06d2ae66105637cd719ff61862f93fc04db4ed9f3bbc0fa6a411678c0b6c2d93

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
206s
max time network
204s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader_slim.exe
Size 58.2MB
Sample261003-ye5trafb62
SHA256 06d2ae66105637cd719ff61862f93fc04db4ed9f3bbc0fa6a411678c0b6c2d93
MD5 4a15d593b0c94683eb555eaf91a29752
SHA1 6f91c3d0694e4900c52eac6e4ac97b98aadca205
SHA512 f865c278d43cdb9dc5e2aa2f8d566b3cee15ec6d5332aee197a045126bdb98810112b61fce56d733e81a8a4892baed43e20d96882aa9be10f456b4720345688c
SSDEEP 1572864:wsJOqTsJO+T85+iFghLYAfOPoNQ5tZNKtIzzx:wsJOusJO+o5+BhLYHPbF4Mx
TLSH
T160D733217213D037F629A0F01A28EFF4A0A5B4399B6214C777C1CF7684651D77AB9F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3796	neverlose-server.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	loader_slim.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3872	loader_slim.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	loader_slim.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	loader_slim.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader_slim.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe
3872	loader_slim.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
260	msedgewebview2.exe
260	msedgewebview2.exe
260	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5644	firefox.exe
Token: SeDebugPrivilege	5644	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe
5644	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 5020	3872	loader_slim.exe	89
PID 3872 wrote to memory of 4428	3872	loader_slim.exe	90
PID 3872 wrote to memory of 3516	3872	loader_slim.exe	93
PID 3872 wrote to memory of 260	3872	loader_slim.exe	95
PID 260 wrote to memory of 3532	260	msedgewebview2.exe	96
PID 3872 wrote to memory of 1508	3872	loader_slim.exe	97
PID 260 wrote to memory of 3788	260	msedgewebview2.exe	99
PID 260 wrote to memory of 3788	260	msedgewebview2.exe	99
PID 260 wrote to memory of 3788	260	msedgewebview2.exe	99
PID 260 wrote to memory of 3788	260	msedgewebview2.exe	99
PID 260 wrote to memory of 5176	260	msedgewebview2.exe	100
PID 260 wrote to memory of 5416	260	msedgewebview2.exe	101
PID 260 wrote to memory of 5416	260	msedgewebview2.exe	101
PID 260 wrote to memory of 5416	260	msedgewebview2.exe	101
PID 260 wrote to memory of 1244	260	msedgewebview2.exe	102
PID 260 wrote to memory of 1244	260	msedgewebview2.exe	102
PID 260 wrote to memory of 1244	260	msedgewebview2.exe	102
PID 260 wrote to memory of 1244	260	msedgewebview2.exe	102
PID 260 wrote to memory of 1244	260	msedgewebview2.exe	102
PID 260 wrote to memory of 4808	260	msedgewebview2.exe	103
PID 260 wrote to memory of 4808	260	msedgewebview2.exe	103
PID 260 wrote to memory of 4808	260	msedgewebview2.exe	103
PID 260 wrote to memory of 4808	260	msedgewebview2.exe	103
PID 260 wrote to memory of 4808	260	msedgewebview2.exe	103
PID 3872 wrote to memory of 3796	3872	loader_slim.exe	104
PID 260 wrote to memory of 3388	260	msedgewebview2.exe	105
PID 260 wrote to memory of 3388	260	msedgewebview2.exe	105
PID 260 wrote to memory of 3388	260	msedgewebview2.exe	105
PID 260 wrote to memory of 3388	260	msedgewebview2.exe	105
PID 260 wrote to memory of 3388	260	msedgewebview2.exe	105
PID 1940 wrote to memory of 5644	1940	firefox.exe	108
PID 1940 wrote to memory of 5644	1940	firefox.exe	108
PID 5644 wrote to memory of 2872	5644	firefox.exe	109
PID 5644 wrote to memory of 2872	5644	firefox.exe	109
PID 5644 wrote to memory of 2872	5644	firefox.exe	109
PID 5644 wrote to memory of 2352	5644	firefox.exe	110
PID 5644 wrote to memory of 2352	5644	firefox.exe	110
PID 5644 wrote to memory of 2352	5644	firefox.exe	110
PID 5644 wrote to memory of 2352	5644	firefox.exe	110
PID 5644 wrote to memory of 2224	5644	firefox.exe	111
PID 5644 wrote to memory of 2224	5644	firefox.exe	111
PID 5644 wrote to memory of 2224	5644	firefox.exe	111
PID 5644 wrote to memory of 2224	5644	firefox.exe	111
PID 5644 wrote to memory of 1600	5644	firefox.exe	112
PID 5644 wrote to memory of 1600	5644	firefox.exe	112
PID 5644 wrote to memory of 1600	5644	firefox.exe	112
PID 5644 wrote to memory of 5632	5644	firefox.exe	113
PID 5644 wrote to memory of 5632	5644	firefox.exe	113
PID 5644 wrote to memory of 5632	5644	firefox.exe	113
PID 5644 wrote to memory of 5632	5644	firefox.exe	113
PID 5644 wrote to memory of 6412	5644	firefox.exe	114
PID 5644 wrote to memory of 6412	5644	firefox.exe	114
PID 5644 wrote to memory of 6412	5644	firefox.exe	114
PID 5644 wrote to memory of 6412	5644	firefox.exe	114
PID 5644 wrote to memory of 6872	5644	firefox.exe	115
PID 5644 wrote to memory of 6872	5644	firefox.exe	115
PID 5644 wrote to memory of 6872	5644	firefox.exe	115
PID 5644 wrote to memory of 6872	5644	firefox.exe	115
PID 5644 wrote to memory of 6880	5644	firefox.exe	116
PID 5644 wrote to memory of 6880	5644	firefox.exe	116
PID 5644 wrote to memory of 6880	5644	firefox.exe	116
PID 5644 wrote to memory of 6880	5644	firefox.exe	116
PID 5644 wrote to memory of 6888	5644	firefox.exe	117
PID 5644 wrote to memory of 6888	5644	firefox.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\loader_slim.exe
"C:\Users\Admin\AppData\Local\Temp\loader_slim.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\loader_temp"
  2⤵
  PID:5020
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /Delete /F /TN "Femboi\Host"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4428
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=loader_slim.exe --user-data-dir="C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-component-update --disable-extensions --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --enable-gpu-rasterization --enable-zero-copy --ignore-gpu-blocklist --no-first-run --mojo-named-platform-channel-pipe=3872.444.5306577718650937559 /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView /prefetch:4 /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x110,0x7fff71165fd8,0x7fff71165fe4,0x7fff71165ff0
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView" --webview-exe-name=loader_slim.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-breakpad --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAcAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1748,i,2877830772671986881,13534816512287145296,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView" --webview-exe-name=loader_slim.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1748,i,2877830772671986881,13534816512287145296,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView" --webview-exe-name=loader_slim.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1748,i,2877830772671986881,13534816512287145296,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView" --webview-exe-name=loader_slim.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3436 --field-trial-handle=1748,i,2877830772671986881,13534816512287145296,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection --variations-seed-version /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView" --webview-exe-name=loader_slim.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4340 --field-trial-handle=1748,i,2877830772671986881,13534816512287145296,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection --variations-seed-version /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView" --webview-exe-name=loader_slim.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4784 --field-trial-handle=1748,i,2877830772671986881,13534816512287145296,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection --variations-seed-version /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --enable-gpu-rasterization --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView" --webview-exe-name=loader_slim.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-breakpad --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAcAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5060 --field-trial-handle=1748,i,2877830772671986881,13534816512287145296,262144 --enable-features=MojoIpcz,msWebView2EnableDraggableRegions --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:6ce917c11f71bbd4cd68bd95a776bca377c5af48
    3⤵
    PID:2616
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath "C:\Users\Admin\AppData\Local\Femboi"
  2⤵
  PID:1508
- C:\Users\Admin\AppData\Local\Femboi\neverlose\neverlose-server.exe
  "C:\Users\Admin\AppData\Local\Femboi\neverlose\neverlose-server.exe" --cloud-path "C:\Users\Admin\AppData\Local\Femboi\neverlose\nl_cloud"
  2⤵
  - Executes dropped EXE
  PID:3796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {1aeb3920-4f61-4764-9543-f88bb913e516} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {c83445bd-df13-496a-b5db-bdcbdc8d111b} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27323 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {18d23956-ea74-4f0c-9b11-30e6e4788d7b} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4032 -prefsLen 27323 -prefMapHandle 4036 -prefMapSize 270279 -ipcHandle 3892 -initialChannelId {7eba6ba4-2877-4c55-8e28-2eebbe0ff794} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3004 -prefsLen 34822 -prefMapHandle 3132 -prefMapSize 270279 -jsInitHandle 3188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2976 -initialChannelId {16228d32-6ef4-4f1f-a1f2-838d4389fb33} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5184 -prefsLen 34876 -prefMapHandle 5188 -prefMapSize 270279 -ipcHandle 5200 -initialChannelId {af19f120-ef91-4f23-9f42-89fe599c3f32} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5504 -prefMapSize 270279 -jsInitHandle 3248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4720 -initialChannelId {7867a829-f990-49b8-91f0-0b42f66f01aa} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5660 -initialChannelId {a271ab8a-49a9-45db-99a4-a8d9c4d4e326} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5832 -prefsLen 32952 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 5840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {025d1343-70a3-45ae-93a4-dcee5d913e68} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4968 -prefsLen 36845 -prefMapHandle 4864 -prefMapSize 270279 -jsInitHandle 6504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {eb03ec69-2d1d-4291-b0d5-7cb60aac692a} -parentPid 5644 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5644" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity.json

