hxxps://maderaslavall-my[.]sharepoint[.]com/[:]o[:]/p/slavall/IgCHq549lCKKSKdv1YM4lLSTAQhzf4_QpB0valkmU2F6-Jk?e=7kuRbK

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://maderaslavall-my.sharepoint.com/:o:/p/slavall/IgCHq549lCKKSKdv1YM4lLSTAQhzf4_QpB0valkmU2F6-Jk?e=7kuRbK
Sample261006-t5nkyaaz21

Score

7^/10

persistence phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	379	758681729565rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com	1240	firefox.exe	3

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe
Token: SeDebugPrivilege	1240	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe
1240	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1240	2036	firefox.exe	86
PID 2036 wrote to memory of 1240	2036	firefox.exe	86
PID 1240 wrote to memory of 4316	1240	firefox.exe	87
PID 1240 wrote to memory of 4316	1240	firefox.exe	87
PID 1240 wrote to memory of 4316	1240	firefox.exe	87
PID 1240 wrote to memory of 3816	1240	firefox.exe	88
PID 1240 wrote to memory of 3816	1240	firefox.exe	88
PID 1240 wrote to memory of 3816	1240	firefox.exe	88
PID 1240 wrote to memory of 3816	1240	firefox.exe	88
PID 1240 wrote to memory of 780	1240	firefox.exe	89
PID 1240 wrote to memory of 780	1240	firefox.exe	89
PID 1240 wrote to memory of 780	1240	firefox.exe	89
PID 1240 wrote to memory of 780	1240	firefox.exe	89
PID 1240 wrote to memory of 2340	1240	firefox.exe	90
PID 1240 wrote to memory of 2340	1240	firefox.exe	90
PID 1240 wrote to memory of 2340	1240	firefox.exe	90
PID 1240 wrote to memory of 4460	1240	firefox.exe	92
PID 1240 wrote to memory of 4460	1240	firefox.exe	92
PID 1240 wrote to memory of 4460	1240	firefox.exe	92
PID 1240 wrote to memory of 4460	1240	firefox.exe	92
PID 1240 wrote to memory of 3916	1240	firefox.exe	96
PID 1240 wrote to memory of 3916	1240	firefox.exe	96
PID 1240 wrote to memory of 3916	1240	firefox.exe	96
PID 1240 wrote to memory of 3916	1240	firefox.exe	96
PID 1240 wrote to memory of 1160	1240	firefox.exe	98
PID 1240 wrote to memory of 1160	1240	firefox.exe	98
PID 1240 wrote to memory of 1160	1240	firefox.exe	98
PID 1240 wrote to memory of 1160	1240	firefox.exe	98
PID 1240 wrote to memory of 4404	1240	firefox.exe	102
PID 1240 wrote to memory of 4404	1240	firefox.exe	102
PID 1240 wrote to memory of 4404	1240	firefox.exe	102
PID 1240 wrote to memory of 4404	1240	firefox.exe	102
PID 1240 wrote to memory of 3868	1240	firefox.exe	103
PID 1240 wrote to memory of 3868	1240	firefox.exe	103
PID 1240 wrote to memory of 3868	1240	firefox.exe	103
PID 1240 wrote to memory of 3868	1240	firefox.exe	103
PID 1240 wrote to memory of 1968	1240	firefox.exe	104
PID 1240 wrote to memory of 1968	1240	firefox.exe	104
PID 1240 wrote to memory of 1968	1240	firefox.exe	104
PID 1240 wrote to memory of 1968	1240	firefox.exe	104
PID 1240 wrote to memory of 5932	1240	firefox.exe	107
PID 1240 wrote to memory of 5932	1240	firefox.exe	107
PID 1240 wrote to memory of 5932	1240	firefox.exe	107
PID 1240 wrote to memory of 5932	1240	firefox.exe	107
PID 1240 wrote to memory of 5472	1240	firefox.exe	108
PID 1240 wrote to memory of 5472	1240	firefox.exe	108
PID 1240 wrote to memory of 5472	1240	firefox.exe	108
PID 1240 wrote to memory of 5472	1240	firefox.exe	108
PID 1240 wrote to memory of 5516	1240	firefox.exe	109
PID 1240 wrote to memory of 5516	1240	firefox.exe	109
PID 1240 wrote to memory of 5516	1240	firefox.exe	109
PID 1240 wrote to memory of 5516	1240	firefox.exe	109
PID 1240 wrote to memory of 928	1240	firefox.exe	110
PID 1240 wrote to memory of 928	1240	firefox.exe	110
PID 1240 wrote to memory of 928	1240	firefox.exe	110
PID 1240 wrote to memory of 928	1240	firefox.exe	110
PID 1240 wrote to memory of 3596	1240	firefox.exe	111
PID 1240 wrote to memory of 3596	1240	firefox.exe	111
PID 1240 wrote to memory of 3596	1240	firefox.exe	111
PID 1240 wrote to memory of 3596	1240	firefox.exe	111
PID 1240 wrote to memory of 6100	1240	firefox.exe	114
PID 1240 wrote to memory of 6100	1240	firefox.exe	114
PID 1240 wrote to memory of 6100	1240	firefox.exe	114
PID 1240 wrote to memory of 6100	1240	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://maderaslavall-my.sharepoint.com/:o:/p/slavall/IgCHq549lCKKSKdv1YM4lLSTAQhzf4_QpB0valkmU2F6-Jk?e=7kuRbK"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://maderaslavall-my.sharepoint.com/:o:/p/slavall/IgCHq549lCKKSKdv1YM4lLSTAQhzf4_QpB0valkmU2F6-Jk?e=7kuRbK
  2⤵
  - A potential corporate email address has been identified in the URL
