9bc805b7fbf8374d721318b8ec9a540e58c4c43b10df4c34b3f076bf929bc6b4

Analysis

user interaction
yes
max time kernel
58s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/10/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pluto_nx.exe
Size 7.9MB
Sample261017-leelcadt21
SHA256 9bc805b7fbf8374d721318b8ec9a540e58c4c43b10df4c34b3f076bf929bc6b4
MD5 a96c881cb8f90ea693c4066f87ba71a9
SHA1 98ccd56152320d5341bb97e3d9351a7a939ed2d6
SHA512 f45830384a68ea63d81cd2d8f97c843a89af0cf5f91b43ab238734506b386a519400e7d4560083b5dd4d50cc4be1483ca67039f6970bc6d1b60738343fa11bf1
SSDEEP 196608:MKQ1sTpv7m5ge1CehxhYQiS/S7XlEgSCrENk8qpy32tdTL:MhSvw1CChbitpVrMrPQL
TLSH
T16D8623BD628C3748C41E89B89433ED45B2B6156E06F985EE76CFBAC0379B500D646F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/5024-6-0x0000000140000000-0x0000000140F31000-memory.dmp	vmprotect
behavioral1/memory/5024-21-0x0000000140000000-0x0000000140F31000-memory.dmp	vmprotect

