912BBDDA54B001F79B889581D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2161e909c19126ec0bf3b3f3aff15a93f16d7c393ec7ea45234d693c75aeb508
MD5 4ab0fa48ffeed97d47f0aecb2769ab98
SHA1 e6e4ef79123d8efd74a0574c7589786ae9bd8242
SHA512 20a943f2fba4b82beb4f23e5a34825815507986e2a5ec5fbb9e0531fc5571ba6b092ce9a14fabd0f1615f443e83b9bde0e13342ff156e2f820f099d14bc83542
TLSH
T1CE21AF4E3EF84D2AA886E7AC7084068F57D04E2B145B1D539D03DF8DCC81AE932AE43C
MD5 SHA1 SHA512 TLSH

Submit Download

52b6477b-4813-4add-86ce-3ead543a1ff5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\52b6477b-4813-4add-86ce-3ead543a1ff5
Size 235B
SHA256 dacabfa73cff98d7d5891349839bbdd314d5600575ea10cb21b2e6d2b241ef1c
MD5 a2af53e3e1c505c49c01625bdc00a5c5
SHA1 e664cdac3b224d69675beca8032a45e3cfbed711
SHA512 47f93b8dc57e06f570e400f53c8d00ede4b8534d598faccf4ced910be268ca34e3a4bcced7eea393c037d120d43192029c014c9e858274dd5e22809427b3c30c
TLSH
T177D0A7D428E97BAD18544F16F0E069C631985C332479D820A6526574A9BEDC54161C67
MD5 SHA1 SHA512 TLSH

Submit Download

a41b3317-19e9-4dbf-a7e6-9c2ff50d4ad9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\a41b3317-19e9-4dbf-a7e6-9c2ff50d4ad9
Size 871B
SHA256 4b5f86d2b706d57d4ab47c6ea2318351a45351c670fcd083db7b9e7f6e767143
MD5 e16843ae3187feb6c32d8de46e65000a
SHA1 6501b138223afe30b9fef657b46b917994baba02
SHA512 b9991b2c4c9bb6184f4a5ab84a9ba48535ebeb9f1ea75ee8fd07f63ca5cd0e22b8354a6348756ea3822c54e45e25bb36f5e7c44586d6ea50e041405a272dba47
TLSH
T173112380D674B8B28C39924BCAB13B068BB4752380CA51143DF49A184D7E60E63AA307
MD5 SHA1 SHA512 TLSH

Submit Download

b1204436-ec4b-4543-90f4-2379ecce3bf9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\b1204436-ec4b-4543-90f4-2379ecce3bf9
Size 886B
SHA256 2f4c25c930efd4f703f853835834dec4038851bf5e389df10c1c2db94a1fd1f3
MD5 bb0d39c7eac60fa18f50fe47a5ef7ba4
SHA1 c7a63188e424d7bed797ca732a1faa3179fbb0e5
SHA512 d88b62fd6830c179379fc0006f37c19737942859633a79f7a03e7557574e1be6866084b7d6390429012abfd3d7528bf5622ece9b573a9f39f45a29407e1a498b
TLSH
T10F116380C678F4B28C38D25BD9F03B824AE4B53380CA19147DA59A284CFB61F639B307
MD5 SHA1 SHA512 TLSH

Submit Download

b8a39074-7abc-4189-ba03-393c11b74c9f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\b8a39074-7abc-4189-ba03-393c11b74c9f
Size 2KB
SHA256 9af6e9ffd9174c01984d24e86d6f4d95b8458e06113a456dd23c574b4c427ee0
MD5 7314f085bd5afb0b20e9e883fdd27698
SHA1 5b9aaa9a28ea0966100e014eee34b288a73cc8b3
SHA512 f82b0063e73294d7c39a528c72f3f639b0ba0403c9911bca916faef3afdcc829f44d57f68fef17ea7a9a86237294730f17c6d29867e7dcbd174aa27710321f06
TLSH
T1D44134DCB9F89C7A9C97F15E9451238F57604E13008A28436E51EE0CCD9269D336A537
MD5 SHA1 SHA512 TLSH

