Analysis

  • user interaction
    yes
  • max time kernel
    84s
  • max time network
    86s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 15:46

General

  • Target
    Question.py
  • Size 159B
  • Sample261002-s714davdrh
  • SHA256 4e28c559d843357cc122f49162583bcf75e677e1fa00ca9088c909697a3ee11e
  • MD5 SHA1 SHA512 TLSH

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Question.py
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    PID:572
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5828
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Question.py"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5644
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Question.py
        3⤵
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {a379e8b6-99f5-4022-9324-a4f829352adc} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          4⤵
            PID:900
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {51845555-d2b2-42f6-b083-0856a70696bf} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
              PID:2724
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27323 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {2fde2074-12d2-4a0f-b380-0907e12108c3} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              4⤵
              • Checks processor information in registry
              PID:548
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4080 -prefsLen 27323 -prefMapHandle 4084 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {fd863e7e-e3b3-4ce3-980c-a8d1cf274e63} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              4⤵
                PID:3368
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3152 -prefsLen 34822 -prefMapHandle 3156 -prefMapSize 270279 -jsInitHandle 2696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4448 -initialChannelId {3f2128bf-8337-4d4a-b4fd-21b9a96d970d} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                4⤵
                • Checks processor information in registry
                PID:5760
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4672 -prefsLen 35010 -prefMapHandle 4660 -prefMapSize 270279 -ipcHandle 2804 -initialChannelId {75bc4064-82ce-484c-a330-11412ac88550} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                4⤵
                • Checks processor information in registry
                PID:5276
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3292 -initialChannelId {dc6d1e9c-ac26-4989-9848-b6c682f11072} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                4⤵
                • Checks processor information in registry
                PID:4032
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {29c95d78-6519-4d3f-b5ab-d3adc1414bff} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                4⤵
                • Checks processor information in registry
                PID:4240
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32952 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {7fe77b72-c9be-4334-9942-039230b9b3c0} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                4⤵
                • Checks processor information in registry
                PID:1708
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 35062 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {6f0b3efa-8783-4efc-84c9-0054558a4ba2} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                4⤵
                • Checks processor information in registry
                PID:728
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3016 -prefsLen 33071 -prefMapHandle 6616 -prefMapSize 270279 -jsInitHandle 6456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2992 -initialChannelId {fb8ba460-c1c8-4338-aab4-9543817c433e} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                4⤵
                • Checks processor information in registry
                PID:3796
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6876 -prefsLen 33071 -prefMapHandle 6856 -prefMapSize 270279 -jsInitHandle 6860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6868 -initialChannelId {4dd38fe8-e092-407f-80f4-944cbdd9383f} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                4⤵
                • Checks processor information in registry
                PID:2972
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:4876

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                activity-stream.contile.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\activity-stream.contile.json
                • Size 4KB
                • SHA256 3334aa62df53d7c6feaef6843331770c5c2da1b798b87fd7d0319c6c33c036c3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                activity-stream.discovery_stream.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\activity-stream.discovery_stream.json
                • Size 74KB
                • SHA256 52d06aa2b9d43928ddc8ed19f4d22f85ac715acc8054bd30c097e56a26f58198
                • MD5 SHA1 SHA512 SSDEEP TLSH

                activity-stream.discovery_stream.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\activity-stream.discovery_stream.json
                • Size 75KB
                • SHA256 c719d6982d9afa54e17e7a00ca5a00ea59d97b67fefab0390460c510cfc75820
                • MD5 SHA1 SHA512 SSDEEP TLSH

                12000

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\12000
                • Size 10KB
                • SHA256 b3c7c170b9fddff1c67e62da87dce0275b3b70b545b1de42f125a060f022c764
                • MD5 SHA1 SHA512 SSDEEP TLSH

                1256

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\1256
                • Size 52B
                • SHA256 d05977b02ad22d16fac05ff42b816952cc7a26c6ac095372f38af84f5bbaa7bd
                • MD5 SHA1 SHA512 TLSH

