5648c010ef34fb0efbb07d1c3f976ad88b8b5202f8debed9fee7fd33670c58cc

Analysis

user interaction
yes
max time kernel
189s
max time network
188s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3c1I5OEf7ec37U.html
Size 5KB
Sample261102-e94emahs2n
SHA256 5648c010ef34fb0efbb07d1c3f976ad88b8b5202f8debed9fee7fd33670c58cc
MD5 c34fd5d1f4e276827009683920cda567
SHA1 60eb789281dd58596354f57a46570e98b8b392f8
SHA512 6243d0c1525981a04511c2624c2fb443c952660ef11b665e566ff74cb091696d2fef37116e34882967ed420828ac91ac184e2f38d1aa429c61ab01e77c3a22d6
SSDEEP 96:nGyC5Pn6vYcyoiF3yC5Pn6vYcXXIb/RkjaNihjw7nXx/ICu:nGyC5Pn6gRoi1yC5Pn6gU4b/mhhM7nXc
TLSH
T143C1A7563D60843A41D190D87531F71E6EA2E017AA43CA44B3FC8D916F65FCBCC9BE98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
141	raw.githubusercontent.com
207	raw.githubusercontent.com
232	raw.githubusercontent.com
266	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2836	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe

Checks processor information in registry 2 TTPs 41 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{72A629DE-8D11-4143-A32F-A358AE2061E9}	ShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe

Suspicious behavior: LoadsDriver 33 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
820	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe
6540	ShellHost.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	firefox.exe
6540	ShellHost.exe
832	ShellHost.exe
2672	firefox.exe
2672	firefox.exe
2672	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3048	3444	chrome.exe	88
PID 3444 wrote to memory of 2836	3444	chrome.exe	90
PID 3444 wrote to memory of 3932	3444	chrome.exe	91
PID 3444 wrote to memory of 3932	3444	chrome.exe	91
PID 3444 wrote to memory of 5968	3444	chrome.exe	92
PID 3444 wrote to memory of 5968	3444	chrome.exe	92
PID 3444 wrote to memory of 4700	3444	chrome.exe	94
PID 3444 wrote to memory of 1472	3444	chrome.exe	95
PID 3444 wrote to memory of 4700	3444	chrome.exe	94
PID 3444 wrote to memory of 1472	3444	chrome.exe	95
PID 3444 wrote to memory of 1168	3444	chrome.exe	96
PID 3444 wrote to memory of 1168	3444	chrome.exe	96
PID 3444 wrote to memory of 5288	3444	chrome.exe	97
PID 3444 wrote to memory of 5288	3444	chrome.exe	97
PID 3444 wrote to memory of 5932	3444	chrome.exe	98
PID 3444 wrote to memory of 5696	3444	chrome.exe	99
PID 3444 wrote to memory of 5696	3444	chrome.exe	99
PID 3444 wrote to memory of 5172	3444	chrome.exe	100
PID 3444 wrote to memory of 5172	3444	chrome.exe	100
PID 3444 wrote to memory of 3244	3444	chrome.exe	102
PID 3444 wrote to memory of 3244	3444	chrome.exe	102
PID 3444 wrote to memory of 2452	3444	chrome.exe	103
PID 3444 wrote to memory of 2452	3444	chrome.exe	103
PID 3444 wrote to memory of 3852	3444	chrome.exe	104
PID 3444 wrote to memory of 3852	3444	chrome.exe	104
PID 3444 wrote to memory of 3600	3444	chrome.exe	105
PID 3444 wrote to memory of 3600	3444	chrome.exe	105
PID 3444 wrote to memory of 2664	3444	chrome.exe	106
PID 3444 wrote to memory of 2664	3444	chrome.exe	106
PID 3444 wrote to memory of 1996	3444	chrome.exe	109
PID 3444 wrote to memory of 1996	3444	chrome.exe	109
PID 3444 wrote to memory of 3592	3444	chrome.exe	110
PID 3444 wrote to memory of 3592	3444	chrome.exe	110
PID 3444 wrote to memory of 5048	3444	chrome.exe	112
PID 3444 wrote to memory of 1320	3444	chrome.exe	113
PID 3444 wrote to memory of 4652	3444	chrome.exe	114
PID 4640 wrote to memory of 2672	4640	firefox.exe	116
PID 4640 wrote to memory of 2672	4640	firefox.exe	116
PID 2672 wrote to memory of 2468	2672	firefox.exe	117
PID 2672 wrote to memory of 2468	2672	firefox.exe	117
PID 2672 wrote to memory of 2468	2672	firefox.exe	117
PID 2672 wrote to memory of 1116	2672	firefox.exe	118
PID 2672 wrote to memory of 1116	2672	firefox.exe	118
PID 2672 wrote to memory of 1116	2672	firefox.exe	118
PID 2672 wrote to memory of 1116	2672	firefox.exe	118
PID 2672 wrote to memory of 1432	2672	firefox.exe	119
PID 2672 wrote to memory of 1432	2672	firefox.exe	119
PID 2672 wrote to memory of 1432	2672	firefox.exe	119
PID 2672 wrote to memory of 1432	2672	firefox.exe	119
PID 2672 wrote to memory of 1760	2672	firefox.exe	120
PID 2672 wrote to memory of 1760	2672	firefox.exe	120
PID 2672 wrote to memory of 1760	2672	firefox.exe	120
PID 2672 wrote to memory of 5068	2672	firefox.exe	121
PID 2672 wrote to memory of 5068	2672	firefox.exe	121
PID 2672 wrote to memory of 5068	2672	firefox.exe	121
PID 2672 wrote to memory of 5068	2672	firefox.exe	121
PID 2672 wrote to memory of 6316	2672	firefox.exe	122
PID 2672 wrote to memory of 6316	2672	firefox.exe	122
PID 2672 wrote to memory of 6316	2672	firefox.exe	122
PID 2672 wrote to memory of 6316	2672	firefox.exe	122
PID 2672 wrote to memory of 6684	2672	firefox.exe	123
PID 2672 wrote to memory of 6684	2672	firefox.exe	123
PID 2672 wrote to memory of 6684	2672	firefox.exe	123
PID 2672 wrote to memory of 6684	2672	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\e3c1I5OEf7ec37U.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff89f0cc728,0x7ff89f0cc734,0x7ff89f0cc740
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,3349792860412371830,16435599083841394727,524288 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,10252485054997942772,13680877258892803562,262144 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,1376452153851233191,17970381696985028656,524288 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,12625570412860026956,3327522025069197477,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,3766236979536850228,7763271083930618152,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4992,i,8375636281670595072,269954798774789898,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5252,i,14031516149354540349,15974220206501636726,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,9959900747492622464,18154588918987999044,524288 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5908,i,10468777857658933865,17815255036394028522,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5944,i,1867312056400838266,13963343305497637278,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5900,i,15291757899207845685,4150794893589636461,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6352,i,262713707148263931,10984530620261672872,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6252,i,8202113638775934214,6334504019313535794,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6588,i,13027012386607779465,9261295038744753674,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6720,i,5042508102320714069,14203686408703993555,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6540,i,10557155954331928544,16658197515425820985,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6864,i,17784762567327225154,8084777938258420825,2097152 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,16499697478076973156,1703515297900004074,524288 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,18307170086991058430,3569601977166703953,524288 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,8319365018552312291,6815445532531526365,524288 --field-trial-handle=1916,i,15319773903911734249,1896202829357192087,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:4652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {5c359837-051d-4bf3-9361-568d80e4fde2} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {fc5df822-0303-48d0-910f-2b6caa19b618} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 27274 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {eb2586d1-d40e-42f9-ba11-b28694352b80} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27274 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {43b2e6dd-505b-4f56-b42b-f6f587839169} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1636 -prefsLen 34773 -prefMapHandle 2644 -prefMapSize 270279 -jsInitHandle 2648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4664 -initialChannelId {f9169158-6b52-4bf1-821c-ffdbc3aea199} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2720 -prefsLen 35010 -prefMapHandle 2784 -prefMapSize 270279 -ipcHandle 4968 -initialChannelId {0f7bd9fc-0141-46c3-bcda-e2c58b74026e} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 33031 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {a060123d-19e6-42a8-9c27-f360fe8b6ab6} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5772 -prefsLen 33031 -prefMapHandle 5776 -prefMapSize 270279 -jsInitHandle 5780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5808 -initialChannelId {0c6fdc9a-94b8-49b7-92ab-b36ee7c27fa5} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5960 -prefsLen 33031 -prefMapHandle 5964 -prefMapSize 270279 -jsInitHandle 5968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5976 -initialChannelId {55c68dfd-1def-4d58-87bd-61cfe890b19f} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6312 -prefsLen 33031 -prefMapHandle 6316 -prefMapSize 270279 -jsInitHandle 6320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6328 -initialChannelId {4f490fd2-f8e6-4ce1-ad41-130bd1225101} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1604 -prefsLen 36885 -prefMapHandle 6456 -prefMapSize 270279 -jsInitHandle 3204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2944 -initialChannelId {48b63548-0ce6-487f-94b5-75cc16e7373b} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6456 -prefsLen 36885 -prefMapHandle 3204 -prefMapSize 270279 -jsInitHandle 2944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6636 -initialChannelId {841a6206-ba91-4ad2-8e05-f95a7354d076} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6988 -prefsLen 36885 -prefMapHandle 6992 -prefMapSize 270279 -jsInitHandle 6996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6964 -initialChannelId {abd55141-a47a-43d0-8513-a6b4a4331f15} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7072 -prefsLen 40022 -prefMapHandle 6844 -prefMapSize 270279 -ipcHandle 6996 -initialChannelId {ff2dbc91-7da7-461f-a9c1-5c23b172d130} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7140 -prefsLen 40022 -prefMapHandle 7272 -prefMapSize 270279 -ipcHandle 7280 -initialChannelId {a28766af-1468-4661-80ff-92701a97e43e} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility
    3⤵
    - Checks processor information in registry
    PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7448 -prefsLen 36885 -prefMapHandle 7452 -prefMapSize 270279 -jsInitHandle 7456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7464 -initialChannelId {d512d438-2c7a-4e6b-afeb-b4abbaf63f5c} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:3408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6660 -prefsLen 36885 -prefMapHandle 6524 -prefMapSize 270279 -jsInitHandle 6328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7940 -initialChannelId {ec57743c-f63c-42a9-a7d0-5b85b10f32f7} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7096 -prefsLen 36885 -prefMapHandle 8084 -prefMapSize 270279 -jsInitHandle 7088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7940 -initialChannelId {abb69279-3282-4a04-a5e2-7af688efe28e} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:6480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2664 -prefsLen 36885 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 6356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7012 -initialChannelId {f078a8b6-f42b-4a87-9102-b6608f381403} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:4900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8416 -prefsLen 36885 -prefMapHandle 8428 -prefMapSize 270279 -jsInitHandle 6392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8404 -initialChannelId {02c292c5-8754-4e5e-9504-ca18d84e927e} -parentPid 2672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5396

