cc11d415d9326ccc4e749aed6d2d8f12a28e53d001938f6b4cf2c47a2422dad0

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
challenge.php
Size 13B
Sample261027-hnd5dsbs2v
SHA256 cc11d415d9326ccc4e749aed6d2d8f12a28e53d001938f6b4cf2c47a2422dad0
MD5 08de2fdaabcd120b8ca1388d21179921
SHA1 64343a83ad8c0b8e2789c32ca5ab1eb6abb614e0
SHA512 4f6ea55b6612ceb9df952d82a4a24eeca15508b167f16ca7e6dde2b02535e1240d9c54726c621534ec70cc6e68b2569f6bd4441fd0e2856a54e3b8fa26e3280c
MD5 SHA1 SHA512

Score

3^/10

discovery execution persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2700	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1992	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\.php	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\php_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\php_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\php_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\.php\ = "php_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\php_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\php_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
1760	chrome.exe
1760	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3808	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeDebugPrivilege	3812	firefox.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe
3812	firefox.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3812	firefox.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 1072	3808	OpenWith.exe	92
PID 1072 wrote to memory of 3812	1072	firefox.exe	94
PID 1072 wrote to memory of 3812	1072	firefox.exe	94
PID 3812 wrote to memory of 2708	3812	firefox.exe	95
PID 3812 wrote to memory of 2708	3812	firefox.exe	95
PID 3812 wrote to memory of 2708	3812	firefox.exe	95
PID 3812 wrote to memory of 3948	3812	firefox.exe	97
PID 3812 wrote to memory of 3948	3812	firefox.exe	97
PID 3812 wrote to memory of 3948	3812	firefox.exe	97
PID 3812 wrote to memory of 3948	3812	firefox.exe	97
PID 3812 wrote to memory of 2804	3812	firefox.exe	98
PID 3812 wrote to memory of 2804	3812	firefox.exe	98
PID 3812 wrote to memory of 2804	3812	firefox.exe	98
PID 3812 wrote to memory of 2804	3812	firefox.exe	98
PID 3812 wrote to memory of 1724	3812	firefox.exe	99
PID 3812 wrote to memory of 1724	3812	firefox.exe	99
PID 3812 wrote to memory of 1724	3812	firefox.exe	99
PID 3812 wrote to memory of 4940	3812	firefox.exe	100
PID 3812 wrote to memory of 4940	3812	firefox.exe	100
PID 3812 wrote to memory of 4940	3812	firefox.exe	100
PID 3812 wrote to memory of 4940	3812	firefox.exe	100
PID 3812 wrote to memory of 5416	3812	firefox.exe	101
PID 3812 wrote to memory of 5416	3812	firefox.exe	101
PID 3812 wrote to memory of 5416	3812	firefox.exe	101
PID 3812 wrote to memory of 5416	3812	firefox.exe	101
PID 3812 wrote to memory of 5460	3812	firefox.exe	102
PID 3812 wrote to memory of 5460	3812	firefox.exe	102
PID 3812 wrote to memory of 5460	3812	firefox.exe	102
PID 3812 wrote to memory of 5460	3812	firefox.exe	102
PID 3812 wrote to memory of 5468	3812	firefox.exe	103
PID 3812 wrote to memory of 5468	3812	firefox.exe	103
PID 3812 wrote to memory of 5468	3812	firefox.exe	103
PID 3812 wrote to memory of 5468	3812	firefox.exe	103
PID 3812 wrote to memory of 5476	3812	firefox.exe	104
PID 3812 wrote to memory of 5476	3812	firefox.exe	104
PID 3812 wrote to memory of 5476	3812	firefox.exe	104
PID 3812 wrote to memory of 5476	3812	firefox.exe	104
PID 812 wrote to memory of 1520	812	chrome.exe	106
PID 812 wrote to memory of 1712	812	chrome.exe	107
PID 812 wrote to memory of 1712	812	chrome.exe	107
PID 812 wrote to memory of 1992	812	chrome.exe	108
PID 812 wrote to memory of 1100	812	chrome.exe	109
PID 812 wrote to memory of 1100	812	chrome.exe	109
PID 812 wrote to memory of 1308	812	chrome.exe	111
PID 812 wrote to memory of 4280	812	chrome.exe	112
PID 812 wrote to memory of 1308	812	chrome.exe	111
PID 812 wrote to memory of 4280	812	chrome.exe	112
PID 812 wrote to memory of 5156	812	chrome.exe	113
PID 812 wrote to memory of 5156	812	chrome.exe	113
PID 812 wrote to memory of 5304	812	chrome.exe	114
PID 812 wrote to memory of 5304	812	chrome.exe	114
PID 812 wrote to memory of 5992	812	chrome.exe	116
PID 812 wrote to memory of 328	812	chrome.exe	119
PID 812 wrote to memory of 1860	812	chrome.exe	120
PID 812 wrote to memory of 4444	812	chrome.exe	121
PID 812 wrote to memory of 1760	812	chrome.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\challenge.php
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\challenge.php"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\challenge.php
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {6626fa21-1f2c-47c8-82ce-09e3dea5e369} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27135 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {ea053680-0e02-4710-ad3d-dc1a13e15c7f} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:3948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3576 -prefsLen 27276 -prefMapHandle 3580 -prefMapSize 270279 -jsInitHandle 3584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3592 -initialChannelId {6cc0240b-4a18-4dc8-ac37-5045abfbf98f} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2672 -prefsLen 27276 -prefMapHandle 2800 -prefMapSize 270279 -ipcHandle 3576 -initialChannelId {bc9f7c86-11c1-4e81-a994-2966071dec03} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4264 -prefsLen 34775 -prefMapHandle 4268 -prefMapSize 270279 -jsInitHandle 4272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4280 -initialChannelId {5a5188bb-32d1-467d-ba6d-91ae9eb6eca7} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4796 -prefsLen 35012 -prefMapHandle 4580 -prefMapSize 270279 -ipcHandle 4856 -initialChannelId {06022dcc-e3e5-466d-b713-426701903d58} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 32900 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5064 -initialChannelId {023e3a6b-a503-4848-a38d-de03e83b7654} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32900 -prefMapHandle 5108 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {ce24024b-bf35-4023-b1fe-cc22a3fc9edc} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5464 -prefsLen 32952 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {c8ae6609-5a45-4e19-8c3b-96f4839be238} -parentPid 3812 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3812" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff81c94c728,0x7ff81c94c734,0x7ff81c94c740