Submit Download

eb15bb1b-65ae-4aee-884a-694751a2101f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\datareporting\glean\pending_pings\eb15bb1b-65ae-4aee-884a-694751a2101f
Size 235B
SHA256 03f8c0f28e20c81bf2e231ed00fd9dd591c4b49c69a79853b338decb56756a8f
MD5 057469dd4d3ada8a79a711d302f0f14f
SHA1 47581c65a02f4b3f743266fb1b3b697f274a6aa7
SHA512 891119508cface493eefef069a65b54b40dac6112a284d986e7a79db549bcb6229a184b49bc0f726f6f0e3a863133e38bded173d4e1b57be39a5df0b30bef504
TLSH
T19ED09781A488AB3C48040F06F0E028C6B0698C3720746810BA5205B889BCBC982A1907
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\extensions.json
Size 16KB
SHA256 f3a89f1812efe424ddc212e509e3a0777af6bdbb52a104ee61d17d20d80a96d6
MD5 aa8bcb7b786e947fdd9cea3937becf65
SHA1 f72a372075a8cb3ee9f3f877312a9c214c49f69c
SHA512 e5716b8ce9a94afd57538cc05d489ec84da369f62cd800de329301394533cbaeef157e3258bfdf38968466d3561bc1f7c79f46be2bfc4e1c10f47b13cecd913d
SSDEEP 384:+ZkI4vtUmldvS8dhWo94zY96onL4H6L4PpQL4HeL4HrL4HML4ha:+6I41Rf3Xt4I6c4o4hS4E4X4m4w
TLSH
T16772421545448EB8294FA78BAA367E01C37D473B60845C78F4DD8FC842FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\prefs-1.js
Size 7KB
SHA256 fb8db198c0b1921d7ebf6684e4131f37624fb14049ca465a5e7d4985d59696d1
MD5 04d997e096cb7ae980d8131dc064140a
SHA1 82155212e7c445a7b5496f1f83ccbfc71caa4df1
SHA512 04b502130b9b8190787eff0b3b99847028f95a458fcc13f3eae62980167700b443afc8e78f794a1b873b305be6f0576e16ed81c1c5b8023dc01c9ccf8eb30723
SSDEEP 96:xHPUTUeeqGqffSoZObzSw9UmSSlNdv9jinFHJGBw88P8L4cn8mofGS:RuZRffSoZu9UmSSoJGBw88Qg
TLSH
T1EBE11F7895088B7F64B677BCAC688C315AB2413B7ABF68D350B554C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\prefs-1.js
Size 8KB
SHA256 ef42f1e135bbb339dc742b7d1e6b8ef3357e73f3ed92aaa26f422626f2d82024
MD5 c9ec06ab7f14de237cdb1c45049c204a
SHA1 e1ae6fe0d8c6a09c5ee3e6b804d3f16e98227f82
SHA512 306bbbdf8575d41cd1d0aca7096028d5a98b8f686abbd78bab015b4b11d7be4513aab91ef97395fc911b9ba72145283c5444364aae732a2d32ba3cef7352abc8
SSDEEP 96:xHPuo3MqKGTUeeqGqffXoZObzSw9UmSSlNdv9jinFWRVtCnBw88KYv8L4cn85of9:RdZRffXoZu9UmSStRHCnBw885g
TLSH
T1240210789504CB7F64B6777DAC2889315AA2413BBABF6CD390B944C5011CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\prefs.js
Size 6KB
SHA256 c5041fd0ea5f0b270233159f94dd40fc7c12a080e236a61f881d26b2cdf39807
MD5 508135c90aa0228e31edbaba56d7b8f5
SHA1 4292c6c133632e9ede9c9e06ac54b2aa0db8bed4
SHA512 44ef1aa5a2d7a0f3df898ad8e575db2f2440e39c07129c0232360be55529614e68734fa55fe95aa119b9ffe235d4626c1eadf3994792789a8238128cd8cff349
SSDEEP 96:xHPUTUeeqGqffSoZ1zSwKSSlNdv9jinFHJGBw88P8L4cn8mofGS:RuZRffSoZFKSSoJGBw88Qg
TLSH
T1FCE10E7894088B6F64B677ACAC688D319AB2013B7BBF68D750B554C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\prefs.js
Size 6KB
SHA256 32511952ac33bde0ce1acb7f6234df942bfef9cdc912db090ba752a10f9bcf95
MD5 ef3983306cd827a2f97684a0d13f269c
SHA1 d86a3b6552dd863ed2a9233155440e9f09fb96d0
SHA512 fc7cb2239b5b3119f8ea03c852d0bfbc94c0e308b58a370c8d6dd911b815f85458f298c4fcb40f68d2d096f718fcc0fd4f1b57953375d657a0812de5b6cb8233
SSDEEP 96:xHPUTUeeqGqffS/N1zSueSSlNdv9jsnFHJGBw88P8L4cn8mom:RuZRffS/NreSSmJGBw88Qv
TLSH
T1E2E11F7890588B6F64B677ACAC688C315AB2013B7BBF68C350B99484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 2da591b9313b9c8071192e52169275a8582243d25ec6a21abb25d111d6b703c7
MD5 2acaff24d55735c77a5caa9e4af494a0
SHA1 dbfb85f37a60a9fa32171d3c2e2ac3a666b105e3
SHA512 46c3d422aa3325e290e84508ca2703f5857ea1a8475eeeb5c5631bca9a724de329804115b8dae80e0dc6ade4e40c1c8a0865f7e2ee3af1d09bdb81096e97577e
TLSH
T11C21D7C17E7D8CFA2919C3E180CE0FFDCB0CC019821899B0E88D440046D851DB7AFA6A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iopj0gis.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 0de03186ec9e3b9b9ef0b77b45b17cb388ade73d6d3d3dd64ff8a0b36a5f3d9a
MD5 a4978004cb212389c96e1abe13670baa
SHA1 ab542f494cc44879aaa2d86682234a385977e591
SHA512 ff1ae6c243a3b51cda70bd502744e7f52f0bf4a58e21e7aa117e3a34c90649769fc159957e90b701c75de2754882650d37c4d257355f2d4f3489cf21cf08013d
TLSH
T1CF3195CABE183DBB0554C04A15D5AFB9D9DA1025479FA59492051C090B1D21FB6AA252
MD5 SHA1 SHA512 TLSH