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5024	pluto_nx.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pluto_nx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pluto_nx.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5024	pluto_nx.exe
5024	pluto_nx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	firefox.exe
Token: SeDebugPrivilege	2192	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe
2192	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2192	576	firefox.exe	87
PID 576 wrote to memory of 2192	576	firefox.exe	87
PID 2192 wrote to memory of 1992	2192	firefox.exe	88
PID 2192 wrote to memory of 1992	2192	firefox.exe	88
PID 2192 wrote to memory of 1992	2192	firefox.exe	88
PID 2192 wrote to memory of 5548	2192	firefox.exe	89
PID 2192 wrote to memory of 5548	2192	firefox.exe	89
PID 2192 wrote to memory of 5548	2192	firefox.exe	89
PID 2192 wrote to memory of 5548	2192	firefox.exe	89
PID 2192 wrote to memory of 4028	2192	firefox.exe	90
PID 2192 wrote to memory of 4028	2192	firefox.exe	90
PID 2192 wrote to memory of 4028	2192	firefox.exe	90
PID 2192 wrote to memory of 4028	2192	firefox.exe	90
PID 2192 wrote to memory of 3308	2192	firefox.exe	91
PID 2192 wrote to memory of 3308	2192	firefox.exe	91
PID 2192 wrote to memory of 3308	2192	firefox.exe	91
PID 2192 wrote to memory of 1136	2192	firefox.exe	92
PID 2192 wrote to memory of 1136	2192	firefox.exe	92
PID 2192 wrote to memory of 1136	2192	firefox.exe	92
PID 2192 wrote to memory of 1136	2192	firefox.exe	92
PID 2192 wrote to memory of 440	2192	firefox.exe	93
PID 2192 wrote to memory of 440	2192	firefox.exe	93
PID 2192 wrote to memory of 440	2192	firefox.exe	93
PID 2192 wrote to memory of 440	2192	firefox.exe	93
PID 2192 wrote to memory of 5768	2192	firefox.exe	94
PID 2192 wrote to memory of 5768	2192	firefox.exe	94
PID 2192 wrote to memory of 5768	2192	firefox.exe	94
PID 2192 wrote to memory of 5768	2192	firefox.exe	94
PID 2192 wrote to memory of 5316	2192	firefox.exe	95
PID 2192 wrote to memory of 5316	2192	firefox.exe	95
PID 2192 wrote to memory of 5316	2192	firefox.exe	95
PID 2192 wrote to memory of 5316	2192	firefox.exe	95
PID 2192 wrote to memory of 5816	2192	firefox.exe	96
PID 2192 wrote to memory of 5816	2192	firefox.exe	96
PID 2192 wrote to memory of 5816	2192	firefox.exe	96
PID 2192 wrote to memory of 5816	2192	firefox.exe	96
PID 2192 wrote to memory of 5116	2192	firefox.exe	97
PID 2192 wrote to memory of 5116	2192	firefox.exe	97
PID 2192 wrote to memory of 5116	2192	firefox.exe	97
PID 2192 wrote to memory of 5116	2192	firefox.exe	97
PID 2192 wrote to memory of 5376	2192	firefox.exe	98
PID 2192 wrote to memory of 5376	2192	firefox.exe	98
PID 2192 wrote to memory of 5376	2192	firefox.exe	98
PID 2192 wrote to memory of 5376	2192	firefox.exe	98
PID 2192 wrote to memory of 4692	2192	firefox.exe	99
PID 2192 wrote to memory of 4692	2192	firefox.exe	99
PID 2192 wrote to memory of 4692	2192	firefox.exe	99
PID 2192 wrote to memory of 4692	2192	firefox.exe	99
PID 2192 wrote to memory of 4984	2192	firefox.exe	100
PID 2192 wrote to memory of 4984	2192	firefox.exe	100
PID 2192 wrote to memory of 4984	2192	firefox.exe	100
PID 2192 wrote to memory of 4984	2192	firefox.exe	100
PID 2192 wrote to memory of 2420	2192	firefox.exe	101
PID 2192 wrote to memory of 2420	2192	firefox.exe	101
PID 2192 wrote to memory of 2420	2192	firefox.exe	101
PID 2192 wrote to memory of 2420	2192	firefox.exe	101
PID 2192 wrote to memory of 5160	2192	firefox.exe	102
PID 2192 wrote to memory of 5160	2192	firefox.exe	102
PID 2192 wrote to memory of 5160	2192	firefox.exe	102
PID 2192 wrote to memory of 5160	2192	firefox.exe	102
PID 2192 wrote to memory of 4496	2192	firefox.exe	103
PID 2192 wrote to memory of 4496	2192	firefox.exe	103
PID 2192 wrote to memory of 4496	2192	firefox.exe	103
PID 2192 wrote to memory of 4496	2192	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\pluto_nx.exe
"C:\Users\Admin\AppData\Local\Temp\pluto_nx.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {bdcbad55-123a-4402-ad14-4e89465d812a} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {bd148eee-d9e4-4c92-9c82-072f96c665a8} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27274 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {6bf36c19-79e7-4aec-863f-3ddb880b38b2} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27274 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {934328e7-896a-4a8e-9937-bb3f68964426} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3096 -prefsLen 34773 -prefMapHandle 3268 -prefMapSize 270279 -jsInitHandle 4464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4472 -initialChannelId {be9fcd6d-ee94-49db-995a-74b1541d61e8} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4888 -prefsLen 34822 -prefMapHandle 4892 -prefMapSize 270279 -ipcHandle 4968 -initialChannelId {7136ebbb-41d4-4db9-a9f3-d9e85b15c8a5} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2432 -prefsLen 32952 -prefMapHandle 2620 -prefMapSize 270279 -jsInitHandle 2728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2736 -initialChannelId {3dffaef8-52b0-45ae-85d9-d29e650baef6} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5568 -initialChannelId {8dc718e4-0ac2-4db7-ba26-58a42805dc8a} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 2736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2620 -initialChannelId {4f9b42ce-9ccd-4883-9cf1-7ba30c751130} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2916 -prefsLen 33031 -prefMapHandle 6264 -prefMapSize 270279 -jsInitHandle 5996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1696 -initialChannelId {f99b634c-0ae4-4ddc-94ba-a2ed012dcf86} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6336 -prefsLen 33031 -prefMapHandle 6320 -prefMapSize 270279 -jsInitHandle 6324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6376 -initialChannelId {9f321902-546c-46b0-b316-ea8250fefb92} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6820 -prefsLen 33031 -prefMapHandle 6824 -prefMapSize 270279 -jsInitHandle 6828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6796 -initialChannelId {69c0539f-37d5-41bb-8804-854389642bc9} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7376 -prefsLen 33496 -prefMapHandle 7380 -prefMapSize 270279 -jsInitHandle 7384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7284 -initialChannelId {42b7a8d3-e527-413d-84e8-e6de6b7b9252} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7400 -prefsLen 33496 -prefMapHandle 7404 -prefMapSize 270279 -jsInitHandle 7408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2624 -initialChannelId {52f702fa-c550-4cd7-b542-718887dd9bff} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:2420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7476 -prefsLen 33863 -prefMapHandle 7480 -prefMapSize 270279 -jsInitHandle 7484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7492 -initialChannelId {26443426-e682-4fc2-a8c1-df13fd4ba55f} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7500 -prefsLen 36364 -prefMapHandle 7504 -prefMapSize 270279 -ipcHandle 4768 -initialChannelId {c091dad5-e226-41ac-83fa-59e251886399} -parentPid 2192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 utility
    3⤵
    - Checks processor information in registry
    PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.contile.json
Size 4KB
SHA256 72622ab15ad09a5da38bfcb6f6633913c1774a30d64d5bc04fa783bef4e16e41
MD5 8e5b8b9d539d2114ee34410fe54ede8f
SHA1 65e664216535ad50a45713a0d9d07e1d9db8b517
SHA512 5450356e47c1d53adb4ed7654b6786e971a458107e3a9305f25a4a17a68048c75cae02a15eb54628fdc2c4f90c408d8ff47ebd7d95132fdf458e68fce9c4650e
SSDEEP 96:TwkAMkYjom+dDaUNiK2FBEn5/7mT+mRk2lz:MMDEFBNiBqt7DmRk2F
TLSH
T157911A57B5288C161771B6F86C1F165CF017F0068DE5D99C729A8C21827C7EED1CBC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 2cb2a02db271a6e54ca1a316c813b2e0730758cdca2f2ddf1a942c615bff1afa
MD5 4b639b36dc9f6fddcc0e25d72556c931
SHA1 a5bef8363479dc5d40f8ed3abb097efd0c25a518
SHA512 7eb026104593f7f2963a53e30ff5153512a3349de32be3ef1b324c3d1cfc79575a80da3941e7759d8e37db73a66a93f828ebd0f71c02f379c823f18b4b4ed243
SSDEEP 768:RyN0ztAhNB/wq0CZ+xidYgpF551gcbSe5aM7x+GtOOrGX:gNgsFD0CZ+xAYgp16FSa04Gq
TLSH
T1EE73F9A3A6E9B2FB1B9137CB2C0FB95B65E20146E34505C8FCE9C91CC1CD754123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