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,2844080272975052808,16065801082222837438,262144 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,12795920964528689271,11322009278201495830,524288 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2472,i,10270016573998126071,17974653199299764948,524288 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,953191257837040653,8929147752394663307,2097152 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,18028263168219336963,14246677490960930623,2097152 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,1238705128611988469,7296249505886685585,2097152 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,1852235822049481901,10797738521371406502,2097152 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,13427001432053386268,5142394111072071468,524288 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,13442451679210308806,11881603840543629259,524288 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,14923193433536346326,1163830665190443435,524288 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,15730296101200249787,6235694788728569174,524288 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4480,i,9491285483073490622,12111860482245325362,262144 --field-trial-handle=1744,i,16655927756860409534,15467699610570938764,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1a872550-6807-4f05-aace-f0691617fb15.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1a872550-6807-4f05-aace-f0691617fb15.tmp
Size 270KB
SHA256 5fcc5d01c2ce7d0320eed962ac7af01bc1b7d29a796a90c2e9bfe7c68299706a
MD5 edc8c31aab95f6ebeff55b6782eeb28d
SHA1 a00c8380fad10592f9b7caaea320c8a102990e48
SHA512 db90675a5b2da52592253f30635ac88a7d5e8870ef179187507296a610cf67be101713930ad59c906c362472e714ca5f67a368b8dd0ecb5f502fdf654eaefd62
SSDEEP 6144:PHhYbFusKYrxbyvK3uWEPw+hFD+7t56OD9ZfSApprm:PbsKcbyvyIwyFSXD9ZfS4k
TLSH
T17C4423367210FC77C6FA9701E0077B05CE7A99DA81C9446982499ECBE19F94E0BF3D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23c968e3-2fa7-4e89-bb4a-2f893f440c0a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\23c968e3-2fa7-4e89-bb4a-2f893f440c0a.tmp
Size 130KB
SHA256 44735013452a0b3b1bdc39dfa40a1f6b6d17ae0de34ca4879a178189242ab174
MD5 7a6fc308cebcf393d33e2825500e8c56
SHA1 a8a72e320fd7dee3cca16af944a56c1752962e45
SHA512 224c845d147b0db9dd8413acd2b201ca13f62189b2d6b53df2cfa8c89c34da7f40cce79451316d58c05e62dc5fad6751f34c0b03d130545fefbde6ea84c107ba
SSDEEP 3072:b+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:b+hFD+7t56OD9ZfSApprU
TLSH
T1C9D31232AA91D87BC9FD5541B157A300DD766CED41EE2A09444A9F8EE09FC4D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ae23f7a-1265-45ca-a7f9-944dd1c04226.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7ae23f7a-1265-45ca-a7f9-944dd1c04226.tmp
Size 269KB
SHA256 aa9f1d13870b680c70ff7515ef4d36637878923576119d35d88e839f9964df53
MD5 536234fb9939490a50d5ff67389bfd11
SHA1 21db57be455aa446c67efc9a7618bb81e504f589
SHA512 f194ab333d09591516e1177db23947f7939b648d862662bd52025e6e957b0fcd0c33b5c0e061602a08e8a71b6a610dd93f93cdbe51fd7e3d750addec2d222245
SSDEEP 6144:4HhYbFusKYrxbyvK3uWEPw+hFD+7t56OD9ZfSApprm:4bsKcbyvyIwyFSXD9ZfS4k
TLSH
T1584423267250FC77C7FA8701E0077B06CE7A99D841CA44658245AECBA09F95E0BF3D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ebc3886-6018-4ed6-ac1b-e3025384e9b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6ebc3886-6018-4ed6-ac1b-e3025384e9b3.tmp
Size 12KB
SHA256 8983871d6fb43617494d5f28dd7717c7bf1dcec83aaa54cfb3aa02e22c106e0b
MD5 b8c8e0a13f4a9e1f040dcde99de418b1
SHA1 75b1670e5e32a272b1fd0b54619aece1e0bcaf0e
SHA512 0b76fe23164286e206fb7b052f0b1982e60e6dabc2a63bc946a3bb9fcdbbead93fe8eb3510f5817105a691407b3a47485da276f77a2cbf94f3f8dfcb97b37a3d
SSDEEP 192:fRZVzPM9fOv7TpAPRp2V9WHsb+WNnFBdTaeo7aBTVyIsnAUgtaJ:fRZVSqvUX6UwDdUaD8
TLSH
T12A42B73EEE10B53B5CDBD21AE9567B53E7F9102220942E84E6FC893C15D79CC622741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89512c31-dcb4-4f91-bb00-f0dcf3d58971.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\89512c31-dcb4-4f91-bb00-f0dcf3d58971.tmp
Size 17KB
SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
MD5 472d61bcf21443a047dac261aad552e8
SHA1 608e068876727f4f676b88d75ee81c5361cbab00
SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a4804b4-de63-4f44-988b-a1668c93fac7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9a4804b4-de63-4f44-988b-a1668c93fac7.tmp
Size 414B
SHA256 51d5ce689abe23c9d2c81cf66afc60d9e162bc862872cc2bea4d38cbfff81cfc
MD5 a43c8d679b6aa5a8d8d4b2d1094f4007
SHA1 e66a28bb8fe5b2340a309d233bc641b4c1205991
SHA512 65dfd55209f165c75ceae466641b2066b67c3b471c085edefbe38a2b165a21dec30cc9ae87a2c12830c6adf02b26584404d683f4aa1c8cb96d0d69212c2fc441
TLSH
T1D3E02B65C921ED271DFD572894585746EB5013573BD4854F3B3CC10C8FB163A4A8782C
MD5 SHA1 SHA512 TLSH

