Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
orignal.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
orignal.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target orignal.exe
- Size 6.2MB
- Sample261102-bb6wba1y2k
- SHA256 75ac33a708abd64ba72f8bc0672509544640e40ed275bd71b587ebcbc2145285
- MD5 9e449f41cdde8a0be141fc98b7ab7439
- SHA1 eaf7a38a9b91abe04d77fa413da143dac547d5ee
- SHA512 36b8f19c100eac5ad87f25bf24a50929b3c25b9031d8cae076d6d5a73387c0b2168723784ba725ad97fa685f068991b728795bdb0eca3a7ff024a1d7c1a363a7
- SSDEEP 98304:2pm116Fp7Cb3LfG+P46t18frP3wbzWFimaI7dloC:KFp7CrLggbzWFimaI7dlT
- TLSH T17866AE52BE8D8176C91A11311B3DAF6A5229BD247B2855C3B2703F7EDC723D1283A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\orignal.exe /onboot" orignal.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" orignal.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" orignal.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language orignal.exe - Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "orignal.exe" orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} orignal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" orignal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel orignal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" orignal.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} orignal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "orignal.exe" orignal.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM orignal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} orignal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" orignal.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" orignal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" orignal.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" orignal.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" orignal.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} orignal.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" orignal.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ orignal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\orignal.exe" orignal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" orignal.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "305" orignal.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 5060 orignal.exe Token: SeDebugPrivilege 2476 firefox.exe Token: SeDebugPrivilege 2476 firefox.exe Token: SeDebugPrivilege 2476 firefox.exe Token: SeDebugPrivilege 2476 firefox.exe Token: SeDebugPrivilege 2476 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2476 firefox.exe 2476 firefox.exe 2476 firefox.exe 2476 firefox.exe 2476 firefox.exe 2476 firefox.exe 5060 orignal.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5060 orignal.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5060 orignal.exe 5060 orignal.exe 5060 orignal.exe 2476 firefox.exe 5060 orignal.exe 5060 orignal.