Analysis
- geolocation tags
asiadelhiinindia - user interaction
yes - max time kernel
399s - max time network
402s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/10/2026, 04:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mtgo.com/home
Resource
win11-20260911-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target https://www.mtgo.com/home
- Sample261024-ewdxtahx2p
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 52 5536 dfsvc.exe 47 5024 firefox.exe - Executes dropped EXE 1 IoCs
pid Process 5436 setup.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\setup.exe:Zone.Identifier firefox.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain setup.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "XY9JTXDHO549GCX7VP5ZPMH6" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1} dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "YYV6PJHVNPRZLH8ON4BQL2EZ" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "56QDNM8TAP7GODW7T7X3Q160" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\mtgo..tion_a2d3b1cd60f988 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide dfsvc.exe Key deleted \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\mtgo..tion_a2d3b1cd60f988 = 687474703a2f2f6d74676f2e70617463682e646179627265616b67616d65732e636f6d2f70617463682f6d74672f6c6976652f636c69656e742f4d54474f2e6170706c69636174696f6e234d54474f2e6170706c69636174696f6e2c2056657273696f6e3d332e342e3135392e343730382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d613264336231636436306639383833332c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\mtgo..tion_a2d3b1cd60f988 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d00220068007400740070003a002f002f006d00740067006f002e00700061007400630068002e0064006100790062007200650061006b00670061006d00650073002e0063006f006d002f00700061007400630068002f006d00740067002f006c006900760065002f0063006c00690065006e0074002f004d00540047004f002e006100700070006c00690063006100740069006f006e0023004d00540047004f002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d0033002e0034002e003100350039002e0034003700300038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0061003200640033006200310063006400360030006600390038003800330033002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f004d00540047004f002e006500780065002c002000560065007200730069006f006e003d0033002e0034002e003100350039002e0034003700300038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0061003200640033006200310063006400360030006600390038003800330033002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d002200280068007400740070007c006800740074007000730029003a002f002f006d00740067006f005c002e00700061007400630068005c002e0064006100790062007200650061006b00670061006d00650073005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300031003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Software\Microsoft\Windows dfsvc.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\setup.exe:Zone.Identifier firefox.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5536 dfsvc.exe Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe Token: SeDebugPrivilege 5024 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe 5024 firefox.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 5520 wrote to memory of 5024 5520 firefox.exe 81 PID 5520 wrote to memory of 5024 5520 firefox.exe 81 PID 5024 wrote to memory of 2656 5024 firefox.exe 82 PID 5024 wrote to memory of 2656 5024 firefox.exe 82 PID 5024 wrote to memory of 2656 5024 firefox.exe 82 PID 5024 wrote to memory of 2336 5024 firefox.exe 83 PID 5024 wrote to memory of 2336 5024 firefox.exe 83 PID 5024 wrote to memory of 2336 5024 firefox.exe 83 PID 5024 wrote to memory of 2336 5024 firefox.exe 83 PID 5024 wrote to memory of 2216 5024 firefox.exe 85 PID 5024 wrote to memory of 2216 5024 firefox.exe 85 PID 5024 wrote to memory of 2216 5024 firefox.exe 85 PID 5024 wrote to memory of 2216 5024 firefox.exe 85 PID 5024 wrote to memory of 480 5024 firefox.exe 86 PID 5024 wrote to memory of 480 5024 firefox.exe 86 PID 5024 wrote to memory of 480 5024 firefox.exe 86 PID 5024 wrote to memory of 2052 5024 firefox.exe 87 PID 5024 wrote to memory of 2052 5024 firefox.exe 87 PID 5024 wrote to memory of 2052 5024 firefox.exe 87 PID 5024 wrote to memory of 2052 5024 firefox.exe 87 PID 5024 wrote to memory of 4040 5024 firefox.exe 88 PID 5024 wrote to memory of 4040 5024 firefox.exe 88 PID 5024 wrote to memory of 4040 5024 firefox.exe 88 PID 5024 wrote to memory of 4040 5024 firefox.exe 88 PID 5024 wrote to memory of 5572 5024 firefox.exe 89 PID 5024 wrote to memory of 5572 5024 firefox.exe 89 PID 5024 wrote to memory of 5572 5024 firefox.exe 89 PID 5024 wrote to memory of 5572 5024 firefox.exe 89 PID 5024 wrote to memory of 2600 5024 firefox.exe 90 PID 5024 wrote to memory of 2600 5024 firefox.exe 90 PID 5024 wrote to memory of 2600 5024 firefox.exe 90 PID 5024 wrote to memory of 2600 5024 firefox.exe 90 PID 5024 wrote to memory of 1764 5024 firefox.exe 91 PID 5024 wrote to memory of 1764 5024 firefox.exe 91 PID 5024 wrote to memory of 1764 5024 firefox.exe 91 PID 5024 wrote to memory of 1764 5024 firefox.exe 91 PID 5024 wrote to memory of 5436 5024 firefox.exe 92 PID 5436 wrote to memory of 5536 5436 setup.exe 93 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mtgo.com/home"1⤵
