hxxps://github[.]com/interplains/Zero-Breach-Toolkit

Analysis

user interaction
yes
max time kernel
1482s
max time network
1081s
platform
windows10-2004_x64
resource
win10v2004-20260911-de
resource tags

arch:x64arch:x86image:win10v2004-20260911-delocale:de-deos:windows10-2004-x64systemwindows
submitted
27/10/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/interplains/Zero-Breach-Toolkit
Sample261027-2qecqahs2p

Score

8^/10

credential_access defense_evasion discovery execution persistence stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
278	780	firefox.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Python 3.12 Installer.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 1 IoCs

pid	Process
5228	Python 3.12 Installer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	python3.12.exe
File opened (read-only)	\??\O:	python3.12.exe
File opened (read-only)	\??\U:	python3.12.exe
File opened (read-only)	\??\N:	python3.12.exe
File opened (read-only)	\??\U:	python3.12.exe
File opened (read-only)	\??\J:	python3.12.exe
File opened (read-only)	\??\N:	python3.12.exe
File opened (read-only)	\??\T:	python3.12.exe
File opened (read-only)	\??\B:	python3.12.exe
File opened (read-only)	\??\K:	python3.12.exe
File opened (read-only)	\??\Q:	python3.12.exe
File opened (read-only)	\??\I:	python3.12.exe
File opened (read-only)	\??\A:	python3.12.exe
File opened (read-only)	\??\J:	python3.12.exe
File opened (read-only)	\??\P:	python3.12.exe
File opened (read-only)	\??\T:	python3.12.exe
File opened (read-only)	\??\G:	python3.12.exe
File opened (read-only)	\??\R:	python3.12.exe
File opened (read-only)	\??\Z:	python3.12.exe
File opened (read-only)	\??\L:	python3.12.exe
File opened (read-only)	\??\V:	python3.12.exe
File opened (read-only)	\??\W:	python3.12.exe
File opened (read-only)	\??\X:	python3.12.exe
File opened (read-only)	\??\M:	python3.12.exe
File opened (read-only)	\??\O:	python3.12.exe
File opened (read-only)	\??\E:	python3.12.exe
File opened (read-only)	\??\S:	python3.12.exe
File opened (read-only)	\??\X:	python3.12.exe
File opened (read-only)	\??\G:	python3.12.exe
File opened (read-only)	\??\Y:	python3.12.exe
File opened (read-only)	\??\K:	python3.12.exe
File opened (read-only)	\??\V:	python3.12.exe
File opened (read-only)	\??\E:	python3.12.exe
File opened (read-only)	\??\H:	python3.12.exe
File opened (read-only)	\??\M:	python3.12.exe
File opened (read-only)	\??\S:	python3.12.exe
File opened (read-only)	\??\Z:	python3.12.exe
File opened (read-only)	\??\A:	python3.12.exe
File opened (read-only)	\??\H:	python3.12.exe
File opened (read-only)	\??\P:	python3.12.exe
File opened (read-only)	\??\Q:	python3.12.exe
File opened (read-only)	\??\W:	python3.12.exe
File opened (read-only)	\??\Y:	python3.12.exe
File opened (read-only)	\??\I:	python3.12.exe
File opened (read-only)	\??\R:	python3.12.exe
File opened (read-only)	\??\B:	python3.12.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Python 3.12 Installer.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5908	powershell.exe
6076	powershell.exe
2884	powershell.exe
4436	powershell.exe
1540	powershell.exe
260	powershell.exe
1792	powershell.exe
3632	powershell.exe
4064	powershell.exe
2896	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4284	cmd.exe
1316	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Python 3.12 Installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Python 3.12 Installer.exe

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Python 3.12 Installer.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5908	powershell.exe
5908	powershell.exe
4064	powershell.exe
4064	powershell.exe
6076	powershell.exe
6076	powershell.exe
2884	powershell.exe
2884	powershell.exe
4436	powershell.exe
4436	powershell.exe
1540	powershell.exe
1540	powershell.exe
2896	powershell.exe
2896	powershell.exe
260	powershell.exe
260	powershell.exe
1792	powershell.exe
1792	powershell.exe
3632	powershell.exe
3632	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4264	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	5228	Python 3.12 Installer.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	5908	powershell.exe
Token: SeIncreaseQuotaPrivilege	5908	powershell.exe
Token: SeSecurityPrivilege	5908	powershell.exe
Token: SeTakeOwnershipPrivilege	5908	powershell.exe
Token: SeLoadDriverPrivilege	5908	powershell.exe
Token: SeSystemProfilePrivilege	5908	powershell.exe
Token: SeSystemtimePrivilege	5908	powershell.exe
Token: SeProfSingleProcessPrivilege	5908	powershell.exe
Token: SeIncBasePriorityPrivilege	5908	powershell.exe
Token: SeCreatePagefilePrivilege	5908	powershell.exe
Token: SeBackupPrivilege	5908	powershell.exe
Token: SeRestorePrivilege	5908	powershell.exe
Token: SeShutdownPrivilege	5908	powershell.exe
Token: SeDebugPrivilege	5908	powershell.exe
Token: SeSystemEnvironmentPrivilege	5908	powershell.exe
Token: SeRemoteShutdownPrivilege	5908	powershell.exe
Token: SeUndockPrivilege	5908	powershell.exe
Token: SeManageVolumePrivilege	5908	powershell.exe
Token: 33	5908	powershell.exe
Token: 34	5908	powershell.exe
Token: 35	5908	powershell.exe
Token: 36	5908	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeIncreaseQuotaPrivilege	4064	powershell.exe
Token: SeSecurityPrivilege	4064	powershell.exe
Token: SeTakeOwnershipPrivilege	4064	powershell.exe
Token: SeLoadDriverPrivilege	4064	powershell.exe
Token: SeSystemProfilePrivilege	4064	powershell.exe
Token: SeSystemtimePrivilege	4064	powershell.exe
Token: SeProfSingleProcessPrivilege	4064	powershell.exe
Token: SeIncBasePriorityPrivilege	4064	powershell.exe
Token: SeCreatePagefilePrivilege	4064	powershell.exe
Token: SeBackupPrivilege	4064	powershell.exe
Token: SeRestorePrivilege	4064	powershell.exe
Token: SeShutdownPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeSystemEnvironmentPrivilege	4064	powershell.exe
Token: SeRemoteShutdownPrivilege	4064	powershell.exe
Token: SeUndockPrivilege	4064	powershell.exe
Token: SeManageVolumePrivilege	4064	powershell.exe
Token: 33	4064	powershell.exe
Token: 34	4064	powershell.exe
Token: 35	4064	powershell.exe
Token: 36	4064	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeIncreaseQuotaPrivilege	1540	powershell.exe
Token: SeSecurityPrivilege	1540	powershell.exe
Token: SeTakeOwnershipPrivilege	1540	powershell.exe
Token: SeLoadDriverPrivilege	1540	powershell.exe
Token: SeSystemProfilePrivilege	1540	powershell.exe
Token: SeSystemtimePrivilege	1540	powershell.exe
Token: SeProfSingleProcessPrivilege	1540	powershell.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
780	firefox.exe
780	firefox.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
4264	OpenWith.exe
2176	OpenWith.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 780	2244	firefox.exe	86
PID 2244 wrote to memory of 780	2244	firefox.exe	86
PID 780 wrote to memory of 1928	780	firefox.exe	87
PID 780 wrote to memory of 1928	780	firefox.exe	87
PID 780 wrote to memory of 1928	780	firefox.exe	87
PID 780 wrote to memory of 5872	780	firefox.exe	88
PID 780 wrote to memory of 5872	780	firefox.exe	88
PID 780 wrote to memory of 5872	780	firefox.exe	88
PID 780 wrote to memory of 5872	780	firefox.exe	88
PID 780 wrote to memory of 1068	780	firefox.exe	89
PID 780 wrote to memory of 1068	780	firefox.exe	89
PID 780 wrote to memory of 1068	780	firefox.exe	89
PID 780 wrote to memory of 1068	780	firefox.exe	89
PID 780 wrote to memory of 5164	780	firefox.exe	90
PID 780 wrote to memory of 5164	780	firefox.exe	90
PID 780 wrote to memory of 5164	780	firefox.exe	90
PID 5444 wrote to memory of 1436	5444	firefox.exe	93
PID 5444 wrote to memory of 1436	5444	firefox.exe	93
PID 780 wrote to memory of 3200	780	firefox.exe	94
PID 780 wrote to memory of 3200	780	firefox.exe	94
PID 780 wrote to memory of 3200	780	firefox.exe	94
PID 780 wrote to memory of 3200	780	firefox.exe	94
PID 780 wrote to memory of 5268	780	firefox.exe	95
PID 780 wrote to memory of 5268	780	firefox.exe	95
PID 780 wrote to memory of 5268	780	firefox.exe	95
PID 780 wrote to memory of 5268	780	firefox.exe	95
PID 780 wrote to memory of 3828	780	firefox.exe	96
PID 780 wrote to memory of 3828	780	firefox.exe	96
PID 780 wrote to memory of 3828	780	firefox.exe	96
PID 780 wrote to memory of 3828	780	firefox.exe	96
PID 780 wrote to memory of 3728	780	firefox.exe	97
PID 780 wrote to memory of 3728	780	firefox.exe	97
PID 780 wrote to memory of 3728	780	firefox.exe	97
PID 780 wrote to memory of 3728	780	firefox.exe	97
PID 780 wrote to memory of 2724	780	firefox.exe	98
PID 780 wrote to memory of 2724	780	firefox.exe	98
PID 780 wrote to memory of 2724	780	firefox.exe	98
PID 780 wrote to memory of 2724	780	firefox.exe	98
PID 780 wrote to memory of 5312	780	firefox.exe	114
PID 780 wrote to memory of 5312	780	firefox.exe	114
PID 780 wrote to memory of 5312	780	firefox.exe	114
PID 780 wrote to memory of 5312	780	firefox.exe	114
PID 780 wrote to memory of 5548	780	firefox.exe	115
PID 780 wrote to memory of 5548	780	firefox.exe	115
PID 780 wrote to memory of 5548	780	firefox.exe	115
PID 780 wrote to memory of 5548	780	firefox.exe	115
PID 780 wrote to memory of 5504	780	firefox.exe	116
PID 780 wrote to memory of 5504	780	firefox.exe	116
PID 780 wrote to memory of 5504	780	firefox.exe	116
PID 780 wrote to memory of 5504	780	firefox.exe	116
PID 780 wrote to memory of 4880	780	firefox.exe	117
PID 780 wrote to memory of 4880	780	firefox.exe	117
PID 780 wrote to memory of 4880	780	firefox.exe	117
PID 780 wrote to memory of 4880	780	firefox.exe	117
PID 780 wrote to memory of 5756	780	firefox.exe	118
PID 780 wrote to memory of 5756	780	firefox.exe	118
PID 780 wrote to memory of 5756	780	firefox.exe	118
PID 780 wrote to memory of 5756	780	firefox.exe	118
PID 780 wrote to memory of 2848	780	firefox.exe	119
PID 780 wrote to memory of 2848	780	firefox.exe	119
PID 780 wrote to memory of 2848	780	firefox.exe	119
PID 780 wrote to memory of 2848	780	firefox.exe	119
PID 780 wrote to memory of 4148	780	firefox.exe	120
PID 780 wrote to memory of 4148	780	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/interplains/Zero-Breach-Toolkit"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/interplains/Zero-Breach-Toolkit
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2036 -prefsLen 27099 -prefMapHandle 2040 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {e4d5a6ca-b23a-4768-aae0-f9e6af9605ed} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {047a4e44-7b28-42a7-8cf0-108af5aba52f} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 25164 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3776 -initialChannelId {4000564d-666b-4626-9ee9-7c9b9d5e4a40} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27276 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {e8c05eef-d430-4d6b-8693-f137f84c76aa} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4392 -prefsLen 34775 -prefMapHandle 4396 -prefMapSize 270279 -jsInitHandle 4400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4408 -initialChannelId {42c65552-5dce-408b-84d9-e9aded4408c5} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2800 -prefsLen 35012 -prefMapHandle 5152 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {aa8e0bbd-b8f2-4ddc-ae9b-175a50da9e87} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5256 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2656 -initialChannelId {2bc38005-93a5-4632-957b-6945768c6eb1} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5420 -prefsLen 32952 -prefMapHandle 5424 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5436 -initialChannelId {bb6f245b-2c1d-4f4b-bc4e-c19c8677458a} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5716 -initialChannelId {fc7c2cff-2aea-4776-a8ab-09691dd9456e} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6896 -prefsLen 39945 -prefMapHandle 6884 -prefMapSize 270279 -jsInitHandle 6420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1420 -initialChannelId {d010d188-087e-469d-bc0e-ddc2ae024a75} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7156 -prefsLen 36925 -prefMapHandle 1612 -prefMapSize 270279 -jsInitHandle 7120 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7136 -initialChannelId {ce37db3c-ef6e-49ee-ab29-4ec615fbc724} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5904 -prefsLen 36925 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {f142a42a-d108-4795-a8a0-4cf1bd1a73b6} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348 -prefsLen 36925 -prefMapHandle 6544 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5896 -initialChannelId {14295e32-3ffe-48b5-9578-f992487f6f48} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7248 -prefsLen 36925 -prefMapHandle 7252 -prefMapSize 270279 -jsInitHandle 7256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7264 -initialChannelId {f8c831c7-88da-4c1e-9220-acf92cdef233} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7104 -prefsLen 36925 -prefMapHandle 7596 -prefMapSize 270279 -jsInitHandle 7576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7592 -initialChannelId {adad7200-4991-49a0-a82f-72fccdfe64c0} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7868 -prefsLen 36925 -prefMapHandle 7872 -prefMapSize 270279 -jsInitHandle 7876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7884 -initialChannelId {7ba29646-d84f-487b-9ae0-97f4efccff00} -parentPid 780 -crashReporter "\\.\pipe\gecko-crash-server-pipe.780" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4148
- - C:\Users\Admin\Downloads\Python 3.12 Installer.exe
    "C:\Users\Admin\Downloads\Python 3.12 Installer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:1436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3388
- C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
  python3
  2⤵
  PID:5228
- C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
  python3 build.py
  2⤵
  PID:3864
- - C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
    C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\emit_stix.py
    3⤵
    PID:1992
- - C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
    C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\emit_misp.py
    3⤵
    PID:892
- - C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
    C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\emit_denylist.py
    3⤵
    PID:4816
- - C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
    C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\bundle.py C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\dist\zero-breach-toolkit.py
    3⤵
    PID:5100