Path C:\Users\Admin\AppData\Local\Fatality\identity.json
Size 161B
SHA256 eb55626994cebe01830b61470735af8031dfefe21450b609b7836c77ee28a46a
MD5 be0cf7364ecb1f669b03638f9df6106c
SHA1 b5aa1391da3184f5f5af114b45763921a8ae1b5d
SHA512 7c45b84afa25533da5192943b6b8c8450fb3c2479debe5d12e04dacc461b3485f1e37fcd9e337a11bc2e2982d9a2d448365093f7863ac2b20e54fc35dfa60f9c
TLSH
T1B3C08C8C00CA0CBEE44D87C4C23CC904E19F538B12C006826E4AABE98E90120B320AEF
MD5 SHA1 SHA512 TLSH

Submit Download

identity.json.part

Path C:\Users\Admin\AppData\Local\Fatality\identity.json.part
Size 161B
SHA256 6e05e94508bafa18cff5dfc49ebb3942f4066ba8115d351e498930ca7e652f9a
MD5 1449397f2a8a715a3474e449e325dfea
SHA1 085c8cc5cd0df7dd284f8a6db1beea1fcf96b4fe
SHA512 d71583c87e9d2270c7fb584f1adf42be974fef01d2493f5c48e6a9c34c59fa1ffdba4350d2c1848a724d8137f846004db48007fa57aab1b0be96fa089b3e3cf3
TLSH
T1AEC08C1ECEC820FEF0820D4148BE822F11FB92D7C01A32B1A8BCBFC9841700C4A8A067
MD5 SHA1 SHA512 TLSH

Submit Download

identity.json.part

Path C:\Users\Admin\AppData\Local\Fatality\identity.json.part
Size 161B
SHA256 3b1fa273160639afb117032a02f2ddef3c5f69904f798af39a8449d8c42e8602
MD5 7f38738496abc6ff93fe742bd377312c
SHA1 ccba781b8651b072d7b942443a07154aa492c46f
SHA512 29c3af468f3dee69520e4cf673d14b43e59729ad16b2bf3e28ed9a5d23e1f1b8997c907320d5e8c7ddebece312799f511745769c940480d8a8281c5f35a4b802
TLSH
T10FC0803F1141863F30A97EE98C3E00495138E18B90C408C15F593275445F5554C4808F
MD5 SHA1 SHA512 TLSH

Submit Download

identity.json.part

Path C:\Users\Admin\AppData\Local\Fatality\identity.json.part
Size 161B
SHA256 a0f3ab982489d9baa995ac17f853b048702466f2245728d073cec354366d8022
MD5 29b64abc7928b923cfd54c73e664d79e
SHA1 2dbcf7231ca7c09aeeb47afeaba2a6be015a9baf
SHA512 7a1785d4fa6b33d8f3fa5f35a7a2db0b75774b3266cac09047dd3f06eb9ed761d0756cb1d51905f584caedb8a03adb554c16ed0b186c6424bdd430e69e0dc267
TLSH
T11EC08CDCC4D01938C3C88F4B083CC9C410DBB003C086E6016A3E81EAEC949342B44A43
MD5 SHA1 SHA512 TLSH

Submit Download

identity.json

Path C:\Users\Admin\AppData\Local\Femboi\identity.json
Size 161B
SHA256 1de2d93294aee2b0948f5191ea163f348b834336495b92a9ebf221e5481acb64
MD5 39cb832ce63eecf02ac9339b59aeb698
SHA1 3e6de4b161f38706e0164c9c0610093c0a47a128
SHA512 9b7d6122299b30dea01138572a7f52df16c04ef915ac6b81af7807191fe1927111d58a8715eb12514b630c5b987f129d43a5e2f544f50093441bb040f3d884ce
TLSH
T15CC0128C02E29D2A27AE0B81E82808CE911B52C2B22002440FCE39EC8A9F4E09A010A7
MD5 SHA1 SHA512 TLSH

Submit Download

cert.pem

Path C:\Users\Admin\AppData\Local\Femboi\neverlose\certs\cert.pem
Size 618B
SHA256 1b268ad5dbc171a35d5e366b145419b79fe248f8afdbce69f347d1c8eb8f957c
MD5 3d8c1f9a34d97b4996ddb951e686bd5a
SHA1 f1bf5db257556ddcd5a048c0de0ec235d245a5bc
SHA512 10264b24bb0206c597f74ef7c323bdf4eccc62c412a906774031e44f60ebad5455ce23b5b640aa1930f7d1894f4b2363af93c3c312d40a319cd067ec4d7c711b
TLSH
T1F0F062D40E2A892414CEC9C9C78F161CD64226D2E78B8E4224EA04816385B1D70BFE0C
MD5 SHA1 SHA512 TLSH

Submit Download

key.pem

Path C:\Users\Admin\AppData\Local\Femboi\neverlose\certs\key.pem
Size 246B
SHA256 b8092ca677e92e703e6ba05876626b3c6ba2244056032ada2776fab5e9d7f461
MD5 95bb7760bf0ef5c4fe11ed7e0901e8d7
SHA1 6eaa5bb5922ab17eda47bf3da8b325ad9f5dd55e
SHA512 de8c62b28b40fb2f727522442f077e35ea2475d1cc313062c45103763cf34f2cbd42f8d64d0a7828506b6e450ba824e1effd533af17045821eef52a3bebdd962
TLSH
T1ECD097820EA44D61C0E6C228080B333F9278CB4332327BE812CB8C073C485B0233C828
MD5 SHA1 SHA512 TLSH

Submit Download

neverlose-server.exe

Path C:\Users\Admin\AppData\Local\Femboi\neverlose\neverlose-server.exe
Size 9.1MB
SHA256 ef453d750f08fef184e35b4d3ba273cbff670db4372054968043e2ef6c3fb9d6
MD5 2c3ed8aa27618cb0ba66e3fd90aa8223
SHA1 ba4dfb025ec6ad8cb9013f789dc7353c8cf16ef8
SHA512 450132d12be0da3edb34fa8f6bb961700a2abd7c4261510d936854c6a1b558b0da00df5cedb3b8a9de865ea18febfa477551d2f96112803e081739b557662030
SSDEEP 98304:6BkjJQFpZHlxp4SEDimzIGfT9yR2CfOCMC+3kEsnDgwBJ74MAQz+bSE/P:6BZFnHS3LQfOCMCOkEsgWyMAQzg
TLSH
T113A65D257B5B84ACC566C470C31B4A239A65B0CB0B35B9FB70CC45383FA9AF81B39759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Femboi\neverlose\nl_cloud\state.json
Size 197B
SHA256 bb273f685923e65721ea6c8d38c27a274e18e2bf52f1ed2a4ac8326db0c00c6e
MD5 b2f2c73e14bc21cff9def80ffc32929d
SHA1 5a3004e4b49aa981c49869cd2b5c109f4813fd5f
SHA512 3d7446e8e0a80fcc1436f98ab14134121c5040a6d71e86b6e156d3f521619029ac8e76ed7fcba39dba6936614d5c7e4459c02a266bf32b3120063946e5d06f8e
TLSH
T17CD02270617A8F214480888440527A4C00DCA087A0460D71B47C2F14C1F83320F0038A
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Local\Femboi\nl_cloud\state.json
Size 195B
SHA256 8f3912d61f68090fc390c6d5a5d05920682552dbfd1d03f9100ffb6dfe0cfcf1
MD5 754df03ec78a472cc3e190bf8b9bc0f0
SHA1 c2d7efe6c5e8a008f1ab82826a39822628d67039
SHA512 7ca08b65499d95212dd0e8899621d12727acaa384a929e2f56ff4846b752aa8d96143b7a0e262e1a5885b86a861a81ebe9c4ac27dbfca464145ce0e46361f339
TLSH
T113D022B4627A8F114480888900127A0800EC208BB04A0C61B5AC2F14C0F83320E0038B
MD5 SHA1 SHA512 TLSH