                13089

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\13089
                • Size 10KB
                • SHA256 796f8bafa7421b697fc2fd229f2cd19985c2e8357eb8edf34f0eb47fecbcb912
                • MD5 SHA1 SHA512 SSDEEP TLSH

                13538

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\13538
                • Size 10KB
                • SHA256 1155ec9b63b46902cf174df487fb2e0a40170887cbab2955ef40ccbed541268c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                13582

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\13582
                • Size 10KB
                • SHA256 6741af2e17b17be52035f2b15bcc1211de9dae02071e5f0850969d10761d2802
                • MD5 SHA1 SHA512 SSDEEP TLSH

                13734

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\13734
                • Size 10KB
                • SHA256 8292a8993a86aa2f2e6cc54f3a88c04596399282d53b3a8f909202567d621f81
                • MD5 SHA1 SHA512 SSDEEP TLSH

                16467

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\16467
                • Size 10KB
                • SHA256 901d06d309c9dc43f5b903b348f95040062eac511b91bfccf80ec9733db0618b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                17000

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\17000
                • Size 10KB
                • SHA256 b8a5965fbde6373cffd16f6a6c0ec06e707da51283b6656af66d5d8119362164
                • MD5 SHA1 SHA512 SSDEEP TLSH

                17314

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\17314
                • Size 10KB
                • SHA256 985f84b0f3e695ce306ce5c06ff4dd682ddd5e79be8e9b9f76abb3e0ba408801
                • MD5 SHA1 SHA512 SSDEEP TLSH

                18464

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\18464
                • Size 10KB
                • SHA256 a5ad797f5f2e6ffbfa68b947524d7f6b65cffec2b1584c47fceee9cc509cca0d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                19777

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\19777
                • Size 10KB
                • SHA256 8727ffcce18e553135b77b34c920d2d99ddf03a432ad365e259f43b5840e92e8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                19957

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\19957
                • Size 10KB
                • SHA256 d77709eaf598673de29a897d1802070575f4777a56c04f608ca9967fe6abbfd4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                20041

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\20041
                • Size 10KB
                • SHA256 4ace6d3e27374060567dab0264f55dc3543856f07530570ff5f96e8fd77a2bcc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                21712

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\21712
                • Size 10KB
                • SHA256 101bde7dc005653c16a4f026225f2f863b4a2431037b2469b3a53541994ee82e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                22626

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\22626
                • Size 10KB
                • SHA256 0d6b20bb1b45efb0c08e43ca1f7ab074013512038ec50ab029b95a4f397ce12d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                24843

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\24843
                • Size 10KB
                • SHA256 63582a2d53325737cecb930203403f24099013c3a55b3de7b6532427020c0c80
                • MD5 SHA1 SHA512 SSDEEP TLSH

                26151

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\26151
                • Size 10KB
                • SHA256 1e828d09cffd8b3b4451572b245256fcc556bb4f225a674c94643e211d73b2cf
                • MD5 SHA1 SHA512 SSDEEP TLSH

                26348

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\26348
                • Size 10KB
                • SHA256 f5f243bd18c50789f09701b9e9f677617831814a2c14de89aeccddec3cbe25e9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                26532

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\26532
                • Size 10KB
                • SHA256 0911d1fc5236503be832cb6a98bb17180bf45ac9439fa3e435ec2a32e4dbe19e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                31374

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\31374
                • Size 10KB
                • SHA256 c41b8c2d7d31c66ae51d0647d5a55070f15165c41795a7c69c5ac151d5802fad
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3213

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\3213
                • Size 10KB
                • SHA256 5f9675bc9af4ce3acf05919feefc44ca6afe7483175c39cbb4b796af0abc3466
                • MD5 SHA1 SHA512 SSDEEP TLSH

                32682

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\32682
                • Size 10KB
                • SHA256 8ae2523ef4fa9371eba45b37361d95c0d003c06f303c598ef25c1d21632acb89
                • MD5 SHA1 SHA512 SSDEEP TLSH