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 5060 wrote to memory of 4204 5060 orignal.exe 91 PID 5060 wrote to memory of 5764 5060 orignal.exe 92 PID 5764 wrote to memory of 2476 5764 firefox.exe 93 PID 5764 wrote to memory of 2476 5764 firefox.exe 93 PID 2476 wrote to memory of 1140 2476 firefox.exe 94 PID 2476 wrote to memory of 1140 2476 firefox.exe 94 PID 2476 wrote to memory of 1140 2476 firefox.exe 94 PID 2476 wrote to memory of 4992 2476 firefox.exe 95 PID 2476 wrote to memory of 4992 2476 firefox.exe 95 PID 2476 wrote to memory of 4992 2476 firefox.exe 95 PID 2476 wrote to memory of 4992 2476 firefox.exe 95 PID 2476 wrote to memory of 2960 2476 firefox.exe 96 PID 2476 wrote to memory of 2960 2476 firefox.exe 96 PID 2476 wrote to memory of 2960 2476 firefox.exe 96 PID 2476 wrote to memory of 2960 2476 firefox.exe 96 PID 2476 wrote to memory of 4492 2476 firefox.exe 97 PID 2476 wrote to memory of 4492 2476 firefox.exe 97 PID 2476 wrote to memory of 4492 2476 firefox.exe 97 PID 2476 wrote to memory of 5920 2476 firefox.exe 98 PID 2476 wrote to memory of 5920 2476 firefox.exe 98 PID 2476 wrote to memory of 5920 2476 firefox.exe 98 PID 2476 wrote to memory of 5920 2476 firefox.exe 98 PID 2476 wrote to memory of 5284 2476 firefox.exe 99 PID 2476 wrote to memory of 5284 2476 firefox.exe 99 PID 2476 wrote to memory of 5284 2476 firefox.exe 99 PID 2476 wrote to memory of 5284 2476 firefox.exe 99 PID 2476 wrote to memory of 3092 2476 firefox.exe 100 PID 2476 wrote to memory of 3092 2476 firefox.exe 100 PID 2476 wrote to memory of 3092 2476 firefox.exe 100 PID 2476 wrote to memory of 3092 2476 firefox.exe 100 PID 2476 wrote to memory of 4804 2476 firefox.exe 101 PID 2476 wrote to memory of 4804 2476 firefox.exe 101 PID 2476 wrote to memory of 4804 2476 firefox.exe 101 PID 2476 wrote to memory of 4804 2476 firefox.exe 101 PID 2476 wrote to memory of 3208 2476 firefox.exe 102 PID 2476 wrote to memory of 3208 2476 firefox.exe 102 PID 2476 wrote to memory of 3208 2476 firefox.exe 102 PID 2476 wrote to memory of 3208 2476 firefox.exe 102 PID 2476 wrote to memory of 4304 2476 firefox.exe 103 PID 2476 wrote to memory of 4304 2476 firefox.exe 103 PID 2476 wrote to memory of 4304 2476 firefox.exe 103 PID 2476 wrote to memory of 4304 2476 firefox.exe 103 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\orignal.exe"C:\Users\Admin\AppData\Local\Temp\orignal.exe"1⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵PID:4204
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {98970a84-b159-4367-921b-08207ada2a98} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:1140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {1d9698fd-2768-4dbe-bfa2-8d85f9542fc2} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:4992
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3576 -prefsLen 25164 -prefMapHandle 3580 -prefMapSize 270279 -jsInitHandle 3584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3592 -initialChannelId {dc994830-5979-4598-a08c-3f78d58e8e77} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:2960
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3752 -prefsLen 27274 -prefMapHandle 3756 -prefMapSize 270279 -ipcHandle 3720 -initialChannelId {f8630cfb-c77c-4171-bbcf-559228c48989} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:4492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4520 -prefsLen 34773 -prefMapHandle 4524 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4536 -initialChannelId {e3423604-e816-4dec-93c5-71c1924530c1} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:5920