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004EC
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:2296

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6540

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43bb4c78-547d-4a8f-877a-076a8796fc31.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\43bb4c78-547d-4a8f-877a-076a8796fc31.tmp
Size 5KB
SHA256 94166c3751c457314018e302b1802a2103e11929604841c99b2494a257ce30ac
MD5 90fb0e470fb333b0aad2e1fb01fc82a3
SHA1 49034f89d0306b4de65f7254d3e710c8341b745f
SHA512 705763c49a0aad69478b76b03cb2bfa891b86ea1e5a35b0cdaa9d16a7874f6e0e5942a69770657b12483e6614197a7c04999bb60b2046d093b8bad0f7e64b55d
SSDEEP 96:aC0d+U7D/u1i5WFtfvuvxjYSl8h4otop5jiDDcB6DGGfvutKRevO0AoVFUAaxQ0k:aC0z7q134vyiU2jswGvWKR23UAaxQUL+
TLSH
T1C2C12970A86E69B76AF6E444F1431D47CEF862BF6801BE90E9E90F1D11D74BC2342927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 84ae77e4d131e93379683481e2602a0250f7ccaba40692ed2949a816431c9da9
MD5 ebcc9a297e5c474090962ed19a5e48a9
SHA1 2e86ffcad4ddd1266a3658610fed4361bfa6153f
SHA512 1346cabd9fe762b02f75bbf7904d7abe5469c2a7cef859aa89ea76204ae27b1759fd0a4435de57059ad8d709fdc549c5703fbcd74fded771fbb19adb99bde62a
MD5 SHA1 SHA512

Submit Download

075a762f-cfcf-4c71-892c-2e47f462bc9d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\075a762f-cfcf-4c71-892c-2e47f462bc9d.tmp
Size 414B
SHA256 be43925a8331a8714214280e3c414792d6c30d22b5776932ab2b94c53dd3fe80
MD5 2f7a1087086073267e713d8119b91aa2
SHA1 1acf82808bad297fb8e7974c27fadd12835b8998
SHA512 73c791ffe3aff6627081d061f3b27b289864b9bc391d44a1a79578d016ca3d7f2e438dcccb02fd5738df3892f1b101c1c730d0d714ff0e0001247584a47cf932
TLSH
T1E0E02BD9CD21EC3B29FC0B1850640646FB5507172A905A4F363D810C4FB5A3A81D7C5C
MD5 SHA1 SHA512 TLSH

