hxxps://github[.]com/overwolf/jar-infection-scanner

Analysis

user interaction
yes
max time kernel
282s
max time network
254s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/overwolf/jar-infection-scanner
Sample261006-tdcdlads2m

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JarInfectionScanner.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5392	msedge.exe

Checks processor information in registry 2 TTPs 40 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 = 7400310000000000465d3a7f10004a41522d494e7e3100005c0009000400efbe465d3a7f465d3a7f2e000000b5e6010000000a0000000000000000000000000000000498e7006a00610072002d0069006e00660065006300740069006f006e002d007300630061006e006e0065007200000018000000	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = 00000000ffffffff	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	JarInfectionScanner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "4"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\NodeSlot = "6"	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	JarInfectionScanner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "5"	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	JarInfectionScanner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	JarInfectionScanner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	JarInfectionScanner.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\MRUListEx = ffffffff	JarInfectionScanner.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	JarInfectionScanner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	JarInfectionScanner.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	JarInfectionScanner.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\jar-infection-scanner.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\TerraMod-fabric.zip:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4840	JarInfectionScanner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5228	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	firefox.exe
Token: SeDebugPrivilege	2572	firefox.exe
Token: SeDebugPrivilege	2572	firefox.exe
Token: SeDebugPrivilege	2572	firefox.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
4840	JarInfectionScanner.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
4840	JarInfectionScanner.exe
4840	JarInfectionScanner.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2572	3812	firefox.exe	86
PID 3812 wrote to memory of 2572	3812	firefox.exe	86
PID 2572 wrote to memory of 3312	2572	firefox.exe	87
PID 2572 wrote to memory of 3312	2572	firefox.exe	87
PID 2572 wrote to memory of 3312	2572	firefox.exe	87
PID 2572 wrote to memory of 3972	2572	firefox.exe	90
PID 2572 wrote to memory of 3972	2572	firefox.exe	90
PID 2572 wrote to memory of 3972	2572	firefox.exe	90
PID 2572 wrote to memory of 3972	2572	firefox.exe	90
PID 2572 wrote to memory of 880	2572	firefox.exe	91
PID 2572 wrote to memory of 880	2572	firefox.exe	91
PID 2572 wrote to memory of 880	2572	firefox.exe	91
PID 2572 wrote to memory of 880	2572	firefox.exe	91
PID 2572 wrote to memory of 984	2572	firefox.exe	92
PID 2572 wrote to memory of 984	2572	firefox.exe	92
PID 2572 wrote to memory of 984	2572	firefox.exe	92
PID 2572 wrote to memory of 1324	2572	firefox.exe	94
PID 2572 wrote to memory of 1324	2572	firefox.exe	94
PID 2572 wrote to memory of 1324	2572	firefox.exe	94
PID 2572 wrote to memory of 1324	2572	firefox.exe	94
PID 2572 wrote to memory of 5532	2572	firefox.exe	96
PID 2572 wrote to memory of 5532	2572	firefox.exe	96
PID 2572 wrote to memory of 5532	2572	firefox.exe	96
PID 2572 wrote to memory of 5532	2572	firefox.exe	96
PID 2572 wrote to memory of 5620	2572	firefox.exe	97
PID 2572 wrote to memory of 5620	2572	firefox.exe	97
PID 2572 wrote to memory of 5620	2572	firefox.exe	97
PID 2572 wrote to memory of 5620	2572	firefox.exe	97
PID 2572 wrote to memory of 5628	2572	firefox.exe	98
PID 2572 wrote to memory of 5628	2572	firefox.exe	98
PID 2572 wrote to memory of 5628	2572	firefox.exe	98
PID 2572 wrote to memory of 5628	2572	firefox.exe	98
PID 2572 wrote to memory of 5640	2572	firefox.exe	99
PID 2572 wrote to memory of 5640	2572	firefox.exe	99
PID 2572 wrote to memory of 5640	2572	firefox.exe	99
PID 2572 wrote to memory of 5640	2572	firefox.exe	99
PID 2572 wrote to memory of 4804	2572	firefox.exe	100
PID 2572 wrote to memory of 4804	2572	firefox.exe	100
PID 2572 wrote to memory of 4804	2572	firefox.exe	100
PID 2572 wrote to memory of 4804	2572	firefox.exe	100
PID 2572 wrote to memory of 2000	2572	firefox.exe	117
PID 2572 wrote to memory of 2000	2572	firefox.exe	117
PID 2572 wrote to memory of 2000	2572	firefox.exe	117
PID 2572 wrote to memory of 2000	2572	firefox.exe	117
PID 2572 wrote to memory of 2468	2572	firefox.exe	118
PID 2572 wrote to memory of 2468	2572	firefox.exe	118
PID 2572 wrote to memory of 2468	2572	firefox.exe	118
PID 2572 wrote to memory of 2468	2572	firefox.exe	118
PID 2572 wrote to memory of 2044	2572	firefox.exe	119
PID 2572 wrote to memory of 2044	2572	firefox.exe	119
PID 2572 wrote to memory of 2044	2572	firefox.exe	119
PID 2572 wrote to memory of 2044	2572	firefox.exe	119
PID 2572 wrote to memory of 3648	2572	firefox.exe	120
PID 2572 wrote to memory of 3648	2572	firefox.exe	120
PID 2572 wrote to memory of 3648	2572	firefox.exe	120
PID 2572 wrote to memory of 5640	2572	firefox.exe	121
PID 2572 wrote to memory of 5640	2572	firefox.exe	121
PID 2572 wrote to memory of 5640	2572	firefox.exe	121
PID 2572 wrote to memory of 5640	2572	firefox.exe	121
PID 2572 wrote to memory of 6108	2572	firefox.exe	122
PID 2572 wrote to memory of 6108	2572	firefox.exe	122
PID 2572 wrote to memory of 6108	2572	firefox.exe	122
PID 2572 wrote to memory of 6108	2572	firefox.exe	122
PID 2572 wrote to memory of 6004	2572	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/overwolf/jar-infection-scanner"
1⤵
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/overwolf/jar-infection-scanner
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {7e3bcd68-65f5-4c13-940a-ed056773cdd5} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {c352a132-59b4-4b30-9087-e3e7f7df1c6a} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720 -prefsLen 25164 -prefMapHandle 3724 -prefMapSize 270279 -jsInitHandle 3728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3736 -initialChannelId {24eb3a55-a0fb-4cd3-a9c0-adb3dd391e0b} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27276 -prefMapHandle 3888 -prefMapSize 270279 -ipcHandle 3956 -initialChannelId {869d51ae-5bc1-498a-8626-e31f93ba8ba5} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4240 -prefsLen 34775 -prefMapHandle 4244 -prefMapSize 270279 -jsInitHandle 4248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4256 -initialChannelId {c3c6daf5-baa2-4078-a9e3-e0568c41bc01} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5032 -prefsLen 35012 -prefMapHandle 5036 -prefMapSize 270279 -ipcHandle 4932 -initialChannelId {b674000f-22b6-4e6c-af2f-74fe45f794bc} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32952 -prefMapHandle 5248 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {c33d7fa3-5f16-47e4-becd-e0dceb5600d4} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32952 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {ef5c85b9-77b0-41a1-9518-12eb892b22ed} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32952 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {e15b6514-2d6d-4700-b978-12fa2acf69b6} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 35064 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 4684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {80d225a1-5d3c-4860-b615-c9c2ca140ffc} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6572 -prefsLen 36845 -prefMapHandle 3128 -prefMapSize 270279 -jsInitHandle 3124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4840 -initialChannelId {ff85b8ae-fd46-41f6-97c9-393639601d7a} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6996 -prefsLen 36845 -prefMapHandle 7176 -prefMapSize 270279 -jsInitHandle 7180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7188 -initialChannelId {76dfc33f-5fa1-4887-b44e-f879466dabd1} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5916 -prefsLen 39984 -prefMapHandle 5912 -prefMapSize 270279 -ipcHandle 7136 -initialChannelId {e45363ad-d8ff-4729-869c-4117a7eec98b} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 5648 -prefsLen 39984 -prefMapHandle 5632 -prefMapSize 270279 -ipcHandle 4948 -initialChannelId {28be4fa5-dc1d-4fae-a153-ac75c2231ff8} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6520 -prefsLen 36845 -prefMapHandle 7724 -prefMapSize 270279 -jsInitHandle 6708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {4b050412-b06a-4b73-991e-edda63be0862} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8312 -prefsLen 36845 -prefMapHandle 8316 -prefMapSize 270279 -jsInitHandle 8320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8292 -initialChannelId {a8f70c19-2df4-4de9-900a-4ebdf3254e1f} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5464 -prefsLen 36845 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {0f2c199c-d7ff-4f2d-9b03-ea2de7e14537} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:6004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8884 -prefsLen 36845 -prefMapHandle 8316 -prefMapSize 270279 -jsInitHandle 8900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8816 -initialChannelId {37a9004c-c73e-4b83-b4e1-28af296c8fd1} -parentPid 2572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:3636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2828

