hxxps://zuehlkelife[.]com/v7sd8fzf5qs/index[.]php

Resubmissions

09/10/2026, 18:04

261009-wnq1vacv9x3

09/10/2026, 18:03

261009-wm1tnacv8x3

09/10/2026, 17:55

261009-whpwlasz3n9

09/10/2026, 17:54

261009-wg64gs1ycy3

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
163s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://zuehlkelife.com/v7sd8fzf5qs/index.php
Sample261009-whpwlasz3n

Score

9^/10

discovery persistence

Malware Config

Signatures

ClickFix v8 — Suspicious named pipes: CPFATP_ (CLR profiler abuse) / Sessions 13 IoCs

resource	yara_rule
behavioral1/memory/4764-717-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-718-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-719-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-720-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-722-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-723-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-724-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-726-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-725-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-727-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-730-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-738-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4764-748-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2

Durable RSA-1024 CAPI C2 handshake public key (modulus). Cross-wave anchor. 13 IoCs

resource	yara_rule
behavioral1/memory/4764-717-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-718-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-719-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-720-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-722-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-723-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-724-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-726-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-725-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-727-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-730-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-738-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key
behavioral1/memory/4764-748-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	Omegatech_WP002_Durable_CAPI_C2_Key

Durable WP-002 RSA-1024 CAPI PUBLICKEYBLOB (e=65537). Runtime-resolved in PowerShell stage; modulus 14 IoCs

resource	yara_rule
behavioral1/memory/4764-717-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-718-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-719-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-720-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-721-0x00000116EECB0000-0x00000116EECF8000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-722-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-723-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-724-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-726-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-725-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-727-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-730-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-738-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key
behavioral1/memory/4764-748-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_key

Embedded CAPI PUBLICKEYBLOB carrying the DURABLE RSA-1024 C2 handshake key (e=65537). Client RSA-wra 13 IoCs

resource	yara_rule
behavioral1/memory/4764-717-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-718-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-719-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-720-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-722-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-723-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-724-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-726-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-725-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-727-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-730-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-738-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8
behavioral1/memory/4764-748-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_CAPI_C2_rsa1024_key_v14_8

Embedded RSA-1024 C2 handshake public key (CAPI RSA1 blob, e=65537). Client RSA-wraps the AES sessio 13 IoCs

resource	yara_rule
behavioral1/memory/4764-717-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-718-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-719-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-720-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-722-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-723-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-724-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-726-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-725-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-727-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-730-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-738-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807
behavioral1/memory/4764-748-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_C2_handshake_rsa1024_pubkey_20260807

Fires on any WP-002 chain component (prologue OR durable imphash OR embedded C2 key). 13 IoCs

resource	yara_rule
behavioral1/memory/4764-717-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-718-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-719-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-720-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-722-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-723-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-724-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-726-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-725-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-727-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-730-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-738-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8
behavioral1/memory/4764-748-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	SL_WP002_any_component_v14_8

WP002_durable_RSA1024_C2_handshake_key 13 IoCs

resource	yara_rule
behavioral1/memory/4764-717-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-718-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-719-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-720-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-722-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-723-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-724-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-726-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-725-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-727-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-730-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-738-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key
behavioral1/memory/4764-748-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp	WP002_durable_RSA1024_C2_handshake_key

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2348	TRACERT.EXE
1496	TRACERT.EXE