C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
"C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe"
1⤵
PID:2916

C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
"C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe" "C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\build.py"
1⤵
PID:2220
- C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\emit_stix.py
  2⤵
  PID:2044
- C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\emit_misp.py
  2⤵
  PID:3240
- C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\emit_denylist.py
  2⤵
  PID:4204
- C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\bundle.py C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\dist\zero-breach-toolkit.py
  2⤵
  PID:5304

C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
"C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe" "C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\build_exe.py"
1⤵
PID:2744
- C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\python.exe -m PyInstaller --onefile --console --noupx --clean --noconfirm --name zero-breach-toolkit --version-file C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\pyinstaller\version_info.txt --distpath C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\dist --workpath C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\pyinstaller --specpath C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\pyinstaller C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\dist\zero-breach-toolkit.py
  2⤵
  PID:1956

C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
"C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe" "C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\build\bundle.py"
1⤵
PID:5964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\scan\run-scan.cmd" "
1⤵
- Executes a command shell one-liner
PID:4284
- C:\Windows\system32\where.exe
  where python
  2⤵
  PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python -c "import datetime;print(datetime.datetime.now().strftime('%Y%m%d-%H%M%S'))"
  2⤵
  - Executes a command shell one-liner
  PID:1316
- - C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
    python -c "import datetime;print(datetime.datetime.now().strftime('%Y%m%d-%H%M%S'))"
    3⤵
    PID:6044
- C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
  python -X utf8 zero-breach-toolkit.py --json "C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\findings\scan-20261027-225424.json" --report "C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\findings\scan-20261027-225424.txt"
  2⤵
  PID:1216

C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
"C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe" "C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\scan\zero-breach-toolkit.py"
1⤵
- Enumerates connected drives
PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-DnsClientCache -ErrorAction Stop | Select-Object Entry,Name,Data,Type | ConvertTo-Json -Depth 3 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-CimInstance Win32_OperatingSystem | Select-Object @{n='Boot';e={$_.LastBootUpTime.ToString('o')}} | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-WinEvent -ListLog 'Microsoft-Windows-DNS-Client/Operational' -ErrorAction Stop | Select-Object @{n='IsEnabled';e={[bool]$_.IsEnabled}}, @{n='RecordCount';e={[int]$_.RecordCount}} | ConvertTo-Json -Depth 3 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; try { $ev = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1116,1117,5001} -MaxEvents 2000 -ErrorAction Stop } catch { if ($_.FullyQualifiedErrorId -like 'NoMatchingEventsFound*') { '[]'; exit 0 } else { throw } }; @($ev | ForEach-Object { $x=[xml]$_.ToXml(); $d=@{}; foreach($n in $x.Event.EventData.Data){ $d[[string]$n.Name]=[string]$n.'#text' }; [pscustomobject]@{Id=$_.Id; Time=$_.TimeCreated.ToString('s'); Data=$d} }) | ConvertTo-Json -Depth 4 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; try { $ev = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 20000 -ErrorAction Stop } catch { if ($_.FullyQualifiedErrorId -like 'NoMatchingEventsFound*') { '[]'; exit 0 } else { throw } }; @($ev | ForEach-Object { $d=@{}; $d['p2']=[string]$_.Properties[2].Value; $d['p3']=[string]$_.Properties[3].Value; $d['p4']=[string]$_.Properties[4].Value; [pscustomobject]@{Id=$_.Id; Time=$_.TimeCreated.ToString('s'); Data=$d} }) | ConvertTo-Json -Depth 4 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4436

C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe
"C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.12_3.12.2800.0_x64__qbz5n2kfra8p0\python3.12.exe" "C:\Users\Admin\Downloads\Zero-Breach-Toolkit-main\scan\zero-breach-toolkit.py"
1⤵
- Enumerates connected drives
PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-DnsClientCache -ErrorAction Stop | Select-Object Entry,Name,Data,Type | ConvertTo-Json -Depth 3 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-CimInstance Win32_OperatingSystem | Select-Object @{n='Boot';e={$_.LastBootUpTime.ToString('o')}} | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Get-WinEvent -ListLog 'Microsoft-Windows-DNS-Client/Operational' -ErrorAction Stop | Select-Object @{n='IsEnabled';e={[bool]$_.IsEnabled}}, @{n='RecordCount';e={[int]$_.RecordCount}} | ConvertTo-Json -Depth 3 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; try { $ev = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1116,1117,5001} -MaxEvents 2000 -ErrorAction Stop } catch { if ($_.FullyQualifiedErrorId -like 'NoMatchingEventsFound*') { '[]'; exit 0 } else { throw } }; @($ev | ForEach-Object { $x=[xml]$_.ToXml(); $d=@{}; foreach($n in $x.Event.EventData.Data){ $d[[string]$n.Name]=[string]$n.'#text' }; [pscustomobject]@{Id=$_.Id; Time=$_.TimeCreated.ToString('s'); Data=$d} }) | ConvertTo-Json -Depth 4 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; try { $ev = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 20000 -ErrorAction Stop } catch { if ($_.FullyQualifiedErrorId -like 'NoMatchingEventsFound*') { '[]'; exit 0 } else { throw } }; @($ev | ForEach-Object { $d=@{}; $d['p2']=[string]$_.Properties[2].Value; $d['p3']=[string]$_.Properties[3].Value; $d['p4']=[string]$_.Properties[4].Value; [pscustomobject]@{Id=$_.Id; Time=$_.TimeCreated.ToString('s'); Data=$d} }) | ConvertTo-Json -Depth 4 -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\activity-stream.contile.json
Size 4KB
SHA256 2e7c2ae4fc1d0457088335c6f585dc86f5840afaa14f59de0c77976779e8ec18
MD5 025f74a5f8801c28d116d73d95eb15df
SHA1 22979f556708f0ba193ef1cc73d070a5d72224e7
SHA512 ea46fc8643402c78d7225f5a6d300d0346330827ab0deac8e2a538ff2baee6749a83929d36bd2269baad2c742dd0571a073d149ecf584c737603884fc15d9b09
SSDEEP 96:T+qjruMWRcm0qj1FLxT+mRo9n4KYMqj8sY96DtlOlz:SqjiMcclqjnLAmRo9vqj69wtEF
TLSH
T1AA91D9ABC96489431731A6E56C5B3A8DF007F005DDE0CA9C72699C20C9BC7FB85DF994
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 f40a368e2da78a7e1f13c51df0a0c3f33ed8ebdc91f0b94f28ba237a878358e5
MD5 eec17c946fe5cc9cc2faf8eeb63f33c6
SHA1 7546de37e1cf49fda3af925f6dde1a63c6386f71
SHA512 b918c4934b85d93d41162e1a1e9940d47c77e2033ece02e12a8160d83ad22cc5afc32d988de233b33ee5eb3e9fbb70cc704e59fdeb3cf580626c669f6bb432bb
SSDEEP 768:cyuHOPQsD3hko6DM6Tcqfi+VmgsiR0Ou51nFK2xOOrMe7VPVV+GmDe8a0:Huuu66XmgsFVvK2SCVPSGk7a0
TLSH
T1E773F9A3A6E8B1BF1B9037C72C0FB95B52B20185F34906C9EDAEC91C81DD754123A5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\activity-stream.discovery_stream.json.tmp
Size 75KB
SHA256 9d7829675cd881108d33c7ed97702ea350d1ef6f3f949ce02de320c1df28a3bf
MD5 708714c92663da436520f8360e458287
SHA1 6bb172b8ff47af5207edf93562f9eee9b672b736
SHA512 6bb35caaddaab0ee0ff78136f8a5e8c0f48aa0dad37c86b6effeeed4280576dac78eb51e4a32e40647ed03133aaafc5dfddfbf41d6f932c1e37b5091533d3412
SSDEEP 1536:H0FPaK2tEybVS3HR/O4xyPCRedAUYJywMS/xJCyABj5ttZfqEo0CT0uGIZ/q3WSw:Hmh8DwM+PiDPLVi
TLSH
T109730AE396E875BB1F9537CB1C4FB99B67E20189E34102CDECD9CA1C80DD654123A9AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

11722

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\doomed\11722
Size 6KB
SHA256 d9bf50e0525a5fea02fb53dc3104a47f903ead8cd0f61390e7a6944cfbc04291
MD5 5e8aea4b4e3b8b6a3272e4bbfa42e5e3
SHA1 f36b539ecde3c3bc06aff7af498fe1d5da894c80
SHA512 ca93c7b1b279dd57273b0bfffd89f71b7d7d50a64bee5420dbb463de24e3573bbdc8972e0f481d74c04039eb146f069bdb46e931ae9985e4da897410167a8faf
SSDEEP 192:PRg7C0Rg7CWXp+fY3wsOjjsOjSfno2jyu:PJ0gp+uwdjdSg2jyu
TLSH
T1E1E13C3F4E48351509864AD2C1866A8F6C15BA07E8D799EDE18C2343FCC87F0566D1DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11960

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\doomed\11960
Size 122B
SHA256 faba6c5f66cc6294ef7b5b9cc300999f98cb654d20f6ef365eb45296bf1bc70a
MD5 5edadfad87c150615d5c864b3941b63e
SHA1 8bd778c99f250083085a960ad6482c26d1f417cb
SHA512 e3b189a2bc0b94ccad12a657c93fffb147b9c0a04375744a283f25ac6bc86e091a236b36d5b24868e4d9c07545fda7575c53106e5b930d3016255787e00bed2b
TLSH
T16CB09B614B45D525E1055D742CA4F54D450A15119954D281A55453105237A501593760
MD5 SHA1 SHA512 TLSH

Submit Download

18396

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\doomed\18396
Size 52B
SHA256 d391f0233ec4ab2b95b07ee993abed5fc0d710a0c771d4c8f5b8992a37497006
MD5 00272aac9180f131d5a4a4d029be285a
SHA1 ee7dd43feaccfe69a501d4b585974bc69c8ce405
SHA512 c8ab076948229b71016aa0d71ec22dd39ebe27fbb6656e74308c8a1621fdded189f3577cdf32f093150413cba6511aaf04ce36dfb8000f75d342eb2a57549565
TLSH
T1AD9004144355CF00D314D0331F40C4F444303D4045FC571334D50FD154134F3104415C
MD5 SHA1 SHA512 TLSH

Submit Download

20734

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\doomed\20734
Size 13KB
SHA256 131767266620ceacd0d7edaf751876f4df2d16c62f67b4fa4b34c51245427c57
MD5 1b0d427e7677212279b63568c4f9f4bd
SHA1 fb4d2b3c2abf892c8d96ed6348f885a2aea25d82
SHA512 03a9c5e92df88f99d9ecaf4dc7a4c10e7470230acd4c781bb05e63e6139526e961976a963a4cb06c344189ac07fff4e7ea02bffe16e14874a55e55a5c638532a
SSDEEP 384:ivfHPsCP8AcPtNz9dlZbUwUDWbUwU7p+uBCV3:kfUq8dNz9dlZbaDWba4uBCV3
TLSH
T1D1529E37AC086A1C52ABC3E3C50E78241E36DE9387C7EDBC2DDD2E06E64895548E51CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20846

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\doomed\20846
Size 12KB
SHA256 ee7deb965f401a71d672c92bfc94d586b828de00dc9565ad5ab2297040078e25
MD5 bebabef6823ea3a885445e3f843d5356
SHA1 a167f61103fd96a23a1aeb7aff1c6decdf81dff7
SHA512 f765789d070745ff7aac400b23bd6fccb5d3d296253d058aea55d76f253604b3995fcee5242078497da1b08821bf7fca7dca3c514b58f685c9c9a54ca6e5c7c8
SSDEEP 192:4jShziZhVu+HgC9qwLjE4w8VhB8pRA8tRg7C0Rg7CWXp+fY3qud0Cud0D:bmzVx7qwP28VPoG8tJ0gp+uB050D
TLSH
T199429E779F0815190A4281D2C2431BDF1D66BD57E9DBC8AF918C734ADDCC6788EA908F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5940

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\doomed\5940
Size 7KB
SHA256 197b143aa3a442044274131f72c2dffc7b8500052898429fc02ae135f212d651
MD5 97811091f2a3d9507df83d3f9baa443a
SHA1 a1ca8a2ded99db2c498f964c96780a4d023b97e6
SHA512 835a58fb7293621ee3ea60abfe08ecf2b110d141ca6a79892303f907c78aa89d99d32f99a4a706d2f6869a479f917a1eb2ec72806eb435ed65ba7133177bc76a
SSDEEP 96:cH9GtoRgbxV3pkYctoRgbxV3SivjCfgp+fY3GQBGLxYjBGLxYbCLq:SRg7C0Rg7CWXp+fY3bBOxMBOxq3
TLSH
T1EDF16D7F8E05241506D54BD1C14E274E6C55FB07EDC79CEEE1882782ECC46B0965D1AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00261983693A974D82334741449B9B27E841E781