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mtgo.com/home2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1940 -initialChannelId {5779d086-c645-40de-9eab-9fe65325cbb1} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:2656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {7f9b1354-6700-4d7c-9339-fc5e9467cb52} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:2336
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 25164 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {51f8a261-bc12-421f-b920-b05f3f6a1fb5} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:2216
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27274 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {c15dfaee-2d62-4099-93a6-2930563002b5} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:480
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4572 -prefsLen 34773 -prefMapHandle 4576 -prefMapSize 270279 -jsInitHandle 4580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4588 -initialChannelId {2c13ffcb-64a9-43b3-8e4d-3a790cafa8bf} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2052
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3216 -prefsLen 34903 -prefMapHandle 3028 -prefMapSize 270279 -ipcHandle 1668 -initialChannelId {0585652c-1ca4-47c0-bbb5-a074c5857d02} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:4040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {b9d3d616-2e84-461c-846a-5c77af605a3f} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:5572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32952 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {75af4215-d141-4890-8bb2-1a7a0f827aa7} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:2600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5916 -prefsLen 32952 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5932 -initialChannelId {390e3269-99f4-4f92-98d2-76a54f25ff1f} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:1764
-
-
C:\Users\Admin\Downloads\setup.exe"C:\Users\Admin\Downloads\setup.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
- Downloads MZ/PE file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5536
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A9F52B825FCDA2685D64133AFA871F4F
- Size 727B
- SHA256 9fd1b86c7ea6c91d351ace8b2bfb79660a88d576fe1250e0520a7f8fcabdb819
- MD5 5b128755cf8a45018afee91f969b48f1
- SHA1 830c5370864bd2e0cb41bfcc0f8703f70e3acfca
- SHA512 7392ccca22a2dce90356ca5b71ad39afb9105a9ffa949b8b03d794bb1828affb87745eada6c7b5ba43b525737ae011de48461d0b55b5ea79694ff5008c17cf9b
- TLSH T1380149445E349E6DEB1DCD647B0C11507C92929017DE38D750F34A4CE04EB5B6D40525
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 bd76d6729ade01c2f3f2c1b03ee9b9b877521e73a668a58cfac63e7684aad19f
- MD5 74700b6f42358773d7f90406e6420211
- SHA1 09b235f714b2b90ef876fc42eb4ec547c2e3851a
- SHA512 66510aeb34e50cb646f936d9dcff365f44715998eceaedf2c0b7e869aa2cc178723968482c37274244e544ccff57eb51f9469328f3a427047f8f5af1d9e56be2
- TLSH T1130199E3DC58D6F03D502F268BBCE5507177D45E31E582713ED4408F547E0351E89544
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A9F52B825FCDA2685D64133AFA871F4F
- Size 404B
- SHA256 2281b7f83c8c5250567e6d7549483edd3882f9c9d8aa7fdd36a89b3823c93224
- MD5 86478a46b5b632efbc05f2b670d79f3c
- SHA1 4e735fb9e8a81c8c271ac950d7c46b1cdf864b63
- SHA512 4f0f93bfe0975552f80bcb73cc1677715d8a52722f2df76d2f7dc2243b584b8573ec67d7a398acf717d024e5c5d7651d10dfaf0a4bbb17696818356070654f2c
- TLSH T172E0C03821F4466DF4F0943447E2D8334489F10A058E826D05409206ED257004CE6AB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 346d2aeb5ce050de3b1dd92838a31e44888e00a35a2036a09fcbf22dc29805e7
- MD5 e65006e76dde4b3fba12d9ab583b24ff
- SHA1 43cdc7cd36e668239f39bce66e049e348b370cc1
- SHA512 c5e81ceea36f91de7bcd8821cec0c874de3d61e478ec7d45dc194158ea545a3a3448fb64a8cfe7795c3256aefd3f1d817307cab4d5fbbaf7c87d5db013dcbf05
- TLSH T161E0683821EFF10EF060883182F9A0712E4CE705140087B91A80030DAB0AF009D109F1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.contile.json
- Size 2KB
- SHA256 d6792e535f14780b0456eadbe3ac5f3ef56c3917a6dc6da8799c4fa795de0993
- MD5 5e551ea6b787a4882612c53c2643bf03
- SHA1 12c99591c18ee8d08d91fc1f94ddbc9816552a67
- SHA512 fbc83a00d8d474af74164bc038fe403f7088a1031d643da9f31d86caa11412a170e27422a9a78d6546ac1943bff825cfbcf8369e8ad2f2cfb94958fff29bacd2