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {0d125876-047a-45b0-95e0-75dff8b99ee2} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {ee9b62d1-54b8-4bfc-b382-31f291df9a67} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 25164 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {4137010a-c0ee-4b73-90e1-dee47b1df865} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27276 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {c607fabd-aa02-4459-b105-10ca48e3c30e} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2652 -prefsLen 34775 -prefMapHandle 2740 -prefMapSize 270279 -jsInitHandle 2672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2976 -initialChannelId {d52ae9a6-eeb4-485c-9412-9b1828304a30} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4736 -prefsLen 35012 -prefMapHandle 4740 -prefMapSize 270279 -ipcHandle 4748 -initialChannelId {2d9d1e34-5a11-4f7a-bba3-a981814598c9} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32952 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5424 -initialChannelId {fe603517-fabe-4046-bfbb-47633cfff542} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5640 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2808 -initialChannelId {e71cd0d1-fdf5-4cd1-bb84-0ee13d687542} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 32952 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {fa7809b9-25b4-4379-af43-411dc0a145c5} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 32952 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6056 -initialChannelId {f98e5c5d-b2ad-4c17-aa91-11a9b1b09ccf} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 32952 -prefMapHandle 4896 -prefMapSize 270279 -jsInitHandle 4420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {d0a0e607-eea5-4ffa-b64c-380606fd73d7} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3032 -prefsLen 32952 -prefMapHandle 4472 -prefMapSize 270279 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3584 -initialChannelId {78a40fd7-eb18-481b-9056-345d4e3e4749} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6580 -prefsLen 32952 -prefMapHandle 6480 -prefMapSize 270279 -jsInitHandle 6492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3584 -initialChannelId {b51eaa1b-0b84-48e1-956a-aba0c78691c5} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6580 -prefsLen 35081 -prefMapHandle 4956 -prefMapSize 270279 -jsInitHandle 6708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6196 -initialChannelId {d03cf320-074c-4781-bad7-fcbf1a57afb1} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6820 -prefsLen 33031 -prefMapHandle 6816 -prefMapSize 270279 -jsInitHandle 6812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6372 -initialChannelId {9b4f9806-0c34-40d6-b7d2-787bd602a0a3} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4604 -prefsLen 34318 -prefMapHandle 7288 -prefMapSize 270279 -jsInitHandle 7284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7360 -initialChannelId {16b5688b-d75b-4f05-a636-8551b1da5fd3} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7648 -prefsLen 36885 -prefMapHandle 7868 -prefMapSize 270279 -jsInitHandle 7652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6264 -initialChannelId {29e78157-1e1d-4a21-8c65-ba05b5c83e13} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2988 -prefsLen 36885 -prefMapHandle 6620 -prefMapSize 270279 -jsInitHandle 3040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8080 -initialChannelId {15f5f3a0-91de-4351-9858-1de5d4880e50} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6484 -prefsLen 36885 -prefMapHandle 7356 -prefMapSize 270279 -jsInitHandle 6256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6608 -initialChannelId {4dc7e14a-3692-44df-88f2-8870b42fd47d} -parentPid 1240 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1240" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.contile.json
Size 4KB
SHA256 95a6fbcc8af2488d889bac210e54045ff13c2c0a1d24ca8308493786c89d2093
MD5 d126a015ffa896e07746c0df764209b7
SHA1 a2f82cb3e4a9c702f3f7bf9efdabeafc54451d6b
SHA512 6c6c1e36c74da0907c506eb213b736e47a0661beec93f32f4e789dd97df908b7408f99e52e13d8b1b14dc5bb103da911ed4fbc326b1eafd0ddd35a1b8225782e
SSDEEP 96:TZ+tXMJAXmP+tsm7pD5VT+mR68ny/+tXU7NSalz:SMaXGm7JGmR68y4U7NSaF
TLSH
T1A7A1C86BC57085261731E5F61C0F2A9CF017B40ADAE0CA6CB2A95D65D06C7FE80D7588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 e26302676380829de25f25ba801765c54eba4cee4f744de8b88d898295c79507
MD5 e2183355bdcdd31ee7243c12f8c54a69
SHA1 36c625c0112c93f5dfe411e33457c286ebd2a8b2
SHA512 9d18417388f5637c9886d9f0e946497166eee1d424f69b83c53fe26cb2e97a2b3f60f318a31db319f086b8282fb7457a265d644d4f765dedd73abe6556dd068b
SSDEEP 1536:J61kscgu5ibim0hDEDDDzuI4MoC1ckgpi:J7scgu5ibgQzuU1ckgpi
TLSH
T17573F9B3AAA471BB1B9127CB1C0B756777E10189E78941CDFCEEC91CC1CCA94123A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 1adb04337689c9ac78f6480370a032b2fe19668e1aa7fcf6dda4e598a153b212
MD5 36701f6f6f8697d153419835cc43965c
SHA1 f9b11ece79d59d6ec85a868313f81577cc03c09f
SHA512 6221e7f3d6da0238f480f0f4ca792caa587558c55aa187b15c023a91394141d31aa2657c283b634dd590ecb838a8b0a492070b2e715eaa861c837ff544c2c177
SSDEEP 768:yy8hJQsD2HPpoy51X733pjR1i+Ci/hifZ5pBfFOOrCS7lGNzBaGY:J8hO+a9npja5fZDemlGNBax
TLSH
T1127309A3A6E9B1BB1B9137C73C0F7A5B52E50199F34206C8FCE9CA1C81DD254123E5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14160