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4764	powershell.exe
4764	powershell.exe
4764	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	2956	firefox.exe
Token: SeDebugPrivilege	2956	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe
2956	firefox.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 2956	4668	firefox.exe	90
PID 4668 wrote to memory of 2956	4668	firefox.exe	90
PID 2956 wrote to memory of 5492	2956	firefox.exe	91
PID 2956 wrote to memory of 5492	2956	firefox.exe	91
PID 2956 wrote to memory of 5492	2956	firefox.exe	91
PID 2956 wrote to memory of 5304	2956	firefox.exe	92
PID 2956 wrote to memory of 5304	2956	firefox.exe	92
PID 2956 wrote to memory of 5304	2956	firefox.exe	92
PID 2956 wrote to memory of 5304	2956	firefox.exe	92
PID 2956 wrote to memory of 4184	2956	firefox.exe	93
PID 2956 wrote to memory of 4184	2956	firefox.exe	93
PID 2956 wrote to memory of 4184	2956	firefox.exe	93
PID 2956 wrote to memory of 4184	2956	firefox.exe	93
PID 2956 wrote to memory of 3056	2956	firefox.exe	94
PID 2956 wrote to memory of 3056	2956	firefox.exe	94
PID 2956 wrote to memory of 3056	2956	firefox.exe	94
PID 2956 wrote to memory of 6104	2956	firefox.exe	95
PID 2956 wrote to memory of 6104	2956	firefox.exe	95
PID 2956 wrote to memory of 6104	2956	firefox.exe	95
PID 2956 wrote to memory of 6104	2956	firefox.exe	95
PID 2956 wrote to memory of 4988	2956	firefox.exe	96
PID 2956 wrote to memory of 4988	2956	firefox.exe	96
PID 2956 wrote to memory of 4988	2956	firefox.exe	96
PID 2956 wrote to memory of 4988	2956	firefox.exe	96
PID 2956 wrote to memory of 5452	2956	firefox.exe	97
PID 2956 wrote to memory of 5452	2956	firefox.exe	97
PID 2956 wrote to memory of 5452	2956	firefox.exe	97
PID 2956 wrote to memory of 5452	2956	firefox.exe	97
PID 2956 wrote to memory of 6004	2956	firefox.exe	98
PID 2956 wrote to memory of 6004	2956	firefox.exe	98
PID 2956 wrote to memory of 6004	2956	firefox.exe	98
PID 2956 wrote to memory of 6004	2956	firefox.exe	98
PID 2956 wrote to memory of 2044	2956	firefox.exe	99
PID 2956 wrote to memory of 2044	2956	firefox.exe	99
PID 2956 wrote to memory of 2044	2956	firefox.exe	99
PID 2956 wrote to memory of 2044	2956	firefox.exe	99
PID 2956 wrote to memory of 1784	2956	firefox.exe	102
PID 2956 wrote to memory of 1784	2956	firefox.exe	102
PID 2956 wrote to memory of 1784	2956	firefox.exe	102
PID 2956 wrote to memory of 1784	2956	firefox.exe	102
PID 4764 wrote to memory of 2348	4764	powershell.exe	105
PID 4764 wrote to memory of 1496	4764	powershell.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://zuehlkelife.com/v7sd8fzf5qs/index.php"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://zuehlkelife.com/v7sd8fzf5qs/index.php
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1912 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {cba3689c-aac0-4fc4-a8fe-0504c8e9be11} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27133 -prefMapHandle 2408 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {abe0d9ed-f6ca-4070-956c-b3c42aaad9a4} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 25213 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {a7591b7c-6e72-40cf-9284-19fbaeac3d45} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27323 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {33c40fab-68eb-45cd-8dd1-585accf7425b} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4356 -prefsLen 34822 -prefMapHandle 4360 -prefMapSize 270279 -jsInitHandle 4364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2972 -initialChannelId {eec6be49-8700-464d-9fb3-0811cb9d836e} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:6104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 34957 -prefMapHandle 5060 -prefMapSize 270279 -ipcHandle 2708 -initialChannelId {285e2292-b8f4-4ac5-90df-090c4c061c61} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 1488 -prefMapSize 270279 -jsInitHandle 4788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3192 -initialChannelId {444634d8-9deb-4f60-b51e-0a4ae14e68d9} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 1456 -prefMapSize 270279 -jsInitHandle 3248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {5e119e93-b410-4316-a0e5-727270c6fb07} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5976 -prefsLen 32952 -prefMapHandle 5980 -prefMapSize 270279 -jsInitHandle 5984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5992 -initialChannelId {e6ad3bfd-bfe0-466d-85b7-a0fa0e567148} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4832 -prefsLen 37462 -prefMapHandle 6352 -prefMapSize 270279 -jsInitHandle 6296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6380 -initialChannelId {a75fb532-1d33-4971-9b63-b96a36731028} -parentPid 2956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\system32\TRACERT.EXE
  "C:\Windows\system32\TRACERT.EXE" https://zuehlkelife.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2348
- C:\Windows\system32\TRACERT.EXE
  "C:\Windows\system32\TRACERT.EXE" zuehlkelife.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\activity-stream.contile.json
Size 4KB
SHA256 f9c0da4354c6a6b45cd274a5ca12456bee2ab07711769dfe976e1a3645b03760
MD5 833bfefe1418afdcb5e9d14f44f91b2b
SHA1 6122aa50a847e9fc58fc875d99da87ab2e95568e
SHA512 d5d4d6000d2e3e977ac006b579eaaf6aaa57caa1ae05f19122fe958eefecac02a9568acda2abb12784214a96b5dd11b1c4095fbce5f665ececedf24989dbd79f
SSDEEP 96:FonHhSNN3sldix6vOv2OVx1n4KYfG/7Mr6DdZlz:MoNN2dix6vO716GTMrwdZF
TLSH
T1A691D85B853404871B71B9F8690B2AACB10770258EC8EDDCF2469C76D3787BD50ABC84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 a35db3084d323b26e3332ed24aa4d9416ec59b2b2f663eee94c34101e9a6730f
MD5 2ecd91c48343d29d5bfc2ad2da26f8ff
SHA1 978a3603bddccfe3ba7197ff316537463b10d876
SHA512 e5c5f1cd18fde56a27a180cd0d42843e1cf7a610c9681d910f24bd57fb184b1db2afa53d94b4e4b3e77a09a05932d50bb1e046c5f6f1fcacdb65e5418d1d90a8
SSDEEP 768:ryfindQsD3Wq1B0ji+Zy7Rd51uihA5Xd5OxDS2KOOrLSKK+GYNuQjxN0aIB7bX:WficaGy7R/s5d2DS3SAGYNxAaCz
TLSH
T19773FAA3A6E8B1BB0B9537CB2C0FB95B52E201D5F38506C8ECE9CD1D81DD654123A5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 7e94b3a1ecbbfd1f39c78e96aa8acf7bd51bb18ccc2e60f74d934621ff6c7a83
MD5 bbac43ea0ebfbfc275652db6c2c33784
SHA1 42467436cbb40adeb6b896932c7a72c53a207f06
SHA512 0134339cdb265f764524d9cc7ac28e82a4b4f5135707ea685b21cf3bcea36ddc684bbea2dbca8e3fa8e8ffe20164d6f6efa9510e68cb288cdaa47619ab2ba44e
SSDEEP 768:rys0xA8/FW1KNE0jlNF8LK1N0E2gHTR9CTm46jAN5PgpIKpSdh7CX:W48o1KBlNF8L6p2gHT3om4bN5MIKpVX
TLSH
T1D3732CA396AD71BB1F9133CB2C4F795762E10255F38646C8FCEEC61C80DC294127A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13071