Submit Download

687c8c4f-c0e1-4e5f-b886-1266335c99d6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\687c8c4f-c0e1-4e5f-b886-1266335c99d6.tmp
Size 11KB
SHA256 46cb7fd7d715765b3a5e90ecd299328fa59693ccc3045e29867dcbe5c59ca424
MD5 57cd5949db299f1cc846914605038d22
SHA1 096494bebacec676c55064afdeca8990ea2e2d48
SHA512 f5c375d66aba26a2c1d67dcbe5b7dc4118ee8cd6377758f962b5127e0ad27939d084d2e4ff25584bcdee49964f142cf4c2c09cd1e49fe0cbe75eab108c595b75
SSDEEP 192:sRO/nxjyv7ZAPRp2pl9THsb+WNnD/0ED2X3/xeVyIsnAUgR:sRO/ZeQXo9wb0e2X3/kR
TLSH
T1AF32942EAD14793F6CDBD229F9613B57D6F9103125912E88E6FC893C25E79CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 127KB
SHA256 e5f1dabe89a7a1d0ae94bd8e14a273cb5144a6541c34a54192411677c18c43a2
MD5 f944721bd55cbb39c452593638459aa1
SHA1 085940738cf5737b614a586d0f2005ff0445d6e5
SHA512 33c8c2882fc81062027733dc7f1d52f2194957cf94b34c6d71e393ed90f37a378a5c7122cbfe4dc35f7e63c26f7c4440886e9b3884663aea2a8183087611b3af
SSDEEP 24:5bglATIKl7DCmTpHTyxpEo1HM9kvfkzyfkmoyfkoRfkIRfkwhNfkm7usyfk6sRfn:qlg116z1+ukYkwkAkgkw9kugkxkY
TLSH
T107D3356D2F958FEAF0F12770E684BF4CB3D96E6251EFC35E1BCC1906BAA00D01048A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 100KB
SHA256 27bce9e85eaf3567a4695ba2b612e32615394d80d0a3a2dcb07b1fbfdfababc7
MD5 f134fda98a277b1c8f20ab8fbe2fbd58
SHA1 a922796190a1f5bbb3c410c6ec591502050df04e
SHA512 2b2e8338afb9b0ca9b5fa3d452dfd80368b5d17566120ae6351b6d03572e5a69cedb97f165fbc31ffb3addcc00506a3fc0761cf2404a5d9826a8448a7c4d9f17
SSDEEP 3072:fd/tI0TeVA5o0VgTuGmxrMRZ6aLxuC+Gtn5HBZ4I/:f81VAMuGMrMX6Mxu9+fCo
TLSH
T108A312846579CDBE5EDC1D06AB21ED4CA2BE53F66B5E367483100E054FF4FB49AB0288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 16904ac96acd654f07f4e7d6fcf70c9094de55b6bc5c606026c97b0e6199917e
MD5 3d6d3626ce4a464afac42dfdbbc68880
SHA1 788ba480ed9cad66775f2c22626d5e82c280db94
SHA512 98dcdd14502d5e610efef0ae02de6daec2447c32fe437bdcdc0e00e4e2826da4258899907518ca218d57078220182c1597bd5e65f6384751f5b27567cec107dd
TLSH
T117B022208ACC8028EB300330BCEA88C0302B0E0A00030323C2E0C8B0EC2A3B3C08F03A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 4f265f386ca9fba46fe54ca8f320159a5ca71e0178ad85f125897a6f173a3661
MD5 fb3b4c813a373433543ab7d86fb40ff8
SHA1 7390a4d39da5fea2e46de71717b4f0ecec35d7c3
SHA512 adf12c5a69c688d814a61f50fba82f2160fa78bf9607ce5904d63d23cc666615a8cb661c95600a437e2173982772af1b7665738599a80767fe0bfc6e6532a5a6
SSDEEP 3:MsEllllkEthXllkl2zEklpP:/M/xT02znpP
TLSH
T19944044C7FC1071DD75410304011C3500371D4101D315F433C5104335CC55504C10070
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

095ca3d8-d94d-41c8-a5cc-e8a7e77b4c79.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\095ca3d8-d94d-41c8-a5cc-e8a7e77b4c79.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8684c50e-f466-4c5b-abae-de6bfc3470bf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8684c50e-f466-4c5b-abae-de6bfc3470bf.tmp
Size 7KB
SHA256 3689242be6bcb4435698642aa4e76c1e79f0a4418029ab54ea03dd7b6fee285b
MD5 a4fbedc98dee1607558a748110450aef
SHA1 449315e9fb1579fb01e9e01db415265134e800c6
SHA512 c7cdf02d61543db0b3989cafe0a68505325da7397f25a743ca9f834ff4dd218217635e8bc22d6e0708221769fef532d55c537f754767519ae1cf3c1fe22c8f44
SSDEEP 192:D8avCunZuaIaTZEaZgOIOPul8rRZfpA69E6n3iDMDkDj8bRu1:D8avCunZuaIaTZNZgOIOPul8r/fpA69S
TLSH
T1CEF1CCF393E88A6DC92196F49A15EE2FCE5D0515431C3CABC8E1EE0B67E2571E20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac600962-fa2e-448d-bbae-e11cb64fd5e8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ac600962-fa2e-448d-bbae-e11cb64fd5e8.tmp
Size 1KB
SHA256 04341f124bccebcec34529bb2cec49093ca6453ed54c20849b597f2cd272721e
MD5 e6e29ac3e9fcb6dd4a39fbafe33ceb59
SHA1 5fb2dfa325a3562f3aa56e0ab3e3a3573d01a24c
SHA512 60c862829d46ee6fcfa7d6bc68192e5533c8b467dbac7fef4c0f0f9f11c84294bd90ea33378b0d889e582a120b1bdabdb7a22e0aea0a651dec023fbda660d624
TLSH
T1323157A3D67EB8BB107D89BB0D15B8193C79F831554264F4DA5BC3ACB0814E7AB12077
MD5 SHA1 SHA512 TLSH