Submit Download

94956047-0e83-41f4-8cbb-a6ee401dbf04.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\94956047-0e83-41f4-8cbb-a6ee401dbf04.tmp
Size 2KB
SHA256 93154f95650fa70c4627fe98bb14786e006d78cd7c070c1839dbb7a7ea91db7b
MD5 641681ed7ed66a337b8258f2446f4e5d
SHA1 3b2c574a5b5ab86535d5c7e9290f6c56298d8282
SHA512 b34a86a12bda5e86d8af5fa3aee849955945c66afd83b7c9c94020b7c9a2905d252d45b69b4c28987028b84f6a36b40a4798dfee2f7761cfe61fa9bf708a07a6
TLSH
T169517BF7D3E4867D861196F49B216E2FCE3D1A14121C3C6689D4AE4B53F2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

d4ab18ff-3be3-48d7-ab42-93f7e762fee4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d4ab18ff-3be3-48d7-ab42-93f7e762fee4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 b9516071a820e96c8966aed305e7c0b166a8ae8d9ffb6e88ec4590d658d53815
MD5 206ce1fbe37210d60b33f4d74f5a2e53
SHA1 2492591b7fad706729bb6e55757ac1fbab94a700
SHA512 5e25425537033498a6df47f5bd394e921034e9c5ec98b710ace36c0d60594a3c644c2ee3c0153b73f99083374ad0d42bed1862f1adf95260ebb247d55975fb06
TLSH
T139B0124484425301C42702F411D034883254DF28A606134151F40E118839291819B197
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 5c9e4a97166c22be151bf2866f138b7da7c9a978e63328e47e67f797ed70f9c6
MD5 bd1a1fe8c2417d04c9bc4d993150a29c
SHA1 c52647dddc2eab7a374d612ffc4810e6a2c6b1eb
SHA512 d65154aac1863c12b547521889ce7c22d70b1223cd778b566ec1eb4d41d7e62e659db90e8299277e7006ed0267b6cc1fcf72a9d3cc0a06cdf8e22b8f88a3c4d9
TLSH
T133B0025DD606A217C0A313B06DD9D5D87170DF3DC6039626DAE01AB7DC3567045265A4
MD5 SHA1 SHA512 TLSH