31140

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\doomed\31140
Size 52B
SHA256 58363c3808960d10a3e668f168328d0e457fa97127ab562a7113834fc182616f
MD5 c4d415c1375ba84c9e204cfbaa54708a
SHA1 2c79d9e9641a21c764ffcd22f3b03717c6c67b9d
SHA512 6db16c6e52e2665ea3debe7183f6bf4567c767072c9b9f13923044bb0baf75f7e9845b4546639972587f5854cfbfafdad8f1d9ab10a8e48465f1dbb7ed460dad
TLSH
T16390025542629B10D024C1318E04A0F4453F3E004480431234F6675294111DF9000040
MD5 SHA1 SHA512 TLSH

Submit Download

5501

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\doomed\5501
Size 256KB
SHA256 9f1513fcbb1e781d434273e00eda8ba5d5d1feeda938c98ce38e22fd6775ab2a
MD5 b4ceeba1c8d49153fa557a290a7bd785
SHA1 25f5864c023039e6b16deb54fd546ac2ba4d695f
SHA512 42fbde5824033117363079c691fd02ed5fe8e17ffc9dda045fec73df130a1eb009f4f9d953d928ef3e73cb270a6ec8463d5782bcbb1ddf70bcdface637c10923
SSDEEP 1536:sYCYPswVrexdSPrg7xvkcIhzrKqAsXnG2rPxE1yexODK8Ct92ZFZWkM1SCumR3HV:9VKxD7ycOzWqAsXnG2FEKs2Zj3g
TLSH
T16E4409F396AC30FB175296DC6C0D72CF62AF8179DB5208DAF86C8148D3C9E65107678A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6079

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\doomed\6079
Size 7KB
SHA256 9b849f3db2ab778839ded48af0b32a2b089390ee2cb0ff5536d757532ed40937
MD5 e8b5ee88d337943fabfbb9720ab2cc90
SHA1 295288c30fdb8708d3e0b86e0da68e6ea17f8442
SHA512 f18bc4119ab0c12efa468bea41b2bf76c507853d9389dd049741325fd055bb47b200d57b52985b22b0b36da15fe1a997d92a157f59ed1c509f33117afa4cc325
SSDEEP 192:eMlBZGffcXZI31lsLqSRzF8hvculPh9D42prisaBmp7wO+6+1f:EH2A8XRzF8hv59D42prpaAp7y1f
TLSH
T1FDF14B7B2F6276B92F52E122EC588E9C0C09FC83D466D5F7A98C028189847D65CE56EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

027294F565F8FA527B06419484DDC1ED2B2C86C7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\entries\027294F565F8FA527B06419484DDC1ED2B2C86C7
Size 48KB
SHA256 7132df62c54edcd3d40bfc8419c16c9467d7570c1199d45ff60080dc636a9c3a
MD5 651d430b10eeafe714c4cd85236d3b9d
SHA1 e02ab6c9d5f119daf307426c2685e567006de3fb
SHA512 43ce5add92f9d6568e527c7f785bd41d442582eb7b216499010ac29ca120724bc4fe5b10cb2a325a8ccd78a1ec94dc62c194ae479f332141ea877738579b8da9
SSDEEP 1536:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlmbEVa0:c6nHvPxMUsglU4AQ
TLSH
T10423F133DF50DD505A64A0719AE7BF882A376503DB72ECEC198862C99FC103458B6CED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C0FB504EB8D5022AF1CCEBDDE5137444D06410FD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\entries\C0FB504EB8D5022AF1CCEBDDE5137444D06410FD
Size 21KB
SHA256 be94c94cb13b53dd7498258853d1b2fbd2ba1a43f32a43c3f7e59beaf8a3cb72
MD5 9c70fcb860bba158d48b58d1c4cb184c
SHA1 31ab03ec9064181480b48b7673ff885000d11ad1
SHA512 5725e058c0e9230e0c49e4706a772d90fc0b4783445788be6df6bac683d8895793dff8965683698482e9664bd081967e5cc3c45efc71c2d4ad6917dff76b7349
SSDEEP 384:upQKnCjw51xF30vl28sLdgjwEMBqu5PX8ghCxblVwbCW0vua5dCSAq0Vk:xw5F0vbJjiku5PX8gMxvwbwvuIAq02
TLSH
T195A2D17F7A5C0D0826C5ADC1CDDECA5D3D04F6436B94E8BE7E502C05A9D136EA8E114E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E5E64E52DFEC73AAA46B59FA1856DF0913CAC1B9