Submit Download

aa2f18cc-3338-4729-aae5-12ea9928d3ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aa2f18cc-3338-4729-aae5-12ea9928d3ba.tmp
Size 11KB
SHA256 61abad0b9ab114a83375fba12357383f0f44f5a04f064051f660c3b759e7ff35
MD5 ccc952b560b4c98ab5765662578e33ba
SHA1 ef2e23b8fe46fb30215fd6971284c9142442448a
SHA512 4eafe8851407d21272dd2a634f7350b1cd5cf2126cbedb8d74ffcada3d56fa8feddb3decff3d35a4e5e06066422427d4966f6e3319faecca9759402da6fbe98a
SSDEEP 192:eYX4K64y7KxkXqK4I40pUZNCgVLHrKHfFKslE2gOXzKD/XW+ErUkKN9cXcYxSgLu:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOe
TLSH
T1E932EA17A48D9E3F0FE8E51DCC426F8B7CB5016227784D24A2FB5C0803A97CA115A6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afcc40fc-0f5f-4615-ac2a-f582fa6687af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\afcc40fc-0f5f-4615-ac2a-f582fa6687af.tmp
Size 12KB
SHA256 0d043c8f9db53cdc9c766dcdf64653e87b3a7fdfb2f1484288ce0eda33800342
MD5 53dae295ad123f2d3ab7e56b2c7507bd
SHA1 ddb9a40bc962e3719aa0b0858a0f77401d2c65c8
SHA512 37a0dc1f8fb51f3b42fa3060162cd2611cd4d21c1e4d9c1ec1f2cfeb999e6da875eb111c553f3effd09bca5ce51dc1d20f489c409f49f4e7d43e5bed01b11733
SSDEEP 192:sRO/nxQ/v7ZAPRp2pdm9THsb+WNnD/ZsH82FD2X3/xeVyIsnAUge:sRO/qXQXH9wbt2h2X3/ke
TLSH
T11642A22EAD20797F6CDBC219F9617A17D6F9103125912E84E6FC892C25E79CC222B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9c5e374-685c-4ce5-a83a-dedc314c6e65.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f9c5e374-685c-4ce5-a83a-dedc314c6e65.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d8a4a6d6-a299-4dc7-a965-0859889dc5a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d8a4a6d6-a299-4dc7-a965-0859889dc5a6.tmp
Size 5KB
SHA256 82db97b9b23360f293d1c4249c77d6783549d06fd8d051efc8bd860e2c5c6e68
MD5 459b634f63403b63ae10311decd5f83f
SHA1 5825377f906127bb7bef70d04f94d0b79978975c
SHA512 b806032df9f55ea9c4c65cd933664d7c3d1565740b4b4a71e183492f180d336938a13a600561084f0758695489998666af9de94e2b9f0a90b3e68365dfa85e79
SSDEEP 96:abJ0d+U7D/u1i5WFtfvuvxjYSl8h4otok5ji5DcB6DGGfvutKRevO0AoV+UAaDJi:at0z7q134vyiUDjGwGvWKR2wUAaDJQU6
TLSH
T16DC12970986E69B7A9F6E444F1031D07CEF862AF6801AE90E9E90F1D11D75AC2342927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eee50868-1e11-4266-af3b-79b37d60a250.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eee50868-1e11-4266-af3b-79b37d60a250.tmp
Size 4KB
SHA256 24185117553ca73aaeba15c79b56d82c33a10296a680db1a6a45e6697e6d5d02
MD5 396dc10de7f4ae5a25df72ba32f34798
SHA1 32f1c766b4f5b525aa58123b5ff0e8b60a107b13
SHA512 57b748f02f544021bf0d4ae88837ea75ee0a5be9c558e65a71a3f8e6fcce1272cae97d741ef917229266effd345b49e80a411bdb319ba7e8246d3714faf098d8
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5jiHDcB6jGyvutFDLxmbYLsv4a:pC0z7q134vtDUDjMwf7FDLxmbY6
TLSH
T176A11A70987D99B795B6C485F5422A47CFB422BFA902BF84D8DD1B1C11EB1EC1312927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.contile.json
Size 4KB
SHA256 3d76c6822eec3ec6b7d36fe340f95b91ebd046168fa85e4b735abd33a078ecf2
MD5 628d134956cd8cc19d83b0cba2adfcd6
SHA1 f9347c56ef6752c0d17081f41dd63ff0a588d0e4
SHA512 dc873ca1c6c63ee4cbe3edb6047f622faa1a454176b1ee8e6cae0b9b6bcdc03e4f70d201d3085f93f678b8932755839825eafc0aa7cb6964402338d9f6cc9ee3
SSDEEP 96:THkxMrH/Lqoma3k4vhUT+mRUdon4KYmz+hhK6DxHlz:LGMTLqo7U4vDmRUdoshcwxHF
TLSH
T16791B98F91B889121B31AAE07C4F27ACF107F406DAE19E5C715E9C61C56D7FA80DB548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 3d7493643748198059b3e0bad4fdde3cba76059cb901fe818ad2964e1a95e0d6
MD5 abc0cd1ee04c68ed7441ec2f08edc6a4
SHA1 baf96320912ae5b4fe7b1d775005ec66ac08052f
SHA512 0e0d427e88fbf5364f58aa1e69a398ee6c8e94b1615d50c1ee81758c6455a28e0774f4976b85d19e5bf2d8d22123900ee898257df618a0be454147730e9c55a2
SSDEEP 768:ay9cVduL02wsytqY51OJiUNPgvXqZ2Jm7O4+GX5V0KOOra1k5:h9cP2nSqIwJLNvZnO5Gbo25
TLSH
T187732AA396E8B2FB1B9037C71C0FBA5B66D30185E34506CDFCE9C91D81CD6A4423A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12835

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\12835
Size 52B
SHA256 98b366d25e3e80c6c7d339e2a464b20242b3dae7deee89b5573ed626e33c1353
MD5 1b52c3e5e500b2a9d64fb414ff23266c
SHA1 639774d2af8a91a86a8ee47d64e85642d31ecf14
SHA512 5d0d6970be4f1411339898d6d0121df597bbb1d094705b922418e3ef1298874d4846639803153b9ffd5450d5b2564775d3c81d84276fadd0592110ed817e1c3a
TLSH
T15590024C4255DA04D4188131094080B904143E444480071338E6575248514E20811199
MD5 SHA1 SHA512 TLSH

