Analysis
- user interaction
yes - max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
XWorm.sln
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
XWorm.sln
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target XWorm.sln
- Size 1KB
- Sample260930-wyncpsvv5l
- SHA256 ca9379e72b62ba26bf8827cc14e282e457909d65fc6feea0b2396a1be83ec7f1
- MD5 aa52c6909a518bd44fb3668589fafe41
- SHA1 6cec2147506bd5e4f722f08c958401a26d674311
- SHA512 b28a785c5d8e9794f378bfcd4d9a8838a30726a5a88693ca3fc0737ada138136fd8b7c5c9ce6b0a8b4ea115600ae42f10f28033b484b7a893d68dff7a1726fd6
- TLSH T1D611269C011E38B0F946539FC2912CC63A774241995F897E208D54786F3FEA5527BC9F
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5764 cmd.exe - Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.sln OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\sln_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\sln_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\sln_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.sln\ = "sln_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\sln_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\sln_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings cmd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 540 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4992 firefox.exe Token: SeDebugPrivilege 4992 firefox.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4992 firefox.exe 4992 firefox.exe 4992 firefox.exe 4992 firefox.exe 4992 firefox.exe - Suspicious use of SetWindowsHookEx 50 IoCs
pid Process 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 540 OpenWith.exe 4992 firefox.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 540 wrote to memory of 4232 540 OpenWith.exe 108 PID 4232 wrote to memory of 4992 4232 firefox.exe 110 PID 4232 wrote to memory of 4992 4232 firefox.exe 110 PID 4992 wrote to memory of 920 4992 firefox.exe 111 PID 4992 wrote to memory of 920 4992 firefox.exe 111 PID 4992 wrote to memory of 920 4992 firefox.exe 111 PID 4992 wrote to memory of 1928 4992 firefox.exe 113 PID 4992 wrote to memory of 1928 4992 firefox.exe 113 PID 4992 wrote to memory of 1928 4992 firefox.exe 113 PID 4992 wrote to memory of 1928 4992 firefox.exe 113 PID 4992 wrote to memory of 3364 4992 firefox.exe 114 PID 4992 wrote to memory of 3364 4992 firefox.exe 114 PID 4992 wrote to memory of 3364 4992 firefox.exe 114 PID 4992 wrote to memory of 3364 4992 firefox.exe 114 PID 4992 wrote to memory of 4720 4992 firefox.exe 115 PID 4992 wrote to memory of 4720 4992 firefox.exe 115 PID 4992 wrote to memory of 4720 4992 firefox.exe 115 PID 4992 wrote to memory of 2164 4992 firefox.exe 116 PID 4992 wrote to memory of 2164 4992 firefox.exe 116 PID 4992 wrote to memory of 2164 4992 firefox.exe 116 PID 4992 wrote to memory of 2164 4992 firefox.exe 116 PID 4992 wrote to memory of 388 4992 firefox.exe 117 PID 4992 wrote to memory of 388 4992 firefox.exe 117 PID 4992 wrote to memory of 388 4992 firefox.exe 117 PID 4992 wrote to memory of 388 4992 firefox.exe 117 PID 4992 wrote to memory of 616 4992 firefox.exe 118 PID 4992 wrote to memory of 616 4992 firefox.exe 118 PID 4992 wrote to memory of 616 4992 firefox.exe 118 PID 4992 wrote to memory of 616 4992 firefox.exe 118 PID 4992 wrote to memory of 4736 4992 firefox.exe 119 