C:\Users\Admin\Desktop\jar-infection-scanner\JarInfectionScanner.exe
"C:\Users\Admin\Desktop\jar-infection-scanner\JarInfectionScanner.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4840

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\jar-infection-scanner\terra\TerraMod-fabric.jar"
1⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc4cfea44hc9b9h49d3h9a7bhd8652c25e1f5
1⤵
PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc4cfea44hc9b9h49d3h9a7bhd8652c25e1f5 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7fff15c9c188,0x7fff15c9c194,0x7fff15c9c1a0
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,14801541602475654596,16399059437877577490,262144 --field-trial-handle=2372,i,15951436224268408259,17878713001355189361,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,12933159028812044307,7251597550677244589,524288 --field-trial-handle=2372,i,15951436224268408259,17878713001355189361,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,1157005946505754185,13452398580582164312,524288 --field-trial-handle=2372,i,15951436224268408259,17878713001355189361,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3268,i,23803480730494354,13572614122293187981,2097152 --field-trial-handle=2372,i,15951436224268408259,17878713001355189361,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:2
    3⤵
    PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

06665b9d-2438-404f-943b-1958b0b8ce93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06665b9d-2438-404f-943b-1958b0b8ce93.tmp
Size 9KB
SHA256 2eb027a8a9485327b7a55bb3a07273ffd98fe9915eba5f8a122c580649ed4781
MD5 812a3cfa96cc85f2af2fc3665f85297c
SHA1 a14e6b4f8c12ceb4dce3443cea98b3e51489f756
SHA512 8115ea6cab5478d863628d9a219e0b2526073f92c275d48b023cc0d843f0ecde0dfb7ae345d7a918008009934853492870ae7c5a9a78969618b4d70bd0d2922b
SSDEEP 192:EsN26nnHCkQmiUyK3qUbcX5hQDP1QODEzNKVgyVq5+FUO:EsN26ni0haUQX5+DtQODEBSmoUO
TLSH
T1F0122A34A8A9EC774EEB6555F0C732939EA42077D9887F84D6E85F1C00CA79C270E913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

171752fd-0ab9-4ac3-89cb-f5c893cf3712.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\171752fd-0ab9-4ac3-89cb-f5c893cf3712.tmp
Size 8KB
SHA256 7801062351d97a6b27447cbde500d80de240405feefcda549850eca22f2b4f23
MD5 dcc95e662f6813d5936601717c5f92a8
SHA1 a83b29c2d4a11c4b1423de1f89b48bb353000f86
SHA512 0f5d0b6d6e0a231c3c25c5cc8ea05f28543248df7824996e13dc21aff06844c34b837a068d0882a9cd069e0de5aedb46218056bb7a43dd98e400175aabd43402
SSDEEP 192:EONT6nnHGQmiUyvJQYcX5hQDP1QOD1MccUmU6:EONT6nCuQNX5+DtQOD13mU6
TLSH
T10702EB34BCA97C7B8EF76D59B48633139FA4213BE5946B80DAE85E1C00D765C230AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

333ae562-b54d-4c98-81b6-7b6f833f78ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\333ae562-b54d-4c98-81b6-7b6f833f78ef.tmp
Size 8KB
SHA256 6de14781c1d0abcedcb1dd06dd6312863448a3c38564dde7175f73241f22573d
MD5 306b801262c1848cb2867a8a0688bf28
SHA1 f130316bb80fc68369d3dbbbcad35985ab80be3f
SHA512 834de63e4f7acd943d52054ec5d9756a0b95e7f583a0c415bbfa60a3ae085cf9d049f562f8c84aec99892026ef8e6a6f55f34e2e4d287c8f748ad25b47443962
SSDEEP 192:EONV6nnH6QmiUyy3JUYcX5hQDP1QODEzNKVg3Yq5+FU6:EONV6nWRZUNX5+DtQODEBXjoU6
TLSH
T126121930A8A9EC674EEB6555F0C732939EA42177D9856F84D6E85E1C00CA79C270E913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e2c044c-743e-4853-93c1-b1d6e94f60a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e2c044c-743e-4853-93c1-b1d6e94f60a4.tmp
Size 9KB
SHA256 5e56f8b9d5a57b5998b511729bd8886b28eb884b49875a246e3d6eae0a0b04ca
MD5 304b38603f134b5d88f191e9dc27b5a2
SHA1 83935b125c645b453fd800cadb03bd3e92c43ac8
SHA512 c0efc4efb5530698b350517664dcfd5b13e31d0c6659ff3f2e3e0e355df4b87629b8a0a6895b5ab9c32def08b0e8ad1601cbdf75e2d6b25e3d44b826324d2fb7
SSDEEP 192:EsN26nnHCkQmiUyH3qUbcX5hQDP1QODEzNKVgyVq5+FUO:EsN26ni0AaUQX5+DtQODEBSmoUO
TLSH
T1D0122A34A8A9EC774EEB6555F0C732939EA42077D9897F84D6E85F1C00CA79C270E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

05cba1b5-16b8-47d4-9abb-d325e3f1174f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05cba1b5-16b8-47d4-9abb-d325e3f1174f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e92e805-742a-4a1e-a473-5e22e35b5e98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3e92e805-742a-4a1e-a473-5e22e35b5e98.tmp
Size 7KB
SHA256 1f782caa1f1c4ab4967e936179d98b90608d949893482d5b5a23a92403269153
MD5 d8dcf06b2f87cebb982498333b54011c
SHA1 f2e7e686464a59abcfb7406a9f41aea632e31f7d
SHA512 203c9eae90bdcf71085d28559d83db744c2a288aedb85ae29baa7788dbb5e10898c3ac96459ff617d43c5ef0b9c6d18bac98b1f9fca9f783cc57b38bf54a3e72
SSDEEP 96:sa2jaiEDWuLscgUb9AmDcdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjaiQ671wUho:sxeu6sFCerpMHW6+WNGYopxhgF
TLSH
T1D7F1C952AE24657B4CCBE11DBB66BB53E1F9513225C4194CEBFCCA1C089B6CD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68e8e46b-986e-45d1-917e-6672f26411d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\68e8e46b-986e-45d1-917e-6672f26411d3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