Submit Download

nl_sidecar.json.part

Path C:\Users\Admin\AppData\Local\Femboi\nl_sidecar.json.part
Size 135B
SHA256 a7050f6de6547f6facb8b53dd52004d265d659aac40144bf4cbc583a895e43db
MD5 2c97e05fabbf72d84725d20020522a8f
SHA1 f680875db6205bcbf2bb7a3bd303fbb04494c4a6
SHA512 ae77f0fc58b2bc7a284117b54ca24444316524e6a26f5a3729f1808fd7f5422efd457805917e41a31922c4717db318d24b646c8ba4060c62350ec77cd7c3f2f7
TLSH
T196C02B206253DF12B8313FCC4B368E4CC025104C30C4DF450ED8C7884D011690842443
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\activity-stream.contile.json
Size 4KB
SHA256 dd6e331b046e36c493d635a88a772037662381966d5c2f005cdad17366e72b07
MD5 b5e06cbd557cc288bb98f7a2c809d9de
SHA1 5d950eb28d6361b1123f79d79d6f28bce8277fb1
SHA512 d555c25240b075fd7877cd84da0931b4e1b05de1113ef6c1d5c466e8e1c2ff32a7bb40d0b12d4c03db680389b996b77b733084c66313d46b17062c847900fee7
SSDEEP 48:YdbAkreDZoyuWMxCpqnioCQ3mqp4JmreDZHSyuN1wDQaRgGjy6T+jiRdQKnqtW7L:TSMMgQ3mXS7SD5/T+mROKnyCc8i0lz
TLSH
T170A1E99FC8B885521771E5FA1D1B3288F017B01ADCF0DEAC72A59C5391AC7BE80D7989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 95681adba5f38e997d7c2bab7af271e349e26c97916fe77134a8ba77d4509a84
MD5 72e3125134315e1bddbeccde3c97f122
SHA1 5bbf84d70fa15098979fee0c39d13eef2fa6d9ed
SHA512 2b843f4e2d2c68c4c627dddb3105244d903b26c1c5c86851c39ec743f5187df6f8d41f80a0816e60fc46eb471409080c67f5626cc0d6c26fdcde3b96052eb2cc
SSDEEP 768:nyVsci3BFyi5gorjUM51P54pUvXZBOYaTg+GMOOr/tFJmVk:yVn2CsgUjUED4p4BOYkBGUtb
TLSH
T15F731AA3A6E872BB1B9137CB1C0FB99B62D20186F34506CCFDEDC91C81CD654523A5B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

10771

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\10771
Size 118B
SHA256 74f1408d3c9b0f8510a591393fc0bff08b03d7f27a57eb1f2e77b3282c31f83f
MD5 dee5e9d50e751dafee8057da055abd94
SHA1 e99221cb98dea5ca87769352d34f40ba7de4acf1
SHA512 9212fb8ff971da05b961e9da0af0d218bcdc211f90c46f0f929da9e8e04a006aa13cf7d500975b78ca86e7bd10b8d30de55d687b51abdba01152f7fbeb260cb5
TLSH
T1B3B092C80722881CD2A69C3E8CBEE468580657B0C9C10E01B8E0964E50A0382A192B91
MD5 SHA1 SHA512 TLSH

Submit Download

1184

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\1184
Size 257KB
SHA256 bdfdb38e1248504d83ac06f47170ec08d5e06066e2841337ebed74a1c0b74658
MD5 7a3912ca52212d301939dfbb88f56a7f
SHA1 f2e2211d86b7ce89bfb381305467053a7884a92a
SHA512 097e1fdc99d9cd2c1ba8983b6c85fdbae3edbcbdfd5e2f73b817904d5fa588a40788585eb765317149503ea00222deafa4675ce9a348af01426e840471911f10
SSDEEP 1536:nYCYPs8yGTjfwSMsSPrymOvkcIXhC0AKIK/tIezbpwLfv3f+GJK8Ct92ZFZWkM1L:oyGTjfwSHmXcScFo/K9G2Zj3Q
TLSH
T1ED44F7F796AC30FB175286DC6C1E72CF72AF8139DB4209DAF86C8148C2C9A651076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3697

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\doomed\3697
Size 52B
SHA256 73e6d01b278a6b1e4b09a92aadf55080604ea53e5ea760049e9962069158b071
MD5 c2c72176164852896b8ae582633e5c18
SHA1 3c9c59eb3403bcec0304a569aba96ced767600db
SHA512 3d4b524a6af4ec1e429baea57ebf4d1ae5dca985bd72eac35f172a1e5f5eb5af21fc731d3a76b27d78497e87ed285eb3320c589ac827c13dcc62084cbf0bb64a
TLSH
T17F9002444371D51CD46480B10C55C0B408143D7184800222B8D15B991A121D30040904
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 bc45462c91357621d066eb8c593196074b3129a49edf5db233226e75aafa080d
MD5 149a02d8d435a1cdb739812947f47818
SHA1 42dc4009da977d2de80c82340a7de316d0dacfd4
SHA512 8a77ce70fc5146f9a574d76eb75e958a8dd8ae9ae482ad008a9add2eb3ed6e5723f2d4877fb4a670b3a0e5dabe9aea2e89f86f29be7c1a88c9f4d539d3be55ed
SSDEEP 384:HalwSiO024YsWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAdgL+4jgS+49:6l8ZYsWTToXJWTTogB7S/AmVAf+hRMWw
TLSH
T1D8727E7D8F013CAC2657D0E8C8B683558C1CB3A7DFF5C06D25583E09C984A6A71FA85E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 fdcc7b4ce20581b92eb09015f4da44f51be433f00fc9ff5a17d6b1bdd9e0b691
MD5 aa419ccf4fddcc2f98ad2e3b95c3dcaf
SHA1 227925f740b6fb3ae72fa614f81d8bf72acc5809
SHA512 5e65c7edf7542d62ad5c47d053aa99c1e906a11160fd3e607f9d7a85413652523e2bf0c005f6090c46c066c82f4cd7fa4270db9978a4353e804b2ade0949ac7c
SSDEEP 3072:j3lF6gsDGtz20fEEeNZMMoxqaBMpv3xnXwY8ex:pFvrSCbeE9qa4Gw
TLSH
T12BA3AEF6DFA2897D55FFD42C9BC1883EFD262400B3A7200DC863635065C6BB876B9648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 cddd86264835c7b2654a2367a43279257208c31dbe08e30a05c33ebe4a194f56
MD5 708edfdd579f2d67aa9026bfd698fd01
SHA1 1d3e93c2c335114decd8a753d5425bac96c43952
SHA512 731fb255b4080a80a93f0df3b80a328f7f030a00b7de0aebfb159084e5c0f3efd6c92cb4dafb633ff99071bc098dab474f4d1bf708b8741cfc95cec2439d8266
SSDEEP 3072:X3lF6gsDGtkx7SrRgUt2oxqaBMpv3xnXwY8eF:FFvrGIRg4qa4GM
TLSH
T1E7B3AFF6DFA2C97D55FFD42C6BC2893EFD26240473A7200DC823675061C6BA876B9648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 3KB
SHA256 012fc53259459d88a9bab06547068eb4c6c930b37c1c84ce92a7f50f7651712a
MD5 b6dbd155d46f5cb44cc6471a21878e70
SHA1 538d3e45bdf15189d4818d88aeae0b1737c29c32
SHA512 6fc128cbc16bb86bbd6e40e3873567a0871c1df60e9ac7ffc8ff3033bd6ecce4b030feb4f10b80d17df940173375d02bbc1f2cf88b85c81ccd564e8baac7ebc0
TLSH
T14961E35766ED2209A6F29B61ADF38422DA37BC561A35AD4D6488C60D0CEEA00DC24F73
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 2KB
SHA256 b18195f2759f2531fd91200d7165f58e7fbc52b32c35129f54ed2b7ebe2b4775
MD5 64daa9c60ad16974a2bad34ce7043cdd
SHA1 cd24d68d4183cebb532307b180e2c1fb43012ab7
SHA512 707ee63cbd2ee88f55a830ad2d726295e438ec5ec86e3122a187c658d7d1fbb863272594d9c331449377a5a37fdc51679f3b559fc0375c911194e09ecc45ff6f
TLSH
T17641D45766ED1209A7F39B61ADF38422DA37BC561A35AD4D6488C64D0CEEE00DC24F73
MD5 SHA1 SHA512 TLSH