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5152 -prefsLen 35010 -prefMapHandle 5156 -prefMapSize 270279 -ipcHandle 5164 -initialChannelId {1ae33cc3-d96f-4b82-b784-9c2ae6850523} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 35062 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {89745477-7182-44c7-a300-43888e88f41e} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:3092
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4124 -prefsLen 32952 -prefMapHandle 4120 -prefMapSize 270279 -jsInitHandle 4852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2740 -initialChannelId {4320691f-2ee3-45a8-b36d-7b3fcaa64f98} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:4804
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {254d1a7b-a671-4c7b-8faa-2e7670249930} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:3208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5996 -prefsLen 32952 -prefMapHandle 6000 -prefMapSize 270279 -jsInitHandle 6004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6012 -initialChannelId {af990fb0-c34a-439e-bf91-7f5fd5a8823b} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:4304
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\activity-stream.contile.json
- Size 4KB
- SHA256 05d1b089bdf044c66e5180602f600d06fdf96b0434b7ab8fafdae3458ec35c0e
- MD5 880539410a4b95ecf15374d7cb400c04
- SHA1 ed3fc289621346d9104bc58f14541f1775262d5a
- SHA512 ca729e4da9ee26c0454af7f4918d7ce43607b524cf4790eaf333d8ee287b6c118a7162105d3cf6098c85d7db0123a79b29d5c4ba5027d52f38489d0138c8fb46
- SSDEEP 48:YdbA45eDZkyaWM1Fpq3qio2Qnmqp4Je5eDZqyaN1ZsQRsNGjy6T+jiRgQ+nqpNHc:TAkMd9nmcTEZIT+mRB+nYgDAgxlz
- TLSH T1FC91C8BB883054120F75E6F16C0F27A8F107B406A9F08AEC7179AC60D59C7EED0D7988
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 f7f7c754e1c7ed86bf34492f79d05dc0bcab636c5ec93fb3c2a70b1d3967125e
- MD5 5b3b899e3e0b5af175e74772e3850e7b
- SHA1 70703a7183d61efc34c0da9f2073b7043fbf8ca6
- SHA512 0a1b9605e03812f35bc12869b869bac6b39c7dcfb14a407d61292ff4937d888f09c32b836a902aad77a34adb73ddd5f2d94ab740b1278f1d989f7345185e2a3a
- SSDEEP 768:eyT1xH3j1BOkbAEjvXsRuiAi51W+kfOEb+GZp6OOryJmiR:FTPpBOkAEoRuLKg+kfOECG1
- TLSH T1D4731AA3E6E9B2BB1B9037C71C0F795B61D20245E34606CDFCE9C91C81CD6A4523F5AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
- Size 16KB
- SHA256 cab71a170f65ceb0d30fba8112c1a8fd94718cd9d1270a35db91c497c85e86f5
- MD5 dc3a5f4639ee4cd9e9b7659a15aa62bd
- SHA1 455a0c356f96b3bb8bdb70be0c870978436615a0
- SHA512 47cd5d9cda6326495107a67f31ca2c4f493c6ae6b57065a7fed21dd3f4be714449df77d71c7445bc2e0ebe69ab37f537e93dfaaa914b725c9ba0758ff3eef474
- SSDEEP 384:HXwIiO024YPWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAZyt:36ZYPWTToXJWTTogB7S/AmVAf+hRMIyt
- TLSH T102728E7D9F413CAC1757D0E8C8B98355CD1CB2ABDFB5C06D25983D09CA88A1A71F984E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 4f00ddf03c3f6dab39bf65392a8a41ab1218213d514fdb27366c9d554282e0cb
- MD5 a402e40ff722d2558ca9646971a22c18
- SHA1 8c1221876e4c525af702df7cc869d3258ff38fa6
- SHA512 e4d0e90f60fca5f1e9afc7cb00f49dcef6bebf8fbaa45d60b5af9f8ccaa3ffbadc0d43efceb27d0a6c55b63f2f14bc7c2ffbd5e4b4d06ab051d94ed456bb46e9
- SSDEEP 1536:jTrlizlHsDTDy+G9L3VTcBUeLG1ZdGa5o8rPqVY0fXPkN4KNB5jDxYWR7YknxwYb:j3lly+G9dte8jwA9zPlmT803i