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\doomed\14160
Size 9KB
SHA256 874f1cba9c2c2fcd52c2e6f14ae99fe93f6948f999b367176d1483ae5c3859d2
MD5 6fbd36e4c7a2c16794ad5ef430548a3f
SHA1 5366d78e77204006d92e0b757cd4edad76def492
SHA512 695d020d9858abcfa6976a29af3fa66a6e878e0d42dc78ac74aa83d77a7e153b95c1f2abe568d70b99480459561f84ffdb9607796a5f8767108a1fe2b9a6982a
SSDEEP 192:6GXuYUAP0TrFksnlLKdYx7fOEmAIArnXhC9ClPEqna0Axkow:6GyTrKqedYxCEm3wX09ClPEqnAJw
TLSH
T150128C7F0F1438A98B6141A24D2EBAAA1C198963D7D9E66C68403F01CCC4F96C9F809F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14333

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\doomed\14333
Size 12KB
SHA256 f2388714476c93b74a257460ac9e96dd7887ff5f4766f219fc94cad2a23cf6d3
MD5 f72b19c46b3ea0ea95de28a8f7248071
SHA1 dd5fa8145b843fb8baefe007483bf94ba888fcd6
SHA512 d7cabbe5ae3c480e8e02fc431d50170283fa377c70de31b44547bd7b11dcdcfc64c6207c226ebb4e42343834f7a99c10ed3d4b2995e3f8ef3b34385a5aacbf61
SSDEEP 384:i7tpMfW1sDnyTrKqedYxCEm3wX09ClPEqnAJK:at24sWTr9eixCX3wX04Rz
TLSH
T148429EBF0E5438888B9101A15C6EFB9A0D584A97EED8E24D7D002E02CCD8F96C9F54DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19701

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\doomed\19701
Size 9KB
SHA256 8eaa4b69537bb382300b3afa58cb1345a67154ea7c2b12a0c45577d87579520d
MD5 b4709c6d32f2a7fa873ebaa9f26bf8ac
SHA1 58a47af316c7022fe22eaca062848c69458cb1c1
SHA512 7a8ddfb6edf8d4631301bd79882bedc4b8710821096e96d63bfefb69dece317f0a9b09ad3948a1ef6a0801f8882c91c81c46192c99756b0185a9cd350bd6c39e
SSDEEP 192:qmW1tFTYKuYUAP0TrFksnlLKdYx7fOEmAIArnXhC9ClPEqna0Axkou:qz1zyTrKqedYxCEm3wX09ClPEqnAJu
TLSH
T1DC128F7B1F243899CB6541924D2E7AEA1C1989A7E6D4E66C6D403E01DCC4F9AC9F80CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21303

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\doomed\21303
Size 9KB
SHA256 aae938cd3d59beff42c67ba94609e302493614bff09c6d1600eebf7d7842942c
MD5 a3afbcde128e3c4be294b64538d34d01
SHA1 ad2222147f5a4d1325d4cc5741087f6a2d12f69c
SHA512 f8a8c5bc51e640615ca50d5dc44c2dfb37b8f8362f653c47974fc66b1b8cc8fcb257b8d11d53e477870c74766f2ccbb2245af0ad8f5a96882fc18758d2aee02e
SSDEEP 192:M23uYUAP0TrFksnlLKdYx7fOEmAIArnXhC9ClPEqna0AxkoQ:M2hyTrKqedYxCEm3wX09ClPEqnAJQ
TLSH
T111128D7B1F2438588F6541914D5EBAAA1C1C8A57DBD8E66CAD403E01CCC0F56CAF80CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29110

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\doomed\29110
Size 9KB
SHA256 e37cb7f605ca24f15f81e75e895c5a87272e805f6d40c7f75eb7db9d990b5d48
MD5 5ea78a655bb6fddee1ec518cf8b18d4c
SHA1 08373fd41c898313f889815cbfe784be852c98cc
SHA512 2526ceef109ac5dda54e07659675f4095b529f172807b0d6be38a8204d7c728973c8b8e1e82bab43055782974ef66ac314099bac85928e7b15936e303181973e
SSDEEP 192:JhvHTPnPuYUAP0TrFksnlLKdYx7fOEmAIArnXhC9ClPEqna0Axko5:bfDpyTrKqedYxCEm3wX09ClPEqnAJ5
TLSH
T162128D7B1F143899CB5101D14D6D7A9B2C19DA97DAD9E56CA8443E01CCC4F9ACAF808F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5655

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\doomed\5655
Size 52B
SHA256 8f07f021b28778d82d19bcad72d85e0f0cab39faae72d5e12c629770ce0ced56
MD5 50ffdea7135590d63ede094abdf7cca6
SHA1 d5426e1c7dc9adcffc11cdfa2e6757d3e79c3871
SHA512 ab013ceb920001d648cee03d0845b05ac5ae09415803148a43a248e66d590eb1da0a3b82b144d6b027c4a68a5f335c45d0ac7858351a8ff189ef0cf2dc324885
TLSH
T10590020442528506E0298035280080B415203EA45980476635E107519C511D34700001
MD5 SHA1 SHA512 TLSH