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\entries\E5E64E52DFEC73AAA46B59FA1856DF0913CAC1B9
Size 2.1MB
SHA256 962e3cc3c4cf7a6ddf27dcfa21dc33c7d9bc08ad4a827607869419098c955eba
MD5 f5d20cb893a256270f1eabbbefcaa334
SHA1 ec1d7929480ab8e42885e37b4d013570284ccbeb
SHA512 92a6e683d7446a4cabc4cd584e8f356feb416bde633e253476f19fd917a02862b4b16f01a176b58c2b64b5141238dd348360bee3e68c9937c3ccf3bc7f8da858
SSDEEP 24576:iu2izXI796yV4T32RcvoUc0SMaNZCwzwNQJA5F9ZzczsJAp9ZzCwQBVQdZzFwQB1:iu3zXI79232RcvoU8Z5Ao
TLSH
T11AA5E85AFF82AF22D961127040B723313B75E44157E6E32B3E9E75257F1A3680E6236C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 d98b1da0d700f4c745d873059113b5d5bf5531155e2558b6789395e3a8b61adb
MD5 699ef460b18d71b7586e6eea8a4be3a5
SHA1 27caab338248d2e6d078a76a27a5207384d07ff9
SHA512 50af908ba9acad9ea8a0840ea400d47bce6e5cc334aaab3c5dc6dba2f936d12bb890301f10f08928594958fef8691d9c70117c3705b8ea5c32ba1d5d8a366c8a
SSDEEP 384:HGNQiO024Y0WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAX:mDZY0WTToXJWTTogB7S/AmVAf+hRMi
TLSH
T120728E7D8F013CBC2757C0E8C8B583598D18B6A7DFB6C06D26883D09C984A1A71FA44F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 ec38c979e0b87c172cfcf2856283f593f3fb07ee7c26a4c160fffb771dd46463
MD5 7fd6ceabfbc324a98d4c8b1ca7c61a02
SHA1 c5fa83ed2b0a9cfb0daa00d4059049106317bfd0
SHA512 7ad6c8fd80f819c37a11e9918ca81bc4620e860ac304e621ebcb5ba7195bdd8a19c79ba42d29935c1f711eab7cbb29fe954a334d01036a5f9de7bcd4b9228e7e
SSDEEP 3072:j3lxp8BbL1qnOTUKJVGdYol2xv1M1phsOJCpH:pxMLMsUKDG2u2x0hDc
TLSH
T12EB3BFFADFA6893D54FFD41DA781883EFD262404B3A73009C963271465C6FB87679608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 0990e279645ac4cc5afe7034e3600a94c3aad47b99e583bd8c1194c9a0b0df27
MD5 a824ebff9f3378ce1a046b616c3dfdea
SHA1 2122b180933815ed4f25fb962f20e1bf12c62589
SHA512 f7abda716a3ca2c2b3b313d98746387f7f18012af79a01201379e996b568970833314bfa3dacfcd25faafb3e0a2ae9c6c3442079160a963d90b1f1ad5830b8af
SSDEEP 3072:X3lxp8Bb48vdsVvJVJjYol2xv1M1phsOJCp2:FxM4i+vDJ8u2x0hDL
TLSH
T1D9B3BFF6DFA6893C55FFD42DA781853EFD262404B3E7301AC863271465C6BB87678608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\AlternateServices.bin
Size 10KB
SHA256 fe7ecb93b230ffd8281cee59b3257a05c4703735ced6598b45614a4e514fd38f
MD5 2a140905f552667d134be8d0fc2d9370
SHA1 23d13c98019a999b7344944c63495a97d6cb8bbb
SHA512 9481f3d9f538897e780bcfb8de5c6b3bfbd3f6b5637cadf1d0ae30ee4fdc043a5b74eeff31979ff40d2c894001565a477c075bfb343a71620d8ea878797d4d30
SSDEEP 48:28JCzrrZMNLa4MmM2MSXMcMaZMfVEM2MGM:28JCzrWIxrbhNbLbL
TLSH
T15D2284FB97B5D831F165AFB090D8758C893342796839B985DE0890D22262BB2D17FB1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\AlternateServices.bin
Size 21KB
SHA256 83472db14a839b1108bb6dacbc7e4c5190d48577a450405ce9e71a4a10abb167
MD5 08041db67b6a3936501dd62413e617f8
SHA1 b2d4bb920fc9ec502e81bded55e2f4c8368ae93d
SHA512 91ec60846f3859ee6281a1c39a2ca4975bbc124ec95eeb713b7af7cafb2fb6ec451977ecfa0b8750c8fa159c2de7c0cef95e6f18b36cb26bd50adc7173700588
SSDEEP 96:mCzKLHPFBbbHbHnRJHP3q4FZ4ItTHNxW3e88EYH54:9PY
TLSH
T1EEA2B7FBD7F9D422F1617F70808879CDC93342795829B9599A0880C72261BB6D07FF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\addonStartup.json.lz4
Size 4KB
SHA256 02af08352b89ec8cf4197de487470c48c767f8052bd0fc8361993ac59f636080
MD5 098393d2c713b352a44e9d160112dee7
SHA1 1abd928369993fe6093d61469add7bf9f4a14ff8
SHA512 6e6279ff46d8e0b80bebe40fdfff73b0079afd6874e14d9066e157bd928403fc5a9ce37aa985aed730229cd613c2e035ff89580239af0571fe8341344d1493de