PID 4992 wrote to memory of 4736 4992 firefox.exe 119 PID 4992 wrote to memory of 4736 4992 firefox.exe 119 PID 4992 wrote to memory of 4736 4992 firefox.exe 119 PID 4992 wrote to memory of 5764 4992 firefox.exe 120 PID 4992 wrote to memory of 5764 4992 firefox.exe 120 PID 4992 wrote to memory of 5764 4992 firefox.exe 120 PID 4992 wrote to memory of 5764 4992 firefox.exe 120 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\XWorm.sln1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5764
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\XWorm.sln"2⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\XWorm.sln3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {c6d5893c-a8cb-491a-8f1d-3930f42e984a} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:920
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2516 -initialChannelId {a26532ae-b7c8-4f8e-9fa4-6721981710e9} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
- Checks processor information in registry
PID:1928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3536 -prefsLen 27325 -prefMapHandle 3540 -prefMapSize 270279 -jsInitHandle 3544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3552 -initialChannelId {c44bd1f5-f7fc-4e31-a7da-5dc07f1c2b67} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:3364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3696 -prefsLen 27325 -prefMapHandle 3700 -prefMapSize 270279 -ipcHandle 3768 -initialChannelId {de06f33b-6bad-4dcc-a67f-6b18a4cde3ea} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:4720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4260 -prefsLen 34824 -prefMapHandle 4264 -prefMapSize 270279 -jsInitHandle 4268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4272 -initialChannelId {93f5b8a7-588f-4231-9ef3-839ee7255bdf} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:2164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 4912 -prefMapSize 270279 -ipcHandle 4900 -initialChannelId {b3d2d67c-b5e9-450d-9361-d08d0fa195f4} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4932 -prefsLen 32952 -prefMapHandle 5072 -prefMapSize 270279 -jsInitHandle 5076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5084 -initialChannelId {4710e546-0b9b-434f-95f4-248a064d0505} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:616
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {3b2e6881-363b-45f4-ae14-32cdf73e4f87} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:4736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32952 -prefMapHandle 5512 -prefMapSize 270279 -jsInitHandle 5516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {c2bfe369-5de1-49e7-9e80-91acd8d27f45} -parentPid 4992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5764
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 c6f03953cc33a8f5dac6aac02c2c31c5a52e96c3bd2cf6953616a97583f85559
- MD5 58e80ab56668610adcff677f500712cb
- SHA1 3d1a582caad8232c9994020133f323a8868150ad
- SHA512 6751e6e40940c6227f0728f9e159f934f715b4f0d821cd25720d42ae46b8377ac4bccda86350f2346b97c88d535dc760215d27464e55378d532016cec1bbf171
- SSDEEP 192:jOv5zboPRoCyj/MZE1d66JozGzgCl6mc0dz:sboZoCyj2Od66JozGzgC1jd
- TLSH T124F12FA4E628863FC004027BCCA51F450F36389ADC4E2F1976AC600C2D5A3DD769D1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 0067f838a5917a909f086d6cdafad5b5f71bf2f93ffb714894fd42290673d65a
