Overview
overview
3Static
static
3In Stars And Time.7z
windows10-ltsc_2021-x64
1In Stars a....dylib
windows10-ltsc_2021-x64
3In Stars a...2.node
windows10-ltsc_2021-x64
3In Stars a...4.node
windows10-ltsc_2021-x64
3In Stars a...4.node
windows10-ltsc_2021-x64
3In Stars a...32.dll
windows10-ltsc_2021-x64
3In Stars a...64.dll
windows10-ltsc_2021-x64
1In Stars a...rks.js
windows10-ltsc_2021-x64
3In Stars a....dylib
windows10-ltsc_2021-x64
3In Stars a...ket.so
windows10-ltsc_2021-x64
3In Stars a...t64.so
windows10-ltsc_2021-x64
3In Stars a....dylib
windows10-ltsc_2021-x64
3In Stars a...api.so
windows10-ltsc_2021-x64
3In Stars a...i64.so
windows10-ltsc_2021-x64
3In Stars a...et.dll
windows10-ltsc_2021-x64
3In Stars a...et.lib
windows10-ltsc_2021-x64
3In Stars a...64.dll
windows10-ltsc_2021-x64
1In Stars a...64.lib
windows10-ltsc_2021-x64
3In Stars a...pi.dll
windows10-ltsc_2021-x64
3In Stars a...pi.lib
windows10-ltsc_2021-x64
3In Stars a...64.dll
windows10-ltsc_2021-x64
1In Stars a...64.lib
windows10-ltsc_2021-x64
3In Stars a...eamcmd
windows10-ltsc_2021-x64
3In Stars a...cmd.sh
windows10-ltsc_2021-x64
3In Stars a...o.webm
windows10-ltsc_2021-x64
1In Stars a...bm.dat
windows10-ltsc_2021-x64
3In Stars a...bm.ivf
windows10-ltsc_2021-x64
3In Stars a...bm.ogg
windows10-ltsc_2021-x64
1In Stars a...e.json
windows10-ltsc_2021-x64
3In Stars a...pgsave
windows10-ltsc_2021-x64
3In Stars a...e.html
windows10-ltsc_2021-x64
1In Stars a...e.html
windows10-ltsc_2021-x64
1Analysis
- max time kernel
299s - max time network
261s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
30/10/2026, 18:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
In Stars And Time.7z
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
In Stars and Time/www/lib/crashhandler.dylib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
In Stars and Time/www/lib/greenworks-linux32.node
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
In Stars and Time/www/lib/greenworks-linux64.node
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral5
Sample
In Stars and Time/www/lib/greenworks-osx64.node
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral6
Sample
In Stars and Time/www/lib/greenworks-win32.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
In Stars and Time/www/lib/greenworks-win64.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
In Stars and Time/www/lib/greenworks.js
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
300 seconds
Behavioral task
behavioral9
Sample
In Stars and Time/www/lib/libsdkencryptedappticket.dylib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral10
Sample
In Stars and Time/www/lib/libsdkencryptedappticket.so
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral11
Sample
In Stars and Time/www/lib/libsdkencryptedappticket64.so
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral12
Sample
In Stars and Time/www/lib/libsteam_api.dylib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral13
Sample
In Stars and Time/www/lib/libsteam_api.so
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral14
Sample
In Stars and Time/www/lib/libsteam_api64.so
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral15
Sample
In Stars and Time/www/lib/sdkencryptedappticket.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
300 seconds
Behavioral task
behavioral16
Sample