- TLSH T1CBA3AFF6DFA28D3D65FFD4286A82843EFD262444B3A73009C923631461C6FB87675688
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 ccd764a595fe3292c2427673e39ac34915d39cfc978db633d18841e1a0b6bb29
- MD5 d519a36900366223721ca7f119c07540
- SHA1 e0b805fee43b15e9f2c3db440d3329e031c54a4c
- SHA512 d77c9e4a9b08f9fb3c9d51e9d0e25a00c5b9fee7bd5205a8bdc7c6af87380ed68dcd9a5ce3a5ccae16df2b4b072706998812eb9ffb3c8b4024142fb5f35a0bb8
- SSDEEP 1536:XTrlizlHsDTDy+G9zzkl6WqidA8dYE57JPq8YjfXAwjK4KNB5jDxYWR7YknxwYXf:X3lly+G9FWqu92q9zPlmT803Y
- TLSH T172B3AFF6DFA28D3D65FFD42C6A82843EFD266404B3E7300EC923635461C6BB86675648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 21.9MB
- SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
- MD5 322a050bc53af9aad7a659054354862d
- SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
- SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
- SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
- TLSH T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\addonStartup.json.lz4
- Size 4KB
- SHA256 4d874e076008c40180785da9238816abea528ebf97aa996a7be3af1e68972a8c
- MD5 af0e1a8d2b7dafaf2b6bf16746616591
- SHA1 a761e14023a4b1a989663f38fdf276b4be5e8a3d
- SHA512 726f9116260c721e0b210cc7d97185909006cc1292734c1621123878320cea61e2a09058adb4f9906b1392f50aab52e078697c8178b334408e8b68e51d3039ec
- SSDEEP 96:NdIM4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:N852xxhD8rGvm6ApwnHUuhN
- TLSH T1D2A17DBAD541EFA1FD32C04358D97FF2EAA6AB7410A9C4D4F1AE71294C24A735700340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\crashes\store.json.mozlz4
- Size 66B
- SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
- MD5 a6338865eb252d0ef8fcf11fa9af3f0d
- SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
- SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
- TLSH T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\db\data.safe.tmp
- Size 26KB
- SHA256 8b9a47e8cbb47e8df597187fc91c76adb52fb67a3df9eac07629c20ce8c14020
- MD5 aecce81a4d4c3a37ca8a0b2514ecfa16
- SHA1 2907276e20282d777c4cb6255adfcd290f8f2939
- SHA512 4f70354baf9523ce0b3e8a6deeab20591c412cb7d951b71cb294c8db9378e7991002750ae4624dfb764f1c92bbc1cf319e82850ed6a8803c2f600c8185d66d9b
- SSDEEP 768:uQh5JCsGGcm+uPURe6LfU2bTb1bqbnG1/:v5JC2Uk4
- TLSH T1EAC20F44EB2A913FD41552BBDCA517042F79B8CA99092F973A4C64682C872EC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\db\data.safe.tmp
- Size 26KB
- SHA256 d4d12e896d6894bd369b5ce7bbb8542766f9f5bd62237e9e670848caf78586e1
- MD5 558694fc8c7b526389d9f849626e9419
- SHA1 ca865d72f417c4a43b06ba2325ade78e8c051f5c
- SHA512 25c5ed1bdc326b8ac5bde3e35edea48867b2519057a4e21bbdc61a851aa63a53fec7524800b96399eb14be5b4c771d1616bfaf6873ee9b60380f5ee2cee786ca
- SSDEEP 768:G5JCsGGcm+uPURe6LfU2bTb1bqbn7lf1/:G5JC2Uk/
- TLSH T134C20F44EB2A913FD41552BBDCA517042F79B8CA990D2F973A4C64682C872EC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 a50105d883397a5864d6f1c0725531269a3b095dedf9f1e9d89b754fadc4d2f3
- MD5 e35e7d45a99d3bc2ee54ac8685cb65a1
- SHA1 9b128a5d5c94e7179e59bf1a491240dc2e4e18b5
- SHA512 16be73cbfb6e74ff4cb89850a50e5be2737d1f2c84f875a33b11cdbad05e324f7a54f0441f22d584b9e7407bfedb96ed20c33100d5729d662154880777888f65