Submit Download

avatar.png

Path C:\Users\Admin\AppData\Local\Temp\neverlose\avatar.png
Size 414KB
SHA256 7ec076af3f3a63c5b06dc6e0ab1bda7b54c7d54bd4cda3afb1677af24763ecef
MD5 2665142cbe4216e65638989c2901afa6
SHA1 8e43e691422b4bdbca1b917839ad304ed75f36fb
SHA512 9ad878349f7a19d555c3d96484e8d2cfe2ca2e4a3467f7655302492c7ceac48e6dc611852b6699957e5333a3a3c5ed595d161e6a8f7784e01b5f4b04a187b880
SSDEEP 12288:RbnscfS1NtKPCvRB5yGE8HNJI+Hl8Is0Ds4R+whWN:hnbGWKJTy+HNJfHGIdDnR+kWN
TLSH
T15B9423A5101A8E53993E0F428E47F1239F6271E0A3B670BDC5EB595C812E4E763BD31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13800a45-b0be-4145-a729-85fcf140b382.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\13800a45-b0be-4145-a729-85fcf140b382.tmp
Size 15KB
SHA256 abcd9ae6557815d8580d1b64bce465b397b156b75c091030473050df00ee95f2
MD5 7d96c8c864484241778aa541dfa868c5
SHA1 63f65465de7645f7cc84b38b497f4eb6dd3142b5
SHA512 ea82b9d529bac12f6515534cb3c08af299c5890e69aadeac2e9a49aed995e1ada1aba733204a8efad32c8e2c6df3e4dc5cebc1ea93a55f9234b9f5812937086e
SSDEEP 384:p+aQikB+z/xvxjg/qhEJNBSh2BLH24xBi9zU:U/UxvxjgC+7DxgFU
TLSH
T181729E3B982A3E2795F3D509BE5D179BCBB594B390C16E784AEC4F0D06C73A90341D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36f341c0-6378-4735-bdf3-07d7fa5b1aaa.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\36f341c0-6378-4735-bdf3-07d7fa5b1aaa.tmp
Size 15KB
SHA256 5a9f422c15470c329ee29398f4858948f8672624f0d595081783cd347a9ec0d4
MD5 984688d049489fdf931ecfec4e608877
SHA1 b93b8b7431ca1410b427ce34929cb2c06716c747
SHA512 c2886c2c68d5c2a93afcca8ec143139bfbb64d1a457eefe88421ff6b4b5e63b9dd9b33566f24b07536384ad2b911c3d25b9e617c3696a5b8d71d385a362dfe2a
SSDEEP 384:u+aQikB+z/xvxjg/qhEJNlh2/LH24xBi9zU:5/UxvxjgC++DxgFU
TLSH
T10E729F3B582A3E2695F3D509BE9D179BCBB594B390C16E784AEC4F0D06C73A90341D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f54208d-1771-48f9-b1b9-863d87cbd965.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\3f54208d-1771-48f9-b1b9-863d87cbd965.tmp
Size 3KB
SHA256 c655cd21c06f4564bca0d24c914de231377bb4a3f3528156e11fa0fc5dd00324
MD5 37fe82e0b77817e085b21e6148c6e249
SHA1 fd492044508affcb0616e63ea963e228c9787c36
SHA512 e126fe95cca0fcf79c88a815eb0ffef5f3063f8a7e0990f100988f5eeac67f2a4f5a13d2523b6727b91970f7d82e5c5060d5fd5919b476579120793a0e1a4373
TLSH
T1B261C637A825A97B8DF28604BD863B22BBA29067E5853F99DAEC0F0C11D739D1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

7e5b7cd6-0089-41a5-9a6a-47a54372b232.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\7e5b7cd6-0089-41a5-9a6a-47a54372b232.tmp
Size 2KB
SHA256 0c956a00eaba648208bdfa8e8468fa168f398d40e991b1c4bd999eedd152d397
MD5 7293b563c87ae314b379c55265fb88e4
SHA1 36ef89c23d64cba745738f3ab1116a19dcb354d1
SHA512 60454fb1ae86807cc4df65f63813ecb008f601314d410e96e6bb9fe81a991d7d9c0069cfedf8cf7fc77a6a3f68526d21d6fc293f06b26c0b3bf16f8e92adebff
TLSH
T1AD51A733AC166B77C4F24248BE4A7B33DE7690E6AA551F519ADC070C11DB66E2341C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b0dab6d1b1a11e1de9cedb1b5237acd803986889305b9fe0aec42022391a5506
MD5 fab5aa0225061f56bd860fb1c03deb78
SHA1 41fd4948bb3745ca41610727ede617b014639586
SHA512 afa32a4c0da2bbf0e538d2ae545f8a03984fb378a8950935c0f854092cb81befb9b75e0a42e22d02a498312d4ca3f788395b2f303e75559dd21f9383ce91fb2c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 590f40f9f86bda001c9556e64a360192baabcbeded41e8e7631d6ebddc322cc3
MD5 aee55ad00cf05e22b4c1c22d80ddea9f
SHA1 344d9463f8953a4fc8fe7b2a1dc118d2c41d4392
SHA512 be1f9d097a28ec0591fe19cbe0e3dd5f7d782cdfc9bae1d50b70a7596fbbe8907c0b7ad6f2c06db75e803a54272015864432bd52ddda6eff1060a7bed194f4fb
TLSH
T16CD0121F33421534C0102133001271090448C50B80064111A42C851D6E840544A02456
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2837d214-31eb-4346-a417-57d386279b27.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\2837d214-31eb-4346-a417-57d386279b27.tmp
Size 6KB
SHA256 3d4a87000ece67aeedc385734ebd57fe81080ad4aabf7d91c6fc733558f62059
MD5 a543c0f6880f5ef169d0387b6c8ce46b
SHA1 3295dba045da95d7953e6733e8bd7c7cbcf06fbc
SHA512 e87d9ce0aa9b9bd9bfe4e44c1428cb8216662c7a9235746b7b241ac04a716ad336cd5c15f1b51d6111f3146ddf6924e455c3d92cc94cdeb17f1e62f55383914f
SSDEEP 96:stW/dfpzyGzb9jkco5h16ZbvsXR8/x+6MhmuectARvGjeE5K+gxUl28XM7C7K:stOVJ7toivsXI+FRAR+jxkqG0K
TLSH
T1E8D1B7035A25687B8CC7E11DFA35BB53E2F6603266A41E48E7FC891C18DB6DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6008fd21-fe36-481c-8e60-ac4e9f2504ec.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\6008fd21-fe36-481c-8e60-ac4e9f2504ec.tmp
Size 6KB
SHA256 c29bc48b47bcf3e5f229f113c58a2abf21a75498936eecc3bda73b2a2b8a6f9d
MD5 d0ae3c7b4febd344ea827c6a3311744d
SHA1 0413ee357103f638b42254fff5e320186bc72902
SHA512 b47bc312e71ff5d448c6914bf0470c9ed9fa63815cd2faa580bcff428651c2bcbcbc000706b8ea725d62b10c62082654c06215a4e85c2498f1a38aec85b1f1a1
SSDEEP 96:stW/dfpzzzb9jkco5h16ZbvsXR8/x+6MhmuectkZ4MFNjeE5K+gVUl28XM7C7K:stOVJVtoivsXI+FRkZ42jxkiG0K
TLSH
T128D1A7035A2469BB8CC7E559FA35BA53E2F5603274D51E48E7FC851C18D76DD230390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 37556972f48289ef2bb19953da56b017299e1c7017e69638dffe09c2a794aeb9
MD5 b0b8f33a5c596ce763b33689e1ef55a8
SHA1 b4faa8daac8555ec0d6043d08972ad89f92af76f
SHA512 4cf3fccd8005029b85f00139ece5b9a9d1e996f8be9f5b615095d8486d1ce6348493ae3ef0b03d53b224e08e62cf3fcaa56c8d61534e00682fcbd4a9fe8e9167
TLSH
T14BC0923652B00008DF30823E01860854337D6D214F134F4D608420AA7EF678F9962A32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b2ed28d980d906702ecab049ec591917fbccc16817669bdc23de009dc68d08ef
MD5 af9bd5791155de2138203301e4d1debf
SHA1 a13719e6023fc1d00ef0af54118edadc28271c44
SHA512 9d418f8d89c6026e59b132e90cf805ab2ee708a79c4227c8446dfc85b9b9040764d0184c54b5c28097bf8fa6b5ada3c399ef355f243c9baf5036dbb7d9d04379
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3d204608-479e-44ad-b6f8-12ca37c97c58.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Network\3d204608-479e-44ad-b6f8-12ca37c97c58.tmp
Size 2KB
SHA256 be2882fc822868d2c9c5769088714e1cb6553df3da6a6e92007ed4f9f2b8ca10
MD5 499c83245f5245b3e662b009cd1fd712
SHA1 eec179a364ce54271bd0ffead1238135222693f7
SHA512 60483049998f93a8c6acd4464076a16458b11f8507d256594873681ed3da48376c9c1bff78ee2cf57cb73206a02675e1d5e0c3a48e5f0de6f7721a0f35b02708
TLSH
T17951B9B5C3E4839ED95116F81A652D27CE6E06280359389AC5D9EBCFA3F01B0E34154E
MD5 SHA1 SHA512 TLSH