SSDEEP 96:Nneo4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhaFs:Nu52xxhD8rGvm6ApwnHa6
TLSH
T1CAA19F65D185EFB1F932D0435CD93FB2EA969B7814B9C8D0F0AE72254C64AB31704380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.bin
Size 7KB
SHA256 80f56b6cb1e830d9669ff9c0784ca7a2a326499324b3ddbbf336a3e93a455229
MD5 3860b7b44b6e977e4c3fc02e442c1417
SHA1 082f3db732438bd944ba10980770ff443900959a
SHA512 0d22b9586a56231bce2d0bd0a495d60581fb4fc3b6d5827dd29a0f066388ec7d24288318a3c508627b9a2161d25c4ae044f395724b56e8fbaff1fef3e4c022d6
SSDEEP 192:o1d66Joz0dzgCl6mc0diOv5zboH/ZOZyjs8:Cd66JozQzgC1jfbofZOZyj
TLSH
T19AE13EA8F629827FC018027BCCA61B410F36388A984E3F29359C75096D472CD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0c8709fc5fcffa6a2f2dfb5527740e8c24eee1cfa8d02ea945713d4feb5b8a5d
MD5 4a9e92e7e6b4de9b63326aab841b38ec
SHA1 294eed76d1e1c425ef95deafbd96419535facc51
SHA512 0cd6cab3c11ecbff51152bf947bf0916e38d86a09aed6c1bf386e11652cebd0587c70065d75bdff29e71fe01ec549deed75a33c9ca1579bd10f43a224ec6c56f
SSDEEP 192:R1d66Joz0dzgCl6mc0diOv5zboH/ZOZyjsxI:Pd66JozQzgC1jfbofZOZyjL
TLSH
T1B6E1FDA8F629467FC458027BCCA60B510F32389AD84E3F29359C75492D572CDBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2da6c79438d2de7f0e2c78e96ad674970c36c8d32afe3069c965d743598f48fa
MD5 612ff3a96573626f12d6a41225ed92bd
SHA1 07ffb2de42a2eebc90d23bcea80f54d2034a6baa
SHA512 bfc6ffbbfacf9a5dff99c7ecdc08c2f27bf612286e42e92ae7b877ee7e11c75e2138a93cec16771236571663bf384af052a910e08446c3f93cfae70e1dc81929
SSDEEP 192:o1d66Joz0dzgCl6mc0dROv5zboHnOZyjs8:Cd66JozQzgC1jsboHOZyj
TLSH
T137E13FA4F629827FC018027BCCA61B410F36389AD84E3F19359C75092D472DD7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 e68711f8e5cab52808146f0bfcf358257e58bc44f6f05a1d0eb8802cdebc64b8
MD5 1ff7705c6e080bbbfb295fba651a1482
SHA1 f2e3ec001caae7da741bcf4629e82e1bb3f1e913
SHA512 4e6187742b2d3cf4f813e50c6118ac50c9ac60272866d5d6a045358d9129907c028893afb33c4ef327394480f71f95e0cdcc89003c63b2076ad69bd37b63cc26
SSDEEP 768:HoMYbdi5O96i/HGcmhuyFK1SGqZbCgbs7dm+pP:HoMYbdi5OURFsrp
TLSH
T17BF22280FB2A953FD41412BBDCA60B042F79F885591A2F973A4C64686C872DC7E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 381366164b26bf193aa23d9bad9931f23ccb3b5314aaff11d7b0d28064f2d209
MD5 3047ffcd424c67dea56f4a8ed21bc3c9
SHA1 203cf145afbb3dac1b8760f3156747ce7cac431d
SHA512 ba31e7764f7ab36f5bbf567cac94016f85d7a2a3be6b6861db8107b6eaea2f7dec2137d671ed2c0b3943253c1e19df4d41dc1203ba4c161df8cad154769942b0
SSDEEP 768:imWoMYbdi5O96i/HGcmhuyFK1SGqZbCgbs7VpP:8oMYbdi5OURFsrL
TLSH
T1E6F22280FB2A953FD41412BBDCA60B042F79F885591A2F973A4C64686C872DC7E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 62bf85065fd6d0517a36991c47748acad29080d757d05b0baad39a2aa361b3fe
MD5 97a2ca27f44df6d570f4dc0d3709349e
SHA1 b3a3b02c11adae4116acbdf46b1bc8aee6109242
SHA512 b49a341dad07f242c2760de300f4834d7977c0ef6aff5ecb7659d99a1544aede4d96d18f08b8f431558b7be68581de4733523fc012e7598d73ff5c0d7d0d25d9
TLSH
T179216A5CBDF98D2AAACFFA987445028F53154A4604872C570D42DE8DCC81EFD32AE53D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\events\events
Size 2KB
SHA256 3970c0ae1593e600101ff38d4af076606daf0fe21363d191a1343f53a1fc9aeb
MD5 1fd7cf42b9c8debf494ac64d252fb0e2
SHA1 655aaf31066b3a1ae02439b18c05bbfb2ad7e61b
SHA512 a9a9d4fc2e7793ee76e8eb2809acba80da18ec6f94ad772eef4026306a3b288d95543b247b9bb850e280bf38466dd59aad49f3b6410506ea99e16b78343a8534
TLSH
T18B51ED1CA9EA4C7A69CFF7CDF801028D87554A034487299B4DC2DE4CCC42EA9329F63D
MD5 SHA1 SHA512 TLSH