Submit Download

18868

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\18868
Size 127B
SHA256 28d484bacc2e8dedb5f2737e8895a121f541b8dfc458e18cff8648830006aea8
MD5 ed4c4b9a9ad2940c22e81deeae9d2dcc
SHA1 4e7c77b6760695de80d797c6a2d441bd008823d9
SHA512 08be78fa51b3bd78324855d202b870fbe25a9dc5b5ed50f1faa231ea56bd35f56b8ef4b876986a6ce7cb025e5cb689e60acc5bf8b79b1b1da9c2a6e33d209736
TLSH
T1A1B09BD64B45F809D11D5EF454B8F48494013542981142E1BD41035E48781D147B1E54
MD5 SHA1 SHA512 TLSH

Submit Download

4379

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\4379
Size 256KB
SHA256 485aa94435c784a1d979ebe0372bd1978d331bb37b8de264ee0a5e9bac1179c0
MD5 0358d3ba709629bd2cf44e5c81e8d19a
SHA1 aeacf09e9f9fa27dcae1a71b4eaa101cc6c1f96e
SHA512 431c5a2e6021ddb0b06c989d1e4b697b80b6e1943073b7235f0db56aacf99449382e559000605bd9d47b5dcb2dc3db2393b2d09845a1e122167405989cc4e0a4
SSDEEP 1536:DYCYPsTh4m+ZVFsQKSPrFDdvkcI1VV4WKhtX7MCMeM5EYZH422RSHwK8Ct92ZFZG:t4m+ZVFsQFD2caV4WKh50r2+F2Zj32
TLSH
T1F144F7F3D6AC30FB075297DC2C0D72CF62AF8179DB5209DAF8688148C3C9AA51076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6516

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\6516
Size 7KB
SHA256 fbeb0dec34e1dace85ccc4a9c75c682b9428ea6a29f6b6df48d86388e7d2215d
MD5 7fc9a6e69f8fbd2c8006dd4988fdc557
SHA1 8f08c8c0b0a7c94f52d470f3347b477b7a8328f5
SHA512 eb2940ccdec35405499721bebc6bf2de7f0dc77e56c14fdaa9537caa5f197efbbc266918971183de853fec28ca778971575c5faa31a9d496ab0d2456752a13cc
SSDEEP 96:cHEh6b04/Az/0lw/kYz6b04/Az/0lwZivjCfgp+fY3G6rGLxfrGLxxmZn:d4/A244/A/WXp+fY3dOxTOxxm5
TLSH
T193F16C7B1E4866181AB287D1942C769C7E70778BF5EFACFCC1941B1209C4B7125D81DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8924

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\8924
Size 11KB
SHA256 b82b4593ffdfa17f904c06ace586818ecc41069c99b3d860403373e60683b8d4
MD5 69d8d2a163be8fe7cb29bc4b12083ea2
SHA1 38f3309f809d6e760217b726364b3868d932986d
SHA512 e4232415f1f27b517ec13414fe5b93c80beedefa77553c64a04b1095cfd8d3dc1cab7a260d48738c87fc4ef54ded0a8641d6ccd97a67ba00995b82794b9bcab3
SSDEEP 192:mszvZlWzVDxmZzj/a1hastSIb0qZv++6IAmqxv6v98BNAF425BNAFc8BNAF425BZ:mszBUzVoXi4qZeIAsv9AizicAiziC
TLSH
T119325B759A444D7D0B615A841DE02785FF2EA10BBCABB8E9A071329517CCAFC52C15FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 92a321937d876443073daf90665b9e788f7345de4f75e844ccb3611d41f18257
MD5 dfa01f73ce7456fc1ddc22aefb25c457
SHA1 dc66c66192d939f28d05457ece28e607e562be53
SHA512 b54e7a2bd84c4ba3509be8d4a014d7e51d776232f731d6368ec35fa97ad628918cee89b0f762a2c6a2ae2011708b3853ba8e8ff55f00e438d39933e3ef30390e
SSDEEP 384:HXwIiO024YfWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAZ1L:36ZYfWTToXJWTTogB7S/AmVAf+hRMI1L
TLSH
T1F1728E7D9F013CAC175790E8C8B98355CD18B2ABDFF5C06D25983D09CA88A1A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