In Stars and Time/www/lib/sdkencryptedappticket.lib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral17
Sample
In Stars and Time/www/lib/sdkencryptedappticket64.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
In Stars and Time/www/lib/sdkencryptedappticket64.lib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral19
Sample
In Stars and Time/www/lib/steam_api.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
300 seconds
Behavioral task
behavioral20
Sample
In Stars and Time/www/lib/steam_api.lib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral21
Sample
In Stars and Time/www/lib/steam_api64.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
In Stars and Time/www/lib/steam_api64.lib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral23
Sample
In Stars and Time/www/lib/steamcmd
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
In Stars and Time/www/lib/steamcmd.sh
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral25
Sample
In Stars and Time/www/movies/Intro.webm
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
5 signatures
300 seconds
Behavioral task
behavioral26
Sample
In Stars and Time/www/movies/Intro.webm.dat
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral27
Sample
In Stars and Time/www/movies/Intro.webm.ivf
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral28
Sample
In Stars and Time/www/movies/Intro.webm.ogg
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
5 signatures
300 seconds
Behavioral task
behavioral29
Sample
In Stars and Time/www/package.json
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral30
Sample
In Stars and Time/www/save/config.rpgsave
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral31
Sample
In Stars and Time/www/supertoolsengine.html
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
7 signatures
300 seconds
Behavioral task
behavioral32
Sample
In Stars and Time/www/translationengine.html
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
7 signatures
300 seconds
General
- Target In Stars and Time/www/supertoolsengine.html
- Size 69B
- Sample261030-xcap6aev8x
- SHA256 587cdc48d51a7732ad2019d0d9099c3d1c50ecbc25083cb607db301422373df1
- MD5 052773dd956bd3c2bfcbfb25ddb71c90
- SHA1 f283366c1452a97275443fd49e7a0bc9197ba23d
- SHA512 f50ef9bffc78398704881ca747d866a0102461adf1d2eec2632237dbb212908b9a0c397f76646fdaae9dbe1737c80bdeca0048645a1d76fdd4b4d19f53796b7c
- TLSH T1D4A001E9A4A93009ED2036C00CC13294188E82A030824A1029C03869A55422AD902296
- MD5 SHA1 SHA512 TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1440 firefox.exe Token: SeDebugPrivilege 1440 firefox.exe Token: SeDebugPrivilege 1440 firefox.exe Token: SeDebugPrivilege 1440 firefox.exe Token: SeDebugPrivilege 1440 firefox.exe Token: SeDebugPrivilege 1440 firefox.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1440 firefox.exe 1440 firefox.exe 1440 firefox.exe 1440 firefox.exe 1440 firefox.exe 1440 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1440 firefox.