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\00261983693A974D82334741449B9B27E841E781
Size 9KB
SHA256 026c122a83d383b3704b8b43a1b1b156d56ca7aca1104287d29942ed6fa3d2af
MD5 1a4342ab6e06c25bc2fd3df3303c7ed2
SHA1 ffc3929a8f450b5030a9c6676c053029c54f3053
SHA512 83d68a9e756c990edfef0ca560bda43a07d6f76da901548ee6f50ad3291683d4d2ac81aa3d0006d3d026fc055ca395deac833836e1ec15999888aef19f543b02
SSDEEP 192:zng32LINJtUQYCaGd4IraKD1VZFLuIshzXqxv9n6:zg32LIPACNGIuKJVZcNtT
TLSH
T18F124B7BAE8159242AD2C2C2D656FF8AFE34B143FCD1D1EC720C16C489D836C566906F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0165E42E44A0101A53809624364B0892F6F8856D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0165E42E44A0101A53809624364B0892F6F8856D
Size 6KB
SHA256 4283e9705539a5b784fceffde5fee453adda243bbb4643f1b265e02ff6bff9d7
MD5 1375abaf7fccac43afc46363a74bd819
SHA1 e9e081f49acbcf85e4050b552a3f07113fe6f868
SHA512 84fce22e489274fc437eae98a2468fa5a4655474701c256a6699f5150c1b1fbcca8e0d536677d74f7522ec7f2b6570552efc68992c65832171e416090f22eab2
SSDEEP 96:E3sRtoRgbxV3pkYctoRgbxV3SivjCfgp+fY3GSkGnNlkGnNZ:HcRg7C0Rg7CWXp+fY36KkKv
TLSH
T1C4D13C3FCE4934151AC65AD2C1465A9E6C50FA43ECCB4DFAE2883343EDC96705AA90DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01AF6C54D3E61E1E4FF3A2C0A9701BA30D244AD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\01AF6C54D3E61E1E4FF3A2C0A9701BA30D244AD6
Size 6KB
SHA256 bf5a651b9b1535e86f656197fc9e20756b0de91736a42f3905850036f78daa69
MD5 e75da918d3850b12b8b4fb5dc3cd8a42
SHA1 a44941c7c57daa0f0e940414aeb3524b6bafb8ae
SHA512 78133aea5b251a92dbf4126e51b555e1d3ddeea612a128a9304b2f62b776033117b6fbd6178ba08adc716810984be69f2f375193fa0021dd045120c7da5ea958
SSDEEP 96:uiUtoRgbxV3pkYctoRgbxV3SivjCfgp+fY3GrGnN2GnNt:bRg7C0Rg7CWXp+fY3aK0K3
TLSH
T1F5D14C7F8E0934151AC64AD2C1465B9F6C10FA47ECCB4DEAE2882343EDC96705AA90DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01FEDD87E3BA18CAFEEFF2329365892DBCAA79DA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\01FEDD87E3BA18CAFEEFF2329365892DBCAA79DA
Size 14KB
SHA256 e0f9eff953e8b25b1f8a17e77425099ebedfcbf29ec9fe1c2152131ed07fff95
MD5 652cd6fc3f16c2d504a9c18b75741965
SHA1 f0e9b257399b857f575f84818636a5c0458d1f4a
SHA512 f2a2f772f86445d66c9de48731a255c1787209149888b8f1c509fdba20d744794535e2a3773d950b41f2be7a4704bfee4d45f4bf33f6d55182a35aa2a857f2de
SSDEEP 384:yfntIODIIGCCsAy8KhCsAy87J+aE1Clez4NnsKxKi+Bh:YvIIGCCsAyhCsAUaE1Cl4CsKx+
TLSH
T16E629D370331789A1BC7C352D9DEE9841E99D943F86280EA70052BC3C5AA7EA31EE046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02770E160E652BFF1ABFC8D516E94D5924061127

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\02770E160E652BFF1ABFC8D516E94D5924061127
Size 70KB
SHA256 d1acaafd0993e4ea54e75d46843223f5637f33bd55c6227d00b227f150f25e2b
MD5 afe27506aca079b4ed594a841a3dd5bd
SHA1 8f43c2c9200453d065e7a016e6ca9c512cdc5627
SHA512 b8570069d4d44b1e142a78a6ce429f02325ce2d5d52f5e69c58e198ffa8d0db60f11984fc70f905a1dd42dde5129c177d8d705e90c597e7f3e8ed9ce11fe9395
SSDEEP 1536:iV+zyA+8Bve8KJDx+PoQJt3XPKyaO5oiOJTeyLBF8wrBLINOGruk:LBs5x+PoQJt3SVOy7jWY1k
TLSH
T19263F13D629520CF01C29C54C6DB1D451F08BB8F8D89EE96D544A3C3DD0AB7E8EA3B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02B769E3AAA108CB20D173075390FDE503733C90

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\02B769E3AAA108CB20D173075390FDE503733C90
Size 7KB
SHA256 652483c58982cdfcc89cad4d277e08d41047c3eeb20b199b8e8057d97ece6fcc
MD5 29ec0a2630b0ced8f4f42bec8ba52ef7
SHA1 fcfe3ec6fdfa2917b860f429c7ef8e44ab5491b7
SHA512 36e036c2d28acdbf2af36f0df4d67c05759b6c6ae3039fbee8a4ed2445144103bb3ff1b5d3c1b5c9c25b972044181b162932aa562e3484c04be296100ab53803
SSDEEP 96:4zcNpagmf9JntoRgbxV3pkYctoRgbxV3SivjCfgp+fY3GvzacKacn:4zkQVcRg7C0Rg7CWXp+fY3WaPa4
TLSH
T1EDF10A3BDF0528140BE286D2C2464A8F6D55F503D9CAC8EEE24833C6EDC9274C9681EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02D9A17D42D79B00C94C27F00FDAA29C79D89786

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\02D9A17D42D79B00C94C27F00FDAA29C79D89786
Size 6KB
SHA256 1c45b3c119a217c8fc8b1137404f4bf3ba9a5a6782cace59a5c2a3435cde535a
MD5 6ecb876abbb8bea4058deeddeb16cf4f
SHA1 63a1d4f8ae8c55f64e5bae1a49ca484b4534f2cd
SHA512 49bf8bd950037a7fb82e8e5aa850f4746c3523a52123fee8ef351e770501b2a560d2b11ffe650d388b0f057d4fa7b39541ec6fe03015f1fef8566cb02c835969
SSDEEP 96:1CNtoRgbxV3pkYctoRgbxV3SivjCfgp+fY3G0GnNWGnNU:PRg7C0Rg7CWXp+fY39K0K2
TLSH
T1D1D13C3F8E0834191AD55BD2C146569FAC40BA47ECCB8DEAE1883343EDC86B456AD0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0343A7D83C94162C0DE11BC76737D178EFFBE74D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0343A7D83C94162C0DE11BC76737D178EFFBE74D
Size 15KB
SHA256 92d5459f798d262c0221431b22d048cfa6a37725c7efdaa39c270ddbbb63478f
MD5 e41e1920fdc73164bc06792afe730c0c
SHA1 e04e9f015321dc2abd254ba2dce93098db17d5c4
SHA512 a5c0515ea9420f0688228c60f1ac43e8ddddde9a61e54697ed77bc0862d37728a9d9242228dd19fffa9fd15f902f25a7d7413a845f6b9bfae14641edf719a5c1
SSDEEP 384:uVUJxDTNEz5YrEJCsAy8KhCsAy87J+aE1Clez4NnsKxKin:uKJxDTNExJCsAyhCsAUaE1Cl4CsKxn
TLSH
T1A562AF37172068891FC7D262899EF1C55E7AE103A93180E9B1502FC1C989BFD36FE046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

039297D6BFF6E418EDDC1EA4925D779AFDD3094A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\039297D6BFF6E418EDDC1EA4925D779AFDD3094A
Size 15KB
SHA256 7f7798a9ae8303d5ae5940843d2bc6c260178418503337d95b8c72f7a6d677a7
MD5 01e5f6ecb4b956136bc4be6ec80b7837
SHA1 a0d587244dd3368605645a4c02a33371a0fc5028
SHA512 375b2db29ddf29f99fc34308492b5eee0fed5f2345a8fa467601be3b00e7b99d93bac6bdb47a6e0d7be0d37c76e453ccdb238d13607c6aaaf64d45d656e9b990
SSDEEP 384:s105/OHilGGcYZ/W/GcYZ/Ky8D9Gpo/VMAkUKkpgKkpt:sals3GcYZ+/GcYZyy8R8o/VMLkptkpt
TLSH
T1B5628DB58C2068464F51ED88A5BAB24D1E22B297BBE0FCEDA8C56411C88DB7267468D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03AF643C04593E77759DA45104EFED62EAB22704

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\03AF643C04593E77759DA45104EFED62EAB22704
Size 12KB
SHA256 fe938dbc88ab0706c431e359a3d85e75e09f4f416ce7ae7e98fc9642281f1632
MD5 7f28285575a386557c03d59fb1a12ac1
SHA1 403cc02b576bc4c4a2a2d9f86e4f61cb1acafe5d
SHA512 d9422525d27ca49022873a5b6b82f7ee961b12a1aa01b717ba0e49e5991071ab6255afb40ceedcabe261da13838fdf59e6f1e5d633a106cc474d5af2d0f739fc
SSDEEP 384:+UlCsAy8KhCsAy87J+aE1Clez4NnsKxKiAW:+WCsAyhCsAUaE1Cl4CsKx7
TLSH
T1C0428D360730784E0B8BD3828DDFF9885FA5D607E962C1E6B0462B82C465BDE75AE047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03D74D5ED346B6A425AA45C38A54C3F6BCFF5085

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\03D74D5ED346B6A425AA45C38A54C3F6BCFF5085
Size 44KB
SHA256 09f43eb495b91bf1064d46a39a66a0b2bd1bf4c40cfa892f980f2bc29ac1ffbc
MD5 39a178c780c486df1da2eae944510465
SHA1 278d968cf526f124bf59ed08bd4ada77631dcba3
SHA512 521e7cd9f386ff0cb46f5e939611769e3c4e0b90b10f8273baa7b51bd64fcb2d56a9c978d42869718522ea50a8e8b9eb888c5f65f4930b599f14b04908b46bce
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3u1fZc8:eUEEoBVQDjeQaLnP2pfZTqgSEza
TLSH
T12023F137588B3E608181F250D4DFAA46EC53F553EEE1DAADD0AC33C605093D94B652BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

050AAFB385751A7A88DAD63A423662EE9BF5D97F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\050AAFB385751A7A88DAD63A423662EE9BF5D97F
Size 90KB
SHA256 0da650b8b6e725cc37522cf326ec4747f602a5d71b8d2af16774f6e617c8db90
MD5 186607fa9eda2fc468a3bd07bdfd8b50
SHA1 80c72102b32d71877fa7b0b5ca3d59ee03121764
SHA512 f5df5f5d9b631dad2735c501501f7e10646579aca9552236522d6654647c6834e333f65c0b76c1a725bcc68c4c7f7bf2a3aaa06c0eb464430702d7f463c4a543
SSDEEP 1536:5+acQkLMf3TTK3MuTN8LEa9/hPFDtlcDDGvu8SFemKbzgjj9y7t:55cTgf3TIMsC7fc/GGf8tbzgjJyZ
TLSH
T16793DFE468276A6C0B779E61D93F72C968309055D491C8FED438A51AE4E073B338F7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05E7AFD301D94795B7F987EE485E0A4F51EDCF08

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\05E7AFD301D94795B7F987EE485E0A4F51EDCF08
Size 88KB
SHA256 22b607ea24c2ebd8cf3c4ba4bfb4dc0bce24fca190c0adfbefaa85b33abb9b90
MD5 54ba91a39106e95e57f83d06bead4c15
SHA1 5991942c364da69265aece99d1e862e0279fad1f
SHA512 71b4bbeecf85a7cfa173d1273b80c4edaf182a59191e054f28b996ab0b916e531a0643433e858338b84f0a0f2a7ef1f68edf90e672bce975a5cf128f48a9a2ea
SSDEEP 1536:aFJ1bcoRJ+HJqr1Lb4siTFTp1TF7tWezBgiOeyC/R3YnxrGvMeMJ2scXy8Ua6CZ5:ahbj0qrBM7TjtWezinC/yZGMDKy8UzC7
TLSH
T151930227031038983587A612949DA4C596EACF83F717CAF31846960CC9ACEFE35FC5B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05FC04B9ECCB8B640F7C006E0AB570D7953FFA8E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\05FC04B9ECCB8B640F7C006E0AB570D7953FFA8E
Size 10KB
SHA256 82429ffaf2b08b3ec12532969c250fb6513457fc8a3da68189426558852b5161
MD5 3e4131cd46592d08fb778c4c90c3a8ca
SHA1 50acec1c892206febc632f9debc88783d59eb084
SHA512 f1a47557e295aede0dcd3564f79da10fbc66da7237643e9bd240625d71556a6fdb105f5f26e7c5c0c62a26f8edf8bad925ba96870fab2f5243dcb9b23f822ff5
SSDEEP 192:tkLQADPZccVZ/iR9L/ADPZccVZ/iR9py8gemKGpo/VMAkg7Kkp97Kkp7:yQGcYZ/W/GcYZ/Ky8D9Gpo/VMAkGKkpZ
TLSH
T1A1324D729C1028464F21FD54E5BBF34CAF21F347BAD0E9DD68859515C48DB76AB4B8C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A3A216A18521CD41699069C50DDE73A8BBFF11