Submit Download

8792

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\doomed\8792
Size 12KB
SHA256 92824e2ae3ef145f26db1473bb07fcd8a5b6ccc6e246e0521948ba8a1c84c2d6
MD5 45f338e25c3abcb56465ee53c83574d5
SHA1 c830ebdd29f528875bfb513609161a5763f3514b
SHA512 37630562275ce0f7c79eaf6686409dce3f287df05817cb74ccc762fdb88c5874bf979a2c869fdd3f979884d9c645e1c44f6f2bd3ee273074c7c619f4476c2825
SSDEEP 384:nEI6W8tGr4Q/yTrKqedYxCEm3wX09ClPEqnAJ8:nKKraTr9eixCX3wX04R1
TLSH
T1C6429EBB4F2838A68F6540D24C5D7AEF1C044A53DAE4E69D6C813E10CCC4B92E6F908F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 277f3dba6068e5cbbfc7863ec1c1571f687ddeba431676fc37cf17eb6a9f1d8b
MD5 ccfa0d51fa6e9761c01a5aeeac21521c
SHA1 8d72543963a2f2dd244436f66372d1e311ff24ef
SHA512 46bc02c3c985ad2611aa3d42b464d63c3e69365d88e8da2af68e8836bb695388cb1b7aae073bc39698822ecf792898c0ce5a36aa9bea58a7207e2daaac64d27a
SSDEEP 384:HalwSiO024YwnWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMARL+xS+C:6l8ZYSWTToXJWTTogB7S/AmVAf+hRMYD
TLSH
T13B728F7D8F413CAC275790E8C8B683558D18B7A7DFF5C06D129C3E09CA88A6A71F944E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 abcfde9cfced1dbf8dc429013445423ad1c8188c9de769b4f557bd4dcdeb84d1
MD5 ee0c7a56ca03bf15f08493f9dab2738d
SHA1 2c92261ec1b1e3f4ceeb2bacbe2cb4a2eaaef5cc
SHA512 5f5e1efdbba7d1612b4c9be0d9722ff3ff578db8950c87d13bae95221d684e664df9b1a4a03bf3a140978086efb3f254d25f38604ff345970d9f6db3686b640a
SSDEEP 384:HGNQiO024YKWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAw:mDZYKWTToXJWTTogB7S/AmVAf+hRM9
TLSH
T1E1729F7D8F013CAD1757C0E8C8B983598D18B7ABDFB6C06D25883D09C988A6A71F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 b70b35914a42632d20b61a8dcae8a69560cd8e44b7a013241661ef48ce13275b
MD5 3a78b0a779b43b4015b9f94e6ed015e1
SHA1 a0f1e11d03277089b03812afe75858abb70608f8
SHA512 173c935d113a81a145c00ad950ae70ee5af66fb3f1129d9dcff57c5da8854687c2169f3fd882eb681120e6dd7cab896f0a27a9f251489bf6989f3ccdb77f3796
SSDEEP 3072:j3ljR6xbfcx0ZUNwIdR4JPDdQsxQbSo4I8k:pjCfI0ZUNdR4JKbn4w
TLSH
T1ECB39EF6CBA2C93D55FFD42D6B82893EFD262800B3A73019DD13271461C6BB86679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 1f0e46c80ae045f461241b10d684faa2465d04fffdd252aa10a428ab288c6001
MD5 eefa68f6f4ec1d3021e5982dfbf78790
SHA1 22bc50c508ad0b6088f39fee09f69090f33eca2d
SHA512 9c05b666da25f3ba6a879fc8987ce63db764c889f4641eac23ceee831a8a152a27f9f62e5efd7cf624bf122cafb158869a93b31067ef29b8c5c715d8226dbe9d
SSDEEP 3072:X3ljR6xbCX/4hJYWIwIdR4JPDdQsxQbSo4I8e:FjCCwhJYWIdR4JKbn4a
TLSH
T1E1B3AFF6CBA2CA3D55FFD42D6B82893EFD262800B3A73019D913271461C6BB47679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\AlternateServices.bin
Size 22KB
SHA256 2ec69dfe1def350c6c7d328ae74abb133c4b35cbf0b15cfc0e8153638f9bcd31
MD5 512e16cbaeb92e16cdea52ffc4b3d934
SHA1 f0fb015cf5771542164ef91789c87f135d693039
SHA512 79181f5d0cdde68bf099373da20fa773261f78f44067977ec769298fd9cc6e2741f481306be852f4a0556bf692695b17bea641ec5cb480bfe1af1204cde7e57b
SSDEEP 96:ZE7nLFZ69Gb8q+kx8bHnmHWHe984vOOM1A2wXD1BDX5t1OI56kWH8pCM/p9cKdjX:lQ
TLSH
T1F6A2B7E76B756862F0528FB05069B28CAD3316156858C1D4C782D0EB07C17F9E5BFB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\AlternateServices.bin
Size 32KB
SHA256 20dfde7f2b1a1d61293dbf7b51390186728cdbad127fccc6d704da4cd5b6bf9e
MD5 583361b763c0aef538041874a8bbbfba
SHA1 4404f9927a6c1bf89c5b46e05a06bfe4904f6818
SHA512 dc47772c7362a0dd4a6d7f3ebb41f1669a9afe32420e969b52352f2c4b686f43abe8253bcc7338092da4612dca0290146e5f4474d39d966010ee3c7a7d5c7c4a
SSDEEP 96:ZE7nLFZ+9m685+kx8bHnmHWHe984vOOM1A2wXD1BDX5t1OI56kWH8pCM/p9cKdj3:dQIuY
TLSH
T1EEE2A4E75B757861F0528FB040A9B29CED33162AA958C1D4C746C0EB07C17E9E1BFB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\AlternateServices.bin
Size 35KB
SHA256 426882096529c69f70a00677edfe7e65ce984aa5de61162b1f01b766cccbce9b
MD5 475ec5487de549dab5cbe9092340b413
SHA1 e36f0306a13de4c0351f9e330a7027d7a198ed4a
SHA512 85013fd48b6fb34da0a2ff099b49a83a75dd9d00dd629793c8eb97a98feebff1d5eb5644016abad7653c53e93654003403fb3712a62146d1e55fda8d140ea53b
SSDEEP 96:ZE7nDF9+9m685bkCYbHnmHWHev84lOOx1nLwI61BEi5OsOI56DuHEnRCM/pJ7KQ7:gIQ4uY
TLSH
T1FDF2B6E757757462F0538FB040A9B29CEE33162A6958C1C4C646C0EB07C17E9E1BFB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\AlternateServices.bin
Size 8KB
SHA256 27093eb420215cb3af41d28428847e0bfff4ef6359029270cb6947180908e123
MD5 deb339cdae1ac686945f5709a79a089f
SHA1 ee0ef8303f4ec36f62bb86dd7fbcf88a326a62ea
SHA512 71171898a14cd87b86f9fa77bfa3d5030c436ebae317019bdb791a24a2aadeb2a748747f8d0aacf07577c2f695ecf73fb6c4feac5dd81275a7a84326b76b39a5
SSDEEP 48:uw7+eOMrqX62MLKHbQc81c0c5+kx8bHnmHWHe:uw7+eOMrqX69Gb8q+kx8bHnmHWHe
TLSH
T10402F4EBD2711C25F2165FB4256AB5D8AE632296A890C0D4C782E09A07452E8F5BFB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\AlternateServices.bin
Size 17KB
SHA256 590e41b739dcbb03566d9039bd2f8f0c1cf008d5609aabeb0323d53b57b26c5e