- TLSH T12551C6DBD26984265B35B2F13D1F13ACE11370A90AD0E4BDA304CD24D2ACBADE1A99C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 5cb56dc422231a80951cf89ea0e9e26a9f3f3efc3951c22e045683bb358a2324
- MD5 f5426265a86d228bbb3098fe152eccd6
- SHA1 34bb46d8351d0ecafd463c28933ff24b0406b14a
- SHA512 9271cedf3c9f24b3cc5448e465ec5962d97c56d27f2b36efa229aa3b0b0ab88e074ab4015bbf3e079529d6d3ff8540a01849d1df8846c903c6d399c8750eace3
- SSDEEP 768:iyN0ztAhNB/wq0CZ+xidYgpF551gcbSe5aM7x+GtOOrGX:ZNgsFD0CZ+xAYgp16FSa04Gq
- TLSH T1F273F9A3A6E9B2FB1B9137CB2C0FB95B65E20146E34505C8FCE9C91CC1CD754123A6AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 cbf5b71711f640788baaac87e16d2ec3d9b66ce28fd2340136ba1534cbbe49b9
- MD5 aa295a6c02ee5b7db7223b8ba0eebcd2
- SHA1 349e86a64c9b0c8174dd5429d09e7309baf81681
- SHA512 3790e64cb3f94474b6fc5430213b118937eeb28e6d5d9d35b0c91b8e91162399210951a91e57da5c1f7c7b406325d272ee29af487a666434a0dea87844110cc4
- SSDEEP 1536:Z6a4t3MAeVHRMRgGF84gND4XOGPsdcLdG:ZUtuVHaRENDUOGRLdG
- TLSH T1F77309A3A6E9B1BF0FA137CB2C0BB95B62D10159E34905C9E9E9CA1CD1CC790113B5BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\doomed\18659
- Size 162B
- SHA256 af4639d2fd4673a4fe89309c731ed889d0eaf4e1a14e007097e3e193c0defeb4
- MD5 e88149b5093fd976af481a8c5800f968
- SHA1 599aba0afdbd7fc9b1df083ba19d9e88ad22cdbf
- SHA512 230b4aa75b9e46ef68255aa135dd60bbcf956f51abfef916c89a43f4106a6d3d460eec9a097655159020f1e76b0b71a1fac36b78326477ffd23810085a4a4478
- TLSH T1F0C08CE0149EA822E1148E7A0AAFF4880C2729CFC8844741FCB4232980A02A32B19B00
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\entries\D70D089B7485309F9D772DF778A7D26F3F331D0A
- Size 16KB
- SHA256 197452ae1c1bc27496950ea36cb6668230b380931039ad58061af6da8b06e048
- MD5 83bfa004cc640c3fe7491cc77d5b2cd2
- SHA1 b6ae517016e4b918ef48564ca6ce418d35358889
- SHA512 f994f6a26747c3439347c5b1c1fae8e9d420d06a86463aa8abc9a3a883404f3f3639784a8f3d5687e06421c1b61841327ddbdf671526291bb6ac3f716954282d
- SSDEEP 384:Hu4aiO024YKZWTT78LydRtuSsj8wkac8Woh1B9M0lpDIIOu8v8d:O4HZYKZWTToWdRtuSsjBkaBxh1B9pD8m
- TLSH T13C72AF7BCF513C791E4390D5DC9D83188D08E9ABEED7D06A16583C0AC990395B1FA4CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
- Size 16KB
- SHA256 33343e050bbd3b8c0f272fe6fe1a61a036a764700b5815e09ab4ca450317bcd9
- MD5 b4e08404289361bd8a550619f8ca807a
- SHA1 667c285f45c9289c5b8057bf66eba6b7e0cc4b00
- SHA512 a428b7c78e2e42e9dc7a2e948ee6f2aefc43cc61c599297d5438f618c8e7a657fdf64f950fa3bee21f02072be1025a2248cee144c6797c13c6105b6011e03b26
- SSDEEP 384:HGNQiO024YEWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAVN1:mDZYEWTToXJWTTogB7S/AmVAf+hRM0N1
- TLSH T15E728E7D8F013CAD2B5790E8C8B583558D18B7ABDFB6C06D16883D09C988A2A71F945F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 33d95aaa86f7e28950b9a8d26d170a02b349a7a4352493d29d62c9ee8942ef25
- MD5 5ed17d042f8e6a7fcb9d1549ccf30dcf
- SHA1 cb7abcff5fdda05874dc45dd6606d67b46432e5f
- SHA512 ddcb077a224d3b4f3caa7fb4edfce1936471f3251882746b99a96e877ae0223abaf001f8eb9b38bb2fd5849a7f80347d744a0a7d5ed86d30063d29d1074cf07e
- SSDEEP 3072:j3lwt+BdkCKSqlU/HtVa+xv+z2YEcBsjJs6:pw0kcTa+xv+iYENds6
- TLSH T134B3AFF7DFA38D2DA4FF94286B82C43EFD261404B3B72409CA53661461C7FB86679648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 126c21132350dc8bd8caaaff3bd9dd5e0dbed8b9b53ab5eff83743b1a5ae5be4
- MD5 275900e587d545973c074d48f16b151a
- SHA1 9b189d01360e40632da5c02714288cfc0aec9bf0
- SHA512 abb302fe1507c8ae9db9b3dfdef35942ad29d315804415ffe0f5fc1c46952240265646f788a9b17080b82c3beb545ba4eb85703aecedf93d95024042e3fd189e
- SSDEEP 3072:X3lwt+BdtaCNld0D/Hrpa+xv+z2YEcBsjJsg:Fw0t0Fa+xv+iYENdsg
- TLSH T1DBB3BFF7DFA3CD2CA5FF94296B82843EFD262404B3B72409C953261461C7FB86679648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\061f6548-7d1b-40ee-9155-dedfcccf657c.zip
- Size 3.8MB
- SHA256 ab91a4abb6c9aaf116346f6b7d0cc2f5e396829d877aaea18ac218e678d347de
- MD5 5a4c6bffc7848097c121031a375014fc
- SHA1 2d0f08e751b9c5fa8ebdc8f5d297d61ec16fc67d
- SHA512 becd09ca873dee5460a71db77b8b191436975ff76393a22d4a27f0fbba80701b174e13795427ff0be778c6dcb1ae5e9ce04eec54551bf6c908277dafabd8efa3
- SSDEEP 49152:YpNmO8eOBBPxPBBagRaMbEallFr9oADy7nlaT9Ofqt+h+0dQqXu1Oyk99MSiQzEK:YnmOCa/Tur9Q8UfqtW+07X8K/zE8p7
- TLSH T19006F17DD65C1A0BCDCF83BA850C2FC28C4C4FA68054A96B7A6B99715CA31E6FF74844
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Deployment\821HZ47E.7G8\VGPOWEVQ.XVM\MTGO.exe.manifest
- Size 458KB
- SHA256 32a32d35627ba060223ddc9ebef9eff7a4c70768bb6117f404e4aeb7e44acf7f
- MD5 91987cf60d2331611ec8d02e942a42a3
- SHA1 def83531e1a6eacdd98cbf8fff89315311376eec
- SHA512 3960c93fdca1c4ebc126ed41384dc2517c612a39086247d0956b7a3310d2f4dcfa63efae9cebca4351fd26be676e1546dd52f80d3cd1318e6ea9568eac942176
- SSDEEP 1536:De813lPSutvuLY58JAEVv3VDgfgyM5Vm9WsuoRBNC57:Df1xSyuLngoyMC95BN8