Submit Download

b83a8c04-ccab-49fa-bd20-ee0592bdf57d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b83a8c04-ccab-49fa-bd20-ee0592bdf57d.tmp
Size 12KB
SHA256 1178cefcad15239eefa88b189cc8a3625cedf2cf6b3c382c8ca1604cb0e3baed
MD5 047ec7cf20b3649aa32917fa1d82c75f
SHA1 6992b975531136cefb2b4a2741d14e7842b7b1aa
SHA512 5406fe1662537bc71ee788c8b057c69d430a97592079c0677d142b88d7bc4da3593ef8940108e8953bb415ea1cc0a93ea29c7510985f8d304b901fcf87de2b42
SSDEEP 192:fRZVzPM9fav7TpAPRp2V9WHsb+WNnFBdAaeo7aB1VyIsnAUgraJ:fRZVS2vUX6UwDdjaxe
TLSH
T11142B63EEE10B93B5CDBD21AE9567B53E7F9102220942E84E6FC893C15D79CC622741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4052597-6b61-4bb1-9f86-78ef3dfa6b04.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c4052597-6b61-4bb1-9f86-78ef3dfa6b04.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fc826932-c838-4dab-900a-16fc03d050aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fc826932-c838-4dab-900a-16fc03d050aa.tmp
Size 269KB
SHA256 d8b1d00dc0bf492fa885458a2ef45491cd3e2c8672303b07f497ca9f84b5c488
MD5 2fd3cb7918bd417bc77a4c297c3dd218
SHA1 9a2f0ec208e533c3a7216d67302bdc4178297ee9
SHA512 8befc502dfb26132bf1ae1e0dec8c3bdd7caab7ba68a466ddbc08939d2a01bcedd86bf93ed945f7bcc4dd675e65d052b394b2e443e5477b3d7abada7c8608e13
SSDEEP 6144:DHhYbFusKYrxbyvK3uWEPw+hFD+7t56OD9ZfSApprm:DbsKcbyvyIwyFSXD9ZfS4k
TLSH
T1D0442326B250FC77C7FA8701E0077B06CE7A99D841CA44658245AECBA19F95E0BF3D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\activity-stream.contile.json
Size 4KB
SHA256 110f37f1e766316a627526a9c0241f252ed8c225f636d9afdb804ead730e7870
MD5 559e35ec6eac0f5bed89110b780bdc9d
SHA1 dc1adfefe277f7eb73c1d6162a7246939eda3477
SHA512 a44af65d2dd96781e090d0308eada10c31a7a2eadf09a48afb57cf193c3a2e8e5138075c1eed884714351d0bd33da623678bec78d0e9552f3d6d8b8cb3e4e222
SSDEEP 96:T9bjQMCPbCTmzb1PpFT+mRdCmn4KY7bhydN6DUCholz:ZEMmCTstpEmRdCmihONwUChoF
TLSH
T17E91C86BA57448122B30BAE53C0B3ADDF1077006DEE48B99B15EDC6185EC7FD50DAA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 df59bb707647a60065b2f98ffe6f9038ca7e97a9a95e2342046a6b3dbb000502
MD5 f2a9a594bf077c5461adae6a87ebdcfb
SHA1 bae239f3b0af197f81c1a7dc31747327f9c59aea
SHA512 274e50e905a6dd9a3dfe2b67b35fbae15f9b244bd117cfeabf7362ffb837590f570f51af692519156212f2210e0c27351ddf48a670e6aaca7889cc3a625fc5c7
SSDEEP 768:Ky5R5QsDQnevZk51wi+BlAwDNSpCihec9x7nSU1KHgU2cOOraB1aUo+GzbF:x5Rc2MSlALCE9RnSU1H7HB1a6GN
TLSH
T1337309A3A6E8B1FB0F9177C72C0BB95B62E101C5E34506C9ECEAC91D81DD654123B6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 cb6ccd23eb9eda0d7e52a2107ed5b22bd3ccbc5eebcac76e945427752d58e8df
MD5 1a2556b5b28c0b08cab9c4cb461557f2
SHA1 e5827261b6ae03ff07487a7d0033de645dde3a9b
SHA512 3bae301de39f884953b7acb2fdf420d8a4858c39f009278c6abf674070e3f4ba114e463cfd923966fa9c6797031b9992d64b426c5085d8056211af86051c10dd
SSDEEP 1536:jTrliob6aDdkCUvelcOF6dxlOQAd4i98mSCFTrxiRLq3ZqrgqDVQb3XI0H6J7opv:j3lqzveYf+zSCFxiE39pWo