05d086c9-ce09-4b83-90ff-014c9734f7bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05d086c9-ce09-4b83-90ff-014c9734f7bf.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

6b7cdf48-524f-4aa4-b2cc-73a24076ec1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b7cdf48-524f-4aa4-b2cc-73a24076ec1c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a9f38ded-bf0d-4a58-adc7-b3893cdfdbf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9f38ded-bf0d-4a58-adc7-b3893cdfdbf7.tmp
Size 26KB
SHA256 599a78dbfcdbe037b000fe8f8a33dffc6ba74553bee49f9bee04c1842c6616ec
MD5 58007a8465a1ae786772faa98321fae6
SHA1 202e7a82e5c454a7a46436ae1eeadf5402a930b2
SHA512 d37ce251c38ea7ec2c473b767560c083ce33d05d3b25e6be641fddaf3992ee3c5709ceec4b6480c6178a5f7a5e891f9f5db9c1f4d9b814c09490a4138cfd9f27
SSDEEP 768:mzyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX5ropdx3:mzyYR7jWv3NpBu1ja/CL8OXyB
TLSH
T1CCC2E92B640DCB7E4FC01A9DDC5A6FDB7E9802C796548D4047FA944C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\activity-stream.contile.json
Size 4KB
SHA256 68bb13b864f015ffe8f6b111bb7c89e319bf1ac419aefca9eb5eee06fc149980
MD5 6815336e79e223c47af9363e54b17277
SHA1 45b86ab8951100b477a25fe2ff6c05a6150d7e73
SHA512 ce2d39a7dafc0402d3076f28eefaf6ed52a431b3b0f438a2c99f1d9684c2f4ccf4fae40183942317fae59a4bdd6850eb03122f53a70d2434a7222e074b9c223f
SSDEEP 48:YdbAmu5eDZ1y7WMbCpq/ioLQWmqp4J4u5eDZyWy7N1sDQatBZGjy6T+jiRsQFnq+:TEXMmbWm/WsWD5oT+mRdFnya9XTN7lz
TLSH
T105A1E8DFD5B484211731E9F63D4B269CF017B406DEE0DEACB1AE9865C0A87AEC1C7488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 379eaaaf4ba5eb6fe7eb5678a7c7a56d7e3ce12f3bef45cbe08a63af6cc0a339
MD5 ba1c49ad511e5fd7ef22bc1b228b9f4e
SHA1 bbd654bb34ccaefc664a59b3098ddd31f6d2a53c
SHA512 9b98a50878f53827bbca2a80a9b0028642b0d51e5ae5d23a95454230cb1631752ef831a61536d808423eb1242d7a17d0947297a34b1d93585116bf4b240c9b37
SSDEEP 768:MyRpFE7QsDPGveaWHt51Gai+dn0Ec7iTVvdC3Kt6mHdiEJvkJOOr++Gj7tb:XRHUxv0wG7mVvdJomHdvcGX9
TLSH
T15E7308A3A6E9B1FB0BD137D72C0F795B62E20189E34502C9ECF9C91D81DD754123A6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 9d38bbbded72409aaa3e9f8bcd62b599ea9c42306ca643ae9e800d29e8418394
MD5 0fc9338af5283b28fd667b5ace97fda1
SHA1 a21f26212feb5c129f0c1fd6f57505d3199c5fb6
SHA512 0bc450be488dfff811a93c68900539e984c5afbfa202194f09a0ee70bce4807c341cf85035fbb37b17d261618c98a5dbaed8c97122af819f8ec48037380148ca
SSDEEP 768:MyRk59x1lcGeiAnDF/2BTCdM7kMS0XgrZt2piW1JUADDnljkgTGYrYkMkZxeON0F:XRC0+WKq0XgrTVW1CADDnljkga+SthB
TLSH
T11B731BA396A8B1BB1B9427C71C4B795B67F64186E38902C9EDDDC91CC0CD790423F6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

10546

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\doomed\10546
Size 6KB
SHA256 ee0f12eeb33200ea566c05dcb218d16fa5c6360790a895f239b78bd656afc601
MD5 8554daa036c5c193ea5043ac34ac2d99
SHA1 b116c07bb0ddcec23b1303b5e5895b748be7189e
SHA512 7236212ccdae40678a75bac550f5838d6371557df2eef0c2619453d9a908a96f9633fb70238f1cad7567952da86ad66beef2325a8133ec4c1a5a3e14d5730752
SSDEEP 192:pjFs/rlLRguPQmxFik1fLU8a1FodW2Jdw2O:GrlLRlPQOF/UrAW2Tw2O
TLSH
T19BD12C726F10251A1E669FB2DA9E8B512D98E243CDC5D1FE3D083905C4CB31AA5B60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12325

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\doomed\12325
Size 129B
SHA256 d6b99b15c0faea6a3103bacd499ee5087bb2a398199f6f56d93fd55c93d23a87
MD5 469fdd8bca2d68bdf51949633202d1d5
SHA1 c4d258dcb598e24ec5a4e2ee8857af7dc4775971
SHA512 9350ea118ac5d1825a0caa10f925bd047024cd53159cac9ae68ed1475999cd31992094bbb708567b1fa4a6f5b2afb5e156b450a09718e54d2b9a185ef4f2063c
TLSH
T1BFB09B7346527452E5562FFD5468F648C97189815D518253D468536844253DF0515710
MD5 SHA1 SHA512 TLSH

Submit Download

14310

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\doomed\14310
Size 14KB
SHA256 a1da6e7d62efb22004a695b4036c871cb931502961a6fd8bcd0fb4e9a8d33e0c
MD5 a0b8b66bd048eb11e1b0bc2d49088dce
SHA1 a3c9b145aa25c91c84100f35d5d544f1ae0ca3a9
SHA512 a3c9c94fd0a2d349e2cbee57168a17429dbb173f61304a2f421039d4564442abdb7427d4d70bdf5c3787e957813295bb0c32c8413005800106212783721f3026
SSDEEP 192:zidoRuwxMj2o7hATWlxwxoF9op7wOtYv4g+Ev4g+n:mdoudawAFoF9op7/YvYEvYn
TLSH
T12A6244E4A822256C0B339E11E97A33D52830A166D480ECFEC475A25DD9E573733CA7BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30576

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\doomed\30576
Size 9KB
SHA256 f636804aaa954e142b587cf913a118d48e8bd49f87a11348c54808aaf8e130fd
MD5 8bd446be6f14fb34032e50cc54b4ed77
SHA1 ff91e673503a001ad14ee2ede771146c7b4c9211
SHA512 8ebc4aaf6590c49052bd26d86b038c405db9199997662c8c9ee99ac7dc4c818ee743f70af2b505b95bd5f664f2a5f0ef212db348050e54e519629e7656c2e791
SSDEEP 192:QK+FRgWaFYiVHjToRgWaFYiVHj4iumT2pPv3hmzK/h6bjpd9+jdY+u:gF7KYUjTo7KYUj4TmT2paK/sjz0hZu
TLSH
T1D5124CF35F21384F1E676A11928E1E544F52789BCFA1826ADD8C3984EF8C343153B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32628

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\doomed\32628
Size 129B
SHA256 455d80d4ef052bf18668f6aa935ba255a51ed280925024c6b32fd9affbb29596
MD5 43556d6592f4c472c994e1d343fe3557
SHA1 8b4996fc83e4ad7b9e704e3bd98f7e42d622b084
SHA512 32a2f4930f61b2ece193bc60e6687bf1d85b4223c49057b94b67f025484a1d7892844079a93acb21797bd042c4b6f88b2843830a5610733a2f7aa065d3ab7a3d
TLSH
T1B7B09B7349516552F1552D7D546CFA48997189454D514707D4A8437844266DF0515710
MD5 SHA1 SHA512 TLSH