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\doomed\13071
Size 258KB
SHA256 e6550e5bf7421af841bc176d7e820fba7b13ff13019bfa9a8c024a1a4fc62b0a
MD5 58e0d1c0fda6d091f41cd1f7cb510fac
SHA1 a01beee060ab37267c6ffb8dce0257c18c4c4b20
SHA512 2a88dbccd7d6562e80b72a4c12d97b7459325ca03761e29f2d097c324603a3e069e2614d3b5d8591777c5a1c852c74a9f6fca7055661424cb0c385169c2fc4e1
SSDEEP 1536:UYCYFsinNxrinf7SPrCvkcIVeUfy/lPN8pk+WQYOqshV0WUtl5K8Ct92ZFZ1kM1F:pnNYnfqcy9CYe+WQYvWUHW2ZjbT
TLSH
T1C344F8F3D6AC30FB075286DC6C4D72CB62AF4139DB5209DAFC68C148D3C9AA5107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9116

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\doomed\9116
Size 52B
SHA256 be2d041b3b712b8d0dfc36adb2894243ae48c6b0739d74023c367078f5106034
MD5 56dad6be1e9dc516dc8403bea338ad8b
SHA1 f680d39e9863ead811f97cc3a3cd59fd5f17ac40
SHA512 6c03bd2394d641beea5e30245ec671c4edb0e9c4f250ab4e7e5e00281c2d3d33b0a14a782e29795f34322680ae3741d5634472f7d7cb8c58e106ddb1818f63c2
TLSH
T1A090020462D28500F01884360A0682F80C503D4058C8021638D5277305165F27540012
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 c253837213eea133283889a4f30b0193734c844a4cb6b1b1b02ad720dc264f8e
MD5 70e6dc2cd3e3599fa512a0c3dc0eddcd
SHA1 d029829399e4e9c93cf536797b7ad02557fd5840
SHA512 a86657a6cc94ba0bbc9006c1256d1b0f3e3a1a9f708b51bd9bc7996e12d6cf2cabe212ad65db23a5b1308abbe35172bbed8dfa2e7f8deec24d1dba1777cc2e22
SSDEEP 384:HalwSiO024Y4WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAsL+BS+2:6l8ZY4WTToXJWTTogB7S/AmVAf+hRMv5
TLSH
T136728E7D9F013CAC265790E8C8B943658D1CB6A7DFF5C02D259C3E0DC988A5A71FA84E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 a170ff5e9d7b11fe48bb42d277d74d5337840983a7a75f4c3980d1dd2cb4557d
MD5 f6f8f2e4764c4453bdb03bc6059e62f4
SHA1 77c219c315320d37ae0e529ba924f833b5fa981a
SHA512 ddf23d52f7baba8bc6c0e2a092f1eb1f1e59ae4610b092be8ec119a8abbe5695bc0bed7dbc677452f9b89f9efd346e071fe970b0bef8faef6d5a9a59879d57fc
SSDEEP 384:HGNQiO024Y1WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAg:mDZY1WTToXJWTTogB7S/AmVAf+hRMd
TLSH
T1EA728D7D8F013CAC175780E9C8B983598D18B7A7DFF6C06D26883D09CA88A5A71F945E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 3276c4337641965baaf8e49ed134bc8ba29b1d98654bbe070ae24b97ec50f19b
MD5 77ac1ace2b4e4c184bc3518860fb1c5d
SHA1 f93e8177d31f398782c5bffae75a20b248e97f1c
SHA512 c9b4d841abb405b5e762f70c79a8e87732348a8598fbccd593349fbfdb5c3ba5d54e0a4ae72100a76f78a3be185de696651ef8a9cfd5d3d78697061b45cced41
SSDEEP 3072:X3lIDrTYOK1IELGOIjxxlN5dnEvPyohR3n:FITa/LGD17KvPyC
TLSH
T1B0B3AFFADFA2C93965FFD42C6B81893EF9263404B3E73019C823671461C6B787279649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 c8c10ba4dd8d993460ac008cb932ec2cd090d83fa305f18f7a96343ef06e21dc
MD5 1ba898f289b1a4c275a04766e1ea749f
SHA1 eae5f51c18b26956b008b9c03aca4e7bface1ba8
SHA512 2725b23c60a993fc7e9582cd0f4068fdb883cffeb73f3ab4ed5cb492ec8312b694388b5901b6c96ce5ad2cc8aa2d33290df127463cae68fff2cd0bf2c4d3d32b
SSDEEP 3072:j3lIDrTvUhVTEb+OI/fxlN5dnEvPyohR3m:pITvQQb+D37KvPyx
TLSH
T157A3A0F6DFB2C93965FFD02C6A81883EFD263444B3A33009C963671462C6B787275648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b048f9b5-9900-4655-85b0-d56c1f0d1c14.zip