TLSH
T13BA3AEF6DFA2C93D55FFD01DAA82883EFD162414B3E73019C963631065CAB786675348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 37ea210b03541e1787584b9157269a24f54e547ac5d610bf8341ae106aa18b77
MD5 60ddc641838159a450c3cdb18c0a504b
SHA1 09f0b4c3bf643bdfe0cd2d950774bb54d11ef90e
SHA512 0ff03ce2dda03691c3788d740d7381499db38a48364cf80b8ff9e5ceeb5aa304e80975dd10bda0aaca3c6e7b320f459c4104b8e4bb88d1ad4e3fc58a79a19e43
SSDEEP 192:g1d66JozGzgCl6mc0dMOv5zboPVRWYyjL+o:ad66JozGzgC1jhbo9RWYyj1
TLSH
T1AEF13164E628867BC40402BBCCA61B904F39385AEC4E7F1934DC651C2C5B2DD7A8E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f8d7a9408d049bc68b4fe1e77aa3f2ccfaffcf523a469fdf0ec2e18c6b9ba5e9
MD5 c5126d406f6a4f611c65f6af9b8aa405
SHA1 0dfac116e86b05ad868fa72a416ace276aed9a95
SHA512 e175a9704853a21eeafe518f8aca00932d3a87a50761d20d187b9fd547013ad89658d255243ce4c50fe9c27547a8f6712645c00b6ca889f2b4e6c11265707e69
SSDEEP 192:7Ov5zboPVRWYyjL+x1d66JozGzgCl6mc0dz:kbo9RWYyjWd66JozGzgC1jd
TLSH
T106F13164E628867BC40402BBCCA61B904F39385AEC4E7F1934DC651C2C5B2DD7A8E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6bbf34f6518949b379acb8f3725d63b9af203c23a59c6c0597d8be0d19b83e69
MD5 6bb716fbf9298a492d460b37857e76e8
SHA1 064e3c1dce43241b8da09ff9da03ac2dd1ccf1b0
SHA512 6c23fed8267d078c688070aad49e8b61dd3670350b4d9bf7854ae57f52ea57e4d4b59e6fcb601f31bbd4804aadf495f21fe73cd839f5b8d98ba4e4c1dc62d70c
SSDEEP 192:t1d66JozGzgCl6mc0dHOv5zbowbWYyjL+:Ld66JozGzgC1j+bowbWYyj
TLSH
T1FED12F64F6284A7BC404037BCCA61B914F36395AEC4E7F1934DC65082D5B2DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 93a09b3e1be7755512708412c19eb67a386136dd16a436801455dc90f8b55fce
MD5 0059d44e51093b09833aebe517cf5dee
SHA1 57808d510e4676367ab79381d29ec3473ac55297
SHA512 c69907af2a838a9d79edc3ac54ce933d9d9bf1de138b2836d4c20c96bee6ff51937b77c0b29b12d52ad0ff39f1bf13e9e82421849eecc3b848c4aa4a5700a078
TLSH
T11E61AB58F2299A3FE4444239CC965F812F347452E8AF7F2A34ACA14D5E5B2CD768D03D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 00672fa871394a60ecad741cd850b865c12d50d63c3acfc9e6d23ec0352b5f24
MD5 7abf1ec7d3c9596642c2c596435d2413
SHA1 53ca3c65095f55bf1b444ca91a93df602881828a
SHA512 2cb58264fa8e93ba0268fa654b4689d0a0dc41f176df8580478e15e91a1858ae3128fa96bd0ee17a90147a8628fb7de5741b3c8341dd5b720ee4178c68c69127
SSDEEP 192:IOv5zboPVhZWYyjL+D1d66JozGzgCl6mc0dz:zbo9hZWYyjod66JozGzgC1jd
TLSH
T182E12064E628867BC404037BCCA61B914F39388ADC4E7F1934DC651C2C572DD7A8E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c0abbd7618685bc2d5566569c1a93cd831ab62a97c5a9c3cf278c18725c2ff89
MD5 6ff819f7edb32bdf8e0dfa2b4d44eaee
SHA1 91b506c1ef8be6f06e3a8b44d3f01f461d68c01d
SHA512 5b71fab3fb0954298d210816c64f70afc7415b0f91b97a9e128f9367469b58a6b36999048393002d11900381fb7c0b51293d00fea984eedcabef69854e136de7
TLSH
T1A221AC4C39B84D2A98C7F6AC7482128ED3258F0B14871D474D42DF8CCD85AED31BE839
MD5 SHA1 SHA512 TLSH