MD5 cdace638e1a52fa06ff65d8f5b17d6d1
SHA1 de281a3ea7c59b4e4144a0446fc1271200dc7a8f
SHA512 af107e92911d9ab888fa96b082a32b6ea5ea3db4b94b3c1b57b7bdfa9969805a9dbb57eae9471f2f01df7f0543b0bac321f66d343d661be37583448587a9823c
SSDEEP 96:ZE7nwOMrql69Gb8q+kx8bHnmHWHe984vOOM1A2wXD1BDX5t1OI56k:
TLSH
T14D82E5E797756821F0528FB0506972CCAE33121A6868C1D4C782D0EB07817E9E5BFB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\addonStartup.json.lz4
Size 4KB
SHA256 163499d42b00f929ec0119781d84eed52627dfe51c15523c5b6ae03f404a5433
MD5 3fd9fc314ba77c2d88101496ffd5d8a8
SHA1 9d8c2101f2b4819b9037104470bb4f62eecf4de4
SHA512 1e5b1937b1e4d16b56b48104182d730111773f575c5ef482bf8022368043162c26f62ecb6018b643c0fa48d93d4e22a3e06e87651142208efc28c8cfd29d15ab
SSDEEP 96:NbWq4sHNw6M2xWGhD41MgGvmHhZrUpO1LnOYvhQhIRhN:Nbe52xxhD8rGvmjApwnHUuhN
TLSH
T100A17DB6D541EFA6FE36C04388D53FB2EA959B7414A9C4D4F0ABB1294C64A735705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 94898ded285452b8027cddc391c683d1d51b8ccc286bd572d3abe487273180f1
MD5 ec469e1dc7aae4f55598a0668cb95d48
SHA1 62424fc28c80ab131d9a85348b79521eab1d0126
SHA512 423d0a0dc67395a764798e9746c8511c7118bc64608d4302513f3b1dd5423b5c1e1f179db135bc18c9d3f7afe84a2d87058ec8e13c541cc57e6a133cc6f71baf
TLSH
T14861B858F219863FE444823ACC961B412F34749698AF7F2A35ACA08D1E5B3CD778E53D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 125KB
SHA256 e5e4ff6edb66dc0aaccd1319c53ada234636e01a9031d288465d14b5cd932e4e
MD5 7d9d63c7f21688ca69dbb1a39f3c9d31
SHA1 9b3a215f2412f96f0210a5fe7cedb25e22d59daf
SHA512 300024dc4035b9bbae02868523cf8a79787a46d5eca873625234e942a4d25f96d72ba247a93e036b4d3beebae9cf1b9cd61f95546d8d9902c526576cbd853919
SSDEEP 3072:+zovmtKnWGAhf0Ha6nfxzz+5Gk9NKaCvit9606flk:+zSmtKnWGAhf0Ha6nfxzz+5Gk9NKaCvk
TLSH
T1F8C3E0C4DB16403BEC2485BFB495673C3735F4644A599B0B3AAC04752DCB3BF2D0AA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 963a592a7fa16225fab14c517ab455a8c346c03feaa46c0e602d6b2c57b1a45e
MD5 df8bab8f358e54a828083a07dd8244d4
SHA1 e2c7fff8192c18bbd9a5dda1f32c922608934f76
SHA512 905a0a002b41655a25dedb62fa1bd3108103a3dd47a8af4c77a7b3a96f2803f887b0a2d5a889672c2fb133b48409013b75ad5c8db36b1320195f02f40e2b01dc
SSDEEP 192:x71d66JozGzgCl6mc0djX9Ov5zboP6OVZyjifO+:Ld66JozGzgC1j8boiO7yjM
TLSH
T1B7E13264E629863FC418027BCDA61F504F35389A9C4E7F29319C644C2D5B3DD7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ac61dd7786a8e7ea9f133ea7f9a27204fff377faf8fb7b3d96b7262e7efcf70c
MD5 f7cf585136d336f7f29d19a5477ca08d
SHA1 c760ff633b23b196b3f68ad021ea3254b72a11c4
SHA512 00a8595b5a1b92c11db30daad5d6ce1c1ce7ee044469eac15bf259f97da86c003dd2b5bb3ba37494615ce12b031298fc4fa2e81de2e1a4726bff9709d43548f4
SSDEEP 192:BX9Ov5zboPCOVZyjifc7X1/66JozGzgCl6mc0d:Abo6O7yjl/66JozGzgC1j
TLSH
T188E11064E629863FC004137BCDA61F510F39389A988E7F2935AC644C2D5B3CD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c1266fd0aeb92f78f1a1eb3732ca34e7088704ae88746d1072ec8746b084d40b
MD5 37db02cb5424b2d631a4dffb8b0c976c
SHA1 56e72f8832d83670a7b45ee3c0d6efe48a9073f6
SHA512 320d6652d953e93e324f0ac77135b33af68ffee5a4a8175ec4b735090763de8c6af5c6b00753002f7fe416c3a4d686395cf0f64cba2b9b7768d2f944e5594f4c
SSDEEP 192:e71d66JozGzgCl6mc0dhX9Ov5zbowZOVZyjifO+:Md66JozGzgC1j+bowZO7yjM
TLSH
T1FAE13268EA29863FC448027BCDA61F544F35389A9C4E7F29319C644C2D5B3CD7A8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d6d6b5be1847259585b9ad2392a4d2487891085e8f5334883a8c1034730174a7
MD5 6cc5c9fa25f648fe12c0333c729c5e97
SHA1 6b43fed7f3c3f943e857fc0695aa17155eddfee3
SHA512 4591027847ed572c3c0b511db4ce4819815d5712449f63a1ce8bfbfaee01cffba71cdb15f8caa0d08cbac1b051058ba23ddbfd317563774ed1768c57708d988e
TLSH
T1C6217C4C39B84D2A6CC7E6AC798102CEAB594A0F14871D470D13DF8DCDC1AD932AA439
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
Size 4KB
SHA256 4b15865d0e75817fd70a3020a19efa7c415276f94614ae1827ee3061942a6be7
MD5 bb6a16e2a85c80167d7afa76b03bcc14
SHA1 6e73a43e3ed76528b02a3606d0d83394cf9e7396
SHA512 ee8fbf224368c74690d67ce0c1590fc26fb87fc70a6f97b86769e9032acec24a3529ea19529859453de44432344255d02c891a1ef82b849698ea7e04ee84a67d
SSDEEP 48:YpyASBbYAi6wzDzhLaWmHxMK9d/th8dxi/5EzCtYZJHbHV5j9OjCwhWht4vIiCSj:hwXdEOKr78KESAPjPoAt4aTdXz4
TLSH
T158A1111C65B90CBE68C7D69DB841038D5BD94707E4CB1D870CDBDE88CC86A9A339F529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a10688c-38ba-4761-a8aa-d40493b4d8b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\7a10688c-38ba-4761-a8aa-d40493b4d8b0
Size 886B
SHA256 585155c863f7f1a5af5cdc69ca2abe132a28a78440afe77f0fe01c89eada98b4
MD5 d62d064b1a550cc6cf157cb820cb57b2
SHA1 e06e0ed2b371876e7b0e363543cb9323ad59d4f1
SHA512 9f680f04bdbc375141b483c67d517c196ff52122e096f41d55e12718ab8e7ddbec246fd760f8ee16f7115e79a80bff9fd9b0d897b95a69a4a8f8252a3dc1da15
TLSH
T1B81163409635B9B6DC38E28BD9A037428BE0347380CA99287F644F180DBE70DA3A7247
MD5 SHA1 SHA512 TLSH