733849FFDF119F55FC621850508A6E493C2FEC79

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\733849FFDF119F55FC621850508A6E493C2FEC79
Size 353KB
SHA256 59223d570560d5c4529df44ef927caccf90e3eb8d3d28abc45fbd5fbdaf41820
MD5 155b0b5100150e8b84cee911d6b0d78a
SHA1 4c97681409f780f0d6fd3f4fba8329fccb75bbc5
SHA512 cdecec32ee2a1d05d34c733e14991d0fdb90bfea1c61cc9365055db5deaceb2bc469d2e34fa9ef87120a9cf3238e6087e988f54fff316f0c30494a64bee81f8a
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRq1:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEm
TLSH
T15874232B2E0DC93227874796503E392C89014A1A4FCF66D51B6847E8853CAFBADF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 0b211aa964cdf241e07140a603023e455267919154282074bb13ab4814a985e8
MD5 f3042bcff077e8f6ac731c5af6d575d8
SHA1 5fbaa5b6854d11fe146f2724b78d9bc665969432
SHA512 38ab1270bfd944768cbc000624e11d9557daa86403c6cece1acd190749e153ed9ab91f7f1d0edf31058ade2f60cbe0f5a111d8552e3e3df8c42bde37923aa3a2
SSDEEP 3072:j3lfqmf5pV6IgS7Th9PDOkUzoxlmST4857W:pfqiUIgS7l9PWzoxlmSxW
TLSH
T10EA39FF6DBA28D7D69FFD42CAA92843EFD266404B3D33019C813261466C6F786779608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 a975cdf0edb22dd31d613f509d2fd5aba9488e964812cb3e7fc753dc4831b4b1
MD5 b32ce4149f5d4c03e55a12303e85f9d6
SHA1 d523d3895fb22fa54dc7ba7d7f51ec653c909266
SHA512 5e1ab28a751c9825d5887b75c00fb78ffe967858c6eec9121dab8930b3f3f24cca4732766a568dd292366795299e6dbf537c6cb4ab2cf94a7647496954582a26
SSDEEP 3072:X3lfqmf5pV6+hCoFSGrh9PDOkUzoxlmST4857a:FfqiU+hrFSGN9PWzoxlmSxa
TLSH
T199B3AFF6DBA2CD7D69FFD42CA682843EFD266404B3E32019C817261066C6F786779608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\AlternateServices.bin
Size 6KB
SHA256 b95bed98a60fb1c4a0d663d7286552da157fd6d093f50e5bf3351dfe4773c056
MD5 e3497f6d1857cc226541a92794a46969
SHA1 890f27e04bcf9974202d58944dd48cc004884ea4
SHA512 7e5fb1f420d4789ca532a963873b7c3d048d87d9ccda5b2c0a82ec475096d1c0c9505658daa8505393444ba280251c0edec37da1c84b1c4f3d0244985a0a1746
SSDEEP 12:TQphMQSQEy34nw7qncgXbm0w7o7d6EcgXD/hQNsOpjlzOpKpcE346cjnc3XwBf6S:TuhMZpeg1XyxaXFX+lzvNc9Bri
TLSH
T1ADD192F383729061F4514FB0948930686C361769467EC48A4B06E1D702D27E5D0AEB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\AlternateServices.bin
Size 8KB
SHA256 7e39eba7d6c8a169635f9071841190cd59af1372b8989ea4ca85edc3c74495ed
MD5 dca22760e0db4713bdd6e75a13d37340
SHA1 6f19264e7c6fb55edae1fa8669328606893e3fcc
SHA512 6705fbd4cf54535a6ce0879c461a92dacf5546bc59652741ca78f42766c1ec37e45d9211596ded2f1a0ade0840a12306450b688d7207d14297b2438da47a2b59
SSDEEP 24:TuhMZpeg1XyxaXFX+lzv091XiVc9Brik9Vvr7iUF9Fn7i:HX/XFX4uoVO8GBr+UvJ+
TLSH
T1E1024FF35B72A0A2F0A28FB19098716C9C331669457EC1858746D1E702D2BE6D06EFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\AlternateServices.bin
Size 17KB
SHA256 fa31d33117fcbd09a74ec583eba1831ff12292454400e71576407a8d490d8ee1
MD5 40ebdf2d902e94b962f3c7ff4ec86b69
SHA1 ae2b40bd5154e053f922acc6601e00536103aafe
SHA512 b48b6e3553348c964005de67b52e0b9b527d6c268cabd654247b2aac2f93d6e4e8b03568c9731958763cdfa60321d3772e7b537fd011f6cd6221cb6c61522e2f
SSDEEP 96:HX/XF4WyuZMH+eGBaUvoSshb5bM/p4isRkt08WLiPed:HX/X7ZZJNOQB
TLSH
T1EA822EF35BB5A063F0628FB190A875AC6C331229486DD1948B46D0E707D27E5D17AFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\AlternateServices.bin
Size 26KB
SHA256 e827a84a82b57bbb8514607c774ae23206c1503e7a34e1eff0a8570b7d5ac6ad
MD5 04627eff3f102d33f57ff0b8529de336
SHA1 b89b1053b0218c55cccc6dd6e4306a9fe9baef54
SHA512 fafadf3692601749006ddb8f5d28ff96013955657bc5f89a2c8b0d98738f6fadeca05bb48862ce57c49d75f463651d930bcf76bcf5fa26affee491dbc49ff7cb