- TLSH T1DAA4479648C17D16433190D8FEE2D914FC01BB17057E518ABD8E1AEF6FA241CABC727A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Deployment\821HZ47E.7G8\VGPOWEVQ.XVM\MTGO.ico
- Size 56KB
- SHA256 32976494b413f5e7b95fcb547b03dd24846ce25701fb23d9da24a43a05e2aec4
- MD5 24d00ff0bb7b60e5b79fb91d594c4ed7
- SHA1 5d4d855e58a80ea24288b484c3bae7372e1f0e1d
- SHA512 a4084fb176dac14d624497dfc9ffd304b15949cef617cf8356c58b8f6832f4b34e4dfabc5c577c6885997108ff9d6e97dbaac1dfed4b02fc1156e43b28b72347
- SSDEEP 1536:z1o0d4mjh+vm9NNj11qDUY8FScjFhoXqmgL:zq0d4I+vENt7Ud7cjFhTmy
- TLSH T13143E1215999BB8DECC3F7B1C022D7319B5BCC88392DB692A9801EDB3C17E415C1ED29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Deployment\M8DHX3YZ.9NA\9ZGZEO3B.R6L.application
- Size 12KB
- SHA256 1e88dd53cbf6357c1a89623e961386b7a03bf7f531c3615fa1568a574df8cbc2
- MD5 cbefb4a966d12d85b6bd5dad1eda4b17
- SHA1 05652c069699d6e7682d1ec7b58a4aae97dfee3f
- SHA512 6f5f9f196c2e7d83301aa7602826e896ed05b72aadef829c7056d5b2eeda957d881c04575c662df72e24014b533f81850358c38260a245e34a6948621e778826
- SSDEEP 192:okxU5+VE0tC24B3o2OdJ83o2rM3AorgIoCzEDh7BqWoUA:c+VE042Y3k43NM35ooM7Y7
- TLSH T18E425B5E8DC8AC92A304F5307BE3B5125AD827A3C4DD04897D98AD4F9F0DEE161133AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 21.6MB
- SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
- MD5 40bf410fa9ef0d5499907e34885af6f4
- SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
- SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
- SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
- TLSH T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 9KB
- SHA256 075babd5e531d675a85ff542977c4b6568da082a91925a6e0bf75cce16e7f618
- MD5 4f3f4cb12acffca06236367ec1b99cf8
- SHA1 04cda38f11a475aa4f4aa3663df4cd07bb75f96d
- SHA512 9fb736a50049b834947a69f2123bd6ddfe24f5c7227c7cdd21ad814397f17a2a9e2cc438140186173c4fbf909bed5f3bc713745bb5e553a9eab023f6606aef5a
- SSDEEP 48:oY0dF9J5UgdwbzvFY7dF9J/6Bdw9vFYNdF9J/adwfvv4YJdF9JzH65CjiPGdOFK/:0PMWP/ZUP/fPPzGGdsHksGdsUFPOTU
- TLSH T12F12FE014BFA1955F6F397323A317B17ABB3F9154B2F450EC282664904727A0E5ACF93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CQJC396IYLGGDIUC524J.temp
- Size 9KB
- SHA256 8f3d7af7a0c10cdf429e9f42128ffe454af98be424aff10482c595772327ed29
- MD5 bc1fe5e86e2b31617336d9c5297a5c21
- SHA1 2672d088cd7748dfe039a27f71be55eda74e1484
- SHA512 1e964b94df20e581c6263fce1b9712039043f0442e46fd588be2c7459fad3b9821b1b7a44516f3fde93640d0f5741c1af41da61b4760d38cfef6ec3f933bece6
- SSDEEP 48:s0dF9J5Ugdwbzvb7dF9J/6Bdw9vbNdF9J/adwfvv8JdF9JzH65CjiPGdOFKiZ3kE:5PMbP/ZBP/fCPzGGdsHksGdsUoPOTU
- TLSH T1FB121E014BFA1955FAF397323A31BB07AB73F9154B2F450EC182664904727A4E5ACF93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\addonStartup.json.lz4
- Size 4KB
- SHA256 e7f3ebb1085aa85e588104efddb216516f96a06f996bb3cb09502808b3d24041
- MD5 92dfc30685fcb9d33d806992feb38261
- SHA1 f160d7ec96d6abe91b0256be27239d29ff575465
- SHA512 c2fd5de898a57aac974d73bce64ff74040ddd3db8aa3d75f9b1c69de481e236a48ea3403dd192f319ddb0c67120f19fffa28fd429a078fdcb19717574897b78f
- SSDEEP 96:NKq4sHNw6M2xWGhD41MgGvmHhF+rF5pO1LnOYvhaFs:Nc52xxhD8rGvm6jpwnHa6
- TLSH T114A17EA6D545EFB2F932D04358D93FB2EAD59B7424B5C8D0F1AE72290D649B31705380
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\broadcast-listeners.json
- Size 221B
- SHA256 be45c7d62d4a86f20e6fbb5c26370735cd025c5d5dc15db95f480324d9d69408
- MD5 67620a18ccfdb895f26555c2f1b8ea64
- SHA1 7ecad6e19a77ec70556fa55af3834e7ecebc6d25
- SHA512 f1f1a677fb5a4f4cc73eb0f151ccd3c15f676ce2c7d630c88abaca1f1c287d672d06ab5f279eae6d7a6f8b818ee45697bd8fe55b1c3393f3c6cdd5a0fb2a237e
- TLSH T138D0220F68133C7F4B4CA729F0046B810B9A20093670A03DC3AF60941A2AAFC44481A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\broadcast-listeners.json
- Size 221B
- SHA256 9ee5eaa965e3e8c872457ca7617a8d07d1aa11da44eba9455141f67073ad13fb
- MD5 b1abc968e0224c109b3822903bcaf6a8
- SHA1 935c31e222955f2ee82a61f97e6ffa717849ce5c
- SHA512 92841a640f4378932fc5198f6b9ff08376de7afc5ef3c9b9fda0bf97cfc33a64fc06a95429a07ce2b6ba661ca6caaefc67ca8b439416eb0e98dc25f06300b83e
- TLSH T12BD0220F58173C7F8F496729F0052B850FAA204A3270A03DC3AE60940E2BFEC8208290
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\crashes\store.json.mozlz4
- Size 66B
- SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
- MD5 a6338865eb252d0ef8fcf11fa9af3f0d
- SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
- SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
- TLSH T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 70821137ec5ac4a5e5874f2a0fa81f1ecb2b05a206539a8b6868954c67ed4961
- MD5 883ab3738039624590e352a0429319b3
- SHA1 774c4ca163bf3d1e122c86d819ca4a99c09a7628
- SHA512 e6589c123331d68b1696e6ea73c7afc06b5a81e8b318baa713a67d193ed91e098c7e96dd5134e916870abeada7b1cf41e63b8855949b19a95e1cb1ed17766c71
- SSDEEP 96:6FF2IkVE/dd66Joz0dzgClKtmc0d/UuSdF95/7bkW6QXjrvEOZyUR6fWI:S1d66Joz0dzgCl6mc0dJOv5zbooMOZyt