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\06A3A216A18521CD41699069C50DDE73A8BBFF11
Size 12KB
SHA256 68d9eb146212e4030eb04ddf69d7089d2edca912cc4d7bf547d12e8786d19e1a
MD5 ce919966bb44d3cda0dc755a967e226c
SHA1 3c106951661db21ab3a627091c0f94c9c4e1ad3c
SHA512 6c44c9a65d7402cfa41991f2e73e9a0787dffef762567ddc088207189b716808ccd788cf132967c12334809e905f6241f7a15d40824cfd05fb1e60af13bc2e9f
SSDEEP 384:0w0aGcYZ/W/GcYZ/Ky8D9Gpo/VMAkVKkpKKkp/:0faGcYZ+/GcYZyy8R8o/VMSkpPkp/
TLSH
T17C425D769C5028060F62ED81E5BFB78D5E21B35777F0E8EDAC846411C48D7B6A74A8D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 89c81271a5ba679f3d646d468287a7ed03c62a6c1282a95083d7a0812e547097
MD5 ab7cc0363d7f644fcf93674d99dae833
SHA1 9749432ae7a8a52ab648ae394f3f49c1a3439fe2
SHA512 9debdb03b048266cbe51ae8be85a0d090c3430eaa2fe4159b92d8461f44c2497cc05cf8ae5ba1ba6a37bacdef4eb1bc0a040deac7aa99c280885d71c38f652ec
SSDEEP 384:HXwIiO024Y9WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA7XDgq:36ZY9WTToXJWTTogB7S/AmVAf+hRM2TN
TLSH
T1CD728E7D9F413CAC275790E4C8B983558D18B3A7DFB5C02D269C3E09CA98A5A70F984F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 d7062974e337ec46cced662c6c43f4df4b2f0bc6f0bad016259106a6a4ed80b4
MD5 26fb26f7fc8e523a142e4b19aaf23120
SHA1 058b8eaca67c23566485d39b0e154ec6ac2e6348
SHA512 152e9f9f329a914f214b364e4387ca56241312b766d27911766450dd3cd04494f48c7ced6500cb1d160294e83d746782dd81e453892c6f19e8cee53ab1bb2e98
SSDEEP 384:HXwIiO024YxWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA7XDgq:36ZYxWTToXJWTTogB7S/AmVAf+hRM2TN
TLSH
T186728E7D9F413CAC275790E4C8B983558D1CB2A7DFB5C02D269C3E09CA98A1A70F984F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06BCDC9B77386082B4BC8E41E0C08BE4DD77A3C3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\06BCDC9B77386082B4BC8E41E0C08BE4DD77A3C3
Size 12KB
SHA256 c26b60ef1819349df48f356a3d2bf754443b38dedc3d5b540602428817f88773
MD5 7406695139ab55c284955e68b984d57d
SHA1 7d8ee28d9273635f89880d6a0c3576ccb0507546
SHA512 8a6d1d00afd67836d3e662c755e6865e1a894b6045a94d358c37c5a7e5a84411c6ea3a9621e4704b87f80f1a51702d26e5e81148af387e33dd2888c6527818ad
SSDEEP 384:bBGcYZ/W/GcYZ/Ky8D9Gpo/VMAkWKkpHKkpC:tGcYZ+/GcYZyy8R8o/VMVkpqkpC
TLSH
T10A425D729C20340A4F61FD84E5B7B7885F26B247BBD0E9DDAC846512C4CDB76AB878D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

070A399ECDEEB2A01B9FB20BE1F8663B28BA765C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\070A399ECDEEB2A01B9FB20BE1F8663B28BA765C
Size 14KB
SHA256 8cb30ebe85066c85ee73394f75f05f71702b4b7affc2c1dc6e8e8d6c9be975f0
MD5 78f3ba5341c41264b8e5641c90c1b5d7
SHA1 e8fea4a51496afd2aaa0ac1448a06dadc9d7d7cf
SHA512 9bd79c8314eceb578309b8da97eb359bdff3b4614d8156f0a64d696e9d935d1a0642e31aab5d716493448a09db111bd2a4772a1d3a58e53f342de5c856ba3a1e
SSDEEP 192:yidoRuwxMj2o7hATWlxwxoF9op7wOF8S34v8S34/:jdoudawAFoF9op7IS3JS3k
TLSH
T1F36223E4A833256C1B339E21E97A33C52930A056D491E8FFC434E65DD9A472733CA7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0714361B5B35723AACC141F3B2AC61BB64FCF737

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0714361B5B35723AACC141F3B2AC61BB64FCF737
Size 29KB
SHA256 8ee715a5bb2eb61d0b9b144aaa1c6acbeb64213371ab90a339cbf0f58f0d528d
MD5 a98fe5329ec91991baf2b55d93662eb6
SHA1 920c88fd0350b5fa53cd77d5eb0ce4d3cd5b5f14
SHA512 16d8d75a0e64a131b04951b93c414fce889fb6ef2b00bdd19553f62fb44897f79a2ccd4d6b888d2805c53fe7cd98a9cf1db4b11aae3c7c0a6cd781028a97787b
SSDEEP 768:MKwudyGTEooRcYeq09dd4c5m5TPNFyVhW+fZcNg:MFurE3cW07wPnpg
TLSH
T109D2D17BDE11572025E693C2C54FAF9EFF02A303F456D2AC319D25C0CEDAA6C456541B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

075B8FCF1E4761117058C2EFF149858F93A6A354

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\075B8FCF1E4761117058C2EFF149858F93A6A354
Size 6KB
SHA256 c94d586b056843449e407555035725fc0fc421508a664dc3eb024c0cbaef566c
MD5 5dcdd26f4a882a0977cf471c128dad3e
SHA1 6183445bcc1957a7a31c2edf8099139c9b36a2ea
SHA512 2e82969939c414a7a4a31be284ea56aa641186a634cbb136430218cdc0eace2305ec94e8a3e0aac6ace4cf6c4cbab710c565a5aec9185ee07ded4447f179f93a
SSDEEP 96:hnebLuHNfgARDlrkFOlkZF0fBAdwmohemuIshzXqOwQE15jw2OE6OOE6pJ:1xaKD1VZFLuIshzXqxv5GE6NE6b
TLSH
T111E12C7BDF40952419D352E1CB976FCAAE32F183ECE2E5ECA54C26C449D437C066612E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0776911F4AA7FA7BD7505628CCFA1A190D5544E6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0776911F4AA7FA7BD7505628CCFA1A190D5544E6
Size 73KB
SHA256 654279f619c0dc2c608ff31ba5a3d685ee62ddcdf584c5f063cbe37212ebf3b7
MD5 c95b92d343f79bf1d8a96937af1a89e2
SHA1 ce752460b732ed71fcaba7a3ae1dd28ce8f13b9d
SHA512 158bf97714d68bb99618cabed976669b2b5b50b8ccb96d54856bf857cbcb47e97f1ead41d8845f20b02e8078021d1443506c4220cb850904dd48329d924df28b
SSDEEP 1536:MiDf+bNhWt4O657iYfPP9j6H3dLmfXN3rjLDxIHXc2dUUwMfuO3+NCypa:MlAdCpnP9j6XdLmfXN3rjL+M+wMfuOua
TLSH
T1C97302755F998C8E2CD71AD03A59680BBC17F857F22ADCD02B9DB3622E5C484C4983A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

086BDDA1E2AA80E1BD1FBB0536939BF9DDA05CED

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\086BDDA1E2AA80E1BD1FBB0536939BF9DDA05CED
Size 11KB
SHA256 bef89251dc0b9b2efab574314afdc1bd89f5c457b37e46388a42e697e13a2c27
MD5 35d17284e8c728f53b8ec7d8556d7ac0
SHA1 6a93aa9bd665d0951a97985f6b712892738aac76
SHA512 95950c91a76bfc78c98ceebd669f579d5ac79b75a83527b94eec7a2cf0b9d18c3e5e65d6ff86382ff000cef57142b7d8a336f4be561990cedc0bf2016b077890
SSDEEP 192:WWmHPnynADPZccVZ/iR9L/ADPZccVZ/iR9py8gemKGpo/VMAkt7KkpD7KkpY:WdPnynGcYZ/W/GcYZ/Ky8D9Gpo/VMAkK
TLSH
T141426D729C20284A0F61E854F47FB7489E31B257BAE0EDDD6885B401C8CDBB36B4B8D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0890594BD75603AB75E2D7E3A3967B9905308F85

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0890594BD75603AB75E2D7E3A3967B9905308F85
Size 9KB
SHA256 dfd78b87b6cdef4eb338f5506cc244c8bbaa7bbd25fb77d4a576eb421fce9b20
MD5 f39edc2111cbe84f369fe72b3e4f6ffa
SHA1 23ae0c2481b824cbb6cdcd858638eb5ebe70337b
SHA512 8f4d769530172a3f18c67ba2d6d2325590eacc506aef8a8df4a66e56c8a91e2bc64ab5bee8af613981b9967bbac5387f8b99d568abdb4de16823e8764098c6ee
SSDEEP 192:yxENxIYGpUP7w6Rg7C0Rg7CWXp+fY3eCGuG2:yxEmUP7J0gp+ueCz9
TLSH
T167126D7BDE1522051D6F40E281464B8F7C44F903DECBC6BB824C2782EFA95B5DE5908A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08E44A3F23FCE79AC4C36D732456DDC2FFB40341

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\08E44A3F23FCE79AC4C36D732456DDC2FFB40341
Size 12KB
SHA256 77ed1f2777b840a7e4171f922045e1d32a7794561bdc2ab5a90f4fc4e3e082c0
MD5 78cd98038597a679524deea7c08f5639
SHA1 23ad999aeed66b917b706f722ab72e4060f5a9d8
SHA512 334fed7b7ae97338a1775eeab126a9f3b676d82a2b60db85b08915b37799092952775b39e5c98dbfe3055ceca462f09c4b6b1a0d8f4aebd36070f5f1888c0d1c
SSDEEP 384:Zt66/qmFTot0U9/qmFTot0FaGUzHODWoh1B9M0lpDIIDNK9KU:b66Slj9SlSaGUzHODxh1B9pD8Kc
TLSH
T180528D76AE50542C0EA185C2BABD61594D18E913ECC2B1BE3D0D3748E8C067DF5ED2CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0A64AD679A1D60D9F4D0CAD36A436644892B68C6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0A64AD679A1D60D9F4D0CAD36A436644892B68C6
Size 20KB
SHA256 f5c34549439ccfe978e9cf8dba4bc54d6c6b36a72828f221d5f74e2392130a4c
MD5 02bec59e4ab504deb60349bc380b0e08
SHA1 414fd17f2319d42e6ba1e6a3c1347b70481ab200
SHA512 bcb599b9f5a5e803bd62f31e1331c71ee4d8eac3f087ff443d5c75a826494f2d8360952a727e43a544386d3de12d3e71c1d108524c73260cd130fa7a5165af0b
SSDEEP 384:EbRMHA/hJm15gWbDWXTaFg/qmFTot0U9/qmFTot0FaGUzHODWoh1B9M0lpDIIDtP:EbRMWhQXdbSXTYgSlj9SlSaGUzHODxh/
TLSH
T17C92BF79AEE098980C81D9C3D67E529C4F2DA553D8D3F5BC2C84354C98817EDB4BA2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0A75C1F9FB4A51B1BEEB6B76347C48322EC1B09B

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0A75C1F9FB4A51B1BEEB6B76347C48322EC1B09B
Size 7KB
SHA256 26fe0a33514860eacee42dcea864764d7e49f9697921041fbfb9c5bdb4506142
MD5 6328844c74c3d5631a2491f68e849772
SHA1 ba8ed79a800dc36240932e11c68e6d7c9d4612a1
SHA512 b9440a24ae22adcd6cf29d0c86e9708babb2412c109db92d1cf80b6d5a004fdb9c909a515ba54ad743de8efead0bed6e58e3efeaf02467c6caac12ce7bd754fe
SSDEEP 192:f53lfm9hA1mCpuoWPgIapAjMJfiJzhwUykovuBum:fmbAVuFgIxMlszP+vCD
TLSH
T1B8F12A7F6A1028651F905D91EA3CD2465E21FA87E4B2D0EEF45022D0C7C8BF4A18A3CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0B0668A7011554978E464FF2B24B541EA83BAE25

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0B0668A7011554978E464FF2B24B541EA83BAE25
Size 118KB
SHA256 95086b2268e31ea84de4534d62bd7df1e9a78e4157bc6d1828ebcbf722443508
MD5 454148f2130b2bc76f3ca3e754c46d90
SHA1 e1d1004878dd361ef2b340067cf4921959024cce
SHA512 cfb111ab85f4ed2aedbc6ea06cc48f8ee0fd5c470ce87a18222c3ed977acb6d4676f8e7c60aead8bf114a25533d87b7a57af7c4dc8289296812de22541a29f46
SSDEEP 3072:nwitCuCbw5CNuE8wckAoSo5OlQcQTJ4XuPZnJ5hw1t3pmpkK:w6C1bw5uuV/kHSoqQcNuRnJXwX3M
TLSH
T121C3127A858124F006F585C1C35982CF3E75F04FF401D96A929E206AA7C9B3ACFAD2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0B232AE6079613F87BE8BE90D2F5DAEB3E6E2214

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0B232AE6079613F87BE8BE90D2F5DAEB3E6E2214
Size 15KB
SHA256 28ee1ecfce5324eb84788faf4e87f4f31e67db94a841d4d3fd28a97aa059b158
MD5 704aae310cdc81b2e897c34b28e2bdf6
SHA1 b11ada2163b1b45876461964e626a333f0f44dc3
SHA512 2f7f4097daf7511c9374368d2d27995e3b1e359740efea41ea201086f32e892afba61fe13f6b80b46280f6d722d3a1f4b16b7b5c36f709b8dc00715880e7e342
SSDEEP 384:4eiRMPbXgV/Si89YDKCsAy8KhCsAy87J+aE1Clez4NnsKxKiOcR:4XMPj6m9FCsAyhCsAUaE1Cl4CsKxOcR
TLSH
T153729F731230B85A1F8B9BA3DD4DB4986FEDE907E9A1C1E3A0043E81C9A57DD71AC181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0BD6E173BC833458D7B85480F86F14FB9E92F46C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0BD6E173BC833458D7B85480F86F14FB9E92F46C
Size 6KB
SHA256 b6f2aec351c2cf44b08a2d5bf97344cb01a986360d191eb54561de7cefc7d4cd
MD5 8b8527fd5b691fc4716c4abf5312bd7e
SHA1 58449db4f6f1ebbcf7368febca4b5e9336647e96
SHA512 1defc8040454dccecc221ee91d161be41ef88204ac625d150646f8078e1028617a8437ec7bc9e63624a11b15b3d011c61d8465e4983b2bbac7f5a0f4efcb2941
SSDEEP 96:2IYtoRgbxV3pkYctoRgbxV3SivjCfgp+fY3GHGnNaGnN9:DRg7C0Rg7CWXp+fY3+KkKn
TLSH
T18CD13C3F8E0934151A854AD2C1465B9F6C54FA43ECCB4DFAE1883347EDC96B466A90CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0C5BBC2DE0618516FF722A2594136F51A40AD665