- TLSH T100216E6C3AF98D6A6CC7EABC7880018E93564E4B05871D830D12DF8DCDD5AD931AE53C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\04894d5b-6332-4d2b-b5c9-4688687df15f
- Size 235B
- SHA256 770214478caca6e654727804b3d0b2a79508a74ebc2125c127154f2b7a2cd2c5
- MD5 ac6fbfbf27ba610c60e1202b51458897
- SHA1 7626313e9fcbd8dcaf76491e83023844e7f28832
- SHA512 63b54de027475d13297d3ae56d9f1c5b8e5e069490eacbb319dfe9a6f7fe411c91baf197ddedc865362cad5d6b665066b2254f33c767d9c187cab48f65b9bba0
- TLSH T13FD0A7C43CD8676D48140F2AB0E069D630594C3768A4A85099A155789DFADC459A2A5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\08154794-52ee-4c20-a63f-18364536a3d8
- Size 886B
- SHA256 b48220c02a90bbca0fa0540a9649cd233f5018b2d15d2816866dab6a08b8f3ba
- MD5 4eb2b9d2a71827a17a9e9249153cd27b
- SHA1 2528df560cef1ce17f9dc28229b692dec973eb91
- SHA512 2d1d0d87393d6bc1b0b72cbe346154f864eb860a8e74a4c7201cfc9737ed39d7fb636387d4068ff7d47925249da4ae556505eb53369e6548af710566be8bb102
- TLSH T10B1123609775B9B2CC2CC3AB84E17B4246A4603380CB09147DE58E0C0CBB66EA76760B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\14b31e37-7731-458b-88f4-035f3db7e891
- Size 2KB
- SHA256 e9e2111540ed90205043f4c07231cda383b8844fa48571784876643536188af7
- MD5 86553df4306982f05b7a021512b57120
- SHA1 777ef00efb800f0a1391f2bc23dc29418bb94c59
- SHA512 8bdf03dcdad853adebfc344741a9f72b1f0a14df7042bd56c7915e54dbaa746c704712cd67cd05f07ff1543070365245d153ad25aba435ba3b4afbb36ba1c0f6
- TLSH T14741336C3AB84D769DCAF65D9582338953648A0344C218D36E82EF0C8D96B9D736F43B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\341b5a2b-d748-4b08-b4fa-065b3f6d4dbd
- Size 235B
- SHA256 6969c58295826f65ba5e31361319e4cd99a1e902180898902cbef2d545c81821
- MD5 3db1c32374e1a420f7896f96fc738a9c
- SHA1 36fa3a3a67cf687689c2efa4d9f3bfd9c9c483ba
- SHA512 fb04b46fc6887f0fbc19e8281d90b4294c6ea1224c4924ac6d72de350aef11e45a1e4a209fa6675bf5ea6d7e01268ade749f31004a04e667a341fbeb76d9d565
- TLSH T153D0978528882B1D48180F0BB0F02ACF304D4C375074A8218A6041B8AEF99C8426190B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\d6f6d737-9d41-4609-a609-112b7a0a6b84
- Size 871B
- SHA256 0a06b3e4ed631c2628ed990944b8e370e1600418d01bc0fa18e971fdc7bae3e6
- MD5 86140e85e3875d76e99d57d3c56ccc08
- SHA1 d45a42573a7a8c7b86775619bd10537551f92f27
- SHA512 dc2490d2ccf9039db070ca10bde694854572e2eafe38946b1ceec5894026e785f1c4f37eb200c4b3faac7981057ec01bde5a2c41f34c7115817c412d8a6b268c
- TLSH T1B51123509775B9A2CC3CD35B85A57B515BF4713380CA89143DE19D080CBF61E937B20B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\extension-preferences.json
- Size 942B
- SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
- MD5 20357ec0806e9826d6daf456b6b16bd8
- SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
- SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
- TLSH T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\extensions.json
- Size 14KB
- SHA256 2bee2a0c066a67e3eb6077cb18e38a40d5a357164158b119c3d8e3f00a58736d
- MD5 24912bf77a3c9d5982542f038e8bb73b
- SHA1 b0f7bd954ee20f95be43c9b55e2dd1830b5864e1
- SHA512 ba9df0c2b4b0c3df2359260d77bb9f985fca4584ed67d6e6a152c68b8502bedb63c77d053f0c8d0042ed14314a93992e3200dd78595f1a16bcedc8978df6aa55
- SSDEEP 384:JkI4vDy9Umldv68dhW494zq96o6L4H7L4PlL4HAL4HyL4HC:KI478RffX14K6/4H494C4g4i