- TLSH T128C1EB68F629563FC418023BCCA60B500F32394A985F3F2931DC68492D5B2DEBB8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 e2689efdc25a28d8013fbae8ddcd4b94301b7549966882ed9a7349b6ffb9b78b
- MD5 d1d5a63b029282eecc6f9552aecc258d
- SHA1 9b08ff7f7b66f3699dfacb89a95f88055678a185
- SHA512 deb5b4eaf4f98c48da37e04acb334668f754febda5b78cccedbca9bfebf463eca5c21d2fdaabc26bf53cdf56839f5745460d9b3892c029ea4a6e71af02b98e9f
- SSDEEP 192:L1d66Joz0dzgCl6mc0dROv5zboHCOZyjnEC:Jd66JozQzgC1jsboiOZyj7
- TLSH T126E12EA4F628963FC418027BCCA60B510F35398A984F3F29359C79192D472DDBB8E07E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 4f4fca38cabf7f4c17dded221b24b70c911893141868ebb7e208d1100f967310
- MD5 739f1c5448954db13a1218aa93ccc5b1
- SHA1 41b2fa6fb12abc7b826307af2bb72fbaa50eb1aa
- SHA512 5fa8ffd1eda69e995868e853b8176102ba672c11d49ce3a906324b37e8732013334f502d0fceb0a04bc03d97ec7f93f7fc3a4f8cd85669a6585a3a8d0e392de1
- SSDEEP 192:S1d66Joz0dzgCl6mc0dIOv5zboH4ZOZyj+:cd66JozQzgC1jtboYZOZyj
- TLSH T1E3D1DB58F629563FC418027BCCA60B500F35394A984F3F29359C68592D572CEBB8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
- Size 59KB
- SHA256 b463e173f6057b0bfd1b15f41f44ed60ab6ac96eef451e27bd9901f15c07299c
- MD5 3e18de8c196934d8c790711423c113a5
- SHA1 9f8adbabf8c032cddd72a4f7319144e57c8d6346
- SHA512 161edafef5bd91113d07b993e9ba6c49865d14cff6a7fdf0b367f35a12b9af96087b71af4abfd94126bb71e714cd5f13d0bb39eb314c2c2841be7cf28d9861a0
- SSDEEP 1536:4svBncSvrNmieZEu3KTft8x1Rh3FoJQRXA3Z:4sJcGkR3MqD+KK3Z
- TLSH T1A6432244EB1E553FD82802BA9C961B003F79F8895A0A2F67375C65786C873DC3D8E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
- Size 33KB
- SHA256 a95cd90472d5eff88c6c19d5283e17bdd0e1c7e69628d7bb8c7956bda8a2c481
- MD5 fbb1956b7e7f45132250994843288ed2
- SHA1 b2e3e597566986ad93a6ff7e4fd88a32f2f4e587
- SHA512 98aeb24f307c90b08f500a0c30ccd2c4595eb5ba4c2fde6484716b22c7f85ed492887c5dab8c7f8f96c1f639b0ee6cd7638f5b8e00b37421dc7ed05e25593b41
- SSDEEP 768:Zm+Azscza0skvKGcmhucdnKACtz/bWbAGbSN:6sczaJiaSY
- TLSH T1B6E22140FB2E913FD41412BBDCA507142F79B889591A2F9B3A4C64686C8B2DC7D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
- Size 58KB
- SHA256 7862e7f3ea73cffa5f85ad671c65979df63f77d08b9e08ab3128e969f30e8b67
- MD5 b224e29b7762047dc595dd1b3333a631
- SHA1 017d0391e2219ceaa899abfcac2e1d06804c0833
- SHA512 82cb00b58d52d7d9e5294fbf7ddaf77258d6b1919e20187263b8d4b8bdc57c2cf3fad8ee5ce544e0a4c9da81af28e3c166d473e0deab131e55841857a282c26b
- SSDEEP 1536:ysgBncSvrNmieZEu3KTft8x1Rh3FoJQRXA3Y:ysacGkR3MqD+KK3Y
- TLSH T15F432244EB1E553FD82802BA9C961B003F79F8895A0A2F67375C65786C873DC3D8E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 07334ed3625c14b5a4022066b14ed54297706677916b5f6f54d0cc6cc9ddd62e
- MD5 7f2f5f89fa5a6c801b098ba1f925cdc0
- SHA1 337e0167f6134166be5f6b5b15afa6cfde211c23
- SHA512 c3dcc27ae9a79be3b5a7c7772263c0ca8dcb7a4c04482ad430930121377fce2fd02ae4f19732797b1fad917fcf77429a6005c5f3ae8f879f7cfd2a58aa3cfbdf
- TLSH T18D21379C3EF84D6A6CCAF6987442118E53554E0A04871D434E13EFCDCE95BD932AF439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\events\events
- Size 2KB
- SHA256 c501f40344a402c81c5fbb4b31998e9d566e4c032510ca2dc792e8c18d27b61b
- MD5 1f40f416243f501f83c0ff00dbdcc4c3
- SHA1 ab708808e9f0d24a3cdd2bb20f0ad1dee83ff1c7
- SHA512 143ad251a0a9ce11c53f2562fec94374e6e8f76004e85686649e57dd6c45575bd75c21b8d73e04fc72bc9f8f8c4dea0ee68c3c2f3d55881a4a6d584e38f7dd8d
- TLSH T134418A8D3EA94C7A6C87F68CF802068D57854A0694932D834EC7EF8DCD52BD9329F42D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\47ce7476-a8ab-402f-959d-534b01dc6fd2
- Size 235B
- SHA256 7c168fc6ecb12499ffcc6a223628762d6b6fbb2d51d364d8e3e2a0756c45ce93
- MD5 802ddac21f1d6e5d7b21eb619d23f7e9
- SHA1 ec57ad6944cee63fbef665d1b231b53c495966e4
- SHA512 415fc97ed3b93804f2afba2d6e3d2461c6c3fb2257b3464fa7016b5b5532da4c1bbe3a6b484c1b4805fd1c31a1145b0a649bb2bb82520f20e0fc30684b74a6b3
- TLSH T19FD097E51488AB1E18140F07F0A02AC630C98C3310A45860CE52847CEFF8AC40162C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\88571337-8ee5-4755-8a3c-07b147b8e568
- Size 2KB
- SHA256 2b668d5542b2b0cd3cd7e4b028a31c85610f003881700dc30369902bacce78de
- MD5 0d2172d84ffb30d2e298043ff772a0ed
- SHA1 880623ecf8f51eba56b7687f9b277396f0cee520
- SHA512 0a5f4ca73e7c9fcf1b7346072f54acf09fc6cce44dc8499dca77476d74fd6d71cda82fae069a9a3c1d0cb5c475ec210b6629e443dc42dc7fd7ab27cadc4a3b49
- TLSH T12C41646CB9B45C7B6C9BF14D84D2338E53755A0300C328836D41EF0CCDD6B9E23AA52A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\a815f683-9e0c-4064-8f71-be4ef06a1b9c
- Size 886B
- SHA256 3bfa6e02f63d4943c1f1ef7e9dc0d58f47d429ba1eb039836577859c34a00670
- MD5 316326de54be52c3c833b08646689f4c
- SHA1 655274f80be18877f8ee273380fa8de676d3b887
- SHA512 2b11edf030eab75366c69d227a4e40de7ee80ed0892cc053f30c2ee2bed40efdab41f919abf14d6e59fd5230d68638e2b077404841fd7cae6bfadd2e8ca6bc60