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0C5BBC2DE0618516FF722A2594136F51A40AD665
Size 23KB
SHA256 bd2dfd3ceae32837843e3ef6012b9e515c2ab005471375b4e332402e645f0e3b
MD5 1bdda0e0c6a5df116bc2161f903f38fa
SHA1 5342ce9f36b261ce77a8ced8af85a0735cfd18a1
SHA512 7982130c8a8150db766a80035d71387a99b2447b0e0f768dbfcbeec1d93ede70c75e01db92a5a9f8eb66099ed14f96bd6257675e8f7c46d17fa809ff25cadcb7
SSDEEP 384:e0CyBjxsAFiddTXrLl8Do+jrm/A8eb1TiGcYZ/W/GcYZ/Ky8D9Gpo/VMAkF7KkpG:TCyRGK3G/41TiGcYZ+/GcYZyy8R8o/VD
TLSH
T172B2CFB1CC44240B4F61E814D47AFB085EA7B313B9E0E5EEACC55812C08EBFA975A8C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0CE558EA4672CDFA53C002664EB23A0A1074017A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0CE558EA4672CDFA53C002664EB23A0A1074017A
Size 13KB
SHA256 75451e7477a77fa48cac35e8908f31f59b0036013f9b1c55da127baff0b7d1d6
MD5 95919c9f482eeb314a2a16d8c6097707
SHA1 a98c1c84b4114159e835729454b47e409c35f595
SHA512 dd5d99c5146f0cf349b6f9877feb00e47d56fadff430c34b43cf854af364d72df494cfadfa1487dd711c74c205b30d7c2e009911c5ab0eb3f145ffc859140844
SSDEEP 192:3FkrRy/LH4Ag5esMwd7If6qJeClkACTxrQhW+3yLmFsXInaMVy:3F4y/m56wueClRwxrQhWZZYna
TLSH
T13D529DB36F34230846E6E9A0DA7D57A72D34FFA7A8C9639A3C082C14CC597144EE16D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0D31FB0AB3CA4ABB7851947739757B47C41DDB97

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0D31FB0AB3CA4ABB7851947739757B47C41DDB97
Size 186B
SHA256 ec0aee25e073270ebf8afacfaadcbac9cf717e051b83c4bc05837f071a650e69
MD5 136a24654c1f70c870b3de20dc1e9227
SHA1 f115e4839ca7e6009ee00018202487b1a367e123
SHA512 6282cb8d547afe153544fdb5420a1f978d6e29d1f5a561c8b6f0d980de14c3629b9cc163a30ee7f1df98fe2862ff440643ecfcc92561b9dd51d27fbdf81a91c2
TLSH
T1EBC0223B360BC830F38A4C7F4FC01409020128988BCA430AC0A08490DBD2470F242B42
MD5 SHA1 SHA512 TLSH

Submit Download

0E74DCA1CD901583AE707100C593E3A3A3A4DF39

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0E74DCA1CD901583AE707100C593E3A3A3A4DF39
Size 12KB
SHA256 09657526e06ec11353fd103756b0cfda5ac9c55869de85ecf27eac01fb6d5b57
MD5 d5089fed4c981a6911a1190803d155f3
SHA1 7e6d8e052702598b258be5f5a35e490d8be8310a
SHA512 ed0cc08f26c83e6debe08d50bb5b7db17e0c7a6715cfd9f66f517acd4d0e83a7657dedfebcb0c8888b2d10881aa576ffafce3f40107cf15f2e24fd4ef5f45ee1
SSDEEP 384:z34tFDvVSRF1b+SnG2Gfh8HF1l6q6+XJNy2K2W:zotFD94F1+OG2G58HF10qdTe
TLSH
T1A452BF727F90698F2A43E445C2AEBC890D2DFC43AFD0216DD61A3749D38477F9AE8580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0EDD685233C0DC9F3EF16AEAFC74BCC02F160E96

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0EDD685233C0DC9F3EF16AEAFC74BCC02F160E96
Size 12KB
SHA256 b96e775ca3ede4b3e60f90284b44caf82c647e422ffb59807408ee72b361aa1f
MD5 9a7d080a3197dd80bc484e6d60180b0d
SHA1 8b7347812e54ac943f4bcfea50eb7ff8331c4b27
SHA512 10221fdd53ebd038c2591841c3fb418524e18006cdbede39e078b8885bf9ee2d023d1e30485e9c1c04c45c32b80ba25833a3c43c23e52d48183b27919df92f4d
SSDEEP 384:pLAV/o5SeCsAy8KhCsAy87J+aE1Clez4NnsKxKii:hAV/CSeCsAyhCsAUaE1Cl4CsKxi
TLSH
T102429E370B60748D0FCBC342C999F4846FE9E94BEE51C0E664052B82D5967EE31FE516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0F2D081C07E8AA24D0204A6C75AAFEAF60E2F69D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\0F2D081C07E8AA24D0204A6C75AAFEAF60E2F69D
Size 16KB
SHA256 af618e7c80b4eed860189b8b866c5514a20d62f32da1af0e4a7ca5587910a2b7
MD5 77c142e388e77d2dd63b46e1a9d08611
SHA1 3a609f9b1adb794012a1d0cca4ec757efb21238a
SHA512 f73f4ec4530096c4e66916bfd2da2448b9d74ac5980a824c63dedd46affe2ce2d82a2ab290ba1b3a2c17c5c26da24c91b6c8268ce8a666dff77e04b842bcba9e
SSDEEP 384:Q+Se/js47qFodKfGcYZ/W/GcYZ/Ky8D9Gpo/VMAkyKkpMKkpQ:Q+TDqeKfGcYZ+/GcYZyy8R8o/VMZkpZl
TLSH
T10C729F76AD6414060F62E980E17EF6CC2E25B2477AD5E9DCBC80A801C9CDBB7E7594D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

390B7112169B7935EBFDEC658F1566F74868B004

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\390B7112169B7935EBFDEC658F1566F74868B004
Size 136KB
SHA256 dff18d21a2290aef047705e23de6389a0645457a8b1b573a540d2e06e3abab09
MD5 3ab210f925499f4e9c0e1c0a537bc98e
SHA1 ed6db24781a3af7225fa9f3f92cfc5641fc00c25
SHA512 7e3c1a8e7b08e8d3193df95c62948c83fb79bb3a7ec6af5f16d253589d65839949d36b455d4e3f95cc999bde5dd2eb2ca1420b99f5c866b7724a7dc074ff1b81
SSDEEP 3072:k+zhdANJtmoGfsNGT3AOmpbUrQlvEyNGFXCoy/xL0yC:kq4Jx41z5oUr6sjlFy5L0N
TLSH
T181D3127B68848AD1067D17E9849770E4BD67F4839C23F6E9EFFC128C8EA457A064490C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5AA4274959C556810FB23997092AB26C397E9D68

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\5AA4274959C556810FB23997092AB26C397E9D68
Size 414KB
SHA256 bf6da0216b68eb0fdfa9b0e54aba0c38875a8c471f34f19914ae1196181d1d5e
MD5 c6b96162f79ef7d687b223e97b819266
SHA1 3b944288895e43b4b1a9f5a6c02139e067d9455a
SHA512 fb2ab3af14b46d2b07d4606ae730fd01a34b0060a0a02d6d63a58af5d121296b26334371c549f5d357906e108fff301b1d787a228939f803e07cf463a6cc4477
SSDEEP 12288:DG7/CyUPDxbP5y40GJcw0lWKFqjD5yKBliasTtteDbk+xi:CTCyUPDxbNJT0FwcKqaEtte/kf
TLSH
T1469423B1E20B8D584ED9B2E4D9E3CDA2BE55EF8371912AC5E75CC0C626F73E40472125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6AE829FAD431F0A1DF48C9003A5B92C78BE0C7E5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\6AE829FAD431F0A1DF48C9003A5B92C78BE0C7E5
Size 183KB
SHA256 7a3f32f1f2a18db6fe63f6ced01a282b6379924c4266cd76cd651b0b4abe7588
MD5 0fecd6f1b8bf382fecb6a1b79d586da9
SHA1 7f99a2d0f8bb0b67165a7100ceea4f0e0e06f06a
SHA512 5c42af6c1ffc78bbf2f13c83294297509789c423b18ebf65deb965e77abef96d62f927885315edfd3ef488fa6a44e43052edcc17b52acad8b381f32a8eaf7ec3
SSDEEP 3072:HFRvtIGEsawFYlatyomGtPsx+R+449miNQS9OIlpS9RWmvtwZ5:hRZawFYlat1Pe+R+4BS793p6v8
TLSH
T1EC04129F901AA0185B4A23A5873D27CF18F1693790E7592A97850FEBDC81D68CCFF4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

733849FFDF119F55FC621850508A6E493C2FEC79

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\733849FFDF119F55FC621850508A6E493C2FEC79
Size 353KB
SHA256 d09878ffa24bbe06ce031af20e51a38e7c6787c6209ca3cb830990619a64e487
MD5 f14b6aadee0fb749c44b258b1b9dde90
SHA1 9cf6ddac8ae36192453e9e30eb8f3f96f5b664d6
SHA512 69295d04c0a290ec3a72e8b1d3f96c4c29d41ea4f59ab0da6ceb53ef882d1ab1d7a4527cbadacf1e2497d00a8ee3dc017bc033c1799f08003e9d819be13acb43
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqN:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEq
TLSH
T11874231B2E0DC93227834796913E391889058A1A4FCF66D11B6847E8853CAFFADF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 229e767d47141aeb8a1d268f88d9a28d9fd446c31b237b44ea0dfb4c7f3b02bd
MD5 74fb6a7221b7a540b1d86184d3a4b381
SHA1 3df887025da9f593813fd5ada26723d2218af2e2
SHA512 c3f61debc4a25c94a2b9efdb1a15f0bca726891d50d1724c64e2baa139b7f03e1282c12e5f341e0458a2b61976fcd9874df57fe8b685510492a0b1ac18960dab
SSDEEP 384:HGNQiO024YBWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAj:mDZYBWTToXJWTTogB7S/AmVAf+hRMG
TLSH
T187728E7D8F013CAD2B5780E8C8B583598D18B6A7DFF5C06D26883D09C988A6A71F944F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F5C2EC7925304E9E4E82BB4B7282D2D0FD44979C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\F5C2EC7925304E9E4E82BB4B7282D2D0FD44979C
Size 98KB
SHA256 69dcd8daed85fac4b8ba32028706c87a913aa5ecccb53e27e387479f7ecd979d
MD5 7a2e4fb33df4b339d541d01afc87559c
SHA1 580629432c5b10708c8f1f306084fc900d6fca00
SHA512 dee32090615def5e327404d95b11ec930fa186a0b6c81f123463f2f285e653b1f925d288ebbbd0c53c8face97ab4b257b443b3b91b40e25c9d0f0351ba1437b4
SSDEEP 3072:GYzlnqsy2LRBxiXgW2jAY51ynvIxCkVCC0/CM3aPB:Go9NDNBxid2jAY5Deq
TLSH
T1D8A302F6584078469FD3C504F1ABFA185E81FB2EE4F0CA7E4C99C821855C6B5AF8C693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\index
Size 21KB
SHA256 1cc5a2db0842d912b9dc356d8c174c2e69ed7d43ea21344fdf06b85ef72cfb28
MD5 51243b3aca6972a5fa451f6aadd0b226
SHA1 22ff682d448929a79725522b3b6da698fd9f10b6
SHA512 419f2a0b2a83d08f8bf25d44c178218a4fbb05edec836aa7b31e03142fc6aaaa54c4a7b3291f22b85e506abb0ca12d28604158e87bf73c0edec65c97c1980eac
SSDEEP 384:3TEmvUL9zFAEl421MDT4WFMS+6izLgHoAiJVGlemEKu72Z3gK8pzUvocQitEUf:DEmvU9FAX2sWtOHcjKGoulUvdttEY
TLSH
T17AA274AD4370640260D36465C484BCFA7E1C60A7791F8A9A21432D7D4FBEB23BF635A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.log

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\index.log
Size 8KB
SHA256 54af3bd99242cc75c4fa15c6fb42917a0853522a0642f43163300672997a0d29
MD5 2ba29844c0f67734c626f9fdd75bf477
SHA1 ebf5dce92b3f29f06deeece1e90383edcd0e6a15
SHA512 2dca9568f2055b60fe2a31c451b71ba3bf2c4e8c726f59b297245f6f257d7eba6ba88f5559f8125592f16dcfa4ca38a69c717265efb794338733133d148ab1e0
SSDEEP 96:NElay+nR4A+iPXwUm9JbQbNL20i/x6yYacI4td7uaGqbrLYYOCdSKc1Bbq+pUsA2:NElayrAfkYK/oaNI7BLVdsocBRoe
TLSH
T14802B20D291DB1045813143B8AC16C3B7995ACAE8A08E37732A1FE1354B7B759CDBBD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hKqbZkp1_eI6WcORwIQs8Cc3jvNveBH9fNK7lWmFDTo=.ico