Submit Download

51afb7e1-afeb-49ae-8fcb-7e836cefd65d.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Network\51afb7e1-afeb-49ae-8fcb-7e836cefd65d.tmp
Size 521B
SHA256 9d692951b0bd1988a032f7b818e8a5bc8b735bbc48e9f10210ead1a9c0f5c037
MD5 6ab7e21894a21b2d2ad20f850a52b9d7
SHA1 85f148baabdb1c0f7cfa021e628e71c8fb5e3d2d
SHA512 c962f634df941084c7f44524f2736ea8f1475fc2c169a7a60fa3bca26c6750117b9f6676fd96e2acfd113a9fd27c7a515c7e0cd0e6552cd6d95c25c7e11f08a6
TLSH
T1D7F0C9A200BAF873202C097B1FA87C092A37B0322145A4E5EA8B857CB0816F31B06472
MD5 SHA1 SHA512 TLSH

Submit Download

7d20a4cb-1e65-4c5c-b2f8-0fa986f15d27.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Network\7d20a4cb-1e65-4c5c-b2f8-0fa986f15d27.tmp
Size 521B
SHA256 1731680da7519df49ff0d841e1fff115fe759713baba7b6b3c47b98eb268274e
MD5 9a3f9ba4a3154a1fc16f845d68c61b75
SHA1 56a23ceba866643b03539ce72cc142540096fabf
SHA512 68b117b74356dbfd693e837dc09ef3fe212d9eb823bc856657f3d3be704038f76b74f28288fdd313351e70b491fb73b9b74913df471ea1867a5b348312f3d239
TLSH
T196F059A240BAF873206C096B4FA47D195A37B5322154A4E5EA8B857CB094AF35B06472
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 50c6496d52a4f3884082b8b1d8d766ecab50ce58bbad4df088c647d2ec93da4e
MD5 5692762c9bebc34b68c8fa40e8fec984
SHA1 a17f35b69855c0490aa1da36f875802ec00a825b
SHA512 1beeaaeb8102564de249f2f0928b408e2aa03d38e56f5a52b7551ee65add217a22fa6e213a4395b6b4e59cb72f9cab48f57ec06c8e69486be18f222af78bb4d7
TLSH
T1ADF059A341BAF873206C49270FA87D054F37A5322150A4E9EB8B857CB080AF36B06872
MD5 SHA1 SHA512 TLSH

Submit Download

ea14eb03-c3d6-480d-9002-79c0d31a1fa8.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Network\ea14eb03-c3d6-480d-9002-79c0d31a1fa8.tmp
Size 521B
SHA256 4f15805ef2738079f75457139d09b7c9ba4a878da7731db946bb06cd18195d24
MD5 cf8f9b9959640e95a9edbb807dd9cd52
SHA1 4fe63ea474347f0ebc4c0913cef6bff9f904efbd
SHA512 727c6c7e3629c035e6c6b747148b4aca6c0a46cfe094410663e3a77d38defffebd5f41fd78b2def745acf31800723e6afade6973e8dbda3c3b44088677b34bc3
TLSH
T173F059A640BFF873206C0A675FA87D054A37A5322150A4E5EA9B897D70916F35B06472
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

be8bdf50-2152-4d65-9b0f-99f9970c37fa.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Default\be8bdf50-2152-4d65-9b0f-99f9970c37fa.tmp
Size 6KB
SHA256 451688e58a674e5c2ea629e1aea5bab382bf600f7cd78c41665c5fa3713ccf13
MD5 0272c35aafea18240688aea44c726779
SHA1 666c68a04489a6149861dfa361717e58e5ab66ba
SHA512 a10159e5bc904007595248b6ac7a73634f91595d6a0bea71040f84d445da651c44035c45f7549bead60aa7ec70c0cab797b8850991d9e96d3bd80bc5d6d5f88e
SSDEEP 96:stW/dfpzzzb9jkco5h16Zbvs7/x+6MhmuectkZ4MFNjeE5K+g7l28XM7C7K:stOVJVtoivsV+FRkZ42jxkLG0K
TLSH
T185D1B8025E2479BB8CC6E149FA25BA53E2F6A03270D51E48E7FC852C18D76DD2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\GrShaderCache\data_3
Size 4.0MB
SHA256 5d118450192ed9c648700e109592dfc560abdf78fe266237e4341ceb819a4da2
MD5 223a380ba10b9c3512a44302b3ad947f
SHA1 f39a692bfff923e72f6ecadef1cb062249118208
SHA512 d877129e4565a6bc670b68d6e04939c4a64ea9f687addb43879d4ba286e1fae678c4964dd98c3b68d03edb07cf7510016c36402d096a7b6d8df25ca752311f57
SSDEEP 96:gpRSjtO3Flb1QxEjXIQ2DsnRgos02z01qxni9K3Bxv2KG3:9OVlb+xEjXIrDsRgQ2gmikm
TLSH
T11A16CE147A408412DE1AB13C4D8787466379ECD79E85970B704CB71A0E371AB4BB6DD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\Local State
Size 1KB
SHA256 ab6bc1c6df099ab396c8042121f48f29843e6aafa9f89987639d2e9c3f0ebd57
MD5 cd90f97445038658f212e5638aa92f9a
SHA1 5c2f8693ae60466f99e6054c1434c13147186f35
SHA512 bf1535c22e0a364b90f2864aa71e4a772c4043ea01e2f4f296dc29b06617f1ea75fda287c5b4efed1979b89e6256970c9dfc42e63e50d98973695667ed22bff2
TLSH
T1EB21E7B3D8161B32ECC102496B13BB772E6190BFD2004F046ADD470E11AB26EA672D36
MD5 SHA1 SHA512 TLSH