Path C:\Users\Admin\AppData\Local\Temp\b048f9b5-9900-4655-85b0-d56c1f0d1c14.zip
Size 3.9MB
SHA256 06786ec245b294f8d267fd27a946a257285862c875b300c5729368b60b40bfd7
MD5 d604f70db4df9b675141cfc4ae985086
SHA1 8fe5bfc2418d2bd914148639a9d94717737bdcea
SHA512 3cdc60cd9a55b8b5236b7be446a489a37d0c1ed4b74b6047bcb3cc5849be24f10866289d5ed8909e51cfa03b1c9055c667a397b40ab5739adc3dcb9e1c1f3980
SSDEEP 49152:VbxNayAl3/6oZfu3VCYUakx1lmp9Z22jldCgNKjWh6tSEy1oe7Oy8GIdt0m+AzUF:VtNac37OFmptmFjWhWSEU7bOrzU4JE
TLSH
T19B16F135D25C1608EECFC3BA950C2FCE8A4C4FA68054B55B7A6B957D5EB32E19F4C880
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\addonStartup.json.lz4
Size 4KB
SHA256 d157e63f2c812dc987751f309c7a1ab3b1c368f159a9da854c1176585124396c
MD5 2e8d68820ef7641cc060ccf36e351147
SHA1 e7758e2f4b74c413188890cfd13a88d333584afb
SHA512 291928c894eef27fe851c626c9acdfe8d6c254743ede18d603b9c9814e1e05ddbb035120ea2269ebbacb11d948bd394e2b02a1c26d7db922cb52fd1f6c076797
SSDEEP 96:NbGge54sHNw6M2xWmhD41MgGvmHhF+rF5pO1LnOYvhQhIRhN:Nbp52xRhD8rGvm6jpwnHUuhN
TLSH
T130A17DB6D541EFB5FE32C04398D53FB2E6AA9B7424A9C490F1AFB1190C24A735704380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\broadcast-listeners.json
Size 221B
SHA256 ec8fd7a63fe7025126116caa43c6c48016d82b522aac5700a32eb6f2b54cf3d1
MD5 b65549c28b82b8ebc52838a85373fa99
SHA1 7867a8400a1c5014d66007a6c74cd718bba6aedf
SHA512 cdf8589214efebd41bd8ef05e027df44a2e4434dc2c80c110eb776cf80a6ddd387a98c6625ce1fc2f1b62b9589939f5f46c9169c29778e9179a513cfa1ed98a1
TLSH
T1A5D0220F50173CBF4B886639F00427810BAA30097670E03DE3AE74940A2EBEC41085D0
MD5 SHA1 SHA512 TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\broadcast-listeners.json
Size 221B
SHA256 954039fb99f2a88e0492b08b5cca9c7c546c902dc5990dcda8f0fea4e102a562
MD5 c6212bd07a65f98cd3a091adbed0ffd0
SHA1 4bad30d07413b49938cf4354d281667c71064f97
SHA512 3d22b53d475efeb9d54ea1892ae177bf2070cf8ee4527b21e925c2106fbb0bd5086cb58f486d4a024c6c717b67c802cbc646afa195f8c75976ef4873b19f0d6b
TLSH
T144D0220E10173C7F4B4C662DF00427810B9A200DB2B0E03EC3AE61540A2AEEC82085D0
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.bin
Size 55KB
SHA256 76e06486ba6a977b5b57caa62d830c465f5f3d97f271829a08806960e7d7f620
MD5 80c8909595bc77289778639b31c96be8
SHA1 57ea14e216f17b95cb74dcfca1966c9652a7146b
SHA512 1ed895f2c934e80507b5d1a8cf03a97f2f8f17262f847e7e9bbdb8c165316d2549f0c2d96a21036cb995edc5ce948c9cb37b8e882b335cd749f2613dcc8e67d7
SSDEEP 1536:t31oENB3VvoITgNqe2k9vfs3rbbjlHkoAt:t3K+tVEjHdMvbhHkoAt
TLSH
T10643FF45EB1E953FD86802BADCA217003F39F8895A5A2F67375C64782C872DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 55facb6a9fc0f0f5fbf6b8b174957888d2521e5732a5b5b0518bef6cc00b373c
MD5 d11048908f67a5cd25721c286d3672c2
SHA1 7d39870f8fa16b3c22c336724c7718c16f83a931
SHA512 ee656258d369097014e551b9dfcbe14a95d5b51ed84a39bb6519793f70815f7fb3e6fbd93795cf4e8295fee6795749c7ba446bea966645e2765e87a5c81011d5
SSDEEP 192:dkuOv5zbo7OM2DQyjIuDM1d66JoztdzgCl6mc0d:dklboaM2DQyjIrd66Joz/zgC1j
TLSH
T112D1CD68F628863FD418027BDCA61B400F76348A985E7F2931ED641C2D562DDBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 55KB
SHA256 ea479f76a3d898830e707410083fe4f6bdcf35bca6678526944a4202172cb00a
MD5 b65a3a3a177fe2b4b7f54d4dd7a3f7d3
SHA1 90ed0c5cb333c41c858b12bf5f1e569972d54639
SHA512 dccff7d0680f9b803e4bbbe2af6a121da827d45c782a811da41ed44b8a633774986b453fa440918269e6377b8b54aa9a2738f6feeec0e1db60e8da5d26a35ff2
SSDEEP 1536:I31oENB3VvoITgNqe2k9vfs3rbbjlHkoAs:I3K+tVEjHdMvbhHkoAs
TLSH
T1AA43FF45EB1E953FD86802BADCA217003F39F8895A5A2F67375C64782C872DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0aa1ed1dba08029e93b7dbf97912c5652c867163ebac3e3e72df818adfec2462
MD5 1774ddb8c69dd683f246d6515e02e79a
SHA1 faf48ef04f536cbcccfd8c311a73cdee7daf51ae
SHA512 572091016e7eee745a365d8a00b17ae6c012efd576d35ab142737f307a9aaac98ff43a1d35c536897f1479b0b00389650a40ce7c4651060f954e1b361f9aff05
SSDEEP 192:+kuOv5zbo762DQyjIc3PMM1d66JoztdzgCl6mc0d:+klbo+2DQyjIu1d66Joz/zgC1j
TLSH
T13AE12164E628867FC40802BBDCA61B444F3A388A984E7F2931ED741C2D572DD778E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 698454bb84b844043827d274856981308020578dde43cfc241128301932ebaaf
MD5 a9c4a6fe96ab50655ccac61c328d3467
SHA1 3b4fee1610dcd1dba8073ab16772fb341d0b91ce
SHA512 08beafb3175e1d892bb33ba61f5c239688bf1e8f9f556d9139869f880e50fb7db050b130ce385fb67f3570107164fa4ae995945966ac96e0c4c5fc6668888cec
SSDEEP 192:MkuOv5zbo7OZ2DQyjIc3PMM1d66JoztdzgCl6mc0dz:MklboaZ2DQyjIu1d66Joz/zgC1jd
TLSH
T1FBE13168E628867FC40802BBDCA61B440F3A388A984E7F2931ED741C2C572DD778E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a941d6cae4e58db605cb6c47f96703d19b8af72f978547e2efc710a13fce7197
MD5 9d5a92edffca1feabf25a43b13788881
SHA1 fecf40cfebf3085b3328f0048995611bfddc97cb
SHA512 509be24312d58ef11f8f96367d4cee57885c56f4ddda73017d1797f5ae447b7acec833416c2565090261309bee3009183cc314e84b7bfd2c0c2f95a993a86a76
SSDEEP 96:JZkuSdF95/7bkW6ArcE2DQyUR6IPWZEpF+28rWgq/dd66JoztdzgClKtmc0d/UK:TkuOv5zbo8b2DQyjIuDM1d66Joztdzgg
TLSH
T13AC1BF68F628863FD408027BDCA61B400F76349B985E7F2931ED641C2D562DDBA8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e5bc9c00c4967d7e9cbf93d9ecbfa93ea6cf61ad7038cdd3a4bfdda38dc23052
MD5 8a5c37e40c9c98c0018fffdbc2533ada
SHA1 1292fe3dbd1579e96149dd7d9931383bd09bd18a
SHA512 aff66b4e16554ee294894086b4268986172cd7808c904bfd805a47e3694eee6f3f95e0b9fdcbe8fa15ad0a2d8e72d5899a62ddc0c14f3640488bb16de811162a
TLSH
T16C21674C7DBE4D3A9CC7EA9CB440028E93154B4A98876C874D12DF8DCD91AD932EA47A
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 2KB
SHA256 efe6efa1ea2e7e1f3e8594afa3ec4f65237fd292ffc89dd94710edc55183c260
MD5 82497ac2d07db31c69fe86afbfe358cc
SHA1 e98b1f75cf78ffb660e1e601f70ee2e75d367af6
SHA512 302da7c0160298a0e951b92a7c9b64c785f6d94a2474956b36a2a76c32a375b8e06a26e5dfa3413f33342e23c31b6639c2fe2d9abf68f3c7b629ae58fc245591
TLSH
T13741BD4D6ABA4C3A68C7EBCDF800028D97054B06E8C339875DC2DE4CCC52A99329F47E
MD5 SHA1 SHA512 TLSH