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1440 4792 firefox.exe 82 PID 4792 wrote to memory of 1440 4792 firefox.exe 82 PID 1440 wrote to memory of 1080 1440 firefox.exe 83 PID 1440 wrote to memory of 1080 1440 firefox.exe 83 PID 1440 wrote to memory of 1080 1440 firefox.exe 83 PID 1440 wrote to memory of 3296 1440 firefox.exe 84 PID 1440 wrote to memory of 3296 1440 firefox.exe 84 PID 1440 wrote to memory of 3296 1440 firefox.exe 84 PID 1440 wrote to memory of 3296 1440 firefox.exe 84 PID 1440 wrote to memory of 6008 1440 firefox.exe 85 PID 1440 wrote to memory of 6008 1440 firefox.exe 85 PID 1440 wrote to memory of 6008 1440 firefox.exe 85 PID 1440 wrote to memory of 6008 1440 firefox.exe 85 PID 1440 wrote to memory of 1140 1440 firefox.exe 86 PID 1440 wrote to memory of 1140 1440 firefox.exe 86 PID 1440 wrote to memory of 1140 1440 firefox.exe 86 PID 1440 wrote to memory of 2068 1440 firefox.exe 87 PID 1440 wrote to memory of 2068 1440 firefox.exe 87 PID 1440 wrote to memory of 2068 1440 firefox.exe 87 PID 1440 wrote to memory of 2068 1440 firefox.exe 87 PID 1440 wrote to memory of 2628 1440 firefox.exe 89 PID 1440 wrote to memory of 2628 1440 firefox.exe 89 PID 1440 wrote to memory of 2628 1440 firefox.exe 89 PID 1440 wrote to memory of 2628 1440 firefox.exe 89 PID 1440 wrote to memory of 824 1440 firefox.exe 90 PID 1440 wrote to memory of 824 1440 firefox.exe 90 PID 1440 wrote to memory of 824 1440 firefox.exe 90 PID 1440 wrote to memory of 824 1440 firefox.exe 90 PID 1440 wrote to memory of 3924 1440 firefox.exe 91 PID 1440 wrote to memory of 3924 1440 firefox.exe 91 PID 1440 wrote to memory of 3924 1440 firefox.exe 91 PID 1440 wrote to memory of 3924 1440 firefox.exe 91 PID 1440 wrote to memory of 5940 1440 firefox.exe 92 PID 1440 wrote to memory of 5940 1440 firefox.exe 92 PID 1440 wrote to memory of 5940 1440 firefox.exe 92 PID 1440 wrote to memory of 5940 1440 firefox.exe 92 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\In Stars and Time\www\supertoolsengine.html"1⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\In Stars and Time\www\supertoolsengine.html"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27100 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {36552660-ab32-48d5-b0b8-dba91eca7394} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:1080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27136 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {2ee715a6-109e-4307-8c59-35d67347b013} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:3296
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3004 -prefsLen 27277 -prefMapHandle 3124 -prefMapSize 270279 -jsInitHandle 2920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2804 -initialChannelId {699bcf21-dbe4-49a8-92a5-eeb4826f33a5} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:6008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3036 -prefsLen 27277 -prefMapHandle 1644 -prefMapSize 270279 -ipcHandle 3084 -initialChannelId {86bd5b7e-173d-4f3e-8962-9784ca57888b} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:1140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4316 -prefsLen 34776 -prefMapHandle 4320 -prefMapSize 270279 -jsInitHandle 4324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4332 -initialChannelId {9181da8b-46f1-40be-b29e-639200c25f6c} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2068
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 34906 -prefMapHandle 4964 -prefMapSize 270279 -ipcHandle 3308 -initialChannelId {f4bdc78b-3c63-478a-a286-aed0517a3b33} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:2628