                335

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\335
                • Size 10KB
                • SHA256 6b9842e7aaa90eb53d64b2af46e86fdc96b08c81a4e89713536894e176860f12
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3449

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\3449
                • Size 10KB
                • SHA256 4c608aec2224ad8ab61b35896de3b6b622f01b3d8a8b0d4bcd9afa4f63b24d73
                • MD5 SHA1 SHA512 SSDEEP TLSH

                7485

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\7485
                • Size 10KB
                • SHA256 635fe929ca0df1886133316b6a4942380d9212a297a6cc019f4a0abd9491f0b2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                9683

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\9683
                • Size 10KB
                • SHA256 1a853ad0297da49d3facac7828cfcc090a717814b4616fd027ba89133f107892
                • MD5 SHA1 SHA512 SSDEEP TLSH

                9688

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\9688
                • Size 10KB
                • SHA256 3759c476ffe935a3656fe16d38feded1f56d9e29427f958776dd0f98083755e4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                9973

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\9973
                • Size 10KB
                • SHA256 816e6ec5f702a0ef77639dbdea11cc2a239fe8b075ca41607f97c68cead893c8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                15F2BB48DCF5311B791D5FE370A6B16FE2745964

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\15F2BB48DCF5311B791D5FE370A6B16FE2745964
                • Size 23KB
                • SHA256 315e851a332335a7702758ef84384dc3c21dedb41dd11b0db01190513fb289fc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                19C38BF2DD2B081A019388D936F52535103795AA

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\19C38BF2DD2B081A019388D936F52535103795AA
                • Size 22KB
                • SHA256 f5d15f70a43aeb77be8d461779fa0d3e8334d496340b8a542161fb68388336af
                • MD5 SHA1 SHA512 SSDEEP TLSH

                4860CD16A380B5CF35B32B5C1B0D4E4C5F854117

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\4860CD16A380B5CF35B32B5C1B0D4E4C5F854117
                • Size 14KB
                • SHA256 493c092cc27d66bae6cfccca7f55be4a2a264672249cdc77fdb8813680db2c0d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                573ADCCDDE448764CD7C9D0CDA443FE3A798AAA5

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\573ADCCDDE448764CD7C9D0CDA443FE3A798AAA5
                • Size 76KB
                • SHA256 84f79647db86d239d474a72f4eb868b7deca589db254cb034fe3abcbcc52c00b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                7445F0F1A704791B36159C77EEF62302A4FB39A4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\7445F0F1A704791B36159C77EEF62302A4FB39A4
                • Size 16KB
                • SHA256 f855173f431fb07b5f119712d71cafdc89ff9a70ac7eb328995cc55821d5d419
                • MD5 SHA1 SHA512 SSDEEP TLSH

                861847558ACF1613C52A3868D5EBEA5F31FE2828

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\861847558ACF1613C52A3868D5EBEA5F31FE2828
                • Size 42KB
                • SHA256 ed9d685e00443b4b61ba94e1125381bd7666fa979a0ef63b38341136df685f5d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                • Size 16KB
                • SHA256 29de56f82bc12493be150805ab84b371c3608f4f86e2a28517ed6f0d6018da62
                • MD5 SHA1 SHA512 SSDEEP TLSH

                B111691B4D57348085745E4F1020E07DF51B6C53

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\B111691B4D57348085745E4F1020E07DF51B6C53
                • Size 15KB
                • SHA256 2fbe56fbedb6c73da41c8e65fd5395994bb9b70fbbcf397466d39d1b4d73196c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                BCDFF2308A30898B7BE0D9F29A1C4373262A6563

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\BCDFF2308A30898B7BE0D9F29A1C4373262A6563
                • Size 18KB
                • SHA256 378beab836e32b1d848745b13171e3653a9de68a83426f2be9592d55066ac68b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                E45D9D88D22A136F37884CCF58B97BBA5C4C5F6E