Submit Download

6198

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\doomed\6198
Size 867B
SHA256 5054f12110e41bfa92d8f32110a12ee42159271d112d26b7a128b99b7225b831
MD5 aa9f99aca7ee27317f033f07fb437c75
SHA1 355539e73e2735ef95765cb2570cc077a46c2d23
SHA512 523dabdbab2e2168c54f8f93d31685cee96fcc58a757f9e6452e90a92205a234be2ccd51cc1d0497058acc9885ce5fa3c51c58b47d0558a33e0b5a886a181348
TLSH
T1A31115342633BC0A03F1386AD804750C8E137C27FB55B022AC4C1265641F2EEBA25B75
MD5 SHA1 SHA512 TLSH

Submit Download

7669

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\doomed\7669
Size 52B
SHA256 b9cdd34702455d6bce2882aa3add3f06e5f99aeaf864c163ebd54ece1ee0f5c6
MD5 ebaad55e9ab599882b64f142408f6520
SHA1 de4b58883acc8b67c41d85d35e91609adeffc7ec
SHA512 3ee80a48c5f0c195f118a116ce3cb2f86f0c6f0dfb64995457596c53477bbefbbe99db0d9fdcb83d30bb36f5a9b72a58cc99b3b4bdc2a99b179d7d05470e390e
TLSH
T1EE900405435FF503F05DC4350C00C0F554307D0455C0471F34D10F5344F11D3C100040
MD5 SHA1 SHA512 TLSH

Submit Download

26824CE25B243BB51DE52D8164FAFACE6310ADE7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\entries\26824CE25B243BB51DE52D8164FAFACE6310ADE7
Size 14KB
SHA256 ee2503676fcf13f7ba5a157805a3eda94ff995f67ed1f6680b4065063ffca076
MD5 7d36bea8cdd15e7f56d63248f89b9e78
SHA1 c4f87cef6e87f10dbb145ec97ec9cd2ebd1c87db
SHA512 343a06f3f579b4a8fae1135dd481f7a419416fa6c208f6b4a843fe3623faf8e8ca8800a476cb1cb1ffd74e5745eb2ba244d9ac6185455287719e3e4e6ffc2955
SSDEEP 384:BhT9hizpwUi4MOdT6aT6CNg3ShC3AC1Vf34B:ny1iwgfOC3AC1VQB
TLSH
T1EE629EFAAC0929765702B277D8DF8A482C1DF193CD8759FD5F58210294C91ECAAB60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3C512F24135E9987B612CE9AAE2082FD17BC3D5A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\entries\3C512F24135E9987B612CE9AAE2082FD17BC3D5A
Size 31KB
SHA256 8b64abaf5a3704e383c9011d356b1e55885e1458296c907ed3875d56d669b403
MD5 12c3fdac07b8673016aa4c090fad109b
SHA1 4446fb8e881e9110194af2f3d6627285daa7da78
SHA512 2a3e359d42e5274527ace95640bdcbbdd002ceeacb07a4b0a3f119027380b76c80029bd84d934002e994ced98bd10f0d7af564c0a0758e6f50d2079f88bce150
SSDEEP 768:v8ToA9o+NmJZ3kWmfDTnEpPRLpGF6qxKDaHDxJRj:OznNmDkLPnEbNGMqXDJj
TLSH
T1A4E2E1339D8850D5A90397CB50ED584C3D2C9792DEA3D3EE164E26828DC573F732E4AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 2b5c5f9f8c5c119c2c1ce1d06c280a4281597fbee3c2f46f2cf8408fd966df69
MD5 4993a80ee09db19d8c5cb7686d322c8d
SHA1 b9c00229f8e832eca378bf7a3f0fe4c8893160e2
SHA512 af9ba4a69ed532898e385bb400f48ae8073179c621cabcddc2e6379607c66d850cf78dd9413c7bd14e92fffbe1947ef900831d0bdc9e0312a22d6c7fd4a4dd37
SSDEEP 384:HalwSiO024YbWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMARL+BS+q:6l8ZYbWTToXJWTTogB7S/AmVAf+hRMY/
TLSH
T1A8727E7D8F013CAC275790E8C8BA83558D18B7A7DFB5C06D129C3E09CA84A6A71F944E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 f256db728bff7c3fc6ea2f61b48b0d660d654d349a4ab67f5809ee22f73e8939
MD5 ba368cc565779bda386bad40ba408d2d
SHA1 ffe6a873bc97e47e8ab90c1313b39c1b380ea54a
SHA512 7dd12e4a0be69b16691c0b86d4396a748907eed9824395887c7123e122209b2e5857f29115583976e000b2711f127318c7c8f6e7c52c1d5e67cd2066d5810ece
SSDEEP 384:HGNQiO024YSqWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA1:mDZYSqWTToXJWTTogB7S/AmVAf+hRMI
TLSH
T159729E7D8F013CAD1757C0E8C8B983598D18B6EBDFB6C06D15983D09C988A2A71FA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F08AF8370D02BFD65476CBAFF0DED2C48414B2A9