Submit Download

c9b1a4fe-5e04-4c81-8b0a-e500844099ad.tmp

Path C:\Users\Admin\AppData\Local\gamesense_loader\webview2_data\EBWebView\c9b1a4fe-5e04-4c81-8b0a-e500844099ad.tmp
Size 15KB
SHA256 74310a057a741ec216ca282b68ae045e65ba0ed43f7e5e1f5ff117f0d8785fac
MD5 71f798c5b28046047d4c6b30e6dd789b
SHA1 3e8381cede0e02d06e0caea859282af856e5900c
SHA512 0dae226720a882e946fe87f98237a51835df0d4105b7b12026fc03f1e3f67c2994d468a6061fc054a40f0f351ce1a7476521d61e7dee2c843b2d58863d99e930
SSDEEP 384:3+aQikB+z/xvxjg/qhEwNBSh2BLH24xBi9zU:G/UxvxjgC+KDxgFU
TLSH
T153729E3B98293E2795F3E509BE9D179BCBB594B390C16D784AEC5F0D06C73A90381D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\addonStartup.json.lz4
Size 4KB
SHA256 235bd35b66d51d6f85707b91afc5b00c4ba65ef18dbd4f962d93e1bc40eaa067
MD5 6e86ef52704b8eb1b44cc5213eb9f971
SHA1 b38260cbb4f21ddea21a2c4f9aafcae4381b885e
SHA512 9517ac9cf84e22850a03dabf75c0c00000653000760be8dba00d19fe9f8893e9fa01e2ff82da73bdfc8a601d2c92c9d7d170ea93ac4cf45a10f1eaf58ca7a048
SSDEEP 96:Nbd544sHNw6M2xWmhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:Nbzv52xRhD8rGvm6ApwnHUuhN
TLSH
T136A17D7AD181EFA5FE32C04288E93FB2EAAA9B7414A9C4D0F16F71294C64E735705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 eeb9f69f632d92ba64fb370713a156c841a97994b99fd49f5d7a5c17174696fa
MD5 4c4597226b23b9b555d61fcc6fc72988
SHA1 cae6e64f29b4bb54010a443e79b86bcd721b6b2a
SHA512 e7df1d756c69e1738408c915d3ddebc909c404d45c2401948f68c1992c0827b4bf282559e73ed1ba6f2cb7f1d38978239b0dfd927ad99745086815f761e429af
SSDEEP 384:bd66Joz/zgC1jMbolPkyjywCiExvt/ar3Gcm+uLpJG1tKWhQO6blbYIma:01OLNwlr3Gcm+ustKWhQO6blb5ma
TLSH
T1ECD20044FB2E913FD41552BBDCA507102F79B88A59192FA73A4C64286C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 77cab3a502f0fe1a75d0baf574902e2d938864809119cd8c8a8019a661c3ba47
MD5 6ee584af1373ccac74b3e962c18001db
SHA1 b97db3bcbe90ced9972e79af93b32c28810a1902
SHA512 77cbfcee1916d3bce9b89cb1f5253f72fc4bfe646f903670bb3dfebfd8870d07a94ac82fba258e8ba204cb3564230469bbdfee8167b6e4ba25c3c32a9b7f3494
SSDEEP 192:91d66JoztdzgCl6mc0dkOv5zbo7pZgCkyjMcD:bd66Joz/zgC1jdbo9ZPkyjx
TLSH
T18FE10F64E629963BC414437BCCA61F810F39389B9C4E3F29319C74192D5B2DD7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 731386648f43a345309164d5d31a317046b7fa1ac576b9a1d6ea6ac84ea34c00
MD5 4512e2c541a5ff348dcceabcd201864e
SHA1 365edfdc0f37f23e00fbd880298ce6ef6881be7a
SHA512 7ccb4edc3f8e6006295ebba7b1325530815e8804d59bc9294ef74c21458fbe9bed787344e87b6f69120e54eed05bc0f0c2eddfc35fa0ac9365cfe4333998cca5
SSDEEP 192:/Ov5zbo7pZgCkyj4c41d66JoztdzgCl6mc0d:wbo9ZPkyjUd66Joz/zgC1j
TLSH
T14AE10F64E628963BC414437BCCA61F410F39389B9C4E3F2975AD74082D5B2DD3A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 9cbf195eb70960d5c40c1dca6af2eb907e7838459ee1cd958ffddf31754dea30
MD5 2fad7a5f6ee5b6f31f75f178b6f1c4e4
SHA1 bb91a2efd8ba9af0e8a33dfae8faff8ca8947751
SHA512 0e805f013ab131e7d776165f7b39d03ba83736bcf74ad57606a1a893299d0bfa53999d1c0c6c902d2e00294f119d6a7ff21d3ae36d2137f858cb64b11c285ad4
SSDEEP 384:HboKPkyj2d66Joz/zgC1j7wCiExvt/ar3Gcm+uLpJG1tKWhQO6blbYI:7gC1twlr3Gcm+ustKWhQO6blb5
TLSH
T142D2F044FB2A953FD41552BBDCA50B002F79B88A59192FA73A4C642C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4f293cb4055f033aba0eb02844ed8eeaedba5003c060800d420ec06730bee42a
MD5 4a646a0f8d7239f88cb7d2d08aafa7f6
SHA1 b5e17092d5eb476fea455d5eb8a49860ab3b5a10
SHA512 deef5e88fde374cf4c4c62afd60cea7f8a5f33e3e089e0bc1cf48d393bc2a0acb43ce40fb1e83769d5bfec103029ed26987ae133dc3e578e5151234706631fe5
TLSH
T1AE21AC6C39B94D2A5CC7FA9D7462018E53444F4B148F1C4B4D42EE8CCD91BE933AE439
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\events\events
Size 2KB
SHA256 2617a4e4ee79fc155ded3b623f9209a4728020dd81b75ec756832eeb44a4e318
MD5 9a3dcda4147f9a40769b5aa15258964c
SHA1 b56ea106adf02f0ef578a7c783619d1201ca2028
SHA512 a1c8a4ec4ec074754be080b2eecbf7bd5c29381bca38e01f69976216caf24fee0f6cc2609e5bcf2755cffae8c17bd61c6d4932ef79cf918e2c38ee3633704260
TLSH
T1BB419C1C76A64D3A6887E6DDF811028D57454B4264CB298B4DC7EE4CCC52BA9329F43D
MD5 SHA1 SHA512 TLSH

Submit Download

60d3af08-7dcd-4fe4-aeb5-d7e413eeeafc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\60d3af08-7dcd-4fe4-aeb5-d7e413eeeafc
Size 2KB
SHA256 451726318594614b5e087c6d207937e3ef26999f8322344d4b81204830c9fea5
MD5 14305d513c4cd3b3d7438403fd768878
SHA1 de77dfc6f0e8535c224b871c5687d9833a710511
SHA512 60624676ca336adf47bfbd6790170cea02a5c2984826e6a0b24c8004827a8d722e574246551981600a20ce192a26edce42fe8bce5a9bd91f7453617dc2da9f79
TLSH
T1DB41732C75B89E378CCAE15D849223CE57648E0340C21C832E41FF0C8ED6A9DB36B42B
MD5 SHA1 SHA512 TLSH

Submit Download

6822f880-9f69-4d87-a8be-3872252c24bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\6822f880-9f69-4d87-a8be-3872252c24bd
Size 16KB
SHA256 7a8a7aed0373f1b8008a1bb0c538c91b75bceb19576675f34a923e3a275632a1
MD5 04d91138bc5b7d95c11b2361d467a458
SHA1 374a7873eb7a1bc6f7dcbb5b868de98ec7e4f9f2
SHA512 b80cec762f37a7d1d18fb9d35f52df941c94f9f6a975265e1f670dced5e953f49e20a0823301c3f42cdbcdcaa74f95d090959e9131bd51bbe4a8b945852d22ec
SSDEEP 192:yzCKz1BuTuvqPanHdk8FB/E1Ywu/VpSWbzx5Jci+Bjxt4KsC/Fv0OlJ7:ymKzTuTMlFF9l/VpSWbl5f+d0A
TLSH
T1F772DA556870557A9291E37994FC7FC3E6F528CB4C418FCE8BE4BD082DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7db14338-c048-4f5f-aead-bd6425f8ba13

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\7db14338-c048-4f5f-aead-bd6425f8ba13
Size 883B
SHA256 387460ff21f9673b7f0bed613e42bd45ec762dbeda6d315cd07126319b2d5ea3
MD5 210292b385cff7c4e42ab657ed99b18f
SHA1 2c9930a6aea844fff716645fb1a24da40542dc59
SHA512 9c0b8709047c2d2f55009a127f8a49931526e68e98966ba8f5f48108310db4b8c82fe21d2a8827cc01303591f5dea1e81fe0dc3696fc4278fc50453920a3edfb
TLSH
T1D51123509632B5B3CC6CC34B886537834FF4742384C555183EA55E040DFEA1D9B6734B
MD5 SHA1 SHA512 TLSH