Submit Download

454bc102-b2e5-4c3d-96bd-6fc6f7fcb8c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\454bc102-b2e5-4c3d-96bd-6fc6f7fcb8c9
Size 235B
SHA256 de13680b895afda365a448deeb3ccc747b85875fdd0a74decbc9cf3fba4ce343
MD5 7647b28589930a0482f14e5647ae3591
SHA1 6bb9f90a9088fea829ef11aff0b4aa36683506d7
SHA512 b8db056b6d8727955949667e3d8ddb46f28e3ad2c900ebafe83489e5b3a966af8e59f977c88828a78761a0a7ea7d7b70c7ef1b2131fd348e59b04dba752335f8
TLSH
T104D09788A498B76C08180F0AB0A438C630898C3759A5A8A0869481B4AAF9DC84166807
MD5 SHA1 SHA512 TLSH

Submit Download

63bd37ac-9164-4451-a824-ed68a53a24ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\63bd37ac-9164-4451-a824-ed68a53a24ba
Size 235B
SHA256 05315e2ab0c5c6ccabf4566211678a7cec119ebea221a8ebb59231c7b745594d
MD5 5f35a160d97b0d8c7982a80f81bad514
SHA1 f34e63a7957e181b791af47c57fcad6592f324b0
SHA512 164ecba539cb7ded8509de8e05bba354ec305a610d05b549d0208e3b2e46e8c83dbe6dabb31039587b75c2de1254796931a7937ba541713b4958f49e07549670
TLSH
T18CD023817CA8AF6D1D140F07F4E169C671C94C3724746810D7639574D9FEDC54262C5F
MD5 SHA1 SHA512 TLSH

Submit Download

7aa71750-efc1-42d3-8f46-9fa33a2a240f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\7aa71750-efc1-42d3-8f46-9fa33a2a240f
Size 883B
SHA256 611d31370d5aa32d4f4fa6203923424309534f2cd51e6192b9a1437d4c60a4b6
MD5 e7fdfe933bd81c323902db97b650fb9c
SHA1 1cc93e32276d3478976e4b8eb544d7f196206948
SHA512 6b91f663a227a2cb84aefe5ea04ef8196258c9d05afe3c5987200ee363f717cf1e24006053eec0cde27cb73b628e8c7a05b4ad44ae6c002f2ce07bdd0927472e
TLSH
T168112340A7357EF2DC68D38BC86537928BE4B523C0CA85143CB14E180C7E51DA37621F
MD5 SHA1 SHA512 TLSH

Submit Download

cfa50425-bb34-473c-980f-c9b6bd5dc521

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\cfa50425-bb34-473c-980f-c9b6bd5dc521
Size 2KB
SHA256 499bfb0b982fe692e826ae838827c0a267706aa40982ae14a1bf063f25678afc
MD5 40934a83b46fa1c62f43477ad1779dc1
SHA1 59e8b3278ff5fdfbdb43ce093554d653a0b6e45a
SHA512 95c5cd8932102833ebcf29880b39f4bceaf13cc5ee67c8812032dfcd50755876371ada0469460c8a7851db39fdec25feffe05e6df14c9411801e98e0d847e9d7
TLSH
T1C6417128B6B85CB78CCBF28D909133CE53788E4350825CC36E41DE0C8DA625D236A43F
MD5 SHA1 SHA512 TLSH