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\E45D9D88D22A136F37884CCF58B97BBA5C4C5F6E
                • Size 16KB
                • SHA256 c9427e80457f9c261e23bab1ec61d6038982c446dcfc1cc38ceacc44fe5b27ef
                • MD5 SHA1 SHA512 SSDEEP TLSH

                webext.sc.lz4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\startupCache\webext.sc.lz4
                • Size 106KB
                • SHA256 6a2593bbf30369b5287eeff1654119db97ec0630e186e9bb5590676c936396ee
                • MD5 SHA1 SHA512 SSDEEP TLSH

                webext.sc.lz4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\startupCache\webext.sc.lz4
                • Size 105KB
                • SHA256 78635d06a914056fd31b1a75e323990789b999d67fea5a271f8c614ea311045c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 11KB
                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 21.6MB
                • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 502KB
                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\AlternateServices.bin
                • Size 20KB
                • SHA256 4f32ba1a26286ed13973c820f2d68232b23b09a2e99a9afd4861de7276625e55
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\AlternateServices.bin
                • Size 8KB
                • SHA256 ff7324cd116335740f4d6d43cbc1ab2b29789ed8441d02710ddeb95be13dc4a8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\AlternateServices.bin
                • Size 12KB
                • SHA256 07f79588d80bcaa641bc5b1279ea69d89da9c3cf9dc612efa56e337b07d05e98
                • MD5 SHA1 SHA512 SSDEEP TLSH

                AlternateServices.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\AlternateServices.bin
                • Size 17KB
                • SHA256 71f768e3999e85f2475a200696e3a48e70edc504b54b2b6c0dd823f249500c00
                • MD5 SHA1 SHA512 SSDEEP TLSH

                addonStartup.json.lz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\addonStartup.json.lz4
                • Size 4KB
                • SHA256 1ae3739ea5597ee54f7d3887b77986d58d65a281d459c131c6f25569f5f6b388
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
                • Size 6KB
                • SHA256 66d97c02d27aee6f82ec6f40523a232ee8467630d636e6005ac6a8f3aa4d8507
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
                • Size 7KB
                • SHA256 dcaada0ad8b397d098960649ca7c398acc31551d5b482346dfcf62d9fba672f7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
                • Size 25KB
                • SHA256 58b4dc99fccc7e5155dec69b10cce4898ea89643ab5a1254c6fa99a8d6ad7f8a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                events

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\events\events
                • Size 1KB
                • SHA256 9bb7a01d74af494dcfbef92372a4e99af1b45ec6bc3717db9c08f3fc95cfd430
                • MD5 SHA1 SHA512 TLSH

                events

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\events\events
                • Size 4KB
                • SHA256 af831221b5f8993df2c359ccc16cd15a0a4d9fa33efcd614b0fdb1a6e6f184a7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                09a23148-6cd3-448d-a022-093f162b3db6

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\09a23148-6cd3-448d-a022-093f162b3db6
                • Size 2KB
                • SHA256 9c881c010434ebab51cf102f9f441b699ca7f063b24a97ec64c53b285c2b92a5
                • MD5 SHA1 SHA512 TLSH

                5d6ac3a8-7dd4-45d4-ac41-aaae89fdd3bc

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\5d6ac3a8-7dd4-45d4-ac41-aaae89fdd3bc
                • Size 235B
                • SHA256 db3aaac38069bfc82983c7069bd93935618e6d30409315d7f40e8ab7af646dd5
                • MD5 SHA1 SHA512 TLSH

                a674cdb8-ec19-43f4-b75d-5707460a3c2c

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\a674cdb8-ec19-43f4-b75d-5707460a3c2c
                • Size 886B
                • SHA256 462c23e0e3f042ecb50689fa6c514ddfc3f6dce32fcbd06a453b123ed6580558
                • MD5 SHA1 SHA512 TLSH

                a756298f-686d-485f-8358-3d2c7ca8137d

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\a756298f-686d-485f-8358-3d2c7ca8137d
                • Size 235B
                • SHA256 563750b1e2323b75fb6fbf99339be6e04990e674e290f946b62d62bb7b74a480
                • MD5 SHA1 SHA512 TLSH