Submit Download

88ca10a0-791e-41e4-9074-2e6cacb51945

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\88ca10a0-791e-41e4-9074-2e6cacb51945
Size 235B
SHA256 9aa0bdaa0d2f2f50aebedfc22646a9a132578a2c7b3e3dccfe78018d4907f29b
MD5 39cfb0dd602be5240dee1fa76d888b0a
SHA1 41c56e200dc7f39305a37d7357b9d220b875ccfb
SHA512 d3f9956be4e4346e1a2561104fa12abc0a8e3003f4f35171d97544281cbf9fe9b086a0c5dc71224489eeb9f521c4d5184d06c0df673d4388cf3357cddb04ee16
TLSH
T16DD097C028A8231D08058F07F0E069C330864C3320B56820C5704978CDFEDC61231816
MD5 SHA1 SHA512 TLSH

Submit Download

c6db9bdc-410e-4f3f-a088-986476ef5b2b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\c6db9bdc-410e-4f3f-a088-986476ef5b2b
Size 235B
SHA256 d3c2b9048c0be55c9f1b36c0560250625d9154bb1d4687e923026626e9a9cc02
MD5 5d7ac5a0263300008e1338419f3892ed
SHA1 6c64eb6f193312b1694b5311dc7bfd4a85eaf40c
SHA512 f7c8068880b7082de6346e2476a0ea181e18ee6df2ae6a0688270da634f8caef865c278349c108848b9e04c9864bff604a572214e9f7523f9e35b2086dd22733
TLSH
T110D097C01598ABAC08100F23F0E0AAC231A88C3314746850CF624078CDFE9C8815184B
MD5 SHA1 SHA512 TLSH

Submit Download

e9bd71a8-a931-4209-909f-69026bb788ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\e9bd71a8-a931-4209-909f-69026bb788ae
Size 867B
SHA256 d6e1195c276de57c8e7156b0260d19d0eeaf1c77a548ba9e80022efb85c49e9d
MD5 f35af0e150c84bd2a601fee8d760fdf1
SHA1 edac14d7647fffe1e6b7a1badba7d59f53a24634
SHA512 e69eb4794f97a9287aa5abf9c1ae2ce318df606da14e70a306f8bc1a784fedbe7c4dcd48f076ff0c9dca0667e303c71dbae2a3b1cdf5aed9d95ccb4f82d7e571
TLSH
T19011E3E186127023AC38D20FD595772752D6A43384CD41097EFC5D250DFF53F912271A
MD5 SHA1 SHA512 TLSH