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\jumpListCache\hKqbZkp1_eI6WcORwIQs8Cc3jvNveBH9fNK7lWmFDTo=.ico
Size 691B
SHA256 6574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8
MD5 42ed60b3ba4df36716ca7633794b1735
SHA1 c33aa40eed3608369e964e22c935d640e38aa768
SHA512 4247460a97a43ce20d536fdd11d534b450b075c3c28cd69fc00c48bdf7de1507edb99bef811d4c61bed10f64e4c788ee4bdc58c7c72d3bd160b9b4bd696e3013
TLSH
T15D0194C2B2203025F81A82B05613C895D04E81EE0998A42A8CA7D1F6A848A23958EFE4
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 a187fbef9ec761160294ad22fa86289a249ceb35ed7c151ed01895aab4a8a442
MD5 b688b15824b65a7457763dc9718891d8
SHA1 f154822983c5a2fa8e35fe7f4fb80aa69ea754e7
SHA512 5ccfb79d5849bc012698e7d9707c2bc5016c25be7b71c0751b6049be480256cc8cb1a7dab2205360970e2c446a9ce49c24cd4296c8bc608e981cc4978704a732
SSDEEP 3072:j3lW4pWqGASqoXYsWPN09KDMq37HoX2nsR:pWUGASqIYsWl0ogqL1U
TLSH
T1BFA3BFF6DBA2893D64FFD82C9AC2843FFD266404B3973009C963625452C5FB8767A648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 885acf69cd0df4504e1347f66e37eede60e170310e80bf44fdbb46956d5c2f00
MD5 fe229f0080420fdaa4658d15c4d1aa79
SHA1 668af721c8cc20529d1f524db594d01a88b62a96
SHA512 260d1f884ec55e16fa68e81e1d90044eb9b2cf444629caa3dbaf0f16bfeeac54e23fae8fd436ec450d6751a76de4610871b511e2061614b295e953bc3ff53e25
SSDEEP 3072:X3lW4pWqmBOx/PB5oDP009KDMq37HoX2nsx:FWUm4x/Z5oD80ogqL1a
TLSH
T12FB3AFF6CBA2893D55FFD82C96C2843FFD266404B3D72009C963725452C6FB876BA648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp6CFA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6CFA.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_siermepg.mwx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_siermepg.mwx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\bscan_1tnbn7iq\Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\bscan_bkuwa1r1\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\bscan_iwn3tu6u\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\bscan_kbj5cij7\History
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\bscan_po52zqh3\Favicons
Size 20KB
SHA256 d195121b1cd1816ab04117b753256d2c3f8c67c4ef6eddc0a5636706ea352c54
MD5 bbd99e2e7e77f540936b01ea4c1c38b5
SHA1 e993186bbce3f29c5c62a252f864ca3e3a8a69f2
SHA512 191deddd83390aacbffec49478e3b970ee43cd47944dc86b755de48d070c7156de3d0724a5338e34df48625f942aa9ed428266eb31cfd71aa1b533786c800192
SSDEEP 24:LLRQJY90+mhh0GY/l1rWR1PmCx9fZjsBp6UwcECjzmI:+zBmw6QU1PzmI
TLSH
T1469298075E387403EB911E7D36BA083A9E3FE2689FA7AC94347454618CF9442E5394EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\bscan_u3ghxtar\Cookies
Size 20KB
SHA256 ed2f1ba57eba822dc6855a715609ad81d15f8ef753ff991ef36fe841f30538e1
MD5 8595ee6327a3107ff518f6bf956f3e9d
SHA1 e91bc765be4cd0f27e1c6a9efcc8e4da40f97849
SHA512 40c5ff877c12feabe523c41f76525a231c8e01c0490b8c2f142b719803c275b9332d65193476bc8c02d5814642aa160361478a7e6529a3d4069afc0d4385bb48
SSDEEP 48:TeW9aw/aHLopFMavU1iBQ/tHQuSFhXmQw:nPareMaZfTFhhw
TLSH
T19D9222CE0F303110C0F09772E9C2455B1E3C151D9367AE89AA5024F3DD925EFB6060BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicons.sqlite-shm

Path C:\Users\Admin\AppData\Local\Temp\bscan_zen76fr3\favicons.sqlite-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 c30aac1d793c3f8736a98e6a11f7d11a0a65d38f7acccc4376532b2feb9fe976
MD5 25fe2028b1e42a2760a4d58bea99fb7a
SHA1 574442222bc06445eeedbd9965562fd91826fe55
SHA512 489f65a7c1388b57213f11fdfb6bf693ba52eea4403b010c867ad4f75cc6a3abc50d4f1819f85ec8f1cfdaa282ba5ea59bdeb12a84bec370888f46ba71adf60e
SSDEEP 48:gdsdSJ5UgdwPzAdjdSJ/6BdwJAdddSJ/adwLCwdidSJB2JCol3hSXdw72JCol3zD:uy////ujuje2D
TLSH
T1AF22F0000BFA0955F4F3563A35306B136BB3FD01576A9B5E8282768949327A0C6BDFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LN33SDJPQBPP86PH155L.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LN33SDJPQBPP86PH155L.temp
Size 22KB
SHA256 35a44406db4344d78dc45c0ca831039bf8ce31f2f16083d445b1214c7dbfcfba
MD5 cab601b8aa976d31080bacce9b7780da
SHA1 260e8df8e6c6c13db3955367c6abca3389499e38
SHA512 e3e307542967c93ad9158cb33e3e6883394325ba57178fbe9b1c429efb78d5fd1cd7aba23e37e83c4fc241fe7abd560a004055e2bc8960fb7e647bf0ed984c7f
SSDEEP 192:imH/6s9VuhX7uNTBa3X3hv8lztVL/bB0KCxdhMMD:imHisHuJ7uN9an358lzt9eTThMMD
TLSH
T10AA22F0027F71605F5F35A7A7BB166136B73FD028A1A9A5F418262490A33F50CDAAF73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UE2MU2GBMGTCN6DLJ45Q.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UE2MU2GBMGTCN6DLJ45Q.temp
Size 22KB
SHA256 f50e30058ee20bc3b9e1e57aa5fc74fa8941cf9e851fadc393da65792126b149
MD5 8c8cbe6409a4bdaa88908d81b812281c
SHA1 c3397f2a5f062a9d838dd7bfffad69026bf4256b
SHA512 1a0360f1470e29b36c26b269e57232d5c16ab642bfc282cca1cc10b8802e9cccdb1c02444a3b9bb50ef46d9f44c8f50f248065b96762183b59208da0ee4f8a1e
SSDEEP 192:YQN/6a9vuhX7QNTBa3X3hv8l1tVZ/bB0K8xdPMMD:YQNiatuJ7QN9an358l1tnexTPMMD
TLSH
T1DAA23F0027F71606F5F36A367B7166136B77FD028A1A9A5F4182624D0A33F50C96AF73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\AlternateServices.bin
Size 8KB
SHA256 029608a40cfd45ae66a0ab5d939d59d459c313e589a521f4076d2cf4455c61b7
MD5 747a44b0a3a1093ab5032c83f264e97a
SHA1 cade4be237a4ad549a9bcef83a508eded8fba9ab
SHA512 3a6ed86b36d8398dd1b4027e6b457d60f5e7a7f9d4dc4e56ed26cd286495accec16b35667ecc919a96d6e47695acf1b1a6097ed9cba4383194b3da74dc58a823
SSDEEP 24:q+uhMZiRqhBTReRrbtq+lzaW913ZST9Bf4lB9xrrI9Vvdo:e4LOrbw4aMPSBmlTNCB+
TLSH
T18C02E6F72BB56866F0A24FF0805C70DC9C331326552CC185CA1294E262E1BB590BEF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\AlternateServices.bin
Size 21KB
SHA256 bd7bbb5e9d466e4c3aaf5e9376cd49d36133fcb0280762e55d668f4db2781be4
MD5 ff732fc878f6fcd5f25e9a98a9e4d957
SHA1 c95d7c8b21d1ceda4a509993b627c8f782c5b973
SHA512 92238c0ec05592a2b865705fa8776818eada400a4a2e59f6efc54951b213c95a1d999c4a28e15bbf5c1185227d9c527049e9d250dff5a48913f81f0c17344295
SSDEEP 96:e4LO3w4ptCuRWG4BA0GUS/I56LSIDmM/pnKchyx25DyuZn8y8tkVN:zjQj225ZZ8Ft
TLSH
T160A2B5F32FF568A3F0628FB054AC709C9C331329586DD285CA0694E612D1BB591BFF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\SiteSecurityServiceState.bin
Size 5KB
SHA256 0655b22423b61d27ef50b78a930a30b43c8d2b04a2d33e6eb90264270c194b1e
MD5 723121bbf8c8eefe1dd3784886280b09
SHA1 7fed8d9faceef78cf9a9ae69bee53dda63081211
SHA512 256f51aa9ba5824fc1c9307d4c8ff0ffbb8592a27675fdda9e73dd3fe2d4a864ef7d9700b14ce523babdf960d68a677f952523cc17a32cd8f9c45127d9e5c6c6
SSDEEP 48:spgMDFBgETEUC6nnUUNQh6UW8OauIiCOLRIicZeZIicc:V4EjUX9OuIi7IiIgIi
TLSH
T148B154FCAD8AE9F3F1E24D3550ECE8C00D3A1352D503D1889D2B80C06456BAA60BF3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\addonStartup.json.lz4
Size 5KB
SHA256 8e07e58b6dafdc01cb02053ca18ba44483f38ddb36e9d5c5629390900da6f0e1
MD5 d4303f203572dcdfa196f0bcb762cfc7
SHA1 788212558bdcedf2773a3858f87596772f072215
SHA512 588bb959eeb653dc1bdb7096d5dc49dfc30b38d02110f4c37c606526b833d2017a4b8c9a003e5d8eba2dc2e34d1932fd474fc775c7ea7d2e44258aa9403375da
SSDEEP 96:ArR4sHNw6M2xWGhD41MgGvmHhF+8PHsHR6QH7BzJIN1C9ZYvjYy2S3:P52xxhD8rGvmBF2HT71JI+9Qp2S3
TLSH
T104C18079EDC4EE65BF36940528D9BF72D6B59F3415FA8890B19D73104D64A732201380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\addonStartup.json.lz4
Size 5KB
SHA256 c4a6e36f18384a5103ace435516b1369af7661d6b565cd832ea84d5ff8099c26
MD5 6535cb47d1e98e858ab6f455cc4418ca
SHA1 7515d89cf81ba87127d0567df8649f0aaf17a978
SHA512 07cbf1e26b0dcae908f6747807cafa7bd9b4b37a8a56fb1d6ee8a60372bb12578bc0f54efa2dda14f9ea8bfb2423117810bbfe0d1357206559c36f61efc2d87f
SSDEEP 96:lU55sWNNd2xWNhD4fMgGvmH6M++PHsyRdQHg4zB2k9N1bU8RXBYjjxyaY:lW2xohD4rGvmaM8yqVcMM8R6saY
TLSH
T188C18CB9DC88FE15BF76944EB8DABB32C6F91E3411D98821B4ADB3014D90AF11345390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cookies.sqlite
Size 512KB
SHA256 448295457f57596bc9155afbc4b3fc99db3df5f4e0f038a3184336d32fac0bc1
MD5 63bfc215f6673c1cb91a549ce6c18abb
SHA1 ebcbc8c0776b142967201bbe9c559e90209ed9b4
SHA512 6c4aa71e5979d45fb0a51a2e1fa70edaeadf453d871c7621b6a8096d0e7a706f44e194daea5a464bfb4a409e92bab42413d84ecfcc7e1b27d54d6f6e59fe45e8
SSDEEP 96:DQnSa30Niys5ouZhaFuOgWVpuxrbuDbZaOsTshi8uPujus:8Sa3/VaFbQE3
TLSH
T1CAB4A3C2BE38C103CE922530B551E50C2AFC57238892C9FD606D61B21D97B4B982E9F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.bin
Size 33KB
SHA256 5bc960330321e6ab7f83534b2623371c20d47315726d995f2b876b12a49ff485
MD5 490d3776620e1506ebedddf44fae898c
SHA1 bb8dbb78aa14b9fbd6eb5711358497530e0a38ad
SHA512 e6954d64d4b9dd0929a3b01a31a784b1bdbfda713a363c5c3eb8100f64cfb828fffee20c52f67abaa80df3bb8ccc72410a4bce20944ccf86b3e538a0eb2cfd80
SSDEEP 768:AEmvQLHwepzL7rGcmhucj7xwKReTomb/bNbd:RLHweJLgFwpB
TLSH
T184E20244FB2E953FD41512BBDCA50B042F79B88A581A2F573A4CA4686C8B2DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f78672e38f36a5bbb60ea296dfcb67b34daa5aec3ffbdeb44677522098ffe035
MD5 8f57db6c5846904d9552d91d7786ff74
SHA1 520a5b95620f28186e94bf2608973d9b4ff2f3ba
SHA512 910ace69a215ab0f2886eadf5106db9f16a4d4461430e228bcb8750d31a82954e8d22c64f83ce9430ee3f699f8d07be616582f9ad5cdb8434c2ffc3d93ba618a
SSDEEP 192:k1vOv5zboPW4Tvyj6VMOA1d66JozGzgCl6mc0dz:/bou4ryjld66JozGzgC1jd
TLSH
T1F7E10F94EA38863FC418427BCCA51F404F3A389A9C4E3F19359CA5182D5B6ED36CE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 135KB
SHA256 b5d5e1bdf68d0a232cf81b866f7855aafbfa855c39f4e0b0a97822c9c774d093
MD5 cee66c920a02f26758a3440ff0e0e5d7
SHA1 ed036ee37facdb3cd391fc3262119d7c63bcc534
SHA512 30ad6478bf3c3b250869c6852820ae326edbd72a003e363a3089cd3a7277bc384dd44c1446c96ee957b95fec93128d64772322573d89f7a7b1a17ae1c28d543a
SSDEEP 3072:jVvoNI/RRW9cNOF00EgdVYwjBmMq4zj4xDXcfyF7yv5MOa:jp6I/RRW9cNOK0EgdVYwjBmMq4zj4xDt
TLSH
T15BD3AFD4CB16407BEC2485BFB4D5573C3635B4254B599B0B2AAC04762DCB3FF2D0AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7231d5e635de0cabb2f0065c6b840ad7cf94c97914acc33c653f4252e26c84d8
MD5 07d52eb0a2772dae27992a32473bcbd2
SHA1 b86768c99e1b8cc7246ec138a44b4f269b474666
SHA512 3bdfe3895ff18f62cc8bb9a576e365222cf7fffea0c8329de51c7946716f27c4672642d25b833db3f21094374e3e7f4d102a58b0b5234bad568bff0040aecc60
SSDEEP 192:H1vOv5zboAb4Tvyj6VMhA1d66JozGzgCl6mc0d:CboAb4ryjCd66JozGzgC1j
TLSH
T14CE1FDA4EA28863FC448427BCCA51F404F3A349B9C4E3F19359CA5182D5B6AE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 07ab8a07a4b69670a900f56f95ec8116f26ba65217b2ebadce241fa855fae7fd
MD5 c29e6bc594ed3320820534245a22efb2
SHA1 ad9a6d8e2eb5ed6d0ee0101c8214a95645ef8d6a
SHA512 457faa5cddab227b63737b748f9db3ae78baabda08eaf6131aa0edb61106680436bf8208f89362e9e8681d97ddc5b02d48cc0c141cb9175bc2cdc52ceac2f2e1
SSDEEP 192:mA1d66JozGzgCl6mc0dE1vOv5zboPJO4Tvyj6VMN:3d66JozGzgC1jVboBO4ryjf
TLSH
T12EE1FFA4EA28863FC418427BDCA51F404F3A389A9C4E3F19359CA5182D5B6ED37CE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\events\events
Size 4KB
SHA256 981759ba5416883677c2a829bc53b2770ca7a982d6723a65caa9747497861ca9
MD5 4f7318d05aafaf70e475d53673b27993
SHA1 7b78aa3ecc3507799133a31907f94e282f7ef1b9
SHA512 49e96f0c67137ffa72e22e2d39f223ac096fee38d564422e008bee4510825ef88f0aefbec6b0fd8c0c51a9564b7831b6ba02d59f15052600eabc567206efa21d
SSDEEP 96:hkJsA24/dEXH7mTehxvzq1wh4VWRDJ44M:hkJ324/GH7mTeZbNc
TLSH
T1A4A10D5C69FD0CBE3CDBD6A8B845429E8388474684CB1D874CEBDE4DDC66689329F438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\events\events
Size 1KB
SHA256 047ec000a0800132e1385d6ab2e3a632f70a1c26c61703781ff8dfa593311b64
MD5 8fd81804e5de2d7c76eca9daa854c1af
SHA1 da554da180032e68165aee367ec2c25fdbe91eb2
SHA512 9b6f3441f84000ecfb70b189ff3f658ab39a072ca01ba2b50c24dfd35e384804b978a39ebbe37c5cf6e5eb10efa266aca1c5e5f482d0abba79255fb3bfa8e808
TLSH
T10E217C8C3DFC8D6A68CBE6AC7484028EA3544A4B04871C534E42EF8DDDD1ADD32AE43C
MD5 SHA1 SHA512 TLSH