- MD5 e1910b29df492971ef1e8f5a16307323
- SHA1 943820d469a01cf475b051b40ff1bf8d316988ba
- SHA512 fc757123ad6455de23efc2180105e51268ec671bdfbba2525dccd2a195e319fffbfe9b8e54a727d4f2c7da13eb7632c23f14b8a2660bf6f123147956bd5b38df
- SSDEEP 192:4/1d66JozGzgCl6mc0dxOv5zbo7boCyj/M9:4Nd66JozGzgC1jMbo7boCyj6
- TLSH T1A3E10EA4EA28863FC004033BDCA51F410F36399BEC4E7F29769D600C2D5A2AD769D1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 dba373c91d85c76f64652072e8755352592d41e8edbc3db4dd16d29c01ae08d5
- MD5 f607ddbf1dc0f02f1f6f2a1e0c2ca521
- SHA1 601b6f0172fa7220fee8745918496e97bb995005
- SHA512 8dfa4c3b93741d63fd27093ff1c34e097e4c2b0f0ca7150ff6ef00f713d6ef343ff9e1f5378420210359080308b0848259f4c0d8e4cd720da692389ce5299015
- SSDEEP 192:VOv5zbo6boCyj/Mj/1d66JozGzgCl6mc0dz:Kbo6boCyjkNd66JozGzgC1jd
- TLSH T14CE1FEA4E628863FC404033BCCA51F450F36399BDC4E3F2976AD640C2D5A29D769D1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 ef03a54d8e8be835b3e6bedd3e624024b849db3715199329c58b10a8c5497dd7
- MD5 1c7aed1fea28bc710501414fc02fa710
- SHA1 840f12675d75e1628c4702ef6a5f97bbdf8a5e5f
- SHA512 2ea8150679262898b1020b7f4fb02c2184360c70bf1538970123fd066d225f16265762b5d064a2702bfbfe93aa16a3a857364eca00246ee63b0c19a61451cc47
- SSDEEP 192:dOv5zboPCZoCyj/MA/1d66JozGzgCl6mc0dz:Sbo6ZoCyjVNd66JozGzgC1jd
- TLSH T18DE11FA4E628863FC404037BDCA61F450F3A399ADC4E2F29769C701C2D562DD369E1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\db\data.safe.tmp
- Size 4KB
- SHA256 2b0b613ba57fe9d3d9c1d4fbab77b2366676b9da3094308ca4aecc9597391caa
- MD5 8fcd55f3b7c72f611457b2745d158493
- SHA1 46e078f006abf09fc14b085ab5f39c721798fe72
- SHA512 c930fa38102c02b76a6a22d9a81aad1add224955bd9f93e82c0c62531bc5246ab9c46681ca86e642802ab163f3c80035e0d2dfc2eb1d49c390dd58f8200ee1a4
- SSDEEP 96:ZFbQFDFxFAF2/dd66JozGzgClKtmc0d/UdSdF95/7bkW60rcPyUR6:M1d66JozGzgCl6mc0dEOv5zbowCyj
- TLSH T1C2A1A968F229463FD458423ACCA21B400F76384AA85E7F2536ECB44D2D672CD7A8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\4a916767-e8b5-4a02-b97b-ac36418b2e19
- Size 886B
- SHA256 665f58be4818a8c00faf5c93a8bbc3a74a810b682b38d633167f5da23e784acd
- MD5 fc9cd5f8ab59d93bd5918b508d48eb12
- SHA1 a8852bf6fee6f3899c48fea1fc861a0bcd71dcab
- SHA512 73b79dbd21e91b7a4dce439d8bcc4b5df8ff4d1c41ba6b4a9fc819ace6f78de1f078cf0dba07791d775c3017b72223dbf58db931eec3a02fbc58697004515678
- TLSH T1C11140809521B562D92CD24B90E4BB0287E17123C0CA4D24BEA05A180DB962DA3BA307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\604b7ec2-ea7c-4ccf-9539-533f7e51d734
- Size 235B
- SHA256 423d4c5fc68bf1d4dda8a3be81af8d54e613224755f087bb2ded3172c2274897
- MD5 3adb307cc2ea7afaf25111671eb49acf
- SHA1 02300aa0037bba14da89f7d75d9da33b212aad88
- SHA512 f34da24a72b380ac5ce8f2abf85bda5b87f61b83569996168445f6c8c01e307949b2eb512a95e729a8e4aad37c8f889dbdb9ef7d13bc68b459654f6902747fa6
- TLSH T1BED09782A488239C48240F07F0B069C270488C3368A4AC209BA15A78A9B9AC44321C1A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\7ee4218c-b399-4044-b556-0a0010037719
- Size 883B
- SHA256 db513e3674bcf94602383f2fa5a5a0abfefae33604892c5aa852b97c58578963
- MD5 da03023733a885007014e86e0bcfe82e
- SHA1 f5cd4b178a3ab621355ee2ff2a75ac8857e80fc9
- SHA512 cecbeca892d3eb47dd41ffd58d22003a09985971b601070cd23ca4e7ffc5a8d3e7fd1fe6cec22e4fe1acb8e7de9cc5c231d299eb8c0e83e2c93d25243d568397