- TLSH T15A62521544149EB8298FA78AAA367E02C37D573B70445C78F4DD8FC842FA5B902FB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
- Size 473B
- SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
- MD5 7406820f5d56fda6baffa951c60679d2
- SHA1 e7d4894993e506e235d55b3e47aed019d0584148
- SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
- TLSH T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
- Size 1005B
- SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
- MD5 58954048e70c81669675d4f87ab50af1
- SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
- SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
- TLSH T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
- Size 21.9MB
- SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
- MD5 5614c2225ece73a37e47894ff3c19aa3
- SHA1 df3aadd22db3b5841fe488c985365269709b4b27
- SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
- SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
- TLSH T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
- MD5 a0dd5d559b24af4590e5cae3ac11a0fd
- SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
- SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
- TLSH T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs-1.js
- Size 6KB
- SHA256 941ea3d7d9bb0d4a325071d22e77f33fb79b378f612d23735ceeb4040dad4bec
- MD5 ad99acc95118d39622da9695e0a301a5
- SHA1 8c9246f4591a83ef020c796506eedae2b0207e7a
- SHA512 f1baaa3862534d8d7751cc647b7de5af1e2e84a1a9c7b8b94aa49af0ea1e0f581f72d77cbd627013544f15d3afd0629064e6678123f66c2e604aeb39f373c064
- SSDEEP 96:xHAUTUhqGqmHf/B21zSCjSSlXdv9j6nLHd8B+Bw88u8L4cnGpc:SMRmHf/B2XjSS0d8B+Bw88P
- TLSH T1D7E10F7890088B7F74B677AC6C688C71AAB2013B7BBF28D650B554C5051CF3882F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs.js
- Size 6KB
- SHA256 b74046e9af2e9a5fa3e345de279be853cfe3b4f4d795c57863c041a90511cd57
- MD5 28caa010300b43dc8c835c0eba4822e2
- SHA1 4b93bba5b50c3c3cc5d44270ced1ca8b69b4df6d
- SHA512 b10555963be83862e0ffae7c265f0920b475437f4a4366e970132a7e35bbc347641eeaae812d9f47f0db2f841cc5f9891ac694fb7fdd3dff4ae0b8a42db7c736
- SSDEEP 96:xHAUTUhqGqmHf/LW1zSeKSSlXdv9jjpnLHd8B+Bw88u8L4cnGpc:SMRmHf/LWfKSSJRd8B+Bw88P
- TLSH T1CCE12E7890488B7F74B676AC6C6888716AB2013BBBBF68C750B54485051CF3886F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs.js
- Size 6KB
- SHA256 482eff458f38b32f4f34cab4e48b0fe6504e9d6c39d88a0cb0cbbc28ee6909df
- MD5 6b68d041de4a7858feb5da4d8b42d1a1
- SHA1 085ebeb2f946fb95cf9ad347fcac41eac61bb36f
- SHA512 ef267a64d0f1bdf435896522c27ddd8bf7f631163ba871607415fb4fd2db11ddb278640f9f2c8644bdb3703a0d393faafaae704864c542c6f605c1f2638648a8
- SSDEEP 96:xHAUTUhqGqmHf/B2ObzSCjSSlXdv9j6nLHd8B+Bw88u8L4cnGpc:SMRmHf/B20jSS0d8B+Bw88P
- TLSH T1D3E10F7894088B7F74B677AC6C688C71AAB2013B7BBF28D650B544C5051CF3882F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs.js
- Size 7KB
- SHA256 3f8a621f244e7075a28a8e960ae56e2482e279b18fca4f3c5dc3a5233f637f0b
- MD5 6f0d45dcbf01ce27bfe6456f8933c8a5
- SHA1 19387f7fa6d0cf056937d55633c204d7c4883bbf
- SHA512 6fa6553cc156d3189aae5ab6f14b7bcaea2105ce236b22ba8860a6383eeef1d8e3897d259f86b285c787d0f4fcce872bb712a856e95d57c9c19ad7d7f8227f02
- SSDEEP 96:xHA1TUhqGqmHfmB2ObzSCjSSlXdv9j6nLHd8BLBw88B88L4cnGpc:SJRmHfmB20jSS0d8BLBw88BZ