Submit Download

0c42602a-86e0-4af3-be83-72d37a8d34c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\0c42602a-86e0-4af3-be83-72d37a8d34c0
Size 235B
SHA256 7cb2a2508b595dab192e2f95eba5da9bab6efc412b7062b595e4316619d444e9
MD5 20e78a8a738887a894612f2444f2d3db
SHA1 54ee3f49d07a27b783324c205915a89536c2bcee
SHA512 421e6c413e7c2f2d6b09cab34067bb429ff32b559f39cb7db63bfab55aed370a355323536307e51e48bfc3e44190c7cc0ffc90017c1d951156d0e18ec8bbb340
TLSH
T168D097806898237D4C100F07F0A0ACCA34C48C371478A810D5A00038CAFDAC8C11380B
MD5 SHA1 SHA512 TLSH

Submit Download

46336244-9c7b-488f-a3c4-6d83f337f7a4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\46336244-9c7b-488f-a3c4-6d83f337f7a4
Size 16KB
SHA256 b18e38c06b6ce6e450b6405b6173b7caa149eb3397815a3adcf170038d700489
MD5 a6cb0d4319fe9a35a0f759545d608687
SHA1 e85e1461e26a9f9c485b73c4fc0c4244fc1fc002
SHA512 cbf71778ab4f13fe90dbc497c2678752ad2211f2ac5ae5cddfeb7d3b35798cc00f77c87132633743b6361e87ed1bbac3bb3e58637f7eee4552d4f4fc204fc259
SSDEEP 192:aO9eovsi96ybEIMz9/o6EseW4Br0S1pVN+PTvOO4bwb+kn+ECdfdk35s91W4U:adoki96ybHMB/DEseW4SzP0vfY
TLSH
T1E872CA56282055BE8291E3A894EC7FC3E2F538CF4C419FCA9BE4BD086DDE46D512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a978796a-855f-44cb-9134-73e41e25b887

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\a978796a-855f-44cb-9134-73e41e25b887
Size 886B
SHA256 c24b65b6508414976b9c255f475a42c32c7fa89f1451da87caf052a700defdf6
MD5 1033a337024be561d86c61e958396b8e
SHA1 3d8570b39319902e19f8208be706f050ea44dab1
SHA512 bbdb6900899c984ab6f5c83b618cedf5327253968e91a5ae666f549af4883771828df6ee300641ddced012317f3de939dbb1ef454033cb6b699662b916892813
TLSH
T1EA11C0C0A92575F689A8D29B85E6B78387A03073C0C749587D95AF048CAF51E97A6207
MD5 SHA1 SHA512 TLSH

Submit Download

ad295e28-f20b-4ee5-8d69-0cdb12f33f14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\ad295e28-f20b-4ee5-8d69-0cdb12f33f14
Size 5KB
SHA256 0841a7ee5497569601256ffb2e6d73f4edffa55095104f62292151a61e469730
MD5 8596e18e949fc7b1db5d5a9d3e9664d7
SHA1 4e0641c89df261dec96474e187c1b0e26ebc11bf
SHA512 52973be47d9738c3119bc9ea14b876a513c696a2d61a48462a73b5fb1ae3c03aa2a073d2428e198364af403f81278e3e95176b68038aa668834d4fe67f84f088
SSDEEP 96:ygjvEbNCUIy/Ky5mVRE9frbxELVijQvYLy5+Zz3fNmlfI8YRo6EXDYP3XmIaoMQ4:ygjvEP9DgsC11tXYFQo566Sre5J6KB4
TLSH
T181C1DBFDCD0200173EA9E22EF1A9FEAB119A083149CCC78D69FC483A36D69B71613315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db251a5b-702c-4d02-9395-02108ee939f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\db251a5b-702c-4d02-9395-02108ee939f2
Size 883B
SHA256 5be1bb14ef12a228de6a0b6d12826c7202aec8005f7a6f6b5f8cf316152083de
MD5 cea0a5c541a987443829f16fee2c902a
SHA1 a981130691f909a36bb1151b0c1b2202c4482e0a
SHA512 9d9d15850ec9d10bda74d86de88d8ac2c4412fe9f3e553bc379023f217911b9a50c0854c4945bba56d71470ac86ca4f6ea911b614d2ea566b5f5031882812c38
TLSH
T1F01100C0F921B9F6CCA8829BC9A6774787E43423C0C654147DF5AE044C7FA0EE7A6607
MD5 SHA1 SHA512 TLSH