Submit Download

866f766e-0b39-478c-b497-0ca45e0af9b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\866f766e-0b39-478c-b497-0ca45e0af9b5
Size 235B
SHA256 43bb6fbd5a49686a3293fc20286edf13a92d406cdc0de898899f792c825c075e
MD5 d03f930230fcb70ee49be57a1538fdd1
SHA1 ff9e82731dc37a6c38c503de52fc524432e1b7c7
SHA512 a7db7823c6be99da52f60fd3cd72c35e9c98209f97e7c683053b2a9d5d8db1fa1c216b85bcfdaec3021468d47379f9a51b1cf280bc6bf6e6a0638371de8617a6
TLSH
T1C6D097852888A72E08100F2BF0E829C672944C3B29F4A860D6A040349BB9EC4A1A2897
MD5 SHA1 SHA512 TLSH

Submit Download

bfb1b93b-4644-450b-bd7b-e354ae2969b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\bfb1b93b-4644-450b-bd7b-e354ae2969b6
Size 15KB
SHA256 ae64ccf88a269f6c39d3c6529d819b6f9c18a0d7477464bdd75d4086d6c7448b
MD5 6e0638dc5c651debae5bf348b89415bf
SHA1 850bba67137b4c443bd35cfe29b38b7bae093aa5
SHA512 758095a0d40b90338ba5e789c5ccac95673fda3fcd86b868a007a51418a60023be38da8d1e45b2d43719224332254d236ddf313b991bb452fdfb086a9950caf1
SSDEEP 192:6zEOUvSWbzXwu1BYm6bBqKDcxBBu7zxD0tkX82TxozATqsnYKI8xe9HRFGoeUXXl:dO0bT/6bhDcxB87lD1X82TxocTUlx/
TLSH
T15C72DB562820497A8251E36994ECBFC3E6F538CF4C419FCA9BE4BD085DEE0AD112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd3e9e6f-bcb2-49cd-95a5-52cabd6c99d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\cd3e9e6f-bcb2-49cd-95a5-52cabd6c99d9
Size 235B
SHA256 f065057d70856956ede8c49eb635b5ebdd3d09fea5828ebdd379044c228974c7
MD5 c7f0aaaa122783741992ea182816e00f
SHA1 ed9bea95636f8c135a66c3bc57e27053d52c6e71
SHA512 9c0b387bab43e31b6a63619c7bd270f7495cbd3366ad9e041249f32805ef786411f7009c1354a8ec066f18c606c1f9c83461c385be67048bb935bb65b8bf1735
TLSH
T1FDD09780288C6B6E08040F13F0A039E330458C3314B49810C66009B4DAFDDC6017182B
MD5 SHA1 SHA512 TLSH

Submit Download

e3845904-3afb-4bd8-97cf-900b6170f316

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\e3845904-3afb-4bd8-97cf-900b6170f316
Size 2KB
SHA256 d33f92b949495a23cca74a008741905fa7e983d93db712caeeb82ff1af0d1ab9
MD5 5ddd1026b27c4243726ccbb67161fe51
SHA1 e329ad34117390f4668e17dbc95faf3b87606250
SHA512 dd9e1eb924498621b88359c50c5463d3325a92c382b2a0bf39521da4792f113d1c23c456189a6b0525e8f71323a70e7c4055f8ea8d58c04eb5c76e3eb4c12e94
TLSH
T16541411C35B84C379CDBF24D9582238F57748E5200865C836E41EE0C8DA6B9D226B46B
MD5 SHA1 SHA512 TLSH