- TLSH T16B1144C0962475B6CC74928B45E6B7838BB0313380C605587DA05F044CBF11ED39A10B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\ac2ec14b-cc51-4783-9eb0-c0a9ee705ccb
- Size 235B
- SHA256 4c266f9131a0a7bc3c5cb4e451769dc6a3ae35ee790d2afcb46ffd0dc2460261
- MD5 fafe1f7dc42fffb2100f62fa16e10a7e
- SHA1 6d6088856d0816c55e8d932fb1e1de32d387cc07
- SHA512 a59b0e38c95feb17d99a96d8ff93c9d8b12c61e497261a992f7cefda5625f60dfafc15b8b31f6aa51be9e614c842f1671735cec3557a2e502ebeea714afa5e31
- TLSH T1E6D097A014ACA72C08005F47F0A1B8C231884C331061A820D9E2023889BEDC84161A1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\c7270db8-3289-42c8-8885-d8709887ae16
- Size 16KB
- SHA256 f292b59b5f63de33d6656d9ce1c4e92bbc56fd68ed6b547499252e278fbb1edb
- MD5 2d21a07f071d515d355e99cb6ebb0078
- SHA1 8907e47c1863ae504c9186857bc89dae649a8cc9
- SHA512 6566a0a06392063f7a0f69ee63fe90e841a07d71bf718ff9e23d436f6afce0597ee78a6a107c1309fa0a3b2e4eab3b543bb760494af1c7da8468f6843e3910d9
- SSDEEP 192:vaRYn83Dtaftu4w1BuBI8XZMGJ4NaHCJmBfP5dyRuylKzxh0qF5AqG9Hh:iYn8Ttz4jLZHgsylKlh0qFh2Hh
- TLSH T15D72DB56282055BA9291E3A884FC7FC3E2F538CF4C419FCA9BE4BD086DEE45D512784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\fb06dd54-28ee-4480-907e-4d5d2fdfa7fd
- Size 883B
- SHA256 9130afccef38ccced0c8a757c8c01cd54b92bd5d8f6ad789c71ee1627ffa30d9
- MD5 1909ef1fa2085b369268c138f5766802
- SHA1 bba94ea4fb37b67697f85e54cc3c581c9c6b063a
- SHA512 341872deab84b83ff14eacf63eb1d5754264678ec65eca6e5730bc5e510df65eacf36f5b84f854f61af86535f89c938b8b0fd79e5ba393999256a04b0fcf620a
- TLSH T104114080E621B9F6CC78928B86A6774687E43223C0CB45143CA15E044CBF51FD7AA20B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\extension-preferences.json
- Size 942B
- SHA256 a56a46aa7451d640626f9adbce3ffb26ea6ab549f15af56fc2cd69f0bcfda67b
- MD5 8913f98eab4828647224c9a64b706b3c
- SHA1 f886a4456ee44a4e73ef32a2b138193f2fa41d37
- SHA512 28869c106812bf053c732469b0f67da993e42a471c7b576e68d45fe66d2f067bab0a66c5334e88c6460e08a06285daa643f5f34771bd0d7361097307137e1630
- TLSH T16211F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\extensions.json
- Size 14KB
- SHA256 249172c21021abb82f894e1f021733564319f376c2f6fdae1669d5a834bcb797
- MD5 9a6b68b1a6eea877beac646f859fed8a
- SHA1 60b8db2fd8159ee1011b3ab2d69122710adacfc7
- SHA512 d91979e69e07fbcf6406d4fd803a79bf9023c9f9e93b46923939ac4c8ff70edabbff32e643e7181eae5965423499755ed1b71f8ab87ed9ea504fe76c9b05baab
- SSDEEP 384:/kI4vTUmldvRJ8dhWH94zt96ogL4HVL4PAL4HvL4HGL4H7:MI4rRfZCXy4f6V414a4T4M4b
- TLSH T1ED62431549149EB8294FA78AAA367E02C37D473B70445C78F4DD8FC842FA5B902FB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
- Size 473B
- SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
- MD5 7406820f5d56fda6baffa951c60679d2
- SHA1 e7d4894993e506e235d55b3e47aed019d0584148
- SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
- TLSH T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
- MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
- SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
- SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
- TLSH T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs-1.js
- Size 6KB
- SHA256 b95f50874a60466d015ee7edfd6539566074b979942bb6ae108081234a510cd5
- MD5 68ede9e04fde997a9f82a572d6180b9e
- SHA1 4d8ef2bb71dd0ea22ab237474aa8297155758488
- SHA512 c27b2b62337c84f35474b54562fe57210e0e1b88f7eadafd463e7a90667561aa05cb938af8ba8bb110bab393b9852b8d573633da692d5c1fe8b84838674fb5c6
- SSDEEP 96:xHAmUTUJrPqGq4fyj6ObzSjSSlcdv9jjLYSnIHGAvzE3KF7Bw88H8L4cnh1Vlx:h5CR4fyj6NSSXjG/KF7Bw88mV
- TLSH T1EFE12F7895088F7F68B6776CAC6888715AB2013BB7BF28D750B554C4050CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
- Size 6KB
- SHA256 633edbfb4e24895f3c3f80301d29cadc2ddfd25625a357815ef4e6bb156ce06f
- MD5 8220441789113b87cbae655e91c089ed
- SHA1 3ffc9f8761d81347e1c77198efe51ce7216b60c6
- SHA512 7813e43765116a89a25c06e5c58f528b9b7ff6fb535925398668a7805866d5d6ccff4740d5e2fe8beb3a86d7357337f8ef5f28a1e2f832199ffc49fff08b79db
- SSDEEP 96:xHAmUTUJgqGq4fyj61zSjSSlcdv9jjLYSnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fyj66SSXjG/KF7Bw88mV
- TLSH T1D0E11E7895088F7F68B677ACAC6888715AB2013BB7BF28D750B554C5050CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
- Size 6KB
- SHA256 69fc6eb646368daae8ff3fab4ae0f34b233fc6f35da94b4c0d5e38e7473bc68b
- MD5 17ac3b5c49b4a9aa978ed1547aac2c0b
- SHA1 a7c4c6113e04a4b9246e729fa130197640cd6c43
- SHA512 6d226336c37693c1e31cc9e2ad88470a9138655889360c6d7b2ea5260b58bcc610baaa56d634af4d4254488db6ddc93238864accd7a8c027a2482767c39175f8
- SSDEEP 96:xHAmUTUJgqGq4fyj61zStSSlcdv9jWnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fyj6ESSCG/KF7Bw88mV
- TLSH T1FAE1107895088B7F74B677AC6C6888715AB2013BB7BF28D750B954C5050CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
- Size 6KB