Submit Download

1849d3ae-e385-479a-9a26-5786319647c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\1849d3ae-e385-479a-9a26-5786319647c5
Size 235B
SHA256 06962eb90137c111617aea39fcd5bcb10e7d762bbc41f16876bb327f9a05bf5a
MD5 30139e49259f883181774917758cf56f
SHA1 0e9a9a12a7a27be6aa277fef6b8362b71eed6dd2
SHA512 625da89fe7a648a813f2ae88aff5ef634d8c38e4690f40b9ea09947cb9d001f2804c5ba02497191062231da3fe93d9f8000f656d649d676d7620388eca5eb3f1
TLSH
T15FD0978058E8276C0C246F02B0E069C630485C3321709820E65142789AFEEC451A281B
MD5 SHA1 SHA512 TLSH

Submit Download

5fd43ac9-b349-4ce5-8bd9-143889bdfde0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\5fd43ac9-b349-4ce5-8bd9-143889bdfde0
Size 2KB
SHA256 f0eafb7d9e6f1c36aad8bad9b28399fa6d2d70d7fae121297465eef1ef8fb6f6
MD5 8e6d47813388ee6e87421719520a7ffc
SHA1 18629643050c6a9e87ce32fa41afffbdf8be8c0c
SHA512 487412482b5c4c1394d3e3b02c596ad7b8d855927805346e02a01fe74c455c231c707d056af1bc5c33439529148b67de8c06a0ad95e7621dd959efbd0a8aceda
TLSH
T1D641535C75B85D7A9CCAF38D9082334D43704E9340C668936E42EE0CCDA679EB36A42A
MD5 SHA1 SHA512 TLSH