Submit Download

f623e086-24f4-45d4-8748-a98dc1e019c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\datareporting\glean\pending_pings\f623e086-24f4-45d4-8748-a98dc1e019c2
Size 886B
SHA256 d1b33eea728d6ea12afc865dd3df19e9ab6df7d5307550ffa796f281d093003f
MD5 d4bc3711b6d29d0603f78c9d9706a351
SHA1 32f664b510f600e724eddf63b548e8f48a9d1626
SHA512 e59cc0a8f389127397615c2d7ed99255e7b3a59a47b75540322ba02448b5c32c2135ec7bbec5ab2c011f15e9066936413b0162e67b2a75c184d0714780be5457
TLSH
T1C61100409625B9B3CC28C39B88A53B838BF4702390CA5D187EA46E084DEE52EA717317
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\extension-preferences.json
Size 942B
SHA256 75556cb7ef37fd52a4979f0868544a1336d4ded4de77bb9303aa2fed17930d1a
MD5 3e21ab593e5cf6d2ae8ef31f7dda93f3
SHA1 ea5bf6d1dbba6c135c87bff1f016c92cf1e740a0
SHA512 59a0359371b7f97e477a32f0ea45ae4c526c0115abe43ac305343d97d1d63d076d8dae75606366a486523bcfb54d1fcb20c953c9bef1c71ba3d91a80c688b649
TLSH
T1C211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\extensions.json
Size 14KB
SHA256 4873881fe2332ec0b4dd2cae4631ff6bc3561b3f06f2d84fc6755dbecb881570
MD5 6f3de28350daae55cbb5ddbc97d75125
SHA1 603b62d92c2c65f2fe6b030be36830b5877bc2f4
SHA512 dd6bc41e5519213d0c929e33a431ecd70a262822443e0c5f98764c8afe564307df7518183f3f2162e2a90495c93bec6ada62c4c06133c8d498a1b948b88f2769
SSDEEP 384:IkI4v6Umldv28dhWa94zx96oML4HtWL4PIgL4HtL4HtL4HC:fI4iRfLXX476F4Nc4V4N4N4i
TLSH
T1D162321545149EB8298FA78BAA367E02C37D473B60445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs-1.js
Size 6KB
SHA256 ddda566d5e3a3d7390cca19efaf414e03a50b87b7cc8583186adef6ff88d53d7
MD5 b3e8934c04f073d52a1f32e5b23cd469
SHA1 899db3403253fd4611a7e01d9f9e0b3d2889f2d4
SHA512 409fe6529bbb1a1d37904f79674fd8912751038ad59ba4a15949572f3537a309307d77a15a0c110454d01be9be61eb27415b4450360b8dbb2de6e96c2eff0852
SSDEEP 96:xHPUTUZqGqLfh+p1zSESSlXdv9jdnlHDU/IBRcvBw88u8L4cnABKH:F0RLfh+plSSxDU/SRcvBw88d
TLSH
T1D8E1107891088F7F64B677AC6C6888316AB2013B7BBF68D750B55485050CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
Size 6KB
SHA256 d48706ee6c6bb29018731985f7d5a2e8e006d743325f80d621cbb997e097a74e
MD5 c2a4f4e04055af9e625f4a027d3d5130
SHA1 08e9b276491c8985a12d60a6668aacd91f8ca0dd
SHA512 45f399a1df561137d3bbf390d286366a5b121a4c2630ff289bfb263743999387a433cd151735076dc996421b594edb31978c4e5263f2d31a7ed969fda6339181
SSDEEP 96:xHPUTUZqGqLfhnj1zSM2SSlXdv9jzMnnlHDU/IBRcvBw88u8L4cnABKH:F0RLfhnjd2SSpeDU/SRcvBw88d
TLSH
T132E1317891488F7F74B677AC6C6888316AB2013BB7BF68D750B55485050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
Size 8KB
SHA256 c010d33bd896029126fb86d93cc6f4216bfced9f678fa82284908d7e27bf1dcc
MD5 e0c17e18c075c8dcd0cb70f11a1d7bee
SHA1 4adf68a2a788bd59a869c280f4be4c78ee8a7bf4
SHA512 e3e28680197591aa4cc58c9b606ba60abf97a83b5fe0bec79fda114136c387c1148e28cfd88b847c1c6adc59f2c1e493e8e642cadedc5ef85803dd56f90b7d74
SSDEEP 96:xHPVTUZqGqLfx+pObzSESSlXdv9jdnlHDU/IBRcyBw888l28L4cnABKOGS:FxRLfx+puSSxDU/SRcyBw88ke
TLSH
T1B8021D38A104CF7F64B276BDAC2449715A72013BBBBF68D650B954C5051CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\prefs.js
Size 7KB
SHA256 731769b4bba0091c85250754e60144d018ae6966515ff52f6723c566238e9253
MD5 86a3dea13b4c3617b4535c8e3d3c792e
SHA1 c24a39e2ba97ec1a9c4b10de8272379c5a7397c9
SHA512 7f9c5c5bf49e19e139d205046726ceeb70d82ac46fb7b8f08f6826ebc879a83249a7431bcce39b985ebceb0b5692bedcac4df58909e71b6c78dd17f8eedee1f5
SSDEEP 96:xHPUTUZqGqLfh+pObzSESSlXdv9jdnlHDU/IBRcvBw88u8L4cnABKOGS:F0RLfh+puSSxDU/SRcvBw88m
TLSH
T17EE1217891088F7F64B677AC6C6888315AB2013B7BBF68D750B554C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionstore-backups\recovery.jsonlz4
Size 880B
SHA256 169bc245cfa0ad6744a9073d547768b59ce681c2ca0e80bb63d83b10b659a66f
MD5 a43b7d81cfb740f50e0a0b4bb6eb0b2d
SHA1 ff0e403873f14dadb1a46b8b9791567fe46d9025
SHA512 10ca3c4939eab5faabd906ab0ae0fefe050d768919f473bc51bc8a101b3ee84b364aa9a8c4807ef35f8c8f2c7c038115691ff67e3eed9cd6a5abcb7fbbeecc5f
TLSH
T1681144C1EE56343B2E70800634875AB6879920661AA4C8D0F18C558006B868AAB9A2CA
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 e3d98c06f17c0598948f4b0e8de267024d94c2cd6ba2c2b4a0be039882a24c7c
MD5 758e1e249e96efc6e802c9f12f6fd5e9
SHA1 b165fee8bda2526afe9832f3b5f20e932d5893c7
SHA512 1639af2b84f3b56af492e5e59de659bc2ebbf85c5c3c9d20cb5c31c7ae137dcd2c27ef3ca2ff5cfc4863cff460662e2aafd1225a8361db23848ad962942948fe
TLSH
T1E421EAC6AE2F3D7511D6C04AD0C51FE0FB83446045BCE4D0C4AA971201C452F7BDE345
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\sessionstore.jsonlz4
Size 929B
SHA256 39059c7dd84461e2200d8def4a173ed19f9f6a814bc49ece0c75c75eadb86c7c
MD5 1a33a57370f1cee828c7b46dbe80027a
SHA1 a6bbd7fe136b5fb80f86e8c3f0957af6df464d68
SHA512 0c8c4342e4b764fa7c2b4758b68e398ad5e33b94b72cf00b7ab584092311f6d6eb39c13d7d16ecc3b6dad14a7b53b9ac29cf9905367e4de61759fc74be05bf9a
TLSH
T1BD1154C2FF52B4762B30C10660875EA182DC201607E484C0E14C994143EC64E6AEF287
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.5MB
SHA256 7e7d59ee71ea873bc61a6fc3c1c3780f504bebbd703e86ad21b3e7986bea1e5e
MD5 efb72c3fde2deba78287b73fad0a0df6
SHA1 4b8b06a48afb352c4b9e8ca9dbdab467acaa9af6
SHA512 6b7d88282c783fe3493a510151e8719009d64f706dc5910317c4d7db433d5c9d9cb522b7d5663c5bfc58a95b41f6d6720dafed77db5c64ae96a0314ba733dbe6
SSDEEP 49152:z9yWkPn/X1ce8y2D3/Yz3liR4ls1ZUH7oHbDbrV+ivzmEW9wnvikAbAKXOm/grlM:ZGy/h4XORjKWvWyL
TLSH
T11A764BE420E19253F38640B3719993FB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.5MB
SHA256 638caa7247c28facfa43407043fc4eb28231aab26a3f5cbb526343a81933feac
MD5 aa98dab12bc462df6abe09c8ec5903c7
SHA1 e7d86e1bd4ce8f2535772422d559ba14ddb55f5f
SHA512 5f3680ac7f5a6d44ccb9970481c29a11d41a22d98a7da24dd686f2ffe8cd166d365d4cba62bb57fff6a9c5762ac7453d52c28f0538b8b9d1208b5a222c964458
SSDEEP 49152:MXVkAb+KFO3a2ReJXj4yWDP3WvFkzj8IWMSH2HLiUx05ISllqXbg02lcr+jlaSZm:KQa8eJXjPWDPWvSzj
TLSH
T1AF764CE820E1D253F38640B3718993EB21EFD01C6036CE48579496FAA5748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.5MB
SHA256 62bfb212ff0d269e761774d451781bc7ed2ceb9866a68acd2e877af98327bf74
MD5 eba71df7dc130c9c2bdd39a2ac7a19d7
SHA1 4e29256750d2266bb0c4e9bdf45af4f356cdd998
SHA512 4bf32e9c93b048405921e0b73d8b8017d76d661d428037501d3726bf581a52fcf6d0e0db0927f59451d15ea0e1546d4ac7c2759bf63206a5881d8fa25af8d2a8
SSDEEP 49152:LIPkAbxKRO/9dyRw9XyWyjM3WvWlkLyIWMSH2HLiUx05ISllqXbg02lcr+jlaSZm:MDdow9XypjKWvWyL
TLSH
T17E764BE420E19253F38640B3718993FB21EFC01C6076CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.5MB
SHA256 81b3a33a26967a155750918cfb527c6f10bc810c0446c2dcedacf12125280c30
MD5 9892b43489fe5d76fec3506e7c13303b
SHA1 ed30597b7f8ed3169fb91391e7670c7c32f5ad51
SHA512 1e7239210991ca1f33e99882845b539c19ade7cac75aad21d3a1e8ea2c525a8421fdaffefec1ca29a0c9146dc22d124709c031d66332a44ce0c9ab05f8aa60ee
SSDEEP 49152:I9yWkPn/X1ce8y2D3/Yz3liR4ls1ZUH7ojbDbrV+ivUmEW9wnvPkAbAKXOm/grlL:euy/h4XORjKWvWyL
TLSH
T132764BE420E19253F38640B3719993FB21EFC01C6036CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\targeting.snapshot.json
Size 3KB
SHA256 74375b87916c9982d114c8d5196eae4453aaa6db90bf0c42ee620ce5e9079199
MD5 ddf56d91cc149e550036b6587577536c
SHA1 58738826fe139f4dc695e3dcb228b46f07bc8647
SHA512 91ffaf019daf77d5859b7073451d6eb7a85dad385f34365eb2e3bfc814fad75995682d96bc1a166b870d1972a1fe4d58fdd4135286d78dc424467197f014171b
TLSH
T12871710C961CA4BEA66BC3C0E6447FA78FBD053770446458DAFE460C45FB5FB162611B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1oz9o2w9.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

femboi_user.txt

Path C:\Users\Admin\Documents\gamesense\femboi_user.txt
Size 5B
SHA256 2ee089824e7f355b00c5cb2f3c29c7ab3c090da1187e7cda2ae323e9f4f48330
MD5 de16bc4f60b084e2498a419cbc3864a6
SHA1 885d1836d434f1893e8a3eecbfe6d87d81cd6f8e
SHA512 5ddd3ca7720a45a3504eff03b1192a9ce5e4c963bedf289651b6dd08be2a4fd91ddf72a830d43cd7e4dfa1904c0dd572ed26f54a7f1bc9f1946c65dd82fe649c
MD5 SHA1 SHA512

Submit Download

memory/1244-123-0x00007FFF8D1A0000-0x00007FFF8D1A1000-memory.dmp

Download

memory/2616-1167-0x0000018E479C0000-0x0000018E479C1000-memory.dmp

Download

memory/2616-1160-0x0000018E479C0000-0x0000018E479C1000-memory.dmp

Download

memory/2616-1165-0x0000018E479C0000-0x0000018E479C1000-memory.dmp

Download

memory/2616-1168-0x0000018E479C0000-0x0000018E479C1000-memory.dmp

Download

memory/2616-1169-0x0000018E479C0000-0x0000018E479C1000-memory.dmp

Download

memory/2616-1166-0x0000018E479C0000-0x0000018E479C1000-memory.dmp

Download

memory/2616-1158-0x0000018E479C0000-0x0000018E479C1000-memory.dmp

Download

memory/2616-1164-0x0000018E479C0000-0x0000018E479C1000-memory.dmp

Download

memory/3788-39-0x00007FFF8D1A0000-0x00007FFF8D1A1000-memory.dmp

Download

memory/3872-248-0x0000000000B60000-0x00000000045A2000-memory.dmp

Download

memory/3872-1635-0x0000000000B60000-0x00000000045A2000-memory.dmp

Download

memory/3872-287-0x0000000000B60000-0x00000000045A2000-memory.dmp

Download

memory/3872-1675-0x0000000000B60000-0x00000000045A2000-memory.dmp

Download

memory/3872-1677-0x0000000000B60000-0x00000000045A2000-memory.dmp

Download

memory/3872-1680-0x0000000000B60000-0x00000000045A2000-memory.dmp

Download

memory/3872-1691-0x0000000000B60000-0x00000000045A2000-memory.dmp

Download