Submit Download

ef3d7a34-f8aa-4de1-ad7a-66e326c5c0b9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\ef3d7a34-f8aa-4de1-ad7a-66e326c5c0b9
Size 235B
SHA256 66b6313fc2c1eaf8fd756e8cfb15ac290aae8b4fdc2b96e15770b53aa0be97a5
MD5 dc8b7ee6174cebb439be571ca429d735
SHA1 6e15dc9ab70414b70b052e7a18103ff6e2ef87ca
SHA512 9cf700fbff03a47566549c8cf06c80ccc8213959cba0eac9ba7c9f9c3ea19c749765cdfe0ca8806d53b6cd15cd394d9178c782fdf9ab68c040d979bb46f0eff0
TLSH
T150D0978178886B2C08100F0BF0F06AC639848C3B1864A810FBA046389AF9AC4421290A
MD5 SHA1 SHA512 TLSH

Submit Download

ff72a433-e3a4-4f49-96d3-c3bd66f4ad71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\ff72a433-e3a4-4f49-96d3-c3bd66f4ad71
Size 2KB
SHA256 daeb788daa0e4da0d0021940a01dc0564945669fa6cab23f078db5459f556e31
MD5 007d0acd52c20033e807d13ae78bd0bc
SHA1 6d24113a690f3560995af0941eb1b5919d6f7b3c
SHA512 73c5d2dc8dcc58b6976ca9660eacd8846ec6129b3046b910f0be9abf1872ddd8b680ee537bf8ca19f07fcf6c00b2bc1609ae0b37c71c18245bb352c1795a080f
TLSH
T14E41336C75B85CBA6CCAE15D94D2338E53714E0340872C836D51EF0CCD96B9D63AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\extension-preferences.json
Size 942B
SHA256 a56a46aa7451d640626f9adbce3ffb26ea6ab549f15af56fc2cd69f0bcfda67b
MD5 8913f98eab4828647224c9a64b706b3c
SHA1 f886a4456ee44a4e73ef32a2b138193f2fa41d37
SHA512 28869c106812bf053c732469b0f67da993e42a471c7b576e68d45fe66d2f067bab0a66c5334e88c6460e08a06285daa643f5f34771bd0d7361097307137e1630
TLSH
T16211F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\extensions.json
Size 14KB
SHA256 249172c21021abb82f894e1f021733564319f376c2f6fdae1669d5a834bcb797
MD5 9a6b68b1a6eea877beac646f859fed8a
SHA1 60b8db2fd8159ee1011b3ab2d69122710adacfc7
SHA512 d91979e69e07fbcf6406d4fd803a79bf9023c9f9e93b46923939ac4c8ff70edabbff32e643e7181eae5965423499755ed1b71f8ab87ed9ea504fe76c9b05baab
SSDEEP 384:/kI4vTUmldvRJ8dhWH94zt96ogL4HVL4PAL4HvL4HGL4H7:MI4rRfZCXy4f6V414a4T4M4b
TLSH
T1ED62431549149EB8294FA78AAA367E02C37D473B70445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\places.sqlite
Size 5.0MB
SHA256 0f3d328de9b48c5dbfa78c30d88b3fefb961da2c689efc3d3f3548aae979719d
MD5 3b340aa5f14d5840023d2e0e9cedc872
SHA1 a157b0dd2e201bd8f95691d0d855e8462a4058ba
SHA512 e2b9ab5fa0648ad16ffcb70fafda1ed9df42931e27761fd7783e25a0cb6037bb0c963c7be076039876f9b4d1b7bd11a38a357956bbbdfebcd9d73979fc399baa
SSDEEP 192:M8rJQaXoMXp0VW9FxWo7/wMl6SaFoXS6KzA9AXmNCKm:M8r54w0VW3xWqwMlv8m
TLSH
T1E136825F7A645054C4EA9131ECE32F19183F70278A37BA923DA4256D4DE0623B92DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs-1.js
Size 7KB
SHA256 e8e001fb8dfca5f36c40884496736c15c2796e90309d437c11f0a10ac3c5a76c
MD5 ff67bcbaeb118c2cd29a2cd4cfecae73
SHA1 052dedfc3e70fc74683b444de633f0c2260139a4
SHA512 470f7916affc9e800ac662237d612e0c58ab7204a645be7d9e90f64afbb476f54c6306e61f3cd2690099fbfb89f22a2d15e937e94ec8329db75ffd59f03975e0
SSDEEP 96:xHAmUTUJgqGq4fybkObzSCeSSlcdv9j1nIHGAvzE3KF7Bw88H8L4cnh1VlMGS:hRR4fybkIeSSJG/KF7Bw88mO
TLSH
T15BE1307895088F7F68B677ACAC6888315AB2013BB7BF68D750B554C4050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs-1.js