Submit Download

6b97fa94-9d1a-4038-bd9d-7bf89404c227

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\6b97fa94-9d1a-4038-bd9d-7bf89404c227
Size 883B
SHA256 e587fabc8b37874792eb8bb1b18ed9e7a2bbd7753b08159819fbc91876ea8c8e
MD5 0b726be0fcd0924be383fde5fdbc79a1
SHA1 32c9c8d9f689b6c3b916acf9d93c8ce2b03de38c
SHA512 5aea5f8a8964eaecffc6f40641f700f8376d8826341985e66abab6a7ca86f321622c7ec7f54cac0507b18c4301e1191ed784746fcdbcbc498f6f4b7cc7c7065f
TLSH
T1C71100809734B6B2CC68924B85967B065BE4601380C985243EB69E080DBF51EA3A670B
MD5 SHA1 SHA512 TLSH

Submit Download

adfc0f1a-7b77-4b76-b13c-4eaa964117ee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\adfc0f1a-7b77-4b76-b13c-4eaa964117ee
Size 886B
SHA256 13be3a62ec7d385d2c61e16734f76752d178846ed658b1f40d5e254713cde251
MD5 4a5f6324415d665fed5817d261589d51
SHA1 5443c1446aa45eae25622547830c393525bd8382
SHA512 26633f26cd6147b6033a57dd0d3fc593fb31a52fbacdab641b469c6d618e908f2245f0af5d95b9196747d78b378e676538fadc386f4453a82c8a033cdd51e734
TLSH
T130114081A734B6B2CC2892CB94E2770683F5301380DA5A283DB59F0C0DBA51EE39620B
MD5 SHA1 SHA512 TLSH

Submit Download

b1026d39-eaf3-47d7-8026-0b69906993d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\b1026d39-eaf3-47d7-8026-0b69906993d7
Size 16KB
SHA256 2ff07efc1cc4df8f9240c5ef64053b694ed51dd2e302a9dbcb5be0fa0591f612
MD5 a25288909a45d38d21fc787f07b1b74f
SHA1 1d073bc9d274aaa218170feef1514bed4dc34879
SHA512 24b65ea67b2b8692322d90f98f32b62c9bc311eda89a56b614c4d1e5078cc4137b2978def862a5307ab03c9fee9479bf4ce1df9c4f8ee22da175b723b8cbb31e
SSDEEP 192:5HEP3ifmOI4PY94uWdLSSoZZlFkyReXH4gcLruzU5rK8RRzIra3kqWeSJ+dy73B1:aP3iRZw83fQ5rK8RRzWaUqW7sybyIwM
TLSH
T12272B856682055BA8251E758D4F8BFC3E5F628CF4C418FCA9BE4BE086DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb06b054-5e81-4d93-ae9a-ee2b81dd3310