Submit Download

fec01f2f-d558-48d5-992d-4b5cdf7aa2db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\fec01f2f-d558-48d5-992d-4b5cdf7aa2db
Size 883B
SHA256 b95ea20edf8432096d13da36b7b1bf38e0dd31e3202cf35c53f04d7620edac90
MD5 f4537aa13407d5c27ebf1359f2bb3c58
SHA1 b75d0742eb570ee7fcf7f4e45ba7fe986abfbb43
SHA512 aa9a0bf2db193f1e23daa46928f199e8bd1c18decb2390179e9eb838a9797efd588d9885b4d477caa5eca34f82df97020ffa2120730e23fa03b48284add073eb
TLSH
T10E110051A639B8B7CC6CD24FCA9537129BE4742380C6E4142EB49E080DBEB1E93A7647
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extensions.json
Size 14KB
SHA256 c729435dff2a9d676c53a0f1cd0f3768bf51f1ec7dc8f75ad573dc0110799c71
MD5 30f831c31c4b4420e888b98f3c5da7a1
SHA1 e72951c5572af141b34a1a33584a19cf1a3a88b5
SHA512 1c1f2dc9b7e3989a794b4e0d23ac6810bb4c2b277fe9bf049cc3f16cfdf247f411f25a87a84ff09bd8ed17a0fe2206b66d265bb8e9c137dc8b94b1d16a4c7e96
SSDEEP 384:mkI4vfUmldvBM8dhW+94zO96otXL4HpL4P1L4HDL4HTL4HC:pI4XRfbXT4e6Yb4h4d4P4/4i
TLSH
T11462531545148EB8298FA79BAA367D02C37D473B60845C38F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
Size 8KB
SHA256 8ed5c1f9daaf1f671e4a983ef1bef2353b3ca92889a92b077e6d85cee89994b6
MD5 170f543999168fa987514f15f02fe772
SHA1 996d4e4817eaa96063d0f03a1a4c30b2c83d471a
SHA512 00ec4d876404525da1f9b0db3433cee35dc1de7ebd925104f541ee9c2cb54bc1a0bc7226f5097886956ae8673a13d4b444a969d3790ad778d451b57351675011
SSDEEP 96:xHYyZKVZBvTUzqGqZEf+fEmCObzSBSSlSdv9jhnvWRN9W/2Bw888se8L4cntGUIp:KyZKVZBFRZEf+fEmCzSSPR2/2Bw88cp
TLSH
T1F90220785108CF7F64B6766CAC2449716A72013BBBBF68C750BA84C5011CF3456FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 5c6a1f54175bed5805b72ab4ea2770b3e8f1b3f3eda9f98d0a41226c066b1efe
MD5 49b25e1a3e76e0e9cb78cb17ad36d228
SHA1 3f6d639959b951358a8600ac174bc0b139a38b18
SHA512 022c095f35ec8cc3b8cee9bdd1de9d0b6759e0473c2c2dc14feac94de88b795a9c8a812e7cbad801299e0262fc8741409b19a0df89077f2fecea1c8d94a092a1
SSDEEP 96:xHYUTUzqGqZEfUSZv1zShCSSlSdv9jZnvHhW/YBw88n8L4cntGUI6:KORZEfUMvOCSS6o/YBw88n6
TLSH
T13EE13F7890088B6F64B6776CAC688C316AB2413B77BF68C750B984C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 f4d3ba63a41ca708f20270380bd08e9e53ec439e4b730a7bab92aa24097fe201
MD5 d0570aada264c8817f3b841a07f37b18
SHA1 01a5aa400acbae5b70f6549cd1f4f62822a31832
SHA512 34408070dc8f8b30ae3fd0fa7738f8bbf92d18d01410ebe41f476567f995964d09d7d52fcca3478a463f53fa3bb1d9837230bad08cc7d1675acb7954ffc0a496
SSDEEP 96:xHYUTUzqGqZEfUfEmCObzSBSSlSdv9jhnvHhW/YBw88n8L4cntGUI6:KORZEfUfEmCzSS6o/YBw88n6
TLSH
T15AE1207891088B6F64B6776CAC688D316AB2413B7BBF68C750B584C4015CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 8KB
SHA256 e200c9b840d771f081fb0e6da099e60c1ea68af0131ded731c067602ef772ed9
MD5 2f2d540cd23ec388c23ef28f11a37231
SHA1 29d6e7bb3fa295968b8213160d6c2173dd10611b
SHA512 1d38db3e2c22f83e3d02c46e736c7fa657cb6d7617b02bcd2b312d0c8c8dfabac81212577879f784a85d95fbdde6e387964d75c2a506b3288f1eae10efad2580
SSDEEP 96:xHYyZKVZBvTUzqGqZEf+fEmCNbzSBSSlSdv9jhnvWRN9W/WUBw888sSN8L4cntGR:KyZKVZBFRZEf+fEmC4SSPR2/VBw88KBp
TLSH
T13F022F385109CF7F64B6766CAC6489716BA2013BBBBF68C740B944C4011CF3456FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
Size 6KB
SHA256 24fb0d670e4d1148b64dd89410153b8a8fb888c56df3e7730b6cc1d88a597720
MD5 e1d28980737988deb99ac8a8a9e6ec5e
SHA1 b56eba7138bcc7f45f8a4570344541c42240aefe
SHA512 ed3fa1b1237bfc316310af9f1bf3e62583e0d7a6d24697cc6a6bbc876870a863d1f3ca4e1cfd6dd037e636adeb0c0448e40c48ad7604b79126d0931fa9d57a4a
SSDEEP 96:xHYUTUzqGqZEfUfEmC1zSBSSlSdv9jZnvHhW/YBw88n8L4cntGUI6:KORZEfUfEmC0SS6o/YBw88n6
TLSH
T181E11F789008CB6F64B6776CAC688C316AB2413B7BBF68C750B584C4015CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 15KB
SHA256 6e17d63265c73402f070dc28d4ecf723afbd407ba5eba5f44bcb4afb7b1ee085
MD5 bca6e6e193569207f55c5203101d2284
SHA1 b7c5a4ef314e60e57cf6661881d1e548c873f02b
SHA512 5b116c41cd8295b9ec1c3ad99f646b25fc2f1590fb947c3983843b9eddc6abcdeada9ac8a557d34e58b9d4081f35ae35e6633801d7a4bf85d5e59981556eac3a
SSDEEP 384:r2b0hxXnRgW1eYorkuMd1yM837YgkPy50tHpTbipLnDW:rIoXn7eYMkXo30gkPy5axepzDW
TLSH
T1BA72C09361362F4EA538A549C85E1FCCA262E066C7B4E190E96A3C44C07974C7DDED7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 15KB
SHA256 ee35adf818c1209662aac97e3b7772362edd8ddba35734a963f4109ccfcd5071
MD5 1f9822f5912fc4f857e2e129f277aaef
SHA1 c536109a4eaf9dd158f4953f4b2be76c874b75cb