Size 8KB
SHA256 0ad643429cdc62d77f298a8d27e4f88ccf874cf65dd6c0a306752fc14bbf7bc2
MD5 b1b26bf64760b414f12dd112d6fa0a66
SHA1 633510c1c010f1821208427ffce2a687115422e0
SHA512 09fab34b58dbcd00995c04ff75e08adfcdaa792b64aa52aa11cebace65c06fbcfe6826b7413370338280b9dc4f8ec269a9a9bf42989ddc129546270c90113be6
SSDEEP 96:xHAm6Pm7/37TUJgqGq4fFZbkObzSCeSSlcdv9j1nIHz6AvzE3KFaGyiBw88AgZCJ:h4R4fbbkIeSSJ2/KFtBw88tBO
TLSH
T1FA021F7C9144CB7F75B676ACAC2848315AA2013BB7BF68DA50B944D5050CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 6KB
SHA256 a7c16b2e57805da2221739e39424b1ddd308c89c78299ea0b32afe0f574b4ee9
MD5 8a35bd1955f70b0d155c0b9ebfaf66a9
SHA1 ad6319e388b4bcb33a907b57e3937842cbd47f60
SHA512 8ed761f8294c323d369d2e475bc3acd554f87460e4c0c8fa2dd48fe87843eba0c8ac494abf4cb21879893b73726d0a7045587726eb9982029d3c6832c77d2387
SSDEEP 96:xHAmUTUJgqGq4fywj1zSLPSSlcdv9jWnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fywjCSSCG/KF7Bw88mV
TLSH
T101E1107895088F7F78B6776C6C6888315AB2013BB7BF68D750B95485050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 6KB
SHA256 4a72eb2a74d867025c6f40dd740abb9d983db83d435f20805deeda710cdb5490
MD5 1ccb60ad53eb75ce8d3567e50e0a82fe
SHA1 38d4e818dbdaff58bbfae6f20ae4e6774516d89b
SHA512 ea3ec6c24c0dbb0c2f61d94788287e52383ce25e4fb193e7dd2e5f25d6ed7cfcacfde32f69826b72a163ff5bfafea3a369763bac8d052c9aaa3f27d60e25a475
SSDEEP 96:xHAmUTUJgqGq4fybk1zSCeSSlcdv9jWnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fybkHeSSCG/KF7Bw88mV
TLSH
T13DE12F7895088B7F74B6776C6C6888315AB2013BB7BF28D650B954C5050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 105ddd0843c6a646ef6a690dfd5bca712158fb4372bab60dc2051673941d9408
MD5 8665d4d3c43d9d8ccfe9488abbce7e1f
SHA1 acc3fbb14a9e6d53290dea2c1bee7f1980086a0e
SHA512 b4d7da4ccb9d93ae28e4e031e60ee9087f93fe270ed1393b1056fe7162dd6744b50de5b54e3079d1814c12473320c83164950dd76a07433ed7bb89e92ca35c04
TLSH
T17621B762A9BB6FE6BA05A337C0989FF5D6C424268CB52070D17C050641E8A69B309558
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 4955952b3af7ad03003d8b947ab8b159095a28aed46ba81fd3109d83f5fe156f
MD5 efae504027b2c4e885b04fd2dc5123b9
SHA1 6cc8150164ecfce161b65976d844b7e233faac9d
SHA512 77be0fc19098545bf9f924ebf964ce6fc60276ff7068e0960e4e282137d819c968028854bf2c4af0540e36ffb5865c0549b9bbc309a23073f293b3280c2ad539
TLSH
T1CD21B962A9BE6EE6B502D32A90585FA7C7D920568CA870B0E56C481501F8B28731DA9C
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore.jsonlz4
Size 22KB
SHA256 fe9508277a170ad873963b2c1d1b366cd7dfa27abe346b07fedb114e00977f07
MD5 4d4e7763e93fbe6f1e976cb2afd30c1a
SHA1 bc997f2a12eb5a80161275863f5ea2533077c8d8
SHA512 e9623608a2d7baa57e83cf7676846ce0c9241d74451c890758859694ea3a3ad059b5a15948a87b2d30487c3081db312601bf32a1cab94b2efbb08c3c2c1d7565
SSDEEP 384:l1gNv8/QQntwECZSJam+Kmbs4OipMe+u5hVhSj3wpWW5TIWb3alXuGg/AFU/OI9s:vIv8/QQtwECcvLErHSDe5TIWb36oPpJQ
TLSH
T1AAA2D123CD9F62D96183DDFA8563148EC8F06D11CA8296DA550AFF30D03BF46D609DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download