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5056 -prefsLen 32793 -prefMapHandle 5060 -prefMapSize 270279 -jsInitHandle 5064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5072 -initialChannelId {4141e9ac-23a9-4898-866f-f76f8ad034a1} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32793 -prefMapHandle 5108 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {bebd2b39-a1bd-4c17-98a7-7b567dc96de7} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:3924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32845 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {0f56256a-9e62-43dc-a4e5-4a5064108554} -parentPid 1440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1440" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:5940
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3zb4vddp.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 5072a474f872ab176ec34de5fbf395905088a781df612b7a1337924b3d0effef
- MD5 126347dc696709d96ec3bbd6d44d006a
- SHA1 00948825938650b62baa89e7e950ab3d3db16ef5
- SHA512 e5b4e52cbc8c92dc70d720ca46309c3bcc939e3ce443779865c3d80291db7bbc2ade6f0af00c9750667ada9b043d90a2d8f25df54bf210ffd79d1acaaeafdf02
- SSDEEP 768:wyKPd1RvXjWlqDnqFR511uiq5J+vbbHSOOr8GObKO+GN7vjJmNg:rKV1A2nqF7zuH5Ji3jGObK/GdvX
- TLSH T11473F8A3E6E8B1FB1BD137DB1C0FB95B62D10145E34606C9FCE9C91C81CD664123A6A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3zb4vddp.default-release\cache2\doomed\3081
- Size 89B
- SHA256 1d89263452f17e00661441be202c4b36d3524b2804d30d8eee221daafcccec76
- MD5 f30ea62710cf8b835b43c64dc78582b9
- SHA1 a166bf0924a88cf79c77bc0ff5224901c9066128
- SHA512 acd91b8b87a87076fdfe4c073eb722b4c4c0730a2e87e9fd85de62a345d94c5189355ce0ccc859363adff68b8c36e798cdff59ec26036af87929d5bb61f50259
- TLSH T1CBB012538D60E011EA4010F10961610E1086340C4A4BB687599C236550253E124401C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3zb4vddp.default-release\cache2\doomed\9944
- Size 122B
- SHA256 a371cc556038584da028f0d5bd40a8d0202ac3a5fb9784d0aae9f3859f32023a
- MD5 a9fb52ca6aef954115cd028a4ee66307
- SHA1 9f8052dbb07fadcba0b92f3cd023253bb0a6cc24
- SHA512 eeec34dad756d675b67827395e51bac3616141eeae49cf0ad02a5afa4cf4fcc754a40b394f15674c5c0006d62eae7fe737d7f16037d442f8332e45c98595fbbf
- TLSH T164B092B309C3D666E68612F96D30840D2C87370A4AAE680A76A89BD6000CEE666865E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3zb4vddp.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 e7df582f2a44b0d9d2ebc94f0fc247e52df3102721f501d56359ecdbd8175b99
- MD5 31162a97b06a209e1d96c44ea01ca5f4
- SHA1 53950277d258e0a37a5486d04342090b4db193ae
- SHA512 d501a3c73b08587552bb0d25a33420206084ff97042ad02200d192284743a7f1b6108f3bc819ca8896155127d4f90a99800daf6f988e102a1bc57f91f8156faf
- SSDEEP 1536:jTrli6c7zDQ3BU6d0v3+fAPzRCYZZ4+wqZO6OnC2MOsC9rf1p8X8rDyk7iYcNgLJ:j3l3U6d4dWgZNQrFBcX83yEmANQk1
- TLSH T17DB39FF6DBA2CD3964FFD42CAA82843EFD266414F3E73009C9537710A1C6BB46679249
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 7KB
- SHA256 d58cf79315a9970a80a8422607908781d787d6ca26d13f28de092d3e8a1d200d
- MD5 ad4e339de5fa0d694d42b06bcb9bcb91
- SHA1 fdf6d528891131042c174b6716f5d60b68f04022
- SHA512 4978815ce8848448fca44e4a9b04188c39e6083788f3b805d60da447a12d71c510e67da95990e2e73363e6d30335f03cde8d2434d065a05d86358746b972add4
- SSDEEP 96:GQt+ZQ/A+hQ/w+sQzuH/bBuH/bG+/uH/bj:GQQQbQ/+QzwlwLwv
- TLSH T185F1DA015BFB0995F8F786363A326B536333FE010B0A526EC185A346497276895EDFE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\crashes\store.json.mozlz4
- Size 66B
- SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
- MD5 a6338865eb252d0ef8fcf11fa9af3f0d
- SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
- SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
- TLSH T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 559e3462ce540c5692dcb96d21234327f2abd723e721609ab4779100a358b4aa
- MD5 723e534fbcdaec0b7870a4f302e8b1cd
- SHA1 908676c552b1e3596c0f518edf16360a3207be16
- SHA512 77ff97a34da21f2396546f6d24a65e6932daea807db12a22c4979a1fc191cfd974b7109a335d681cab06b036642ce9c5a8c7993f8f74de6c15f6d7fb6539e272
- SSDEEP 192:VOv5zboBZJnyjBe6c1d66Joz1zgCl6mc0dz:KboBZJnyjKd66Joz1zgC1jd
- TLSH T184D1CA58E729853BC448037BCCB61B404F35389A988E3F2972DC655C2D5B2DE7A8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 4561f5737a48d0de0575744c2a0fe4a54b8e10e4f88e7b4f1248f2124c5af2e9
- MD5 940b6db5b2a447a68bdd1e917f9599d6
- SHA1 0720e2eea46653c6cc97bcbf8992a4632a1ff2bf
- SHA512 7c59e6c428f337aae1244776534c4ea458f8cb9f7f25b57867472592e804891c2dc62cadd9ec1d80d156cf569322d1d7da0640344ac8d64a2faf9824ed9821f1
- SSDEEP 192:ROv5zboAyJnyjPx76c1d66Joz1zgCl6mc0d:OboxJnyjvd66Joz1zgC1j
- TLSH T1E7E1EC58E329853BC414037BCCA61B404F39389A988E3F1972DC645C2D573DD7A8E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 f19582cb075173d66d79d87af0b1cec4a1fd21c2ee913b0edabb12ea379bbbe8
- MD5 7d2d98ece057e984f7e6b5f2f4d116c3
- SHA1 87f384024ea1ccfe151d32d00bacdeb088f561c7
- SHA512 6f3329c1f932454afc91dacfea7ba4617b794c7d981134411c77324cb5ab8d5a9beb98bde9db1d84c8492b17e94148d3339f5ff02b610727cd98d932954dd854
- SSDEEP 96:JSdF95/7bkW6BrvEJnyUR6GWZfFt02uUQWkc/dd66Joz1zgClKtmc0d/U:JOv5zboBMJnyjB76c1d66Joz1zgCl6m5
- TLSH T1EDC1C968E728463BC448033BCCB61B404F353896988E3F1972DC655C2D5B2DE7A8D1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 83b615c0133ada3de70290819f7492f0c8b394f8231ba55254633a593b1abf3f
- MD5 069d791a96011f93d19360d6fc6ea2ff
- SHA1 d90dce1b3d3502d62ae0f55d171bcb7530591eed
- SHA512 85ea5019c58392f42d8fb1688a2f652454d5a720ff8b24cf95ba3cbe6a524e73160a627a13ad3b600b624582391c6adad369e0d8c49b8e5d57cbc87380cac6a7
- TLSH T10C21675C39FC4D6ADC87EAAC7452028E93118A4B44872C470D12DE8ECD91ADE32AE43E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\pending_pings\3bfebee5-a2e8-4e9f-8557-f91d8a9841d1
- Size 235B
- SHA256 d3d591dd1149a1dff4d6ab0fd74f2a4e342a6934ac8832c6190e937fcced496f
- MD5 1d4fd719d4df7eacb93a289c01db120e
- SHA1 5af1cc176986eacc4a8a3e6b0c588abd782bde9b
- SHA512 1be70a08d2fc31b65fafff62a09de0abe57081946663063682bef50fec55bc31d04e1cc7fd95af990b887b26d21fb1bbc028502ab9877b174c5d279150039eec
- TLSH T104D097E46898639D08041F42F0A1A9EA3084CC3324B56830CA9009B5AAF8ECC015280A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\pending_pings\63027a4b-05f7-45f9-b67e-237d548bdd8d
- Size 15KB
- SHA256 082f540180bda951258f5cc20da800300eaf76b6c6bf2395f06a1a94bcfa6dbd
- MD5 f9b01959b3085c4ecaed05961ebce949
- SHA1 fe02a5d8cfafc169d250b58334ff169e8150f69a
- SHA512 1ca2ca2c0e2eb5f2a60f17f44286ee9cfd9079f2b393780e5ec4feddf0cb8864d8af378773c7d9a00555f8516862afc3ff55620eb439e0fac7bf6bf0c6909738
- SSDEEP 192:3WDHNzxR5ONOLduYy+8zo19Bl73mnD9f3FCk/pBBMfCmZ1p/7PliWnkS38+Rxq:GDHNlRQNOLdu7B8ID9/Frh6PQS7y
- TLSH T15172D956246049BA8651E3A8D8FCBFC3E5F528CF4C418FCA9BE4BD085DDE06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\pending_pings\974ebe8f-4da8-41ff-9baa-4b4d1a5032b2
- Size 883B
- SHA256 2209afc8aaa6cacf349d7ea39ec46d6ff7b49211b0015c40bf98a6eb9aeb672b
- MD5 77029aac0aa95c54e3ff8062bcfd0be0
- SHA1 ca9c47ee152871d269dc63659b5f97ba24ca4c3d
- SHA512 b3c8cc3ae7195a25a355a305f2e82b2a6b4fc4dc53b5a7036605e9121602ad256019f1f41f0bbad0a22ed8d5d154f67d9830774e156778a13c97195325fdf5d2
- TLSH T1B01100C1A7B178B2CC28C34BC9A5371A97A8346380C984083EA44E184D7F91EA36664B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\pending_pings\cc0060a5-6d0f-45d1-b8d9-b1e85f25e13b
- Size 235B
- SHA256 f8dd25b5f6776fd794c32749a39bd4d74563fd6e171d30c5c37b4bfeeb471869
- MD5 ef37063de66ddbf17cd599db4af6fa66
- SHA1 cd5e1bb1aa190c874986c52be7e5491f8ca2e0f8
- SHA512 d07a2b3bc693bae280ed4cdf4e500d661510b1752c327ec1f43185f193e9362d899f1b574371ff9766c0227405795f1bbdd26d63a9d01a792d115cd9a3ae2a28
- TLSH T1E8D0238128EC3B7D9C004F13F0E028CA30884C3311B4BC90C65000B4DEFDDC44161C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\pending_pings\e02e45ae-6af9-4fcd-b4da-b1d74cf89cc0
- Size 2KB
- SHA256 a3554a923074c390832ae2c906219fe6c8b5d7dcd4d0a7f0a4c02f874befdd3c
- MD5 5b7912368a9e69833716c5f9d3559db4
- SHA1 52440941b365227ccb96e599ff1be3e34242fa67
- SHA512 81191458c114969a29d8902297bb440fc6300343d4f3e4ab4ce658e9ecd3efeabca24295e50f40914c0e1176646c5b2f10bc4baee271aaddfa5d61914f8bd636
- TLSH T1224110ACB6B84C779CCBE28C9592234E93A44E5340861C937E51DF0CCD9765D236A41A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\datareporting\glean\pending_pings\f16b30dd-e695-4dc5-985a-5bee924f0627
- Size 886B
- SHA256 632465bbf257e6490623bc43dd4db6ee35a704edb6a477a482ce4c1202a4e5ed
- MD5 dd38618f935107172921112cfbbbae37
- SHA1 1d1e9caaee501f1480ca430f8bbabcbb7d0ca152
- SHA512 b7d93d23aab0f55e5468f4856cc385fa8242908352deeed3dbe49b7898c8960ef8c2f836310dfb4c52c7a85ce30b36a6b190a78f6a75073001311c64f3b8174b
- TLSH T1591144C047B0B8B2CC28C38B85B5B74693A4302380C94C08BE544F284CBB15E635620F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\extensions.json
- Size 14KB
- SHA256 2136c7ecb87e57531d0965eebc97a199ce0e68d1c01ec8729205e4496c020b6a
- MD5 e1cc0c29c0011710d8cb0f459945ccd9
- SHA1 f7deb59b93591f399143870b4020709eaa9bb91b
- SHA512 b442d00f27f74d095cc9b143775bf38a7f6aa3fa50d784135fb94db9921b43820b1a5ca8cc86a294ea4d3fcf6da7e3fe204bf0867c6386ac283ce36ad1132edb
- SSDEEP 384:QkI4v3UmldvY8dhW394zZ96orsL4HlL4PgL4H7L4H8L4HC:XI4vRfBXW4z6t4l464H424i
- TLSH T15C62422545148EB8294FA79BAA36BE01C37D473B70445C78F4DD8FC842FA5B902BB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\prefs.js
- Size 7KB
- SHA256 be5a36ce59246a95c14df1a6d607588cb77c8b5edf5242019fa09354c3729053
- MD5 4a122f7085cdc8c9e425ddf296f1d8da
- SHA1 b265861ed4de38f538c9b5b3fcf57650848204a0
- SHA512 4d5229d39c6353fad0d969f4cb9ae7195c50b40c4a3a46ad47fa1a9f203c41781c4c2d909f515bcc5aeab6936c08e6a70c7b147d12642a832b34046753a2c21a
- SSDEEP 96:xHRFIBU4w7TUp8qGqTGfmrmObzSbSSlkdv9jHnuRHF6onuQZX9iBw88P8L4cnBnD:zU/RTGfmrmdSS59I4L4Bw88u
- TLSH T1ABF12E7C9404DB6F74B677ACAC6488315AA2063BB7BF68D700B954C5051CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\prefs.js
- Size 6KB
- SHA256 6c8917aaac07be9a8e411114beeb9ae77fe0a5129a690f6f86e86868c34b7c4e
- MD5 551bf7c6169e9f2632a645a433481844
- SHA1 e9dd258e0429433ab4395fc72139dff7ed4e3372
- SHA512 ea1eb9601617134a3ee93e449673d3f1024320aab941c71cdc35d2ed69072cfec32374bbc542f942d7c943e76b80850a2729377c28db583a3aae66ecd33bcce2
- SSDEEP 96:xHRUTUp8qGqTGfm9O1zS6SSlkdv9jHnuRHF6oVBw88P8L4cnBnD:zZ/RTGfm9OXSS59I4Bw88u