SHA512 80dc17846b1a214a979d9ce7b4eba534a7ac5b76ac805da8f81990931c575c8c4fb84d5112e89c85b9bc2fd300264dd30f9bed3cfdacb247cc2025f3050c0635
SSDEEP 384:82b0hxwRgW1eYorkuMd1yM837Y+kD1bSUMU3XTihLZDM:8Iow7eYMkXo30+kwU7XGh1DM
TLSH
T1A172C09320272F5EA97CB18E885E0ECCA352F06A86F4D190DD5A7C4CD47874C7E99C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 8KB
SHA256 0027588d918fd97740bc3eee77b8aea5f5fa12af3d70ab3fe8342ffe6d7e644f
MD5 5b86982946e11f116b103568e9af8bad
SHA1 df660f65d64f4130d17a14e920a89fe9d2fafd13
SHA512 3b30356dfde89913f879012841539775236a6499bc024b8056861400796189758a80143674d69abebe36f1a91ac7388be558014bb8181a36f1c66f0f46972531
SSDEEP 192:vz7Sb0QUkq//n2s7W16uoYZf+bt5aeHEzu/QIZLpBgge7X/wLqD0:b2b0hxXnbW1eYoqaH/gRcLqD0
TLSH
T1D802B146723E877EF5E8E98EC08F0B48E3F3E441867470C05785EC14D57758839A9C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 21bc844a5176406fb2c3d7a70d36a03c334e1fed9d3166f82d1a469d1aeca2d5
MD5 ebb74a9e24f0ef5fc7dcf9aa0824dd5c
SHA1 40bcef9bfb78911f79b7c306381355a8ec236e8a
SHA512 1cb84c6c154f7b297be70e26da9a41c36317738ff238c05e9e461394dc6ecc07f209c9e0a6ee344a8ef37e3bb3d7e18167aa536902e473245766091eb3516370
SSDEEP 192:Pz7Sb0QUkq/Aes7W16uoYZf+bH43IAIzau/DIZDpBgbe7ps:72b0hxIzW1eYoARI3m/gi6
TLSH
T1B5E19D47123E4ABDED9DC08EC4CB0B18A3F3A44A163960C06B85AC54D1FB591BDADC4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 12KB
SHA256 7f1a27deac5b0f0f59ea972596348f46cfc11ee052e7a28da8f7fcbe38cf3972
MD5 80773d6c7ab2a5a8366cc42437211807
SHA1 732716aa602ebc0bb88112b9352f14ce890dd016
SHA512 edfc72fdf5b43adf96b2e3b2bfa5117fe7ddc7c07f1dfd9968252f5164729b2a970a57699e1bce692e593a9664c6c5c0976fc7e8b8fb4282f18cbd9cb312a575
SSDEEP 384:q2b0hxXnRgW1eYorkuMd1yM837YilnK34qSZiELBDc:qIoXn7eYMkXo30mqBE9Dc
TLSH
T13442D095732B1F5EB72C6ACDC84E0FD8F3A2E095CA7591E091695C44C079A4C7AEAC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 15KB
SHA256 f0e3d7c70b98dbd763e7ab8ca1f4b27ea86264549d71873b411dc86c7f6fd5d1
MD5 c1a1f5c3bb1ed7c24ab7bf77ed8da40d
SHA1 6bee45c32329d3a4cb0e475f1dd29c665cd92460
SHA512 4e8eb36ea4713a6b245dd8e6a1c6f713f0f9f060c2da06b3c91244319dea2e8c7b4f42c7265565f62c031e061ec5f71fad8e4aa6c085bfa250783c4fde3fe4d5
SSDEEP 384:82b0hxXnRgW1eYorkuMd1yM837YgkD1GuUrc3XTihLZDM:8IoXn7eYMkXo30gktUsXGh1DM
TLSH
T1E072C09320372F5EB93CB14D8C5E1FCCA352F06A86B4D190DD5A684CD4B878C6E99C79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
Size 15KB
SHA256 ee88329c0affa81cc6b651249c2d25364a267f26afcd8c2a2c8010e31f1b70a4
MD5 1385af6c65ea49e3f992ddb42b504b9d
SHA1 aacebd82ea7fdae634035ecf32eeb2ee7605a033
SHA512 7d64b207fe855043190157fa9c4da0c27e1373f9611e5ee614e340cda91cad314021b74d938dedd37c8ccbb00b83ccb73c03b0a3a3c345dc3a329b8d4b71fa8e
SSDEEP 384:J2b0hxJRgW1eYorkuTd1yM837YukD1sXncibLPD8:JIoJ7eYMkso30uk2BbzD8
TLSH
T16072C09320352F5EA97CB14EC86E0FC8B362F059C6B4D180D9A97C4CD47878C6AD9D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3218045567AbLdM_osdle.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\default\https+++euc-onenote.officeapps.live.com^partitionKey=%28https%2Csharepoint.com%29\idb\3218045567AbLdM_osdle.sqlite
Size 48KB
SHA256 22c5563bd2a57b53663588ce4ad2563084b1fc2b631fc5cb9ace4d6ac54fc833
MD5 7b9ec12d2bc5a66d4b3a599eb16e2c84
SHA1 7f2381009ec8dce27c31343b5882353ac45ff110
SHA512 6ae1b038ade4d040110c9c5ec288ee511679cb3153858753f763ea134dce3c123170a9f3d770af11a20a4d6689410405ce3537356ef3dbbaa3a0758ada3fe4e3
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyELac7:Oa16S6CKnqlizbxV+2xVeU7X2B0N
TLSH
T1C8239F8E3F07E511C43AF0B178A08C51FC5E321E07222AD569D0DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e70e5b2a-2ef9-42fe-ada4-29d2d4bee884}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\default\https+++www.virustotal.com\cache\morgue\132\{e70e5b2a-2ef9-42fe-ada4-29d2d4bee884}.final
Size 72KB
SHA256 00eb9412f6c8b1410687ced5a505af8f4dfc9b22e42603fb9fe8866feaa469a1
MD5 ce8729084d29aaba8494fcec9ed41e87
SHA1 11cdb961681cebb3bd2ce39987fc908ebc569a64
SHA512 3c743eeb66041484afb21439171cc53143007364256dc22026548939cc35cac734cbe285a49a893e0fdbcee3128fd4d45d1f616cb7e197bf480b32b0be787eb5
SSDEEP 1536:iqn0viaeOzYaJbSbQAAIAfTRAWt5oySADkalTlSwmvo0zODMlJGUP4L:iqnoi2zMUF+8HSQhSwMoWODMFP4L
TLSH
T19473F1B4B758F8DB143303F7F99EBCE8537CBA11B69BE010E221E6B11446215BF8A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download