- TLSH T1ABF10E785004CB7F74B676BCAC6448319A72017BBBBF68D650B954C5050CF3852F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\sessionCheckpoints.json
- Size 53B
- SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
- MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
- SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
- SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
- TLSH T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 65477567d376954c7fc48e4a994e71096b3547d892b4f080f53c818446f393c5
- MD5 a9d2e57d98110bd74b1089070dbf298e
- SHA1 873481331cfbc51db9a274ea4eba7b7ee0ece981
- SHA512 3cee727ac4f3e464954f10b53f85c9658db1b6493453700815c8f2582e5d0efb26a57ffc22341cd20217cceb756b1af684b89753ab272cea1fdad359e0fb84ad
- SSDEEP 96:dCfE9rFHXjeW9jILA0NjoB8kMJttn0YJZQFI:GE9rVDOnNcB85JttnTZCI
- TLSH T123918D41370B2967F95B8A8FEB4A4CE10564310D558044E880CF7B26B63FF4B3958575
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 d3c6107092b6e7b09964ebddd78c271ea46a22709037faad207fad2e4a6b71d6
- MD5 80d917b4ae4cc6f3750c92fdf42c382d
- SHA1 200134f74d27e343f1dc6fec828a58914f6dd943
- SHA512 8bc59bf1ed710bb6bbced36f22442144eef9813e152a73516e917df1a79b1edf5fc2d26299400261d6f9893faf718f210bffd9573a792075ba8884e09f28bb86
- SSDEEP 96:dCfE9rFHXPeW9jILA0NjoB8kMJttn0YJZQFV:GE9rVfOnNcB85JttnTZCV
- TLSH T15E918C82370B2967F95B8A9FEF4A4CE105A4310D558048EC80CF7B26B67FF4B3998575
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.5MB
- SHA256 f70a41abb0e686a42519d1f32e1c089fed55475dc39a65a4d752963f17579262
- MD5 e9e771b4bafaefde21204df6628a7104
- SHA1 a27d95a9c1a5d5da41d2eacf4a6c49cd2a25dad6
- SHA512 3bc4c62589d885b1d91bc9092c4a7f4e1b75efa001e86d4a0de95dc413db500b8cf856f40553f1647d2fa4bea78c031053e01a8748352da6228c1883d2d8b0f4
- SSDEEP 24576:tMzyH4GRTe8FjoAEYxWhk4QyrqQObIu4TU2ZyNhtppcfDum34HJtQZi/Ju:tMImc81Y1MTU2yTfp2Dum3oqc
- TLSH T1D14619E820D1A297F3814033724593EB21EFD00D5037DA085BA99AE9A574CEF9E17B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.2MB
- SHA256 cd0ddee0917b4a9e6a3af254edb05323cc7b9d9ffcbace7b6cce350a458a72e9
- MD5 17a949371e9220c2ed67385da415d388
- SHA1 1386f722b18441b4af820c5da1df10380d626e4e
- SHA512 71397d9195a5ce2e2ab1d48eaabe0c1980b9e6906dfc7c79008fe7e030357b0b24ee554edb715d902a7f7cf8224da44335dd0b3f71d3c9afc340e001f6731446
- SSDEEP 24576:6Z82huTEyaUQZsdbPWuSxWWO51drwSbOguGWuaTU2ZrBhtppcfDuFf34WYtQIpkN:6Z8aEqsdbPWJQaTU2rXfp2DuFf3yvW4
- TLSH T1316619E860D1D247F3864073B24983EB21EFD00D5037DA0857A55BE9A5748EB8E27BBD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.7MB
- SHA256 9735346c84a3fecb5c11874f901d62605edcf4ee052b36822652fad9fc7c0698
- MD5 0e701a7a2259987811d27dc1a0626be5
- SHA1 54a4a778009a559d91cc2ddc3cdfb8d2964239a1
- SHA512 292c57c87bd9de7cce0cd4955d80769efb49563e6da610b171cf3b2ce031d901d348de4d50cfc665fb34fde6cc986149ce678c7174fabc2f052e06233158f67b
- SSDEEP 49152:YOham4sibPsJrO+1fzb6Yp2E4njhWQX3KlczWn:N5z1fzb6Y2XjhWQQ
- TLSH T1B4664BE860D09243F3428073B18993EB21EFD01D507BDA4857A45BE9A5748EF8E277BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.4MB
- SHA256 82bb82de84578e59f305f977bb8d91cd29453ef8465d95851cbc25cd6f6cfaf5
- MD5 41b4d0479654ce23b594c63426345c10
- SHA1 0097b63a9cce0ebf95f6d6377065c6e6eacff60b
- SHA512 4674605e8b7af0bc87bd629107cd342765507ac6f034c109cf0283cb85ee4ac161ac0260564491200a78d14b60430051663667c3100f768b14621d55f034cf68