Submit Download

kotonoha-launcher.exe

Path C:\Users\Admin\Downloads\kotonoha-launcher.exe
Size 4.1MB
SHA256 8471637a51ccd2ce6a531c42fc2a3972535b477ab0bc968c6bb30c849d430e45
MD5 111ee40bb8e8b9e15b8cafaf30d718b6
SHA1 23bfb4072bdb33780903c301f6085b1342669c21
SHA512 ac0d0d5a28f233098743b0c089b532fa462394123623f09ceafc35bea7de3796b33a973d243d0b48375cb10f3798932d6ec8f68369dc8acb902ed6337d50d06f
SSDEEP 49152:O2VhLcj+RzYWTKEpmculgGEra4AX6JIHg6d4xBdhrCHnQiq+GcspTnfiU/QiyW/N:HVhLzeGa+4sBcWBnp
TLSH
T14B1629217A5A99ACC55BC03083568A625A3230CB0F35B9FF64C856393FB9AF51F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2856-8-0x00007FF60BD50000-0x00007FF6113DA000-memory.dmp

Download

memory/2856-9-0x00007FF60E308000-0x00007FF60F273000-memory.dmp

Download

memory/2856-7-0x00007FF60BD50000-0x00007FF6113DA000-memory.dmp

Download

memory/2856-1-0x00007FFAC2530000-0x00007FFAC2532000-memory.dmp

Download

memory/2856-2-0x00007FFAC2540000-0x00007FFAC2542000-memory.dmp

Download

memory/2856-0-0x00007FF60E308000-0x00007FF60F273000-memory.dmp

Download

memory/2856-10-0x00007FF60BD50000-0x00007FF6113DA000-memory.dmp

Download

memory/2856-11-0x00007FF60BD50000-0x00007FF6113DA000-memory.dmp

Download