- SHA256 a7c16b2e57805da2221739e39424b1ddd308c89c78299ea0b32afe0f574b4ee9
- MD5 8a35bd1955f70b0d155c0b9ebfaf66a9
- SHA1 ad6319e388b4bcb33a907b57e3937842cbd47f60
- SHA512 8ed761f8294c323d369d2e475bc3acd554f87460e4c0c8fa2dd48fe87843eba0c8ac494abf4cb21879893b73726d0a7045587726eb9982029d3c6832c77d2387
- SSDEEP 96:xHAmUTUJgqGq4fywj1zSLPSSlcdv9jWnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fywjCSSCG/KF7Bw88mV
- TLSH T101E1107895088F7F78B6776C6C6888315AB2013BB7BF68D750B95485050CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
- Size 7KB
- SHA256 2f493d5bce060a07bf86ce3f665eb8bc772cf72663f8c925e467c576cfe6c972
- MD5 52c322db2e62bfe1777848359fd70d29
- SHA1 4bf3439b05a9a3cadbacf1ba7b5133bc675d4eb5
- SHA512 826281598fad7880a5838e77893f4511cca4a43c51ed312d44441f0d37e4ab3f3ba677afa6fced5466408f8be28ac40be45a5e641e097c8a0e9ff0308d063ed1
- SSDEEP 96:xHAm9TUJrPqGq4fyj6ObzSjSSlcdv9jjLYSnIHGAvzE3KF7Bw88g8L4cnh1Vlx:hQCR4fyj6NSSXjG/KF7Bw88LV
- TLSH T13CF10EB89504CB7F68B6776CAC6888315AB2013BB7BF6CD650B954C4450CF3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
- Size 6KB
- SHA256 4e05ae9d30e58ab0ec9fc3018cab3d02856e9e1706f221dde0466333ed61712a
- MD5 715c4877a42115207cce7d7f846813a4
- SHA1 df9ad6cb09c5fb12ff04b6b8ceddcd551aa58765
- SHA512 502909af3a5f84e27c65319e81be2a8e344c071442f87753b8c67c3223f21192d435db873b85b2d71d5d3249d0de7e8d657a339c6ce86d54a885fd052d7c6f6b
- SSDEEP 96:xHAmUTUJgqGq4fyj6ObzSjSSlcdv9jjLYSnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fyj6NSSXjG/KF7Bw88mV
- TLSH T1AEE1207895088F7F68B6776CAC6888315AB2013BB7BF28D750B554C5050CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
- Size 12KB
- SHA256 9c1bd5d9862208e0c1845de5603e83de052e4ff59d0b4a54eacb2aa7c8428b8d
- MD5 0cc78751e0f0bb4d38c6b2d075213223
- SHA1 7b7e958eb362dc74153eac1a52efe7821bae5b50
- SHA512 2332a0dfb637abc3d4779d7ec2a205143a6aa28e50e37c5b15b61b02b550da7861b0a73aff1737af78355bb5fed29aff886a9cdcc5affa7047d15bb3460b4df2
- SSDEEP 192:qQCR4fB9Mj6NSSXlLRU/KFTOBw88M8t98Fbz9:FL5RFIwHm9
- TLSH T11042DC3C64018E7F64F7727D6C2589B059A10137BABFBCD246B884C2494CF6445EBAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
- Size 7KB
- SHA256 430a49948b337d20d20a700ae15dac6dc6108a4e9dd606a39e1a6ba7a675005c
- MD5 cd5ed642bd5d199880a0db69909f3b5f
- SHA1 ba2623afeee6c907abcebf62ceaa31b83c67635e
- SHA512 8c34673c8aaacbf0095986f2a386deabb4c2bcd866dcd3a3fb02a46ffb60cdabf25262fa88c541d7fedaedcb48ba03c2bf225cd96ce32d051b3b56d0975b7864
- SSDEEP 96:xHAm9TUJrPqGq4fB9Mj6ObzSjSSlcdv9jjLYSnIHGAvzE3KF7Bw88mQ8L4cnh1Vb:hQCR4fB9Mj6NSSXjG/KF7Bw88a9
- TLSH T1FEF11EB85504CB7F68B6766C6C2888315AB2013BBBBF6CD651B944C5450CF3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
- Size 53B
- SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
- MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
- SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
- SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
- TLSH T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
- Size 8KB
- SHA256 3ae0c51c8437afb455abcddce2c73733cd44709f901f38ef02e3eaf39fe62557
- MD5 6f43424bb1605f6acd2b63594ddd5e6f
- SHA1 5850a766c0e34949cac72030290fd38acd9edc6e
- SHA512 f39c44e99ecb61b57144796fc5cfe199a0197f32a3eca12c7e9c6ea7610e6ba5230ac6b030577dddd309e198e7d3bcf05c62dbe0f5511d4870518923a336e645
- SSDEEP 192:QpGcRsbOgUCZN82Cty+j/Qkj3fHYu9eAAh+iJ8LQSDIR:Qp9RiORV2x+jQkzgMeHhH4QD
- TLSH T168029F674A271F955D67B394C4EC3B6AE4E304A083741908C6CA3E1695CF7D8E72FE28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
- Size 8KB
- SHA256 f8a52bfa65c056c5a342ba7b483347d247d29b66226783585bdbfe4bf0a78d74
- MD5 d6076586bbdac722051d2c6dac9508f8
- SHA1 ee9ce8f1d0b893dc26f345aea22399988daa0907
- SHA512 3fe12119fd27adfd8b3253695b685760aab4a0b4059374ba2eeb732a695acfc8aeeef8a2a3fe4e49e61ef268627c5d905cf7864b7d1ab1053c4c41635d082138
- SSDEEP 192:QpGsURsbOgUCZN82Cty+j/Qkj3fHYu9eAAh+iJ8LQSDCR:QpaRiORV2x+jQkzgMeHhH4QJ
- TLSH T104028F674A271F965D67B394C4ED3B6EE0E304A083741908C6C93E1695CB7D4E72BE24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\settings\data.safe.tmp
- Size 264B
- SHA256 2468c7a7b7c2b01fc4272577278f9020865812523ebd5c8aa258a6b4ef95f5b1
- MD5 db72440aa300835974e3825b79338007
- SHA1 4daf77edfaaaa332862768f3c97e0189e4b69440
- SHA512 df6d8b5d3c4a54c61945ba559d7eaea7fe83f392181319ed76d9590a998ccb0881591873458cab310e3ca4e84ab3d9cc965dbe67840bee3062aae2b79fb94a23
- TLSH T1B5D0A71A4C051453E8C4B5304111DF625B8450368F39A5D6428FA7ED9E10493F4EA0FD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 13.3MB
- SHA256 9627438275095c0902fa574c40e8898fe3f469f90c28fdd83f068ec2a2c4aeb7
- MD5 4e0780860ff6bc0919fb13c5b890fd7f
- SHA1 16c538a224d92c3d0dd828ecab6dd7ce9aa56bda
- SHA512 0a62fad7e30c7696a9b635c2775d0de1175f2e84b4a23e705f8a6f3d6a8e55d59097e1e669ff0081e27a632f44dc9ec774cde1dadd0a91d45c04ab8bceb3a357