- TLSH T1ED112381A571B576DD7CC20FC4B5370257F57663C0DA44183EB059180DB9A1D63B7747
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\9c5c79f4-fff5-42dc-a996-2c302c68ba28
- Size 734B
- SHA256 adb476f5040ba13925a594811994b250bd3ed8f29493a8eebb92943eafd5b64f
- MD5 bf3004eb6a7cf22e63fae33dfbc5326e
- SHA1 7c8823ed0a8ca40d99201100b4cc9fe9308f6720
- SHA512 05f9d4128d7d1dff158ec7c47575ff962f89fdbf39e064b29df1224471e3c159f2ae32439acf779eea15df03b34c534784691098a38cf5e06c1be806244517cc
- TLSH T1ED01D0D14125B523ECB8C30EC964771E87E2A532C0C681147FF595040EFB11F927670B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\bb452fb9-361a-4619-8169-61cd0d8011ad
- Size 15KB
- SHA256 4844179082f2233fbdcc26d7f358a750157ad5221a9d0e46097bcba196b06b55
- MD5 cf8a17379fc7d7d0a3c5409cd625e0c1
- SHA1 a440fbf77467b7d97d34f24556a5ef2923c863c4
- SHA512 05cc828ace809001e92aa731dce9dc7a784eae21654948fafcf794a3e8a59fc5dde60c7eb5a549958189ffd00a30828300f1eaff370d8b76bf31878876816367
- SSDEEP 192:eqmKY1pfBpu0zMoyisaTrA8gMalRE+i9KmzioC2k3so8BBZ4bePG/R9sKGH9S9:eTfi0zyisuOMalR/i9KmWoCneKQ89
- TLSH T1C072C9562430597A8651E3A994FCBFC3E2F628CF4C418FCA9BE4BD085DDE06D112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\c26f9719-9e4e-4248-a80c-491f248256df
- Size 235B
- SHA256 0a0ef09a7103a6e334ee044b508de305c9d322947eddd61d2353f33695b3b29b
- MD5 4b6bdc8905e5f9c705e589c9800f0b3d
- SHA1 5cebf2a9758bd2e37bdb6077efcab846dc253c2d
- SHA512 7e6dc38f63887384908050df63d1d6b42b652cb545558c6e39d6c79e5babb053206fcb3c1cf99b702b846db2bd07f1293a95ceec50fc6238275de9b39a9ed7e9
- TLSH T135D097C8289CA32E08140F0AF0B03AC234488C3354B89850DA514538DEFCDC40123906
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\datareporting\glean\pending_pings\deea8ca5-7690-4268-9513-45f15689223b
- Size 2KB
- SHA256 361e295c4cac07f277cad8e3751851fe628b7d41f3df22b8b53afe7dc1065bb6
- MD5 0a38a396e4a7d843c6b02d0f9d4b9abf
- SHA1 4f05481108916766e0b6dfa5abaf2547fbe251cd
- SHA512 245d8443970f064216e8363742dc7d704c7c2cbc4683c2e2e65596723088d02634c9b1395b8441c852e9df99e73de1b118c00de1ceb313d974defebedae3e09f
- TLSH T12141305C75F84C3BACCAE54E9492234E17754E8340C618836E52FE0CCEA679A736A527
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs-1.js
- Size 6KB
- SHA256 0a55f681e0577796d28baed2491aa2378ce7cb45d3e42dfba16647ca42e19fcb
- MD5 474ea8d1172387938d175dd78c1109fc
- SHA1 a0a2d410129dbdc9cf95e0b7f3eb74fd9c9d8df0
- SHA512 24ea89d84663ba27cb110678d97052b27cd94c57397bf96d9e4c8de6f780adbb9f488e88a576c04c37fffdf43be355ee4d07c6f0b4557c0238281ba2e0a6182e
- SSDEEP 96:xHlwUTUnqGqEfxwBsN1zS8SSlSdv9jqnHRHZlejyiBw88n8L4cnihK:0aREfxwBsNVSSt9ZTiBw88k
- TLSH T1ADE12F789408CB7F74B676AC6C6888316AB2013B7BBF68D650B554C4011CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\prefs.js
- Size 6KB
- SHA256 356902da19b79d10043ee05019472dc2bf5453083954ae7cb2dd1910ed889a1b
- MD5 4673fc6e49cd127b8c7da3cc38ed2066
- SHA1 3653805b32247886347bf41b494c2504441debd2
- SHA512 070a2d89ae839f6a04c3969226d13229c9b70e5712c0560c1e293b7c34f29c4cc7a06b7d65ecfb6f464e583538cd9b8de9379b6e9c3b29a487583e9f63d4d471
- SSDEEP 96:xHlwUTUnqGqEfxTik1zSbrSSlSdv9jhnHRHZlejyiBw88n8L4cnihK:0aREfxTikmrSS49ZTiBw88k
- TLSH T158E11F789408CB6F74B6776C6C6888316AB2023BB7BF68D750B554C4055CF3842F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH