Overview
overview
3Static
static
3In Stars And Time.7z
windows10-ltsc_2021-x64
1In Stars a....dylib
windows10-ltsc_2021-x64
3In Stars a...2.node
windows10-ltsc_2021-x64
3In Stars a...4.node
windows10-ltsc_2021-x64
3In Stars a...4.node
windows10-ltsc_2021-x64
3In Stars a...32.dll
windows10-ltsc_2021-x64
3In Stars a...64.dll
windows10-ltsc_2021-x64
1In Stars a...rks.js
windows10-ltsc_2021-x64
3In Stars a....dylib
windows10-ltsc_2021-x64
3In Stars a...ket.so
windows10-ltsc_2021-x64
3In Stars a...t64.so
windows10-ltsc_2021-x64
3In Stars a....dylib
windows10-ltsc_2021-x64
3In Stars a...api.so
windows10-ltsc_2021-x64
3In Stars a...i64.so
windows10-ltsc_2021-x64
3In Stars a...et.dll
windows10-ltsc_2021-x64
3In Stars a...et.lib
windows10-ltsc_2021-x64
3In Stars a...64.dll
windows10-ltsc_2021-x64
1In Stars a...64.lib
windows10-ltsc_2021-x64
3In Stars a...pi.dll
windows10-ltsc_2021-x64
3In Stars a...pi.lib
windows10-ltsc_2021-x64
3In Stars a...64.dll
windows10-ltsc_2021-x64
1In Stars a...64.lib
windows10-ltsc_2021-x64
3In Stars a...eamcmd
windows10-ltsc_2021-x64
3In Stars a...cmd.sh
windows10-ltsc_2021-x64
3In Stars a...o.webm
windows10-ltsc_2021-x64
1In Stars a...bm.dat
windows10-ltsc_2021-x64
3In Stars a...bm.ivf
windows10-ltsc_2021-x64
3In Stars a...bm.ogg
windows10-ltsc_2021-x64
1In Stars a...e.json
windows10-ltsc_2021-x64
3In Stars a...pgsave
windows10-ltsc_2021-x64
3In Stars a...e.html
windows10-ltsc_2021-x64
1In Stars a...e.html
windows10-ltsc_2021-x64
1Analysis
- max time kernel
300s - max time network
330s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
30/10/2026, 18:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
In Stars And Time.7z
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
In Stars and Time/www/lib/crashhandler.dylib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
In Stars and Time/www/lib/greenworks-linux32.node
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
In Stars and Time/www/lib/greenworks-linux64.node
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral5
Sample
In Stars and Time/www/lib/greenworks-osx64.node
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral6
Sample
In Stars and Time/www/lib/greenworks-win32.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
In Stars and Time/www/lib/greenworks-win64.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
In Stars and Time/www/lib/greenworks.js
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
300 seconds
Behavioral task
behavioral9
Sample
In Stars and Time/www/lib/libsdkencryptedappticket.dylib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral10
Sample
In Stars and Time/www/lib/libsdkencryptedappticket.so
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral11
Sample
In Stars and Time/www/lib/libsdkencryptedappticket64.so
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral12
Sample
In Stars and Time/www/lib/libsteam_api.dylib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral13
Sample
In Stars and Time/www/lib/libsteam_api.so
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral14
Sample
In Stars and Time/www/lib/libsteam_api64.so
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral15
Sample
In Stars and Time/www/lib/sdkencryptedappticket.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
300 seconds
Behavioral task
behavioral16
Sample
In Stars and Time/www/lib/sdkencryptedappticket.lib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral17
Sample
In Stars and Time/www/lib/sdkencryptedappticket64.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
In Stars and Time/www/lib/sdkencryptedappticket64.lib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral19
Sample
In Stars and Time/www/lib/steam_api.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
300 seconds
Behavioral task
behavioral20
Sample
In Stars and Time/www/lib/steam_api.lib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral21
Sample
In Stars and Time/www/lib/steam_api64.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
In Stars and Time/www/lib/steam_api64.lib
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral23
Sample
In Stars and Time/www/lib/steamcmd
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
In Stars and Time/www/lib/steamcmd.sh
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral25
Sample
In Stars and Time/www/movies/Intro.webm
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
5 signatures
300 seconds
Behavioral task
behavioral26
Sample
In Stars and Time/www/movies/Intro.webm.dat
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral27
Sample
In Stars and Time/www/movies/Intro.webm.ivf
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral28
Sample
In Stars and Time/www/movies/Intro.webm.ogg
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
5 signatures
300 seconds
Behavioral task
behavioral29
Sample
In Stars and Time/www/package.json
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral30
Sample
In Stars and Time/www/save/config.rpgsave
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral31
Sample
In Stars and Time/www/supertoolsengine.html
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
7 signatures
300 seconds
Behavioral task
behavioral32
Sample
In Stars and Time/www/translationengine.html
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
7 signatures
300 seconds
General
- Target In Stars and Time/www/translationengine.html
- Size 208B
- Sample261030-xcap6aev8x
- SHA256 d209ac70e2aa60df1d938be78e9c4ea929a584211e3d9a541aea51b7d5dacc3e
- MD5 3423413b2aaabb4a6ae7a8986e4abbf5
- SHA1 4cd8401726498a9ee023ee886b53bcd5cd2a3fac
- SHA512 0596bad40b2b2c2108cb8798b1cd65ad8af838bba4f6b6fc9229aa71e6b3d52b174af720022a84a3f4928e5511f0dd7645a696d1f042e9f4240965b3448c2266
- TLSH T1E1D023FD165663E58C2473825DC1B1D06F4DC59C317304002C91749C918152C9B270D5
- MD5 SHA1 SHA512 TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings firefox.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1816 firefox.exe Token: SeDebugPrivilege 1816 firefox.exe Token: SeDebugPrivilege 1816 firefox.exe Token: SeDebugPrivilege 1816 firefox.exe Token: SeDebugPrivilege 1816 firefox.exe Token: SeDebugPrivilege 1816 firefox.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1816 firefox.exe 1816 firefox.exe 1816 firefox.exe 1816 firefox.exe 1816 firefox.exe 1816 firefox.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1816 firefox.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4804 wrote to memory of 1816 4804 firefox.exe 84 PID 4804 wrote to memory of 1816 4804 firefox.exe 84 PID 1816 wrote to memory of 3836 1816 firefox.exe 85 PID 1816 wrote to memory of 3836 1816 firefox.exe 85 PID 1816 wrote to memory of 3836 1816 firefox.exe 85 PID 1816 wrote to memory of 1100 1816 firefox.exe 86 PID 1816 wrote to memory of 1100 1816 firefox.exe 86 PID 1816 wrote to memory of 1100 1816 firefox.exe 86 PID 1816 wrote to memory of 1100 1816 firefox.exe 86 PID 1816 wrote to memory of 3620 1816 firefox.exe 87 PID 1816 wrote to memory of 3620 1816 firefox.exe 87 PID 1816 wrote to memory of 3620 1816 firefox.exe 87 PID 1816 wrote to memory of 3620 1816 firefox.exe 87 PID 1816 wrote to memory of 1508 1816 firefox.exe 88 PID 1816 wrote to memory of 1508 1816 firefox.exe 88 PID 1816 wrote to memory of 1508 1816 firefox.exe 88 PID 1816 wrote to memory of 5016 1816 firefox.exe 89 PID 1816 wrote to memory of 5016 1816 firefox.exe 89 PID 1816 wrote to memory of 5016 1816 firefox.exe 89 PID 1816 wrote to memory of 5016 1816 firefox.exe 89 PID 1816 wrote to memory of 1900 1816 firefox.exe 90 PID 1816 wrote to memory of 1900 1816 firefox.exe 90 PID 1816 wrote to memory of 1900 1816 firefox.exe 90 PID 1816 wrote to memory of 1900 1816 firefox.exe 90 PID 1816 wrote to memory of 1160 1816 firefox.exe 91 PID 1816 wrote to memory of 1160 1816 firefox.exe 91 PID 1816 wrote to memory of 1160 1816 firefox.exe 91 PID 1816 wrote to memory of 1160 1816 firefox.exe 91 PID 1816 wrote to memory of 1468 1816 firefox.exe 92 PID 1816 wrote to memory of 1468 1816 firefox.exe 92 PID 1816 wrote to memory of 1468 1816 firefox.exe 92 PID 1816 wrote to memory of 1468 1816 firefox.exe 92 PID 1816 wrote to memory of 1336 1816 firefox.exe 93 PID 1816 wrote to memory of 1336 1816 firefox.exe 93 PID 1816 wrote to memory of 1336 1816 firefox.exe 93 PID 1816 wrote to memory of 1336 1816 firefox.exe 93 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\In Stars and Time\www\translationengine.html"1⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\In Stars and Time\www\translationengine.html"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27100 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {72fa05c5-94a9-400b-89f9-945a368a680a} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:3836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27136 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2516 -initialChannelId {bbb6d95a-28cd-4372-b8b9-6603fe5a1a1c} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:1100
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 27277 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {a6633efc-8b41-4242-b40b-f9c7a50d4b3f} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:3620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4068 -prefsLen 27277 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {8a5f5405-9c5e-4fc7-a4d8-9d6a56c22a80} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:1508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34776 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4376 -initialChannelId {5569ea1e-86fe-454a-8035-b52e40135071} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:5016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4920 -prefsLen 34906 -prefMapHandle 4996 -prefMapSize 270279 -ipcHandle 2756 -initialChannelId {b2059d09-0c8e-4181-88ed-4cbcddc80fcf} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:1900
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32793 -prefMapHandle 5108 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5056 -initialChannelId {835d40ee-2ced-4282-a1b8-03a695ac6dee} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:1160
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32793 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {c269bf83-57f3-483d-a5f6-ae1440020036} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:1468
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32845 -prefMapHandle 5620 -prefMapSize 270279 -jsInitHandle 5624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {b33bb8de-6b19-4c1c-9a2f-059f2813a150} -parentPid 1816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:1336
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\activity-stream.discovery_stream.json
- Size 74KB
- SHA256 dcb1eb246d8fa22a5d8e723e8afd29f9ca4ea649dd030b06c931584617002ffe
- MD5 e5ee89267bbef28b90c7bcbe44bb932d
- SHA1 9ea15aec3076ac68c7012689dbde27e4a188d256
- SHA512 b926aa802c82bd11befd123cb7999b5201ebc393e7b4101b997079153cec6f6b53466c2aa3d4906442091235a4ecf85ede0b7a008a26faef2d77e3d681d07e9f
- SSDEEP 768:lyIq6DuKsB32516tTs8PByiQOOk7fAr1OOrdkfi+GbCLsslJmb9:EIlyB3mctTs8JymOMfAIfDGbCna
- TLSH T13F73F9E3E6A9B1BB1FA137C72C0BB95762E20155E74606C8FCEDC91C81CD654023A6BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\cache2\doomed\26317
- Size 122B
- SHA256 c7484902a5ae9d36d5bc6d8dcd7bae8da0d09860c739afaf40ce55bce5e4dc76
- MD5 1656f6d1ea7e5c153f4a48929555cfcd
- SHA1 a8e8e0cc1b05b8e222d4e6849057c58be0551ce7
- SHA512 d98559524dd5e3e27d47872bd0e678e0f4f06f762aa13fe21511e3362c183a99fcd31eb3617dc91bc28ca06f42d4fe5f46d5fe988b92bca631179745c637eaec
- TLSH T142B092B209838A6ADA8511F97E30A41D2C86370A4D6E644AB5A4ABD20409EA2A6852E5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\cache2\doomed\26766
- Size 89B
- SHA256 e49866d639ded5abb5d335d9be32b2685fcd07b99a346321c52f69aa10232e50
- MD5 8552c02f8914610e120a44cbfd40790c
- SHA1 89311e67d1454f5b3523da038c5395328193c728
- SHA512 cf1a387747441a9d3a8e244d111c8cceb07f6c12b9c9a86c0ae84ffc85b78c8fc4625fc06b87c06dfb37afeb9e4ff86df0784f8939e86a5b33c6b8b4274423a9
- TLSH T12CB012634D30C400D64010F02E70700E100531084D4BA18398BC33E900103A264503C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 0a68f786ee66e46591375900b5b544809b148e0f8fb847e8776742bcb92efe11
- MD5 40216ed139b16ab6e6fcf7c7c3e91804
- SHA1 e2fddb5eb5455a7f6f72da8d740f199eeada59ae
- SHA512 28ef7b2ae69df750535ca33349c4f3aa4b825e65ea127caa20b34f40a939919ab678ae17836e84e40be643f4181b7877159fc32885c099298cf8dd6d07ac4804
- SSDEEP 1536:jTrliqi1oDq2bKv97uuwsbjp/NTk3a4/w+oYQbLwgcCLc4Q5/Fnzp3HAe9RlRcOo:j3lI8Kv9k+1aqGwYiTccIFzRJSUN9hZY
- TLSH T189B3A0F6DBA2CD3D65FFD41D6B82893EF9172400B3A73408C923671562C6BB87639248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
- Size 7KB
- SHA256 e5bb398540e0740ebe72a10c03414f5ace9dd9b067bcb546cfe79591b4aae2f1
- MD5 77e833e93d4e96837750a3d81f500aed
- SHA1 c1cc46652c3b1a43af15ff74c2033c680101c68b
- SHA512 2a1f32c1707bca6a5b06ce916bf93cd37f082f6b449369de396fb1cf1ef62a8853445fcd79e6da449e58e645286cf8042adecd1dc6c67b5c05d5afa2c19f3d42
- SSDEEP 48:+dlcFdudJ5Ugdwx8E86z7dlcOdudJ/6Bdwx8E8G7dlcUdudJ/adwx8E8Ufjdlc36:sFZFew/SFIe/CFaHMuH/zuH/rFmuH/c
- TLSH T15CF1CE024BFA0996F8F3973936327B436B73FC011A16565DC1C2B24845367249AADFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\crashes\store.json.mozlz4
- Size 66B
- SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
- MD5 a6338865eb252d0ef8fcf11fa9af3f0d
- SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
- SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
- TLSH T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 e5d1cfd004f9c5a52d2ea08f8d4ec07a62a701129f60c5ea187d5e8035a9181c
- MD5 a2fc7ae245771c8228a3210cb6772d2f
- SHA1 49e1001b9b7246e47f52b511888921c14c65396a
- SHA512 37e7b3a8a3d4e812617f51c4045a43bd5f1e10ae0e4c8246a88733204170498b8fe0e1c665ea3e2f9b272daa920cc42bca53863efbca12213b5104030b328f19
- SSDEEP 192:dOv5zboWbZxyjn61d66Joz1zgCl6mc0dz:SboWbZxyjkd66Joz1zgC1jd
- TLSH T1F5D1CB28E628863BC418433BCCB65F400F76789A985E3F59329C654C2C5B2DE7B8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 65e3d44b510b83b94fc368a7a165e9874fc79b54b8fb04d488658f1a8ec71c2e
- MD5 48d3bfdeacfd2c2da99f05e74d70ef0c
- SHA1 045011548a452bb564905f1e983b19d505cec510
- SHA512 ae03e60100f2f056367ed0f61b133a425dfbd97c9c844359e78bcb1c2ce99f8ab9827724f794e19dcfa1a480a63144e6146f706c09c3b7b55a92e9290ff9f867
- SSDEEP 192:HOv5zboAOZZxyjnV1d66Joz1zgCl6mc0d:4boPZZxyjTd66Joz1zgC1j
- TLSH T147D1DD18E628863BC418033BDCB65F400F76789A984E2F69359C654C2C572DE7B8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 d64304dff5f9fa79f24693800d3c674156bbc36e971bdf37506b92eb3c6d3d51
- MD5 67f0c5506eddd092d7296087592f0fd6
- SHA1 6ffb3a2c685a5bc0389c326739de5b7c78d7a2cb
- SHA512 50649da109da1325b23fe198f4266c3a2ecdc9cda7dfca0a9a54c7e7450e60fd4ba4beda046912133be42cf0deb9c42c6eeffa418e59871544937c5add17f12c
- SSDEEP 192:c1d66Joz1zgCl6mc0dgOv5zboAcZxyjZxI:Gd66Joz1zgC1jZbojZxyjU
- TLSH T1D2E1DC58E628863BC418033BCCB65F400F76789A984E2F69369C655C2C572DD7B8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 cb9e3ada8c13a4461a5351b8c2c5a1b929b1fcc52a4afd1074da2c2a94a4b2ce
- MD5 02e6933ccb00372a4f4c7bceaed3c458
- SHA1 3e0c70f5c8ff6abd52ae37acba19ab49f7e828b6
- SHA512 a0cde1a2929302b123385072fd67ed6519af8699c4b6202d5be507d581d231dc3eb8b0f1f89b9e1e032ddb12d603fedfd83dee8aac2bfbd8557d3c787ace91a6
- TLSH T126214C5C3EF84D2A69C7E6BC7441028E93518E0A048B1D434D66EFCECE81AD932AE539
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\51835edf-7d68-4e5f-978e-ff6fe8b4dfa3
- Size 883B
- SHA256 4cf4d675a58b1e1eb967171029c8764959a9dd9bb476726bf2c45363160db583
- MD5 fba1cffb78dd66dfab0b5bf085324c7c
- SHA1 46727ee8abc29fa595134a275c3aa82225c3e9c4
- SHA512 527692ec78a07584f71140d91bc9dfbec8ef28a4013bedb8745935a229618f76b491145734348a1ec7948999aa5f28f54f0e0b177308c4ae3b55b3ba3e73ed4c
- TLSH T1FD1100849674B9B3CD3C930B89617B0257E8782380C980543DB54F180C7A91DE366607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\6e58d715-875c-491c-a0b2-9869e37e8844
- Size 15KB
- SHA256 135e9e3a1ba095b57e8045eb61eae7ae8b9bebdb96c8d274d4ed10e08746568e
- MD5 382097d954ebe5bc2aa15776f9ebd215
- SHA1 f5a677dd5ff80c79a8fd4f7adfd62a30c02f33e0
- SHA512 8eabcdd93e168ec6160824ea7efe1d1158a0c15a28e073b561ae732934dfea18311f81adcd2b367a2d049f3a14dfe393d1af6e82a8f9ed571d081831c4bf9816
- SSDEEP 192:x7qkTKCMowN8IT1HCBSBqPAqVLS8bqpzERfyAS/Jm6N7xFonqFr4EMSdAv77eHE/:0SKCeN8oCcIAqVLS8bG4ReDVdDHIx
- TLSH T1D872B8562860497A8251E36998FCBFC3F1F538CF4C419FCA9BE4BE085DDA06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\b91bbcc7-b848-44f4-93bb-2b61a17f7f4a
- Size 886B
- SHA256 27e33180a37c34fb9053b3f42082d894c931b30c9a880450084dc22a4a2a1a6a
- MD5 3a41a01b37f8c86faecf66e7053749f6
- SHA1 bcdd0970d5b7601aa63589e79e3a092d7b9d689d
- SHA512 2457d11f11cf9bb4e39aed6788f3bf8ed6fa26ccb9de148cfbe7128ab29d95a5fe184206ceb029fe6739c66f236c15cd0bad6946fe2cd8ce4675bc272fa69cc6
- TLSH T12B1100859A34B9B3CC3C834B89E2BB424BE8B42380C909587E654F080CBE65EB356607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\c24d6b66-d43d-4d3e-b572-7695c75c782c
- Size 235B
- SHA256 86d3d105e225287c02d193a4af907130b9ab4097dd789176623e6fde5e59873a
- MD5 816cf47ab368d1ffaad3acc10e231bd4
- SHA1 efb6ab2d70e0d8d41bc8ff32680048c319ef0740
- SHA512 edcb551c5da37317db56b3d57d6dd08f31296dc3021e6428d8ba637e316d0b2f9461025f0f0fdf41017a69cd289075c236ac8f17b389c716d65c023868e3048e
- TLSH T17AD097802888A76D08040F03F0A06DC63145CC3328A45820C6A18A78EAF99C881A2897
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\fda85ba6-56d6-4338-9172-782659276123
- Size 2KB
- SHA256 7bcf0cffe490b54967c39b5f91a1e370ae283956f6a4a1ac705ffaa954a9693f
- MD5 e64fb1c11fe453a07dc646b9b9702afa
- SHA1 8c0a0abbd91eda22c5ea13549f9926153c1ee708
- SHA512 526cceaa3b9d106fe71af71b38ea18a525c0002338c955c6e6fffd1a1bf3cde8b82c41f26805040d4acb8adf98a6770016a0987c3fc058ce33a9c4554d133f21
- TLSH T1FA41449C75F85D7B8C8BF65D94A2238E53A08E1310C72C836E51DF0CCD9669D336A527
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\fdfc66d2-ed50-4553-adc2-99d9fbb0552f
- Size 235B
- SHA256 2d27ca8cc3f169b23a50f2fd1b7b3fb1922279e7cf4c9c6f62f5a1aa76c5b6ab
- MD5 3d33f391ff331fefb39f0b6324b56414
- SHA1 55a5322e67447b5896bde66e74582547db677fca
- SHA512 c52dc08eebfe680d8e2f9d0525bf7207a7d3ecaf3f9c82c500388d89ee9ddff61783524b197dfe86493353b00a1f3a7e6deb3db641a7f5b92fa86cc5f6361543
- TLSH T105D097802898639D0C248F07B1F06AC638D48C332060B860D69044B88ABEDC44161807
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\extensions.json
- Size 14KB
- SHA256 2bb61e94d1ca10f52bf1d8d6cdfe9534755fc55cadbbf06b7221fe83e1c96725
- MD5 ad358bf4985e4ce37df55bdc75f0a841
- SHA1 76f1fe25283c97de7e765c5b26c5da07372a2168
- SHA512 2e4594e4f48509bee52a4c9a0a3c885ea1fc5a1f2b83339073becce0b536ed491a50c50d74245af5f65c375bbd47243bbaf9fc75d664381352a81168217296fd
- SSDEEP 384:ykI4vxUmldv68dhWT94zh96o7L4HuL4PctL4HHL4HYL4HC:FI45RffXe4T6Q404Et4L4a4i
- TLSH T12662421545049EB8294FA79BAA36BE02C37D473B60445C78F4DD8FC842FA5B902FB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
- Size 7KB
- SHA256 63fc5b7332337b01fd880402c882438c09f26489a3cd8187de9de2d27b1609b1
- MD5 20e873c92333a8adfe92818bdf04261a
- SHA1 970b778c0777dac368f183a77ae0f81e8c02d5a6
- SHA512 bfe9cd192efd743ba0c303f211f47e83611435eb2d2f23d7934f9c35ff8f22720c7445979ee8827d7c915c42af3bff0893f8271f04e5fdcbcb8ec19b631e39ed
- SSDEEP 96:xHXtRTUWqGqQrf60fObzSoSSlkdv9j2nEHsdGz0Bw88P8L4cn4i8rB:RtQRcf60fySSOcGz0Bw88Hd
- TLSH T13DF1EB7D94048F6F64B677BCAC6489305AA2013BB7BF68D740BA54C50548F3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
- Size 6KB
- SHA256 9e7aa48d64a13c07165ed37fa460031bbbdf56c66db895e6fb4f70d120b1e4e4
- MD5 b8a0bee799114d58a6ec8db7b8518fbd
- SHA1 50c58778fc70eeabaaadf8f7a8de454375942427
- SHA512 6657bf8eb6c526f398849c6c7e3af79db6d5fd2a30d4830911c12163af11528e9e49d92b0288a4134a36c0d175e50b9e4e982a804ff8b7e44cbee1cd9a1563c1
- SSDEEP 96:xHXtUTUWqGqQrf6Ec1zShSSlkdv9j2nEHsdCBw88P8L4cn4i8rB:RtxRcf6EckSSOcCBw88Hd
- TLSH T1A1E11F7894488F6F74B6776CAC688C319AB2013B7BBF68D750B65484054CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
- Size 6KB
- SHA256 8bcfdf1504e90567b4e82df4b0ada9f46807fd70a993b29f78ea3de6ff48b71a
- MD5 046609e0686a84222cb13cb0566a7f6c
- SHA1 45ed612db5091bbb283a5e95ac58cc7677a0996f
- SHA512 4b0686426253031c8ec1eaf1ae04ad5487b4c095d6ee1819c9b658ac4d9cf5562c98eb5a57b4c5168c722ba225b8fb1f4d6dfbf06105814dca9e78e3b9476454
- SSDEEP 96:xHXtUTUWqGqQrf60f1zSoSSlkdv9j2nEHsdCBw88P8L4cn4i8rB:RtxRcf60fZSSOcCBw88Hd
- TLSH T17EE11F7894488F6F64B6776CAC648C319AB2013B7BBF68D750BA54C4054CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
- Size 6KB
- SHA256 e58c8ca87a77e730b675ad8a0535e524fa6b63a52f09d45598d101afaa6dec77
- MD5 ae209f0ca3de4037fec32d89e21a5709
- SHA1 ced0ccc60f0a8ea1446940f1183e494d3e6539c0
- SHA512 d5725040623ab480240685efa2038c5a7a3bfa7a221afbb62292c91f7ba6e34eb78ed9e29a11a28977ee53b3d50fde252109870c95ed8c25e3ac754c5ef2ec5d
- SSDEEP 96:xHXtUTUWqGqQrf60fObzSoSSlkdv9j2nEHsdCBw88P8L4cn4i8rB:RtxRcf60fySSOcCBw88Hd
- TLSH T144E11F7894488F6F64B6776CAC648C319AB2013B7BBF68D750BA54C4054CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
- Size 6KB
- SHA256 49ba792f23e6346121e7af10a67f29d3b9c2271326fa544b9db57e70ae561170
- MD5 49b395e3ef6be92c26f4438cdb7dac4d
- SHA1 8243297d217707960aad0c2fa13396503b6c8ec1
- SHA512 14ca2a40c4bcd0c44c123ec75adbe458f56b294f97ea6f271f63924f5cd8d1c81b7195e084dc55a416e9bc141e6249b5af6ad9316e5f88221d07b9acd50c33a3
- SSDEEP 96:xHXtUTUWqGqQrf6Ec1zSoSSlkdv9j2nEHsdCBw88P8L4cn4i8rB:RtxRcf6EcZSSOcCBw88Hd
- TLSH T1FAE11F7894488F6F64B6776CAC688C319AB2013B7BBF68D750B65484054CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionCheckpoints.json
- Size 53B
- SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
- MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
- SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
- SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
- TLSH T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 cc918e087657491b1e6ee950a62431f5f897888ba875eeed0785bda0d5e52fd3
- MD5 afa947c59c52d137bc04ec0e23863744
- SHA1 ec847383f5232e8ace81f53bb41638d9d4c72b9f
- SHA512 a01872d1d1acdfb1fe98250041e467ae172dab3d1f649b658ead4f8ddace5ea0feed60f8e433d18510ae77b22a7efb8d4085d382adf320c2e4ed88ce1a77b86c
- TLSH T16121E6C3906B6BB5BB96882E80C48BF98A193835C465A460955A8F46088D89E77C9169
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 d4da526de4f15df5b2f1a7fa3c5c2bd060763879dd1bf7ff4b8f86beb371e811
- MD5 1adf8bc83287a2613f25b50d1be59732
- SHA1 104d94737bd902749b9fd4bbf3eda36dc93871a9
- SHA512 a6059a8250d48fedcee5e8cd9a4d3b15cd33625214c909878ec7b23ed3848391a37f2137f245206bcea3d6a72411d4769b48f875d45b76b1cb6bb904e7ce2731
- TLSH T16D71910C961CA4BEAA6BC3C0D6847F978BBD063370447458DAFE460C85FB5FB122621B
- MD5 SHA1 SHA512 TLSH