Submit Download

e5df3bb2-e1b5-4a84-933a-716484a626f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\e5df3bb2-e1b5-4a84-933a-716484a626f4
Size 734B
SHA256 eda881e118655891a34a803a196363a677c277dfc9ff5a813bab2d491947da71
MD5 3a47fa87e781472d1b388a468e8c468a
SHA1 d7cd112fa0878cafef4db81258b9b28e084c17d6
SHA512 f8c0f1080840ff187a1ccc5fd93bd9ec251498939a258e0026172a7d518109c9c382d6643de221839022a085c060a5d045273d531f822e07ad12446028db0356
TLSH
T1710120914231B423DCB8E34AC958375696E4A032D0C280143DF48A144CFB02F5225707
MD5 SHA1 SHA512 TLSH

Submit Download

e83d4de0-ac53-466b-84f5-6db15c75c6db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\e83d4de0-ac53-466b-84f5-6db15c75c6db
Size 886B
SHA256 118b78f1707bc2109d7d9aa64f4fb612b6321f7d4f67957d265ffe9b376bba94
MD5 ad47d89e1791a28165abcfed1cb5fdda
SHA1 4e561779f2c35f23268b0e4085d481d83f8be587
SHA512 5a8cbe6077e4df9876d99ffe99dd66334e8de31cdff862890e6780836c3ed11e69dcb18a21ed24cd84abc7a00f32ad04f6d377c2f4cb47902c2094abf8022ebe
TLSH
T1681100409679B9B3CD18E3D784A43BD24BE46523D0CA8C58BDA08B280DBB11E976620B
MD5 SHA1 SHA512 TLSH