- SSDEEP 49152:JnmamysibPsJ7e+1fzg6Yp2E4n1hR4XjKlczNjH2HLivxE5ISl6qXbg02lcr+jwX:5oj1fzg6Y2X1hR4
- TLSH T120765BE820E19253F38240B3718993EB21EFD01C6036DE48579497FAA5748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.5MB
- SHA256 d646ed02883ebaa6bf3ee3bd29e1853b2bd5ab8e5714f2bd7931d85c2b4ca0ce
- MD5 3a6e39647d38427f5ec9d7ae22ec4690
- SHA1 65ea146be93cc9608d638f18677cc9c1faa3c248
- SHA512 2a263e87aef5c5ea19a6c49ec3bf5efc2d8b7010883fe34b24c542cd9e44413f0b8e2de7570c9116acefe1ced94f4a7516820d14e7b4b8e5197bc9d87cd0b629
- SSDEEP 49152:FnPamysibP8Jpz+1fzg6Yp2E4n1hR0cmKlcz9jH2HLivxE5ISl6qXbg02lcr+jUn:N3i1fzg6Y2X1hR0a
- TLSH T1E8864CE820E1D253F38640B3718993EB21EFD01C6036CF48579496EAA5748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.5MB
- SHA256 438fe97ff38401819f8aa12505eb15662b6b6043691ebd476b0671dcc6206f63
- MD5 70737478c9b30fa70381ef565ce94d37
- SHA1 8e9c46efe22232c3fc6f8c2b5ea55519d26e0f74
- SHA512 1fadfc56a54626939384d0c0a8482676e638e0dc24267c2eb30abde50f4b22dd26aef8fe62a931079cd1b56f2fbe6486fdcbe89cdebe1ae65ea600cd130a4844
- SSDEEP 49152:vnfaH5sibPOJzl+1fDNwYp2E4nCCgjchKlcz9jH2HLivxE5ISl6qXbg02lcr+jUQ:vNE1fDNwY2XCCgj
- TLSH T1F1865CE420E19253F38640B3718993EB21EFC01C6076CF48579497EAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.5MB
- SHA256 08bf8981d356010d2124346f97d951dd1014616b78c7920fb8e24bbb9ad26a6f
- MD5 509a4609fa43515ad8f041dc84ba64a1
- SHA1 0082817a6d90452e081a2155100b9d2e5e9297f4
- SHA512 dbefcd28a3a8f3bac60b9ccdc129c5683c8855028ee2dbf49f96d6dab14e8f85561bf781572f3e50b93c8758ad41b8a1561e1c67c53292e433029b254e3ae09c
- SSDEEP 49152:ieCBWkeKV2k5O8D2D3/YlYVfXTlNKbe+OU70QnAELs8MA9AW60QbaH+sibPtJTnu:i0E1fDHwY2XvCgX
- TLSH T113865BE420E19253F38640B3719993EB21EFC01C6036CF48579496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.5MB
- SHA256 540e53c53d85db5d1d55ea5a6cf2daaed60fc663f092cd33fd988412cad0b8f0
- MD5 1d3efbf08d0746019251831beaa297f8
- SHA1 0fd08b1c87f89072f7fd082b5c575b0ebdebb277
- SHA512 05e29241791f688d4dee4c865df3b739ab1c73c5732f780bd2c3331f9cd124a5da82cbe190c06cfb543d2b24c362679a9d26cd45bbd54c08c0f8c361ee857ed3
- SSDEEP 49152:69yWkxn/X12e4y2D3/YlYVfXTlNKbe+OU70QnAELs8MA9AW60QbaH+sibPtJTnlY:X0E1fDHwY2XvCgX
- TLSH T11A865BE420E19253F38640B3719993EB21EFC01C6036CF48579496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.5MB
- SHA256 67fa82f009d48fa3604c3525a2555a8500a4218932ff88b5c3642ecbf285d170
- MD5 247d50bc3b9e753ee45f6b1a98300a62
- SHA1 0cccfc38dc82dd46540264552106752a9d30dd6d
- SHA512 11fc13e9f1e04b7b745a909bbe7807ede7e24f9e62518de4a8eec7d83395b71b15a120161a756f7c091b67e0b43c55326f3372a37b48435cdf3562f7b94cfff0
- SSDEEP 49152:M9yWkxn/X12e4y2D3/YlYVfXTlNKbe+OU80QnAELs8bA9AW60QKaH+sibPtJTnlY:k6E1fDHwY2XvCgX
- TLSH T13C865CE420E19253F38640B3719993EB21EFC01C6036CF48579496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 fd153ddd3785007aad4237ce9d44176f89aa72d174db2c9cfce76fd1eee08226
- MD5 86fcad753d3c896c2f050b58dd624f80
- SHA1 483d558e1bd9c797980841f8a164dfb14bec0e44
- SHA512 794ea0fb1001d22e390a1bcde11aad5ed51b04d7271bf83408887d11615f351b4cea6d63170dca78af1ca3147d400ddc395441b01615dac54458a68fd0e0734b
- TLSH T1D971700CA61CA4BEA66BC3C0E6447FA78FBD053370446458DAFE460C85FB5FB162621B
- MD5 SHA1 SHA512 TLSH