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\cache2\entries\F08AF8370D02BFD65476CBAFF0DED2C48414B2A9
Size 53KB
SHA256 7b24764ae0d3566374eef368a1b624b93953b67ce65d70e606d9eb1c5866c4bb
MD5 7b948346a1f2a04d0d069dbad184d5b2
SHA1 09157b1e8607f5286b65bbc6c4fe91b3c32e9e96
SHA512 e0077073fef3f1ddef0f9c3f661b535760227ae7bb51506352820f53cd4ce92d5b2c72e6c84b812207ff1829962c1caca2c240087069516359730f89a610dea6
SSDEEP 768:w8l3iT3FlggdXeihAZcuKzg6RG1CvPzN7gNr/JR/gtgB6PmFndoud3AFoFap71ll:DpiTH91hAozgmG+pcNrD/uGdy7VVn
TLSH
T1FF33BFE4B926267C27329D71E92E32D43D34A056D545D8EEC038929EC4D472B32DE7BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 733a5d542d3e336758d862017c9ac15069c22be791ddc9f04568ad27e73ddf5f
MD5 f7e5b7e86ce1a1daff70fb261b127b97
SHA1 59c2fb02f1b443653f2385406cde14badd84505d
SHA512 1d4d854cc503c1ffdc91684b563b493c308f08cb30593f87eee80fba3a2b795e7bdf8bcbcef372c06f03d4d131b05fb7a07ff428385db0e1f7da7902a8313267
SSDEEP 3072:j3liVngd3BXQEMMQcqJRcT8j+uHNOkrqqj:piVeBxHQcqjrjLNOkrqq
TLSH
T134A3A0FADFA3C93955FFC028AB82843EFD266404B3B73009D963775452C6BB86275648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 63d0809638fd162c1a551acb6970fb36dd6f9de1025c2d191be2be2f325e6b95
MD5 69ff282d74c906238b4b4e5c80fd7200
SHA1 b4063b7a6e529cf71788ab1b0afa0c1e043828be
SHA512 2777f36f6c2e0ff48f9a9216c84539786c9b80bc096187646e17966e0cfff5c7ae088f7ed00764ce08874ca2b99f3ae3bd47a162dd2227d3af929b21bff29109
SSDEEP 3072:X3liVngd3D+b3motMbvqJRcT8j+uHNOkrqqp:FiVeDA+bvqjrjLNOkrqc
TLSH
T1C7B3AFFADF92C93955FFC428AA83843EFD266404B3A7300DC863775462CABB47675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\AlternateServices.bin
Size 18KB
SHA256 6e5e554201655c71fb9c27cdd052fd6eacf027a2eca180f926c87df93ec4deed
MD5 a3f565e9ded784ccb3c003568158f291
SHA1 eae212ceae3ec40293571d6304f1d959bdff645b
SHA512 5bd7f4187cf94ec6a775dc010a3ac8f4f23e45b429669495ab2690fee7fe092b014de3f546f5eea823a04a244747cf8c6b783790727d3f4c503b932325ca20d6
SSDEEP 96:7A84w5dJxPIzgCamWzzKtWLXGgGbG2aRoF8X2+zAZckBUebvK:RKt+RouX2SAZrBUEvK
TLSH
T18F8209FF12B36562F0618FF504BC7488AE7313196858915CCB8580EA02957EDE2EFB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\AlternateServices.bin
Size 18KB
SHA256 66e9693f1bfda2be0dc5a39bf0f74480e6f8d837d5bc77a6162d1b5f7c304693
MD5 b895a7ecffc4875a1c64c11b8151179e
SHA1 774864ffa4140613d9859d9459148e2d7556c3de
SHA512 968cd9e2d75984e1b28b1ad2e8c2cc3d580e5c42a224f4cfe4c7ba25b1e409272b1b9de9e066687e2accf78dbe0cf44b89fd719cb4edf1f32c323d68020344b4
SSDEEP 96:7sykZp84w5dJxPIzgCamWzzKtWfaRoo8X22zAZJkBU9EbvK:FKtnRojX26AZmBUovK
TLSH
T1FC8296FF52B36563F0618FF504BC7488AF7302196858D15C8B8590EA02957EDE2BFB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\AlternateServices.bin
Size 10KB
SHA256 7623a46f85dc107f628b1d9b222e72adee3f87e24efd543db9b85b8d5d2befcf
MD5 08e015bf27aee1e3860d6a05317c51e1
SHA1 df1242cb427fce947118c1dea22c50fde50888cc
SHA512 5514471add88d0070c6d17b1b04eb67822244875e7b4635862a0365c110599efd9336a59d5e3b03503272694a6122c1107e946a575b9123fc4999b5c8d3f007d
SSDEEP 24:7BuhMZECNyRqhBTReRf6Y8+lz2KlaiG1alqolGPPqlKezoAbl6T8PlQt:7XC4LOfp842M41cbUPPs9zoAhY89U
TLSH
T18322D7FF42725461F0518FF640BC7488AD73161A7854C18CCBA680EA41957EED2FFB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\addonStartup.json.lz4
Size 4KB
SHA256 28533dee6dea5860982cf4f2ab3d33cdb22bf3319890382a67fc16ebe9c82a78
MD5 abd0f9ec86de7640361cf0b1580af5e8
SHA1 220d79f414f7c7c12fe88d524d7b2c6f674d6785
SHA512 56aefdf37bee778e82b586e09a8a6bc89dea5d59723aaf39e3834f5e6444f68c353ad6ffa9fbafa0f9741c9ba0d17b7a0f49fdfca2d17d61ae279f35c6aee8e0
SSDEEP 96:NbDv4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhT:NbO52xxhD8rGvm6ApwnHT
TLSH
T19CA18F76D585EFA2FE21C0438CD93FB2EAD56B7424B9C4D4F1AE72250C24D631704380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 b6ebff481b7ae1a098a2a8faae1bac445334228fd93a3954634cef7809eadaba
MD5 b5d9d8485d831a0c93d66ade72d82278
SHA1 861f7be14369d8bbf245b7f5f9f7d0f598e92dbb
SHA512 78618ab1c9fe53141f5cda6660da378096b601a6dd7a5d5015de387229ff8f190ed136f616b2b49f974bcb83083ac9484a4b642838fdaacd0ed3d5ae8b0d1218
SSDEEP 768:tIY2R2ZrWYFWZjrw18JGcmhucwRo55nKIUK+2ToobJbUb/bSHsZiy67yv5xPr5B+:P2R2ZrWYFWZ3FR85nBsiy67yv5xP2
TLSH
T16F63AE94DF1B407BE91095BBF4946B7C1635B4204A959B0B36EC04662DCB3FF2D0AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0e2d5e44d3eb4fed19e6bb947ebaca77a77786e033b1bc298603e02a1cf2114b
MD5 a7288a50a946299881de3dd53df314eb
SHA1 9f86359dca53106dfebcf4c6f719c441b15b278e
SHA512 9555380aa04060b9310b65ba8c04d32ba2e6840920da33eafad1ec7f791e437ab49a9b97884a8db89cb7db4767d5bceeecff1c633f0e0a39d208c3e9ee4ed468
SSDEEP 192:m1d66JozGzgCl6mc0dTOv5zboPhCoyjbO:Ad66JozGzgC1jyboZCoyj
TLSH
T175E13F64E728867FC418037BDCA60B454F39388A9C4E3F1931AD644C2D576DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a1fbd55c9b68403f8227adbbc1bf1d299cf220f1a70b478d6e3024ab762db33a
MD5 2eefd2ee10f896f9c7fc8f16474e118a
SHA1 438e3934e253d47ead399ae9fa78bf351d7cfdcc
SHA512 eaddc746ad5b2447bccf0bdc3db9d8a2a294eafa725695263585b620622ecab719798faf3cd3b7e7d29e960a758c6de914900bc7fa4000aa786d50afdb48c096
SSDEEP 192:m1d66JozGzgCl6mc0daOv5zbombCoyjbO+:Ad66JozGzgC1j/bombCoyjz
TLSH
T11EE13064E728863FC408037BCDA50B454F36349AAC4E3F1931AD654C2D5B6DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 38342b9ac2ba724af8104eaf909f0f21774d04638c8b6ec71c1e63204a2f38bf
MD5 f937458145458b46461538c5c84129c9
SHA1 dbcd695759d445e3d3a5a5329cf5cd0b2f07b673
SHA512 0a243ea13f2cb86625248046e5f1fd911aa156e4d5a64232cb703e4a3cd21c54754617c2cda8a29632575f4638bd0a5896d03f38ec448e968e65b65ee663b238
SSDEEP 192:JOv5zboP+ZCoyjbOd1d66JozGzgCl6mc0dz:GbomZCoyj2d66JozGzgC1jd
TLSH
T1C9E13E64E728867FC408037BDCA60B444F39388A9C4E2F1931AD644C2D576DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\events\events
Size 4KB
SHA256 82c44dd9f829e4ba9bb170ea924d5408580d0d00446a1b4732642fdd774e3a6a
MD5 d86544b8083ab77cba41ae1457483392
SHA1 9e5e8016c9830b2ba8ed010499ea88f71484834a
SHA512 2c544a5f903460366ceb554e08391d32094be40937bb6adb81834ed7672fecc5f414dd8749087fc5d846189dadf54b8488055b7e8160726baedebdf88d2f4e34
SSDEEP 48:YE12YYAomJRPqyKNx0i/tEC5roTjJLfTuIZaDH1RDi/XUD1eC1Z3ute+i/A8CRJK:VGEc2jFpDkL0B8QJxvCWMjv
TLSH
T159A1CF1C71BA1C7B29DBE7DEB446028C5BD5474398CA1D8B4CC6CE4C8C8AB99335F269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8875fe90ebb9c7d4edae8f6a56d6896b358edadbace26abbe1d45af652803b1f
MD5 9a2414b9c00a0324a61dbfe78725f8b6
SHA1 84152cac50b7f2f58b55f4874024d62601c67ecf
SHA512 2cf55b615d331015dec74c745170d62c12affcce7ede70c69702755a9b0d00fd33c9eb026469aedd8cee392fe82b8d0ec581b5e07ec052754697d3d73d8d3c5d
TLSH
T12821495C39B84E2B9CCBE69D74D1028E67954E0B15871C4B0D92DF8DCDC1AE932AA63C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\events\events
Size 2KB
SHA256 249efbcc9d96d64bfd2ae923e350861a841ff387ec45ec02aa3e4c13c1b666f0
MD5 5a7ed649ef3a70efc6340f155c69317c
SHA1 7ec6beeb91bf718083834898ded7b261934669c9
SHA512 37c8c882fac18b915c4f67764a958045d4652589c9ff61bc5efa9a335240606a8c75e3e5a91fa59c246e07513dcbc448b43f0ab533a4d54a4941a562bd04598e
TLSH
T1F351BC1C21AA4D3A68CBE6CEF482064D6B954B0654872D8B4DC6DE48CC86AE9325F62D
MD5 SHA1 SHA512 TLSH