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\cb06b054-5e81-4d93-ae9a-ee2b81dd3310
Size 235B
SHA256 b7d34bc2d2a6ef3f20baa9d48d2cbc95c46bed35fc3b2bc840ede0ae1e1e51b5
MD5 1b6f862b1b95fe1e04729976bdbaa7f0
SHA1 b335524ad92e0bb21feba14e95507c8ebbdf87b7
SHA512 cce6d16c7f0d2a53c7101961e8f15752f514e7be488c5cc55e800b5618cd79e4729dc321c41344f48c162352a0a4010055628e91fcf9cfae642d7311be4367e4
TLSH
T1C0D023C018A8736D08100F03F0E43CC232644C3314F09810DA620034D9FDDCD9312C27
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extensions.json
Size 14KB
SHA256 87ec1ca454934723f1cf341eacdea73203f06130911d9bae7d7a1b923d06577f
MD5 66c03af5cdeb22397b0a6e49baabb366
SHA1 7bef06ec0d82ca3158e377fed81e1fe0e6236e62
SHA512 c88b64e0079fe4089663f148347fa5a0279d86eeb1bd0daaaa8e5f0bd76aeb8c2933a83842f0646154d0556fbf5eeff3d7fc7f8a65aabd1094610e0b62d4cc47
SSDEEP 384:hkI4vkUmldvc8dhW+94zCN96oyL4HzL4PyL4HozaL4H3VL4HC:SI4cRflXj4G6b4f444f4l4i
TLSH
T19062421545049EB8298FA79AAA367E01C37D473B70445C78F4DD8FC842FA5B902BB62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 805bdb42e8de1e133d40eee647191160d8bf9321b5c38f4ee132fcf4f50954b2
MD5 0ef4919cff48cb2b1336868a7eab780d
SHA1 5203ce2453192fe9fb60fe331a5aad9cc407930a
SHA512 7ff6df0315b2bc9d06b926ad49a6b42cf5c72c3770aa555fc59fc731ad714bf01a4643d96db533db6b16b90f262e3712e6bb14de9316f6bdac38620a7cf7978a
SSDEEP 96:xH4UTUbqGq6fUgC1zS4cvmSSl4dv9jXOFnXH/+FFBw88u8L4cnYQO7:umR6fUgCCvmSSWS/4Bw88A7
TLSH
T16DE1407894488B7F74B677ACAC6888316AB2017BB7BF68D750B54484015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 7KB
SHA256 4aa5cf07a4b512c044cc549e9b4c8f50c9c215f8adbc2db27fc46c39044c778f
MD5 d9e92859d02192703f15837c0b24d8c4
SHA1 fbf6f18a9d917a3fa12f80e0bb7cfd98b09f8ab4
SHA512 3a75bdaf33fea62ce7c0ec730a3faf59c69b1e0c8ace118050f378ac5bf6803d4426f7abc70a406c9b37dc8bd605f20950c82d98b15c6aff6cf990a103e521da
SSDEEP 96:xH4hTUbqGq6fUhpObzS0SSl4dv9j0nXH/+FFBw88X8L4cnYQO7:ufR6fUhp+SS1/4Bw88j7
TLSH
T175F10E789018CF7F74B676ACAC6448316AB2013BBBBF68D650B944C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 12KB
SHA256 24715f860946d5014a056484b0fad707d7b41955ccfb2400e6d4ef23b992cd6c
MD5 79b8c6a8375db021eb3f90a125059afd
SHA1 beb3fb11909adfabce5f84d676c26cf27d899a40
SHA512 4c61448902af346ad293a78d5204ec15960db51eca5246af0f9341b024be939f6736bc2d9f2f2563e6d26b44dcfc8f888e7e995a2f87b4a7262bc019a4bd3ed9
SSDEEP 192:TfR6fVJ6qVhp+SSPLRE9f9OBw88FqQMRmTs8:AkR1wggY8
TLSH
T1B842CC38544A8F3F24B6327DAC25496019A10227BEBFFCE255FD84C1155CF2582E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 8ddefdaa4d4ecefc5690c69590d06e7207d3726983cfbe71231666b5433a14fe
MD5 bf576548f0f13ea67f236f4cb58798e9
SHA1 b57ecf14dffd50c2de81ed78b05fc4736ed0d8ad
SHA512 f70cbe2488d7fe82edc08fd7bbd83bbd65383e6349cef356e01124a9f7837b7e3cbb6245f626fb849708c03c9714b8401c2dcc77aa9be538d2652aadf7e67275
SSDEEP 96:xH4UTUbqGq6fUhpObzS0SSl4dv9j0nXH/+FFBw88u8L4cnYQO7:umR6fUhp+SS1/4Bw88A7
TLSH
T1DCE1307894188B7F74B677ACAC6888316AB2017BBBBF68D750B544C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 7KB
SHA256 c9c56259c73e57dae922f3629680c345319636899ff595a407d9e9015cba7f7e
MD5 52639d37ac10b77996caf662c57e6359
SHA1 8c26c7e44a3c22e64c4522a27c2856987335c33b
SHA512 3bfe303da0881dd025c7c401699ce722a5ec04d437faa6cba5c6e2b9805d53a4f73f3d5fd6a96d784d72d5c5470de94374f9e2b4b50c0101a0e022c970039056
SSDEEP 96:xH4hTUbqGq6fVJ6qVhpObzS0SSl4dv9j0nXH/+FlbuBw88Gv8L4cnY/O7:ufR6fVJ6qVhp+SS1/ObuBw88v7
TLSH
T1F1F10E785409CF7F64B676BCAC6489316AB2023BBBBF68D650B944C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 c47336a8f2e65287b1ab110a38f1361b96457a4608acb11e3a620a596b2299ba
MD5 84f45a9759d2ff1055c3e47119281d76
SHA1 d27058cfad08cdaa8ae5e694215e63ad254743be
SHA512 511745c29abbcc3a1b371a8bda590e246df83b7b130392f47620447938174a76d22fcd781a41653140893d7ce16e3bd8b3c9d8d4dc2f25c1dabff4085bfc6800
SSDEEP 96:xH4UTUbqGq6fUhp1zS0SSl4dv9jXOFnXH/+FFBw88u8L4cnYQO7:umR6fUhpJSSWS/4Bw88A7
TLSH
T1E0E13E7894088B7F74B677ACAC6888316AB2017BBBBF68D750B544C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 b2b9cc36d33600f65dfac4a11f3d868ad9bf5a8cc4aa2dad4618a3adb2781f8e
MD5 e5af0c99d2ddef05577833d0ea2d43e9
SHA1 d578a511181fa7aae245f05db5e8c7c209400d6b
SHA512 23990f1231718bc92ec8a4c015afed538bb5b9ae22fa7a036b6af7b36429cfcda8c8fd39ee3e52fd1d7410d0b477dae3fdc86773a4150a60a0334378cf1aa1b9
TLSH
T1B831EA45FE5634FF5305A389434677A5D34B30D185BEE4A4E945EB8603E845AB33C28C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 f1ada5b34983b21c01bcbe51081fd4fa173117f1305b2ff524471729eed9c79d
MD5 eca6b926ea1c1648fccbe8696afecb2c
SHA1 bc568482552db8d8f31e91a13a39ea09f7186bfe
SHA512 29dc537fa7b34de1b30e4b04209da0501c4027ca87c3868fbe64cf9963001a1410ba15053ae7f87ba16fde69568272f16dbfba3ba9d49da2444a1dc5f2c9ce87
TLSH