- SSDEEP 49152:49yWktn/X16e4y2D3/Yp0587TloJzQNdoAo/FXQ6QNBYiWS+DLsCimVzPT4SPE8W:FgPxiigfZtHDf+GGql
- TLSH T18BE63A9270E0DA92DB0186F2B31F43DB317FC1DC20E5899416B8BA6C595329BEE6F354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.1MB
- SHA256 22414947040ab5d19560b572598d83395f08d19044e79f7e1aeab21343b372f4
- MD5 2d0a6a6080949a2a981ea1f9bbb66666
- SHA1 df6d6b9769f3fe648e0af9258289c1a8fe42275e
- SHA512 c8a9383c2a7696d787b5d3685ffc52a60349ee856b1b22e754a98f5700b08f7844b7f96d86d166130321344802ef5e5d70d8b29234c191b271ca5a668b33b2c1
- SSDEEP 24576:wWIHs7hwFhQZjLBEY5OGV7PlwQAHO7zrbK/1tMnyP+xmD57j52oYUgr:wWBukXaYVW8zXgIxmD5792oYUg
- TLSH T188362AF820D1A257F3414033764593EF21EFD00C6027DA085BA99AE9A574CEF9E16B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.6MB
- SHA256 1350992afe90171b951a6681e04d739ee07ac2b3c385475d9549fa4842729515
- MD5 73d2035e1fa87af6df89d1b6b32da360
- SHA1 c0265e4612ff0845c5717663b3d0c7f518d7b565
- SHA512 9430193ac8b49b5fd1bc909f1ed577d5a98def7ed9971cb48991cdc8505a4e4b27c27a47e581a29450fc8b390d9eb235e1a2254d93a86463da48cc75fdea7e0c
- SSDEEP 24576:ZtbLCTcj4s7zVpd4LyA1Xmuuopwu2Yl7PrbK/1FMnyP+x4D57I52oY+FDNA4zKj:ZtfCgj7zVpd4rTPXgIx4D57g2oY+FGHj
- TLSH T1FE4629E820D1A257F3824073724593EB21EFD00D5037DA085BA99AE9A574CEF8E17B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.5MB
- SHA256 47697fcee58f2ba1aaa687086e4df7ffb05efdb92b6ba4e5057c837f59ccc4fe
- MD5 7c0db67265d7bcb3e700974c4ad59751
- SHA1 2743b9204fb4abbc4e98b40f5e18f5ec651bb7db
- SHA512 82449166cd175bb0dee92eb10aea8dab7bb91b1f134ec140a4ad551f927dc15ffc374ea97ebee4f264386d496e6092af46fc4c631b2e916a702d5e05125a527f
- SSDEEP 49152:YnrCmkvz9T4DPhw5igfmZtHVY+pW7JiNn35lH2HLimx+5ISllqXbg02lcr+jFaS9:ePPO5iguZtHVY+s
- TLSH T181864BE820E1D253F38640B3718993EB21EFD01C6036CE48579496FAA5748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.6MB
- SHA256 f90b330b639e16d89e6de7822908f2f2ae15f7ff2d83c0e42b86a0e2e75379d0
- MD5 5c8189d3dbd078482f74f3331b177bec
- SHA1 42e0ecb45fa847eb0cb538b80c09da8c566b1d5f
- SHA512 cc526af701ced9a24f8d5c244a82d3f7ee173fd00056c5e30d93f131d28ec08411341aa740a9c527ad520668d94eb146ad17d3c777936eeb4f326a44a03944e4
- SSDEEP 49152:vnrCmkHz9T4DPJAiigfmZtHDY+pW7riMn35lH2HLimx+5ISllqXbg02lcr+jFaSq:PPP2iiguZtHDY+s8
- TLSH T19A864BE420E1D253F38640B3718993EB21EFD01C6036CE48579496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.6MB
- SHA256 6f00df875d1c8960fbb1928deb526442810e00e0b926c539943d93856e4427f4
- MD5 a18757b3fdde74c292e35e6ac8e6e1a3
- SHA1 a8a15d9ac037d62e54a2b40f5f329f0fabfd6739
- SHA512 9ead3dc8c4c4a5afae12d3dca462fb3f1f08965ef417ea83d39034a37cf5cd56eb22e29cacfca72f28be0ca4572362a8e042d15280159c824b9afccaaedbdc41
- SSDEEP 49152:s9yWktn/X16e4y2D3/Yp0587TloJzQNdoeo/FXQ6QvTYiWS+DLfCimVzPT4SPEC6:ZlPriigeZtHhl+D
- TLSH T18C864BE420E19253F38640B3719993EB21EFC01C6036CF48579496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 b4d0bcb1808b4a946029275506c4285d23950b5546b867a8b3b5671ca435e13c
- MD5 7745866dec0963ce463772e6fdb2ae57
- SHA1 49353161500b6dbdc2475b6d8d4d8391dfbfbdb5
- SHA512 21a0cf5630067d89c3ee66a45a7d84daa22a94fe072501477994e139820081c8f9e949b7f93bc3b29a501faef330e6f4472edfe363deeb11abb611b991e6bff8
- TLSH T178716F0CA61CA8BEA66BC3C0E6847F978BBD053370447458DAFE460C55FB5FB122621B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\xulstore.json
- Size 167B
- SHA256 a261f6c4c1f49fbaac01d6d7437da1149f9b03588d54b2fd860fdfe969596115
- MD5 e116daaa7b2ab9bd0f8985831cbbac49
- SHA1 e7d1fed6c2125cee196699694b7f4532f20536c1
- SHA512 5d0ccbfdd9e5160a07f658fcb99e7527fdaed658a3f7c78c9bec2b7fcba9025e88be25b804102b371307edc1aec5972752fcdb204239dbc5e65f7a3c59a268b8
- TLSH T1CFC08CB022AFA8087D27CBCF128D22983E398A5491D0529A7AEA94A018C470F9D18388
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\setup.ADnKwReQ.exe.part
- Size 128KB
- SHA256 a3e27b5cc4f2bd959285346ae1cb8bf5106f2525927f0d9c20968cac2655516a
- MD5 f8d75f604b84f05e42afd1f927473353
- SHA1 d28a9e568348c5ff72e4f2c76c812c1b82cf1567
- SHA512 c6bcd194eb4441a7738608e37a62394ee67b19ee3a960f3b0933445594c95a05fb406bc65f829c0eae8980103bc0aa3872d98302bf4b532bc258bd9e211f4af6
- SSDEEP 3072:KaZNicL4RyeFwF8cZNuodV20uKKXs8JU86dkPgmWJA/bfgWf9JBAg0Funohj5cLX:hG31DAOnohj5ckePF
- TLSH T178D3C20377FA84A9F1B31FB02DB4554499BBBC699E71DE2F1284941E5968A90CE30F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\setup.ADnKwReQ.exe.part
- Size 550KB
- SHA256 b02b503f85b081c3a2332163744dd3124c49d0f21a9e75fda893dd4f27313b6c
- MD5 bf69a677cc17853fc30eec00e6aab033
- SHA1 e211f6bf1ab6413480945d9c0c8f95e63f17bed0
- SHA512 a2a246952eb1114d31aa5f3574410764c2236b9af0d2fb33f93f3efabf95f2146ae7af78f7dadc86895f8e436be4b5f6eaaec691a6f0f9fcca0ffea263ea1cfa
- SSDEEP 12288:huGj5je69oqAmj5oMqKyKAuqOAP0wu1eMb01JQntLOCHHo0Hu:hXhe29AmjkKuu1emHHxO
- TLSH T1F7C4171366ECBCA5E17216706B7797E0DB7EFC211D30C91F22D0051D997C982BA21BA7
- MD5 SHA1 SHA512 SSDEEP TLSH