Submit Download

1959d905-506d-4954-b605-cae957492196

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\1959d905-506d-4954-b605-cae957492196
Size 280B
SHA256 6302f452f439ef110963be091f93e0b49fcd2a29b038a58de85ddbb7c69b3e9b
MD5 98c0dbfc617f677358e6164868c2b0fc
SHA1 8e5ade8fd694c5de34b9b35485557644c190cd8f
SHA512 89d05ae65db830004bd91ffe9828bd46b54f1411b811e7a0292fd30a80e30e27cd5719e4c9d7b7b23aa33aeb201b561b0a84cac5b8aa4b3f15c4530b5507db0b
TLSH
T18BD02BD42898326E4C684F0BB1F079D774794C3360F59800D59106B45AFFEC9925185A
MD5 SHA1 SHA512 TLSH

Submit Download

24d8c06b-d28b-40ea-9361-afd60fbe19bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\24d8c06b-d28b-40ea-9361-afd60fbe19bc
Size 2KB
SHA256 0c558c1a2b592c2b567d1f4a76e14cc5ce37406c90ee4c3d97736d275bf99aa6
MD5 030b60313bab70d3b8e44bd96c45f4da
SHA1 245763aaf13c007159229dde0af18486d8070c30
SHA512 9c5e6bfdf4f1a7a2ad7740e457b19e48585ffa791ab7a90c79c068f4293107d3fa9dd79362a9b8b46d250d9e8cf0671863911899eb313970c21ac87a28156e14
TLSH
T17241335C76B44D779CDAE54DD441238E53B08E4B00C61C837E52DE0C8DE679D376A52B
MD5 SHA1 SHA512 TLSH

Submit Download

63dbbe93-c2c7-4dd2-a521-84cd49fe3df8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\63dbbe93-c2c7-4dd2-a521-84cd49fe3df8
Size 883B
SHA256 a0cbbf64187c0a43f42ab4d44dc8f16e8a29a2c1ea921764532abe3a48ef6f07
MD5 106e79bde2c3f51015560071d041c905
SHA1 74dfed9c41fa50ef807a8e771fbb9d0d72f49042
SHA512 5a126e9357a0721680825fe006df5d388c73674ae5de84ee1ce04cbbb98d667775e1589c03e7501e9a9e0f9069d9b81cb127975ee6d73fa733b4405e29cc5d9c
TLSH
T1FE110041E631B8B3DC78C24BDA51B74687F4716380C645183DB55A180DBEA0D576B647
MD5 SHA1 SHA512 TLSH

Submit Download

abdac576-6154-4b8e-a9ed-d6d77604b44d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\abdac576-6154-4b8e-a9ed-d6d77604b44d
Size 931B
SHA256 db090f27a0c25c6ef1ff7e2558fa969b0fb6f7b04a7ef80fd0ea234b406f3915
MD5 27588b023fbfb3907447c74d950c41a0
SHA1 f3880c2fc4a73b0007daa70b4e294a59223cd174
SHA512 3cf2f2642355ad98d58ad8c02cb791438def6ed5e4a30601cd884ec7025455ca6ae035d6070c72cc6a640220c725cb95abcdf7384aa0a9aec57aa35cfc1ce8e9
TLSH
T1061110409621B8B2DC7CC387A5A1B796C7B16063C0CA09083D611B180DFF61EA75630B
MD5 SHA1 SHA512 TLSH

Submit Download

af448251-4fe8-4d42-9e7a-c00cb46cb93c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\af448251-4fe8-4d42-9e7a-c00cb46cb93c
Size 15KB
SHA256 eb870104e3501bbd55f8a384481c4bbd43fd78363955695bac3e322e145bd22c
MD5 80d7277a3604a2cb10a12ad64e8a5797
SHA1 284a677262c261d73a143ed20499bf5ba534bf6f
SHA512 5fe18bb7b94f9348198e3505f96688c9dbb78e6f42094d4f709bf81520c2ed9d2d7b73f3b23a377e556708548fb851089f1c34eee4c77aa5937dbca5282b1da2
SSDEEP 192:R11qhUBa57IqP9QGHwR6pBXBt1/7R8bzyYPFif6kxnDXtfH7H8xxvz:MhUBadIe9Q+wsfF7R8bG4Fibbcf
TLSH
T11462D8556820597E8691E368D8ED7FC3E2F118CF4C019FCE9BE4BE4859EA0AD1127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0c3d018-4a18-4a92-8905-9d9b50685986