                cbb9250f-19f8-4dbe-a261-1fe4342c4276

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\cbb9250f-19f8-4dbe-a261-1fe4342c4276
                • Size 883B
                • SHA256 17a2b85ed8e7e8ac7000d0b76a710e82d5e5ed0952987210ea56d7d5f3d32426
                • MD5 SHA1 SHA512 TLSH

                dc1bedb3-076f-4763-a18b-92ae12d89b86

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\dc1bedb3-076f-4763-a18b-92ae12d89b86
                • Size 16KB
                • SHA256 43a2932953704610734c103905a1c65b3e3dd7e80dac534f4bf13a2899185bcc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                extension-preferences.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\extension-preferences.json
                • Size 942B
                • SHA256 75556cb7ef37fd52a4979f0868544a1336d4ded4de77bb9303aa2fed17930d1a
                • MD5 SHA1 SHA512 TLSH

                extensions.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\extensions.json
                • Size 14KB
                • SHA256 4873881fe2332ec0b4dd2cae4631ff6bc3561b3f06f2d84fc6755dbecb881570
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                • Size 1.1MB
                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.info

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                • Size 116B
                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                • MD5 SHA1 SHA512 TLSH

                LICENSE

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
                • Size 473B
                • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                • MD5 SHA1 SHA512 TLSH

                manifest.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                • Size 1002B
                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                • MD5 SHA1 SHA512 TLSH

                widevinecdm.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                • Size 21.6MB
                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                • MD5 SHA1 SHA512 SSDEEP TLSH

                widevinecdm.dll.sig

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
                • Size 1KB
                • SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
                • MD5 SHA1 SHA512 TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs-1.js
                • Size 6KB
                • SHA256 ac19f056ceda18b0ad60d09882079220c58e90e4eeef2e4f7a84bf3e83dbf425
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs-1.js
                • Size 7KB
                • SHA256 dc9be433e23e4eeea92ab50c37ccff963d084e22746a2fc1246270519c76b399
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
                • Size 6KB
                • SHA256 58243b076b79b705b0eac9b2767252a88811dc2de301b07f5568b71b0e1077a5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
                • Size 8KB
                • SHA256 b8cb236d8a6e317f8a8cf7910dd8dde1ade11f70f2f55e15e2f9ab884ab4cfb1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
                • Size 6KB
                • SHA256 3df7e6b06ef6b74b6edcb4f89bf01b61dad836d578bde8a832709e4d3b479af7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                sessionCheckpoints.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
                • Size 53B
                • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                • MD5 SHA1 SHA512 TLSH

                sessionCheckpoints.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
                • Size 90B
                • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                • MD5 SHA1 SHA512 TLSH

                recovery.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 1KB
                • SHA256 16f5197bd3642dab50e7ea296e00658e21f565f852747ff11bb2e089023795e2
                • MD5 SHA1 SHA512 TLSH

                recovery.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 1KB
                • SHA256 9e8a5d8576e7e0cdb37cefac7aff6f9db9c67b5ae964b40b0c0ea8893212e6c7
                • MD5 SHA1 SHA512 TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.5MB
                • SHA256 b4965a118623d1548ba426ad5d2bbd9823aceb659556d655794ab92d08db492a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.5MB
                • SHA256 4df0c1d965502ab82b0181d49129a0be6945b129a016a009d5c2f4b69cad387e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.5MB
                • SHA256 e36f427769369ac3eff0b1973dc5e0c101a6722ca4ec60506893c1bef39afb65
                • MD5 SHA1 SHA512 SSDEEP TLSH

                targeting.snapshot.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\targeting.snapshot.json
                • Size 3KB
                • SHA256 aa3028b5334f74ae287a3afb90d1deaea124f186377c50fd2d3ec0363d73a9f6
                • MD5 SHA1 SHA512 TLSH