Submit Download

6f0a1e5c-6c89-48a9-8db4-90fc57ae0e39

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\6f0a1e5c-6c89-48a9-8db4-90fc57ae0e39
Size 27KB
SHA256 e216da1e282f4017c61f65e1c3da7268a6657af8fb34978de0251f70d1e59ebe
MD5 7fc77ea25ce29d3987e2940576854ba5
SHA1 2021c58fd1a57d7cbcb71913605dc70a40f30f76
SHA512 525b0606090bee271cf2b65ae71c237065ad933a3992afac6e6e863c2ad324c8a548d3d36f08ea0e32747aad8c95174b739fa7f67ca5fbfcbed2eff4f085ac54
SSDEEP 768:y9hAklKhG6fiUihdObpraJclHh16lnCK0rzL/DmGrbETus+10SIJ0Rw+LA8GGVI:zF5B2dEEeHLRHb400b8S
TLSH
T148C2FAFDDE1240473E65E61AF2E9ADAB2057083249CCC7DE69FD083A27C69771527328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b049175-f392-4e6c-a1a7-34f81a8e4787

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\7b049175-f392-4e6c-a1a7-34f81a8e4787
Size 883B
SHA256 51df0037d983f2e331f1854ec62c2dd49c536f5e823f9f16349f0e04bb7e5602
MD5 407b0ed18bf665f2ed01008b287ad9db
SHA1 671ec3c0d6f5df99ba775de4f88979a7f61339c2
SHA512 20321536e5e373d5c8a0dca46f14ac5adff012cd3938154dc6f527c9f9eea07f33a83252b1ab47bf612a8de88c36bb950281debf0eb6d3ea8056f699a537d2ef
TLSH
T194110480A67479F3CC7CD24F88A0775157E8742380CBC5043E6459144D7EA2EA3E660A
MD5 SHA1 SHA512 TLSH

Submit Download

8229b028-e985-4945-9df2-3ffa4fe0590f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\8229b028-e985-4945-9df2-3ffa4fe0590f
Size 2KB
SHA256 d98f0fc63768a62ce1f996a164ea48766c313530b3d90ce4525955885ef4a1b7
MD5 19684e6a3f7e8e567e8a2a5d39c4c5b7
SHA1 8c1d7fb19a348c5452a7c92914139ae2938308ba
SHA512 a8c6b6cd5331d99c6d3d4b81828247ba533caeed816ec9215bfb090753b2401e65100acea447b8e16a17549150a1b88f98669665884fcac427bcdb314568fafd
TLSH
T16541335C76B88C779CDAF55D945123CD53B4894340CA2C832E51DF0C8EA679933AA53A
MD5 SHA1 SHA512 TLSH

Submit Download

c2320319-526e-49bc-8394-46b88d083ff7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\c2320319-526e-49bc-8394-46b88d083ff7
Size 235B
SHA256 02def0d54153a3182aeb27b25d28ff56e144430ea1d3f5ad89760c7b582cc8e4
MD5 45f289d2b806194aadb6e06afb851a94
SHA1 32195ee5669116d32b920e1960d0e56f9d29b4b0
SHA512 e8c2475feb76ce1855cc2e051254e9d86e7e697b0fa626335f99d679d74afef4d5e890cddbb80678c4062790f32abc6c7d8973afe898f74ab2868f790054e0ef
TLSH
T16BD0978014C8BB9E08241F03F1A029C630844C33A8B49820A7A00134D9FAAC8019181B
MD5 SHA1 SHA512 TLSH

Submit Download

d88ba908-213b-40cd-82cb-ad3f8d1a13c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\d88ba908-213b-40cd-82cb-ad3f8d1a13c2
Size 931B
SHA256 fdc81d041e01253a8d13fa7807ac63e14d5e5f0baefc64721920c382ba6f6272
MD5 9a66de53d684f84f8c8dcde1f8a1e8d2
SHA1 9f65e230fc3d8f365235ad585cc6a75eec69f6be
SHA512 e737e6a6002cc5d75dcacffb972c8340b3097b17f4a0fd9e72735130c1d016a8a0bb7029c90f7cb1bbff71413903faaac9108052be43b942c70665fd21858662
TLSH
T1311114809A7479F2CDBCC25B98A077929BF9702380C759043D944B244C7B91E939660B
MD5 SHA1 SHA512 TLSH

Submit Download

e528a504-76d3-4357-a58e-26ea8354d863

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\e528a504-76d3-4357-a58e-26ea8354d863
Size 280B
SHA256 71d93f47a7cc020352759e9ba1b5a96d06c916a598cf6bf2368de99aad8809a7
MD5 1a2000ea923ad192155ca0dc37dd3a35
SHA1 4d4f187fd6a0b40d174ca23f17d5ccb76c71000c
SHA512 a38fdca95e3de5601cc551a0add71da94b23862d1771588149cf9cd8ae62106a65559b2e89433c4dcd26e13305d140466c9d289cddfef10358809ef5afc0ee8f
TLSH
T1E6D0EBA02888262C4E680F1BF1B038EE30654C3220F0480481920234C5FFDCE825180E
MD5 SHA1 SHA512 TLSH