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\c0c3d018-4a18-4a92-8905-9d9b50685986
Size 27KB
SHA256 056edd6c7163e594a4184c46c61d8e7dc588614ad9a6177b5b62e6f0c35713f7
MD5 388018e873313b93b5468413aed39472
SHA1 736dde6a6f1781e5ffba85f9657806580c9c0f55
SHA512 9f403a3e89b7aa3b1d4d9a4a5585007a64eb030b2c9932f9166b6f7297a5ef9074a9a1927d0cdccac8c107a38284d2f40d9477cf7b8c29ae5b7f687009341d14
SSDEEP 768:XOtn67/4qoRP+hedjM9ScRI7HhORlqxtJxlNYUOe6SG0kKdXKCeRT2tkI8shwQs:7yXg9DqORlAlGUit4koS
TLSH
T1AAC2DBFDCE1240473E65E21EF2A6ED6B2067193209CCC7DE69FC483A26C697B1527718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee9c2628-adfb-485d-9c80-a897f49534eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\datareporting\glean\pending_pings\ee9c2628-adfb-485d-9c80-a897f49534eb
Size 235B
SHA256 c3ab4f5a498862ce03f553a8f7c9d625925877603f1a68c320378f3741487423
MD5 5c16d07019621614bc11aef4f70edf16
SHA1 40dc72c266eff968732b73fb1865dc1eab97b5ae
SHA512 e67ffd0c4339eb1ff5166a018a86331297e681685c0ff5ba1f44bb8dcdfc15ac24d549f7f75cce51913466262b48de81be40a17c690908b7915b0c5396ca1c20
TLSH
T13DD0978428887B2C48240F27B0A069CA71448C3310B8A850F95106B8A9BDEC41251A1A
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\downloads.json
Size 851B
SHA256 bd95f08250766753034a70e1a389a00cfa41190bf7ceb5408a1ffca7f6de19a1
MD5 dd16f2fc920f7b4c5d65d4a5fdeade38
SHA1 b15482f822f8c123b9e32e9dc6cf2c668f94eff3
SHA512 5a37b841e95578b090b7c4194ff9b4789f9a0b3d8206b9c23850f7a9718cf8d14704f4a25cc9296f8f7c50fbf944ae4e0b06e14f0244610124ce373ddf0039a3
TLSH
T1B50112F56C428DAAAB610EA4253C2F52AD70A11B87C8406C36CC8E559537835292B87B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\extensions.json
Size 14KB
SHA256 7a302584eb499e1fcdaa62808b93b6a60dae733b3f3a3cc852bda91c992d2f38
MD5 4b1e13d55fd52d2d74411d58e8d1870c
SHA1 29a6cbe15654e3f04cffb3a640192a790e198a95
SHA512 d5950a6bc0e7cdb65d4cf7b048eedc3c2c820a8afb7e05fdaa51c8939bd41dbae53942aba1a9822b144f60a9651c60126123b130b37d435e35fcb561b868b29c
SSDEEP 384:qkI4vLUmldv68dhWt94zW96oVL4HvL4PvL4HqL4H1L4Hd:NI4zRffXM4m664T4L444V49
TLSH
T19C62421545049EB82A8FA78BAA367E01C37D473B60445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\places.sqlite
Size 5.0MB
SHA256 6c8e0fb331aa65d85c72585c057f38596d52525bd89e03739da9e3a9a269dec9
MD5 c3e10b8926016ce5a2eb9a45c72527bb
SHA1 6ca5062c0cbcab79616aa9d9d229b2acd0443942
SHA512 481fb7510ec01d1e71a230a0e698d711c87c9938e518e38b7a275adedfaa9c7461738498ef9b6e4022022232ac76b0e8222c65381a9b31062e83abab5eda49e6
SSDEEP 384:M8r54w0VW3xWYvS8hMchsWWHuMnWOn/lz:rqVW3oYvepWan
TLSH
T16436855F7A201059E5DE9232ECE31F14143FB016D932B68239D4562D8DE0723B99DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs-1.js
Size 6KB
SHA256 0442bc72e8854181a42a5d97278a9df89e813db1dc4b62361ae82c1a2ee3299e
MD5 f646a5842727e21ebdf0b4d8de188593
SHA1 ec4bcc7351fde2122251726cf4e5629454734b3d
SHA512 dc8ed8f4a9b51c768ec14bf06936058bfbecf605501c39d95114efc34b862ac4925ac398712e8b51f39c96452d45c2556b8655e65032bde8624e5d6ccde44d91
SSDEEP 96:xH2UTU7qGqEvfnvz1zSznSSlSdv9jcWnPHEBDBw88n8L4cnlu88:EmRafnvzCnSSKEBDBw88J
TLSH
T154E12E789448CB7F64B6776C6C6888316AB2013BBBBF28C750B554C5011CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 6KB
SHA256 d10f22a8deb5e5a8ac2e4b00d61f40a26a0e0a91184d1d3d1430cb464c5b4cce
MD5 69d9eb1bceaede5d803f21cf16370e33
SHA1 76524231fb25ad8090b84f23630ce5c28bc0f7d6
SHA512 9112673684fce924eb5f5ba286957e935b2f9cf0b7eda8c735f5ece21d1ec52221a114a0da4037cb726e3028613cf7e47eb50331c10dc8cb3269e147303a52cf
SSDEEP 96:xH2UTU7qGqEvfnY81zS+SSlSdv9jcWnPHEBDBw88n8L4cnlu88:EmRafnY8bSSKEBDBw88J
TLSH
T14BE12D789548CB7F64B6776C6C6888315AB2013BBBBF28C750B554C5011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 12KB
SHA256 d9f606800acb91ae3ed357206084ef40cd69c815946fbdc0b49800e572657b49
MD5 83526e12bc44dce9fbcf2784a4eb7af7
SHA1 a775dfc130236169bd1d9f6bee2699bf02573543
SHA512 f93e2539dbac6c7397763da70a73ba74d9af8e79df70fd8856d72956afe5613f8276f9b8c76b9c783c346fd35ac500ae354d76a8026d9346b195a3d050cab265
SSDEEP 192:E7CRafyvz1nSS/cLRjBZOBw88hquS0i81RfX2C3Nf7iuW+SsSXN1Z7E2mRx0tftH:Uk0RFmw8yE
TLSH
T16C42AD385045DE3F20F272BE6C2549702BA14227BB7FBCDA45F994C2445CF2442E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 6KB
SHA256 9d6cc8154d3431a5a485279c41d8db84d3c5c12ef692c710d3e100cb9f0c8b24
MD5 c71586052699ad869a3eb2c64f4818e6
SHA1 8ff30ceb201c586756e977d60fea952d6a2997ac
SHA512 5997ace20132eb57e1a25f8756abd828992052ed3844b3a4ba61c81dca7904e38f7ac50ae5a5de1a892c4541c071bc2b14826d20b4fa6dcfb0d460f6d9a81e18
SSDEEP 96:xH2UTU7qGqEvfnY81zSznSSlSdv9jcWnPHEBDBw88n8L4cnlu88:EmRafnY8CnSSKEBDBw88J
TLSH
T153E11D789548CB7F64B6776C6C6888316AB2013BBBBF28C750B554C5011CF3486F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 8KB
SHA256 d6196c65e1fbd2c6a8252cc2c1e9cdf1b89aef59382a18ca0c6dcc8105faf5e0
MD5 31e83c35ba3887e41e5be5e632c8031e
SHA1 4e4bbe1f7f6a0a11db84e867076a0b20c78ae491
SHA512 97dfb028d9a7710ef53d9e78c9ecf96fa7da36f487013f9f34e7785571c58e3893b7116a03d6596b9e8f8b5bd4aacd62906ebb8b0fe6aca85f7794c72d9be45e
SSDEEP 96:xH2pTU7qGqEvfyvzObzSznSSlSdv9jqtgnPWRiIBYBw88RrQ37J8L4cnlu8pGS:E7Rafyvz1nSS/9RjBYBw88R837c
TLSH
T12302FE785044CF7F64B676AD6C6888305AB2023BBBBF68D750B654C5011CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\prefs.js
Size 7KB
SHA256 9515c728ef311c12cb163d01904cb30a95daeed03497bd20b7a4b565793f722d
MD5 064aab989444d5b17955cb7094841a65
SHA1 dcc41b49210dde02d185cea3bfe547b2a12988f7
SHA512 8b24afb586e4f178c4f6d16f3d4b72406bbd994d9734f7572bc852ccb8291be319a36a0e4f2f1f2cf8bb25a08aea146fec2b6cca196c7448f97d0e500e7c745d
SSDEEP 96:xH2UTU7qGqEvfnvzObzSznSSlSdv9jqtgnPHEBDBw88n8L4cnlu8pGS:EmRafnvz1nSS/4EBDBw88C
TLSH
T107E12D789508CB7F65B6776C6C6888316AB2013BBBBF28C750B554C5011CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionCheckpoints.json
Size 228B
SHA256 db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2
MD5 a0821bc1a142e3b5bca852e1090c9f2c
SHA1 e51beb8731e990129d965ddb60530d198c73825f
SHA512 997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be
TLSH
T14ED0A783C6055075CE83696CB39C7B519E3E04F672640245B1AC954C187F027414B843
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 13f3f01622ce0e4a84251e928f6ed08b55ff02f4fca0588193ce182681282df5
MD5 e97b48c15c9429406b93b5e26eacf396
SHA1 075238fb76cecb4460d6fc88ee4a615485bcffdf
SHA512 a2f0b395be10ef3702f8b1122115a5a7b70a685bd3e3bffe4742d893d3a18b1b9bdd86b75f19cd245e4d0e03cbfb9f2d12ba7bb7222de52ada60c01869eaee68
TLSH
T16B714D5B786B2DD2DC793CB580ADDF09A7CB24737D5254909E09CEF0848124827CE26C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.jsonlz4
Size 10KB
SHA256 4ae4f40dda2c9003c2266dc5dd6a1e61a54203b8690c77f896432948f4f6ffed
MD5 f9c9a03381cc1520ac025253dd312af9
SHA1 1c3034792b8435f030eea5bb70d52fe8886b276b
SHA512 69f07f21b02adb287c8be1423e26d6ef7b30db327db06d6de7391601a369aa00e7b97242070d47997dfcb2bcfeaf959008ba2fc2f37484446bc4ce9db9fd6381
SSDEEP 192:m7zoZjbL9r1RZfotL3t5bfiPEugtdSyWqrX6dMufzFDTaxvhx6T6SWhAsjzn42sk:m7zoZjbLh/lotLd5baROdSpqrOMozFnM
TLSH
T1E2229E8E3DA63F864C383D1780CDAD0D3B671B26BB361C41DB8F66A0C0983485A58399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 0be502663b6c65be62df0ca14e156bf9caea2989cee8300bb1a0604d0ebd0d73
MD5 5eb301a14010b39081be28c5d8531460
SHA1 a2151fb5ee4045ac543248500900dfb41343c51b
SHA512 e35766ce1fc653fa2e5c583de377785a7e796c8fad92632acf592c162752d84c4e4ec5213f48bd8ab29c52b04c939faa7d73ea3d84bf7bc91c321e563d83f78f
TLSH
T147713C9B686B2D92DC3938B5809DDF19EB8B2573BD5258809E1D8FF5848260836CD26C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 e40664aaa8cf34ad62edc2446163a69aad86b0afd4836d7d954a339b768c25a7
MD5 a8b1f6aecafb3045c9ea23587416b48a
SHA1 82ccc4197a789c6d4f176f06a3d32e3e7648aea3
SHA512 8ddcef95d8c74c44b6c619c4ea0f26317cef58b9cb81fcf02faa87ba9a7e625403ef10bc69e8763800ce06c01296283641f9d877527733f11b40c110aa0e4c8d
SSDEEP 192:T87zov0X6Zz9S1UFPQMcEOvhx6T6SWhgOjz3424lY9x4w:g7zov0U8CPQ9HC523mlEiw
TLSH
T147D18F5E68673E474C683CE584CE6D89779767A27E127C50CB0B5E74C8C520864DD38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 2b138a00b92bed7a6c63784dfdca92c0d67684427b648d1d89dd26980494a554
MD5 f211c8688817fa408d51be5ffa00ffdd
SHA1 62ba884515ca51f988f1aaf5c6a5ca918ae0299f
SHA512 700689775769b9e05e1e4ec6c5630f742b36cccf1c5c374887521ddbc85c3af55a8869fb06ec853618c036539370afa6f34f9cbf97ff46745b9e6ee5f9747e55
TLSH
T119614E5F74172DA5DC353895C49DAF09E78764737D1318908A5D8EB188C11492BDE37C
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\sessionstore.jsonlz4
Size 10KB
SHA256 eaa69936191621d0e36f556b945dd545c16b312fe57c9cd125530dfff3d62b48
MD5 6ddd77dadfb6911b9c0ac22f335120f9
SHA1 683c841f8d8c7db0a238c5ecd0532efc31da71c7
SHA512 3c9dbbad67cb79681ccdebdd7304c3f0ed5a30b8fb68ca208a6b800b5b4086686e950490e68d74d303a5ed551b26083a0a7e794762d8feb095fbedc2138ab68c
SSDEEP 192:l7zoZjbL9r1RZfotL3t5bfiPEugtdSyWquX6dMufzFUVaxvhx6T6SWhAsjzn42IZ:l7zoZjbLh/lotLd5baROdSpquOMozFkz
TLSH
T1FF22AE8E3DB77F8B4C393C1B80CDAD0D3B671726BB361C41DB4F16A080883489A5D298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d37b1bc4-3b63-49e1-972a-280ff7935002}.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\storage\default\https+++goo.su\cache\morgue\2\{d37b1bc4-3b63-49e1-972a-280ff7935002}.tmp
Size 30B
SHA256 4a38c72c57c21f7ef1778ebbd64965f8732f873853d2f170f1809b10bd95ad0b
MD5 a97e3dc13a5b5885178910fecb24b38f
SHA1 054f6354e38abbb321d2fb9b6fb0e5809ede6f22
SHA512 d48bf7c43084b455547e0d361907b35c99651009c18c7fe4dcddcbaad11c5ff5430a7017f3acc672e3cb1c507666c10e1eadcb1ef8ef7d83a6dae14d6ad2bcdf
MD5 SHA1 SHA512