Submit Download

f5c8cec5-314a-4992-a81a-185f9fbfce80

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\datareporting\glean\pending_pings\f5c8cec5-314a-4992-a81a-185f9fbfce80
Size 16KB
SHA256 65a1f963eb7aa38a5e44f0d8c746d5d3da8fb083f9ef3615f902b9efd56f3161
MD5 662ec1542925071d3da59a3c55fcda69
SHA1 d8f3367041e187d15d10f520e89fa316721702ec
SHA512 b0370bb5688a5d303bcbb6a622f6a8210c40557bc338a81304481349c827a8c717472644d147398906063f01332db4da9002b68912656b8f0ca820c8326f8085
SSDEEP 192:wAG0jI1Sb7RVjWze92fOy0sdAn4+O119Bptxf7QTJKYU4AmpEDH5l7pzndy4uG2h:xs1Sb7RVjWUQOvs6nBOJL/7JYzwN3PH8
TLSH
T17172CA46286045BA8791E36994ECBFC3E5F528CF8C419FCA87E4BD0469DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 ce42055a393b91f6ba17b02d8017a6c0ce6b1a06ead4e7350ae5a6768eba2a58
MD5 60a671c985b889425e20a3e92517b7b8
SHA1 fb5a71ff786d3641a79c993a9d1ddb83344c98f2
SHA512 bead758974287229f89e078f8ba7deb2ab1d38432f1a2ba57637453e2c1db913ccdb71c5782f443081458f083f494c03c1fd784baef8bd2bdf401e26fb127d6d
SSDEEP 96:xH3UTUJqGq4LfidLObzSCSSlSdv9j4ynnH5mrUBw8On8L4cnGGEt:NkR4LfidLASS5a5vBw8O7
TLSH
T178E1317891088B7F65B6777CAC644831AAB2013BB7BF68C750B954C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 dd369a2d38446b68a3f3b97fb5ce99ebf938132ee8080080b5d808a0232240b7
MD5 502c1e248b4df3af9760c39bf9dfdbaa
SHA1 e96184bf1d72c5a26664059cdf5742db3cd8b11b
SHA512 88302aca9731f6623b63cc1bcebf35617762b429186641267ce420ac2ba88db6e31c3ebccabdb5328e3ea8d766c3fab5f589da619b270cb516ccf7313c638b70
SSDEEP 96:xH3UTUJqGq4Lfiy51zSRSSlSdv9jO2nnH5mrUBw88n8L4cnG5Et:NkR4Lfiy5gSSo5vBw88q
TLSH
T180E14F7890488B7F65B6776CAC688C316AB2013BB7BF68C750B594C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 5726f53953972bd8be70a27cf04037cff4e9f9c6f5e26b23ac073ebc17ca758d
MD5 a791683fa92655c6a78d6a67fea1eb20
SHA1 4d0059f1cc3324e38a1fba396da4ff0157745ef2
SHA512 c58cbb8863f162c27e7260c1100e17ae1844bf423665bf1721f51d7377e70820c0f69501c8faa134415e1d7b75c93503f62a2de5df4af206c14838e33504f876
SSDEEP 96:xH3UTUJqGq4LfidL1zSCSSlSdv9j4ynnH5mrUBw88n8L4cnG5Et:NkR4LfidLzSS5a5vBw88q
TLSH
T1A8E1307890088B7F64B6776C6C688831AAB2013BB7BF68C750B954C4055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\prefs.js
Size 6KB
SHA256 08e75c89d84ffec9ee924f00a99b6d8f40a17f3b4f5054b1c23e06c2769519fa
MD5 0f1c5776fbfdb790855eabaf1446893f
SHA1 029b0679f32807efd66cbcc9c04602182ac130b6
SHA512 aff42fc2470d5f142f323d4edcc6e4513db1c296facacd520c9da0f62a9320745011e6d5bd8368972e96100b4be0e532e03431839cbe92ffee0058218222675b
SSDEEP 96:xH3UTUJqGq4Lfiy51zSCSSlSdv9jO2nnH5mrUBw88n8L4cnG5Et:NkR4Lfiy5zSSo5vBw88q
TLSH
T106E1307890488B7F65B6776CAC688C31AAB2013BB7BF68C750B954C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionCheckpoints.json
Size 181B
SHA256 16b7be97c92e0b75b9f8a3c22e90177941c7e6e3fbb97c8d46432554429f3524
MD5 2d87ba02e79c11351c1d478b06ca9b29
SHA1 4b0fb1927ca869256e9e2e2d480c3feb8e67e6f1
SHA512 be7e128c140a88348c3676afc49a143227c013056007406c66a3cae16aae170543ca8a0749136702411f502f2c933891d7dcdde0db81c5733415c818f1668185
TLSH
T112C080C7C5491075DDC32A5D73D47F519D3F04F776711545B56C594C187B0278547843
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 8ec7839dfbfe0adffa904767d7a8069ff4eb9aab14f05749d9431e655259d527
MD5 3705b34f4d0920ad698b6969ffc167ef
SHA1 e0c61dccaf22c0b23c11a93c040bf7abad548bf4
SHA512 a66f03ae67313c33690510c97da0ae9c4fef76cb7f2748763bbaa768e3461a4fb375ed5f425e84093820eab713eb0b7246154c1bc1df50e4a47183858553ef41
TLSH
T16221FB8264DB3FF53A93866FD8828FF981653139846504B0C68D9582519D1593785215
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 1e565c2d3616e3223c935f013430d0222095dd987e9bc17e0621fc36561576b3
MD5 0214824067207f0d1c64c6155ce1205d
SHA1 c66b226ab12e9428b50984151d951015eb94fc2c
SHA512 fd9c12575990e7cb60df5bf7fe6e072ac23bd2d683e419496f8f30becc0f6fe2a1ab97138e8190b6d17159c055deff8d235a7dc9210967b330172abe6e86dcd2
SSDEEP 24576:uxjdlohpBXkSTjyJDYBR/6YZyRgVBPwfs0U6f3YtQswc1biAYOOboaEZwCM:0jIKIGJYzis0nP21WAYXboaEi
TLSH
T13E4619E820D1A297F3814073724593EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\targeting.snapshot.json
Size 3KB
SHA256 628d929111d68e1887642c98e7cbe1c31090435756e2a03c640a718157df8369
MD5 34995edf9d22c8b232440f8acf5d8bea
SHA1 addca639d255b781271847c0c96ad1583e7e7d68
SHA512 406c6fdb0579bd08707a7163e1b5786976df9df15b5ba35ce650c5419b08cd98ce0e4576fd6d4885d538d954389b49b02a77942600a9c1b14644200df2b2a0df
TLSH
T14471620C951CA4BEA66BC3C0D6447F978BBD053370446458DAFE460C55FB5FB123611B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download