Submit Download

ebff1178-6961-4c56-bb8a-7b92540f344e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\ebff1178-6961-4c56-bb8a-7b92540f344e
Size 16KB
SHA256 67523d1476c37c41be560bfaceae793fd5cd364a64deee91d84865f517b62f00
MD5 f7b358fd82456e2044daf5f1e398bb06
SHA1 b0fce659d6a3bcfadc5a5ae0f86f000cef9521a8
SHA512 3704002807468f7c7406ff34474b5007661fecf4d734d56937690ee4beeedc4c2f54c704a77ca0182352ab1c9c39ceba27e6c2df7be66ca7852e82b7b6e0c522
SSDEEP 192:Bkfyo43y21dB0an+g7jG4G5PEei4KSp2zvwmQ/2yO+NnLFcZ2zaZLS/LBgmhdfor:+K3y2Jn+r4GZLTCFh2OZLS/9gmvoYi
TLSH
T16972CA56642045BAC291E36994FCBFC3E6F528CF4C418FCA9BE4BE085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\extensions.json
Size 14KB
SHA256 a34c6faf4278323ec4cc02d04fba76d5c1cb2af7ebb62ede56ac40bb108ec7d1
MD5 d9de4ec8c877a5b893a2ec70f96b129d
SHA1 47589e19e86f8da35a4547a3b6be9a0a622c5927
SHA512 f0e95886824f9cbe9625fd6a4584447787fc3c6550327c1c6b974402fdfe3c16db1dbc55f57c273e283811cc0a42c35a44e9801ca7d9290e78e09cca06ecd50c
SSDEEP 384:IkI4vB9UmldvB8dhWR94zv96oSL4HPL4PCL4HoL4H6L4HC:fI459RfyXM4h6/4z4I4K4o4i
TLSH
T15262321545148EB8298FA78BAA36BE01C37D473B60445C78F4DD8FC842FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicons.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\favicons.sqlite
Size 5.0MB
SHA256 16b50b8846eaa712fa9adfecef438492cda381a0aada6fe026c8a8d6ce4c59f4
MD5 8b96491ce240055f456b857468368066
SHA1 d483545e32a04565660f487b3db208b0f4c9084f
SHA512 dab67510baf62888a99cfaf53106f5beaef4d1ef29e12e9506da2ce7c49a57952693bd2c53e543abe3989d7e440f199f3f44a582aa71d8085126b70d10af4eb6
SSDEEP 768:v7iB7EjEJrdpKrBpvQWhIzQ1+ogYYO2x5qTPlSfzZokbZzEZzP9eglVd:mB7PrjKjvThoQIYYOTP8tokbGXP
TLSH
T14A36F1E752047099E20DCB76FC0365067A2B70ADEFF393CB2154C574EA3B4ACE940996
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\places.sqlite
Size 5.0MB
SHA256 9da64e3f266f691db37b2dfa1519337d3463e9b6b00d639dba37e52ef2f85002
MD5 9df1d60d270aecd6bd1909c62603d54f
SHA1 911b34905c6973dfe3c6ce52006b11c2aa2e7020
SHA512 663e55a95c24c1470a2fc28374123b7a220e29740394d9bf816ac8dbc4fa1d95b35d57095e56125fa9cf53703e248aed90ad8ae57698860a0a99ead5e236d81c
SSDEEP 384:M8r54w0VW3xWrWN2/sOHnr8Xyr6brah8zW2Rtx:rqVW3oOjC8CWb
TLSH
T17236A55F7A204056C4EB9132F8E32B18587F710ACA32B6D23DA4156D4DF0A33B95D8BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\places.sqlite
Size 5.0MB
SHA256 5fece1477f678e4febb3c7579289b34bf3b4cc43fcbd8f9af28c99ab5b9b2a2d
MD5 63779a6aba31810a1825acb51ca7fc3a
SHA1 c96add35860ebb3b8d19672ee4a7dc8b2817572d
SHA512 1e5c335cdae7e4b7c4395403952c187777ef6bb942c33f4fa5fb313bed2fe5b35cc98bcaff87a20e7f4211e21091c1eefc9e5f054230cbfe58dadc378900c8f0
SSDEEP 384:M8r54w0VW3xWUF9xWN2/sOHnr8Xynrah8zW2Rtxh:rqVW3oUF9gjC8C/
TLSH
T1B636A65F7A204156C4EB9132F8E32B18587F710ACA32F6D23DA4156D4DF0A23B95D8BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs-1.js
Size 6KB
SHA256 d0e67f520ba6f10368cece95aeac0f0493b8fd02012465b377999b2b7b0521c5
MD5 ecf65766bdeec91da8fdbb24cd98d0a8
SHA1 63b29d37eb7531dee42f8ac169c5dfdabb9058f1
SHA512 66e015ad2c3504d7a443bef52504542a65aa3c48aa1ad0da57c97c0f710b4643b7bab742820827cf9e2ac1b604191ba5c2d4455797953f07d66492e95337f19b
SSDEEP 96:xH+kmUTUhvqGqpfqrq1zSCSSlSdv9jYQnhHa7QDkBw88n8L4cncV3+U:RmkRpfqrqLSSv+aUkBw88ZkU
TLSH
T1B0E130789408CB6F74B677AC6C6888316AB2013B77BF68D750B954C5051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs-1.js
Size 6KB
SHA256 9916dd3534a35c7bfe6e779ebdb4bf52ab59051a8df772a3c59ef388375b625b
MD5 59114e9d9f52070ad72231827fe76343
SHA1 cef9b10a608e13f2f25eaba35d39b608628fe072
SHA512 c1aecdb6fc38d75aef38d1e75cc5b5fc313e81fe0f9f12a9540fc97024e9fa2a6ea8935e9f66a2a2db5230d755383a73dc4f7b5a7391778fbf71b5f015b3e880
SSDEEP 96:xH+kmUTUhvqGqpfqxf1zSCSSlSdv9jYQnhHa7QDkBw88n8L4cncV3+U:RmkRpfqxfLSSv+aUkBw88ZkU
TLSH
T1E5E13F789408CB6F74B677AC6C6888316AB2013B7BBF68D710B954C5051CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 6KB
SHA256 52c1e2b98490eb688e6c08b4d85dae32c6b57786e8db5f1eb0179fee60e38a78
MD5 88e63e48eb4da212cbcc5448f5e31a13
SHA1 eae6125a27ae1667dce372305ed795cb1fc6a4f8
SHA512 98b3d49ee6c80977a300b6ae0186f174b31e94c84a0cd8120391ce98d589edb98f44064b784109bb01a277d628d86457684f85a71c6d4691c8d24f3b24917bc9
SSDEEP 96:xH+kmUTUhiPqGqpfqxf1zSCSSlSdv9jkjnhHa7QDkBw88n8L4cncV3+U:RmkCRpfqxfLSSpaUkBw88ZkU
TLSH
T120E13F789408CB6F74B676AC6C6888316AB2013B7BBF68D750B954C5011CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 6KB
SHA256 56a139a73bf61f2fcc3e3c59b158df74d445b7a5de5b643996b0884279c9711a
MD5 d4c9a6400fae0f5b20752abde413e851
SHA1 07e6066fb0813b00941042007819325f54c35839
SHA512 6353bf8fcbb6393566389903c9b9b648a747db6b12bdcffd99602df5eff9b2c258c649172f7e7fcde237adfb4772df3e1cb44fe3cd74356723d62ff65ebaa289
SSDEEP 96:xH+kmUTUhvqGqpfqrq1zS0SSlSdv9jYQnhHa7QDkBw88n8L4cncV3+U:RmkRpfqrqBSSv+aUkBw88ZkU
TLSH
T1AEE130789408CB6F74B677AC6C6888316AB2013B77BF68D750B954C5051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 6KB
SHA256 9194f212316492e98882772af9ff7f042f0741b71ce717622aa53601117344e3
MD5 c0548387e49b0fc16c4bdb8260dc7742
SHA1 6c863f9b1169abc29a33071c5b32110fbbd18d79
SHA512 2bfb5759c3cba5602cca2791cd4c9c017cdd73222cad2f76d945e48f2e07e3c5455fe4fe60d0bf5ec9f92d8f9e32ad10a1ee1575ef6bd576f1593b7b0fcbe25d
SSDEEP 96:xH+kmUTUhiPqGqpfqxfObzSCSSlSdv9jkjnhHa7QDkBw88n8L4cncV3+U:RmkCRpfqxfYSSpaUkBw88ZkU
TLSH
T110E1407895088B6F74B676ACAC6888316AB2013B7BBF68D710B954C5011CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 7KB
SHA256 c748f594f89fce5738f0868f271004b73d8dfa18239099e2d27ce5065681a391
MD5 b9bfa4c52bcf4a6d70c79e3d2d3ff201
SHA1 2a7021c16f1e1366879099ec8792534b11ec5d44
SHA512 b0558d655000601a0b005b6a38bf3034b059c68c510b00be8cedb0168b227be5802f43dbbb0462c81111b308a878ce1b3ae67f56b5a62ecc5e2794c6fccd3e68
SSDEEP 96:xH+kmdTUhiPqGqpfqxfObzSCSSlSdv9jkjnhHa7QDkBw88Bg8L4cncV3+U:RmlCRpfqxfYSSpaUkBw88BkkU
TLSH
T1BFF11E789408CB6F74B676BCAC2888316AB2013BBBBF68D750B954C5051CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 7KB
SHA256 e02cdcf8269901c51c377ef7421b777889281b1de4843bcf28f029f3eb3b40ef
MD5 3db293ca7ed89d4545933b53ca381655
SHA1 a3c88a1ed839cc2ccc58dfa995c6f91b9c0232cc
SHA512 6152a2caae123ed3406def0277d135ed3faf967aebb42ed47dbc8d76a17dd9500de6e2321352ea8c6557edfce0db98cabcbaed2843a3acabf1c48bd960220316
SSDEEP 96:xH+kmdTUhiPqGqpf7ExfObzSCSSlSdv9jkjnhHv97QDUIVLBw88B6g8L4cncV3+U:RmlCRpf7ExfYSSpVUXVLBw88B6kkU
TLSH
T15DF11D789448CB6F74B676BCAC2888306AB2013B7BBF68D750B954C5051CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 12KB
SHA256 296f9dff92e3fb43ba9baf9ebcda56216b0963fad7f7cfed4b4273f7a5ea920f
MD5 b9d075205edf0664d5b8b532ed8ee366
SHA1 ac919d621726786fafa708d6744eb0589e5acc9d
SHA512 2dadcecea443e9740aa7bcc9b964582a6d59aa748595f79c5c72884350d6956c56ee8d0ec064a84422defd92ef0338f03208e7ed08456cd4ebad9b9b8f340f9e
SSDEEP 192:RmlCRpf7ExfXSSjLRyUNOROBw88FdrNrYv44A0txuGe6VhbHvbLACs0FzFTWO/Qj:p6RL7wMgL
TLSH
T17D42DC7858898F3F30B6327DAC2949701A6101277BBFBCE745F894C2546CF2541E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 12KB
SHA256 e9ff842aa82586cab9b804f641a87d9ec9e2fb22b00b317f6072d1bcf9da7b72
MD5 24fb3cc70fc1c5907719252cb0670eed
SHA1 c5436b89185654670fdb208b77ff905ae4168b36
SHA512 767c1d8e54ec5e3b4ec4f03a7ae082a1fee99504e4ffe56be19cc88e0b32fcf3970230cf301b0bc904ce0842a70c8d149eaa637a8f9806651de3e2cc3adb7b3e
SSDEEP 192:RmlCRpf7ExfKSSjLRyUNOROBw88FdrNrYv44A0txuGe6VhbHvbLACs0FzFTWO/Qj:pBRL7wMgL
TLSH
T10642DD7858498F3F30B6317DAC2949701A6101277BBFBCE745F894C2546CF2541E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 228B
SHA256 db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2
MD5 a0821bc1a142e3b5bca852e1090c9f2c
SHA1 e51beb8731e990129d965ddb60530d198c73825f
SHA512 997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be
TLSH
T14ED0A783C6055075CE83696CB39C7B519E3E04F672640245B1AC954C187F027414B843
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 3c84dc470c4bd80d748ef261f4591c06f0ba1d8f13f3d0abba02f89b953a597c
MD5 9c1e49da95e849c8576fed95cc731171
SHA1 a6d24db3c7da5ae2a9a3f8957893adb396eb1d75
SHA512 c8e524bd18c389b4c2aa5380da4beb3847a1ae72e18bea6eaa19932118b775f7563f3a74f0a9606606ee3934ab75222287bd66a36941cded84ce320ef628b87e
TLSH
T125716CDBB61FADEA4D7E90AF44865E0DE98B2078A91388E0C744DF610001A44366A35E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 b1a9e80c7c9c0ba0fc3381c6bd9cab01fdb1816698827dcc675a4c2fe28f3315
MD5 b7264953f40eab87e0e97f1478386d72
SHA1 420960a1edfd2d7e3d7f7efaa002aea42b84d46b
SHA512 1e6d511b37435d3e71399120a840b03bfb5920fb7fa6675c1afa4af74f246a59871023d8e36968515f61d2c4525098b91f5ddb3c53830edc3635d4ee088c9f41
TLSH
T158717CABB96ABD9B4D3ED4AF00865E0DF687147DAA1384D1D708DF35400270426BA31D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 c7a54f66fc0f30b05dd9dd97a820c1b8f880701e0bae82759a46c1aec90883fc
MD5 ae708475f8b00e230e41c625072cf6c5
SHA1 247d03922c60e3a995d1ab6944bdd76752b42f13
SHA512 3550b062ad53e3dd333fee8ff98beb4d50c25b2db2cadac27b11773901c4276bc94ee80b5187b88b7aceea23c895ef57832e27564e20ed812ebcc725285bb2f2
TLSH
T16E717CABF96BBDDB4D2BD0AF00862E4DF68A54BDAA1384D1D708DF310002748267A31D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 f10e4cbd8302e8216cfc23b019303389ef0fa638524fd5509387016ff5881466
MD5 a78330e05e67150c7fe1958d4fff6da5
SHA1 d7fb31d71204d98226ad1b6ec249b7a1b5377c0e
SHA512 8e752f8046d8397b8bd19c91b98215dd09c2dec0acba9e902da4f4c3577e6808f4edb6c6242019e78dd2ef050d2295c77721a2ac7ffdcc6f7982d30a20bcf908
TLSH
T131716D17B11DA9EA8E65646E148D6F4EF5C3102E6A17BC81C765A731840474435BE33E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 7935251e5a570501afc7d007aa870d1586cd3c8d96c276e4e1356140ae3e99de
MD5 3ac3a0bc5c94447787bf0edb72098d6c
SHA1 d4587a0b3a8081109916885f07cb11f142b37e97
SHA512 09c63be95c86dc5c9b88a6d706c4fc4d5fa05811685353632673e3ff36e073c29b271268b1ce41e78eca74c15b12c2236c6ad6f16f4a947cc74292f339cc135a
TLSH
T1D8717C5BF52FBDDB4D3A90AF00866E0DF68B54BEAA1388D1C708DF31000270826AA20D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 048ec37cd5bb0d0796d85bad6c1362139f0cee916eb9ccbc15541fa9eb6f7941
MD5 3bfdfd6e00d21e997d054f104a89adea
SHA1 4945cd85aa254c9d4f32ebc144fd5d120310de35
SHA512 148977584990b476c9ccf0874bd4ddbd6d76b59df263d77a39c9cb87b4521d21d1c848f00c584110dfd2bf5d3b57d18a35fc6c3705c29ad3b8753332072f2f45
TLSH
T1E0815B9BE62FADDB8D6EE09E808D9F0CF5860079AA4388D1C2058F344442784366A34D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 16KB
SHA256 e69b0ec8ef867ca5351cb74756d250da9ddd8dfaa7cfa75daf31710707507c72
MD5 677f777ce5ba224f13327279282b0f25
SHA1 fd787e051cd0596836a71c218e68a16442240a22
SHA512 0ce2a1a36fcab952b9920b52479034727248d385137bce7ee1e14f148d2a404fea53d2701ecb4d0359a14f71a8d41b0edc28f1653135b22f05009d0e8af0846c
SSDEEP 384:uWnX896N89V0qxqo3QRSE/4zpvwt/4iaMFnJ8uzOiIBfG5dq9:u48wN1qB3G/AzpvSaMFhzOiuZ9
TLSH
T1BC72C003E236AF4ACDB964AA0CC86E0952833819DBB656C0DD195FFD4C4B79026763ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore.jsonlz4
Size 16KB
SHA256 3cc9804c0146aaf109783d2cfe59f6c9a1e1c8d6f7ee5e33f4206b449c346849
MD5 5fc3629c0486df4c37b949eea27264aa
SHA1 1f5c1208c9d865e3057c46f95ca18fb8e58e453a
SHA512 891d3cd02075a7370b36eaaacbadc94bffab1ec8fc975fba4b5c3fcd534eaa00b0b46f95603fa9fa167156f015dd1f111a58af07c97ce6ca492d272dbf755118
SSDEEP 384:sWnX896N89V0qxqo3QRSE/4zpvwtm4iaMFnJ8ubVvaki4BfG5dq9:s48wN1qB3G/Azpv5aMFhxvaki+Z9
TLSH
T12D72C103E336AF8A8DB9749A0CC46E0D62573815DBB65680DD189FFD0C5B74026763ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{170701dd-efc8-4b19-b2e1-f85e81d2727c}.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\storage\default\https+++apps.microsoft.com\cache\morgue\124\{170701dd-efc8-4b19-b2e1-f85e81d2727c}.tmp
Size 21B
SHA256 ca446f2dddf819c43645a0618c20a99902e45bd758c05308863a82972cb6d35a
MD5 9f732016c72f19eb4dbb88384fafa9e0
SHA1 84167fdef6920722a43f033cb5877d429151a699
SHA512 2c00b2000810ca4922fa5a8f500f9a430feffb8f3ddda4a07b89fcf619e25bf7ca4ccaf9102af5c4e40fc79c4b443c2423bbadce6fddd90248519568672d713a
MD5 SHA1 SHA512

Submit Download

{677be42d-20c9-45cb-b5bf-fccc6fd5847e}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\storage\default\https+++apps.microsoft.com\cache\morgue\126\{677be42d-20c9-45cb-b5bf-fccc6fd5847e}.final
Size 16KB
SHA256 f1e904fa7c4c58e63feb91652214f000efba3e8765fa86131c745d09d314622e
MD5 7431de9c7f80da08dd44e380c9b8fcbd
SHA1 23c6acd1c32b4007a7bdf23127dedf7386b4accb
SHA512 76d5ce98f00fa9e9affbce039bfd61d7f2939abfe45aec32e7f749919060b9788255bb8ae21fda97478ec853d9829a3c00654de54116cd43671dfb2aea540426
SSDEEP 384:1RpS1oJeUJ/DUwTL6I6oAk305m3DVZyC+1wBwZUW:jpaoJxxDqI9Akk5mzyRw6Zj
TLSH
T1F772D1B9D01C80232137522FC4E876D9B77D129EAC48E4EDE5CE76B126C26C55E3C60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download