Submit Download

{675c9e60-1365-4c9e-9f72-e55cf2ec0947}.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\storage\default\https+++goo.su\cache\morgue\71\{675c9e60-1365-4c9e-9f72-e55cf2ec0947}.tmp
Size 52B
SHA256 1e4beab3e0e0daad3d83c6b69a4383fb64a024abee0a00b4e7f8924f04936ed3
MD5 591c5ae194e34851d2ef20b5f6e28a31
SHA1 811b4ed33ead0df0b8aa86a2a8f197b6a4f09013
SHA512 07c6cac75d468214049c5625f5c5c4679f364fe0319135ee6769a4eedf18f32b8d652d7a23e8941bfd1940e1ac00ae0138bab77687fc6fd612253de3d2c9ecd7
TLSH
T11A9002C351571C58106D911CAE5B54298002A164A6134870A88590D61950B5D91E5D85
MD5 SHA1 SHA512 TLSH

Submit Download

2526825711mBaD_lPeix.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\storage\default\https+++goo.su\idb\2526825711mBaD_lPeix.sqlite-wal
Size 16KB
SHA256 7082b18cca46079fb98b1f9f4389d2490c087da662028ab49b11ab2ec34999c6
MD5 69c2ea356f8f6d1a95bd4e278cb1302f
SHA1 b3e1ae72caf3b7233e4d3395e38d2fd1b118265f
SHA512 cd8d13f008ac3b64e0eef8ec487a269714aba521902b099d72060952516a9e5d16d233b1666a0b9eec967ec8012b1ef2a7abaf64c821a33cbbad90fe7bc4f769
SSDEEP 12:KTKGK2F6TKQlsnPKAHhEKjFKQtquyDA6EKjR:KTKGK2FMmnNu1R
TLSH
T13C725CE103D8E7A4F1A9557CBA07B1D0B340DC18D504068A050191F594FE50D46DFDCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3285085342rcbn_ys.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ng7xsgm0.default-release\storage\default\https+++goo.su\idb\3285085342rcbn_ys.sqlite
Size 48KB
SHA256 7318030afd8106c7e01c115709b50aa28720d90d00e3428cab61d5f5557215ce
MD5 26b28fb157254efd6be53aafb61d1b0c
SHA1 ab1ecd73823ec7d89a22778b3e754bec02b58d4e
SHA512 dbcdaae98ede2f2eebfed59433d9678f414ee46e614fb83686d274e4797a2f8a9ef511245fd5ef8f2faa063bcfe5a27db236ec8249076d8e89f65ebb53752965
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:Oa16S6CKnqlizbxV+2xVeU7X2B0
TLSH
T164236D8E3F07A511C53AF0B178A08D51BC5E321E07222AD579D0DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download