T177310745FA5334BF4305E289838A77B5D34B30E185BED4B0EA15EBC603A8866B33C14C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 712e2c5e7eee0d375faa4eef6309260ddc99396ed433adfaacffa2aca8352563
MD5 712dd3221c8774ca9f18e93839deee71
SHA1 3fad4b66fab0fea18575615578e9392bdb0b8918
SHA512 965d02f4dce1d80d413cb56492c29516af5f7ea0a83835a8f5f4c934e45c8358421060847a3700b2f7e46b44bd9fbc81d7703656a24429edba61ae913f7167ff
TLSH
T125312B256C2B547F2324CA4552D08F98E34667D24D7DB0C8D819D60543EC899736D6AC
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 0b92bfd2da035e4429db6b8b0c041cffa414a87faca51500a091930abc03e87e
MD5 f38f56e7e3491f061f991196f5828904
SHA1 c1daa9d473803f28012cb04fd1b810804b11a5b4
SHA512 5548d77feb52ce22ee72da82d224209d62a50b452b474797a659ec0ddf44cd2f0c1ebb0540388e8aceb96c46e70e16cefa3333db79680d413824dcbf75479424
TLSH
T114310A45FE5238FF5305A389834677A5D34B30E085BED4B0D945EB8603E8456733C14C
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\settings\data.safe.tmp
Size 152B
SHA256 fb2a82be531c77334241e291af0b5a74a644b7f1e88e33de824979c563c936fa
MD5 9c395208a3732e8ede68dbdbed998d71
SHA1 796c54804e0cef5ca5f3efeea73b6c99057e971f
SHA512 13d22296d6ca7bef0535dfee258c4a927953559bc701c8eeacd87ed19fc4a3a18d23b66e99b671109455cb5f9b8e41463862dcbf8d78fb1c47e9dc2a72a4c2d3
TLSH
T142C0220E000A0223E8803830802083A283808008EAB2FAC3808E832C8C28082F3CA0A8
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.6MB
SHA256 b7d047a54ccb310d2ac8af3f91511e4adfb05b3850354dc6ffe5cefdd0675ef5
MD5 91cc07a891b30d7873764106c7e5fad7
SHA1 84cdfb1be52bc8a0d88a06524cb067598bf2e2f7
SHA512 ac4c8915df0966c15c1e1d6e70ecfa9d3d7bee63e948db52be8d35f554d3ab06168646d075cf0623c07295dd1d17771abadbc30c0f5109a60e1bfbe88a5f5b96
SSDEEP 24576:gtpY9CCX8wL0kprnPEES5AG5mdG62wNkxh+ibK/14MnyP+xPD57T5UoY+Ld1Maoj:gtpYQ4+2rnMb7J+ugBxPD57NUoY+L4R
TLSH
T1E14629E820D1A257F3824073724593EB21EFD00D5037DA085BA99AE9A574CEF8E17B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.8MB
SHA256 82bd888c053ac99863068b6730b529a154a1eb2851a8c4b62e65956f4cb6dd07
MD5 13e0280e45b0053085bb3a9a961b95d8
SHA1 9d406af9009e7531989735c2282c7cc4e63640f9
SHA512 38550783e8de8606c528f525736a4e1fca6ffcd0846c68513edcb9901d4f221d261e7aa98f426b7ac9ea98ea4302da7aa48c043311f3e2f8c783fef8e0b5a2a4
SSDEEP 49152:ebSX0P+dr42b7ZdxigK9Z6GThmf2c3wrkbaSKE:YsjxigqZ6GThmu0B
TLSH
T17C663BE860D0D243F3428073B18993EB21EFD01D507BDA4857A45BE9A5748EB8E277BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.6MB
SHA256 c86b8e7d3b778725d412da05cb8917314aca21ec737604b56811bed2b7b3fab9
MD5 c59023e0a0cafcdda8e57afe316e228c
SHA1 21dc2b3d20ec3add8fe29147066a5813abe7f96c
SHA512 b02e5e8ef8db64c9503a4e8eb1f68c5ecdfc403fbd8823087b1e295b83c15d29cfc8b830397084e95586d7c313bcb657e00e79bd91c52d642927d3ea3c5ca1e3
SSDEEP 49152:j9yWktn/X1meUy2D3/YMTsgn4ltubp5BowkcJLUecNJ3+WS+bzYT8P+Lr4ybMcyL:0T+OigyZ6GP/mqN
TLSH
T120864BE420E19253F38640B3719993EB21EFC01C6036CF48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\targeting.snapshot.json
Size 3KB
SHA256 71281262e47b8eb89d1cf5d216d25c1cb9fb523b02c14f951340177523111fd3
MD5 7be6e83bb6d1d7b27b75482146bf7d2d
SHA1 c3c018cdcccdb0aeb2b4b07625cbfb96caf4f52b
SHA512 abd3e12b3923ad43c092f3efd5dc4bb352fc6785bfc64573cccf1cef0ae4b35324a4a5dea062e46325fce4dbdf130086c88a2250ce46d7d269289828dec44e5f
TLSH
T1DB716F0CA61CA4BEA65BC3C0E6847FA78BBD053770406468DAFE460C95FB5FB122611B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\xulstore.json
Size 170B
SHA256 9a064be7a03a41018e66e7987d47ffc3736718756ee071ba8494a49c857636d6
MD5 753a7b1790fb9e8554550383b467c37d
SHA1 536d12622b84acaf3bea2ee360afc4794d28bbdc
SHA512 041b4bee9558bb97dc67a7489696048ef2bb43d722d2e8b9ce2905080f7bb8bf80f699f05a2e58c5df45ca9342de0c748501432b53159823da46da434d83e6bc
TLSH
T129C08071216F98557D17CA8F12C525643D34496451D051D575E594B4148130F9D181DB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4764-720-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-748-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-727-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-730-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-726-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-738-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-724-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-725-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-723-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-722-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-721-0x00000116EECB0000-0x00000116EECF8000-memory.dmp

Download

memory/4764-719-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-718-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-716-0x00000116EE810000-0x00000116EE832000-memory.dmp

Download

memory/4764-717-0x00007FFB85410000-0x00007FFB85DB4000-memory.dmp

Download

memory/4764-713-0x00007FFB8559F000-0x00007FFB855A0000-memory.dmp

Download