- TLSH T1EFE1307890488F6F74B6776CAC688C31AAB2013BB7BF68D750B55485054CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\prefs.js
- Size 6KB
- SHA256 f5a4f56ac0a3d1dc26b2d95c3b4b72f210265ba4fbea677c9712a1e39ee67d2b
- MD5 cd397cca38cd9531e29c968a2accce45
- SHA1 1d1419c5fd0279824bd4b086c106a15bb5f6da8b
- SHA512 f17c434d51103e9732248aa3150381e0e849d7ac4aa8a6175a4027de1d6e776f333ddefd565388dc96cecda122c7568173b4b495dad56d574e9dd19badfcba03
- SSDEEP 96:xHRUTUp8qGqTGfmrm1zSbSSlkdv9jHnuRHF6oVBw88P8L4cnBnD:zZ/RTGfmrm2SS59I4Bw88u
- TLSH T163E1307890488B6F64B6776CBC688C31AAB2013B7BBF68D650B55485050CF3846F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\prefs.js
- Size 6KB
- SHA256 b5691eaf8a2bb93822c2c645506401557b55d748bf01f7b78b5195a2f27e04c1
- MD5 110b93c4c4a24f317db719ecf6369be9
- SHA1 e7a27fbc73a1c07c65fbf308b86e3c06b1ec3422
- SHA512 d4ddc5c97307c799b43de6741ae3cfe1ad75d29147fdbe4c46818179e2549b3d74013d8c6c9e0bbcb4dbf6ce92617da71c40de633ac83a41e5f69882540e6545
- SSDEEP 96:xHRUTUp8qGqTGfm9O1zSbSSlkdv9jHnuRHF6oVBw88P8L4cnBnD:zZ/RTGfm9O2SS59I4Bw88u
- TLSH T15FE12F7890488F6F64B6776CAC688C31AAB2013BB7BF68D750B55485054CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\prefs.js
- Size 6KB
- SHA256 8c0f7297ac111b4982e9134d1a3851876f710ad24550c692ac7206d7a8ad5c2c
- MD5 ee58d2a6b807c067e3996e4cc9d09c0b
- SHA1 c9e07f0d6b951edc219aa70f0a3b46edac04523b
- SHA512 a29426b3615d84348f018ba8700141bdd696520f9cd410dde8145b447bf18e39ee632fac681fcd81762520dbdbc0b1ea882f9c3c4af0af5e6f2e8dd4805e6c9e
- SSDEEP 96:xHRUTUp8qGqTGfmrmObzSbSSlkdv9jHnuRHF6oVBw88P8L4cnBnD:zZ/RTGfmrmdSS59I4Bw88u
- TLSH T11DE1307890488B6F64B6776CBC688C31AAB2013B7BBF68D750B554C4054CF3846F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\sessionCheckpoints.json
- Size 53B
- SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
- MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
- SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
- SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
- TLSH T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 4b6819a834023ce6f831a0fa439bb62d3676d9b7110161ec5dc11bd3b6918768
- MD5 dc5f285b8ad8ae2dd3a8a6f88146c92d
- SHA1 8d9b854d7600298900c568b7ac2488510395aafa
- SHA512 6aec9147b9c3f942c86a156033edf17ebf50b1b062cd7709ceac1c856d5e33545503bfa92957fd1d08d785b6a497a5b88949151384fa1b4549e737c00d701565
- TLSH T191210BCBEDAB3FF7BB62D36284C64FF8C3993064892584E4C54A4F01154E54D37CA216
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 cb3845aec9e68dac3cbbbb5fd47e34a66c2e8613970c673a67d53edb9abf2df9
- MD5 710a4946b7ef0ab2f4a2222774907ec6
- SHA1 a71bd01b84ed65d82a293fdeedbd89c62edca13a
- SHA512 59ec088be19b97d2717b9d41439127e974356bea4942b50b8e48d030da686a0a74967df144108bcab204f78f1e0896bc7f4edfa44ac8ca1fcc1177978c7172cb
- TLSH T1A0210BCBADAF3FF7BB62D36288C64FF8C3D93064891444E4C1464F01254E94E36CA216
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3zb4vddp.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 aaa8caec03f3a4d6e659b1c139b6348c3782caa69a63df635440d426623a1cde
- MD5 6d4922dbf10856ac221333b584f7489c
- SHA1 c5d5556323bb53bb7710ecb24537d7eab9ac7d48
- SHA512 e9d042564c5ef1b69e034de2b561d6afcda66e86f3207d93126c0a8e512eed476cac91b12ada39e48519faff16195f6870b7d0ec93cc88c93b4bcb1099f001ba
- TLSH T1F971610C961CA4BEA66BC3C0D6447F978BBD053370446458DAFE460C95FB5FB162611B
- MD5 SHA1 SHA512 TLSH