SSDEEP 96:HX/XF4KyuZgH+eYBgwO46vPxM/pmrPbtZeEpiPeflya3N2JYYmXgaffPXJ1ZR4o3:HX/X/ZZ9KQf+YiXZtS
TLSH
T1F1C292F757B5B062F0628FB190A874ACAC331265582DC1D48A46C0EB07957E5D27BFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\addonStartup.json.lz4
Size 4KB
SHA256 b8029ebe62b492566158f64eb45c0a9c5c88acf55aead9155339900b200407aa
MD5 8b598d169b4e1ffc8405211a60db7cdf
SHA1 1d5ddc76245c57daf339a7bd8987b44e62f38a09
SHA512 46e1055305f565fc590009b5c09762f1c4df9441781f6b5044cdcc5a4306cb7efa0d6b056f694c29d88fd68b89fade53e20a3bc5278858dd4d1402cbfe957c5a
SSDEEP 96:NGJwMq4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NGec52xxhD8rGvm6ApwnHUuhN
TLSH
T11FA17DBAD541EFA1FD32C04358D97FB2E696AB7410B9C4D4F1AB71294C74A735700340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ff1699495dd79b1e966af6b996ce813543ee0e4959f9a954cefa31c4c0378860
MD5 c450546cfc7841bd02eb02cf563b06e7
SHA1 7c94513bdb50c4d10f04751693555ae4ff422f7b
SHA512 8b2202931ea283136fe9ccf2c52eaf71531375faf83c986d49f9c51acc2cab3d607a2dc0880f7d9a1ccc86d724131c47dd8d15ac5aacb6e79aad28d7b6af97d0
SSDEEP 192:zlcyEKHOv5zbo7CZxTHHyjiW9+c1d66JoztdzgCl6mc0dz:zlcyEK4boOZxTHHyjiWTd66Joz/zgC15
TLSH
T1BFE131A8E628867FC408427BCDA51B404F35389A9C8E3F19359CA41D2D572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 09c3935467770bd66e9f1a22f0147b65660e2ed63791f871bf768aa86a29cad6
MD5 07d338c1ddcf866caef745418e6af137
SHA1 310da33146255884f2083dac001931ab3113dfdc
SHA512 fb5d6d9d7523252e962170a2223bb7e6165b30858ee58814f444a19917ed01dd9e2f72033ba5eef70cf158dd656634f4500f6ea1cebfccf7b3a1346b3df63dd8
SSDEEP 768:i5If1k5DfUGcm+um3KqGRuvbgb2IF1zciQjHAX:i5If1k5433fi2gX
TLSH
T110E21044FB2A953FD41412BBDCA51B042F79B889581A2F9B3A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0a201ae4e42e50b45050265a05122e9164128c12cfb6fc25823e14a5f2b5ede2
MD5 3b192a885d92cd9d419a519edcb951a7
SHA1 a3f586012c491d752a474c3ca1580c0d14f6ab1a
SHA512 5d0730b3ba9af1cc57e2e25267defa7cdee634f7b3146985e062835a473b410c8c5e34be3ae40484cfe1b81264c5824e7cfc0c03bd3b67b43c7049fd9b6eabd8
SSDEEP 192:2lcyEKHOv5zboDZxTHHyjiW9+c1d66JoztdzgCl6mc0dz:2lcyEK4boDZxTHHyjiWTd66Joz/zgC15
TLSH
T1F7E13168FB28867FC408427BCDA61B404F35389A9C8E3F19359DA41C2D572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
Size 4KB
SHA256 fb8d814d4c63512e1609364ce38aaca115eddbf35090b8d2b6ae307cba7f5888
MD5 f341a9d02f8f7d847572b4094a5210c8
SHA1 41b1847e5266c422457079726ffe4808c7eef58e
SHA512 94d50262d90fb0627dbe2e943b4c63c6751c06928de11e12ac9cc82f0645c98ef825f257f01456e6d01c722f2acf9907692cd52a4af64087a256909afbbd0c45
SSDEEP 48:YphheTPR7n+6TKBJr8wi/sFIfLPs5nZGR0StbwmbXZ1w+34qhMz3+IEzIBi/9b4K:NSeG4L0kRZu+EFEcEkr6w64Ro
TLSH
T17CA1F06C75AA0CBF69C7D6F9F441029D83D84783848F1D874CCADE48CC5AA9AB25F429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
Size 1KB
SHA256 edeb5395685c297fb742e69e4c1e32c414d173a94254ec0c56acb39401ac2eb0
MD5 2366fbd5c48ce159ae16109fb48bd686
SHA1 a8603e8c764aaa9fcb3e78d2f30bf1200de4fdd8
SHA512 27a4140d2355f7ca0ecd2e03bd5fc13626d76474678fdb7607c35ed8d015d41cb580100a28435a82d839a9da62ed8b879cb45020bd6231021cae44745bf43112
TLSH
T1122191AC79BC4D6AAC87F67C7481029E93054E4B448B5D434D02DF8DCD91AD9B1BE83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
Size 3KB
SHA256 a8bcc9d3c4e3381037d47026e32f1874d10976e59bf930701c2598e6d70b1582
MD5 8e5b730d707d42cc9ff67afba95bcb99
SHA1 bfed6ebb13612d60728ed7906c45a8224455a94b
SHA512 b9b214672f5d88677ff4d4430a47077bd70ff9b0db7cc51607e4f345808a23894090a7bbc47225d3581bd7ffc0a532123490dba304f75a7f34dba188ddf0abde
TLSH
T1C651E05C65AA1C7A6CC7E6BDF441028D97855B4384CB2D830CC6DE4CCC57A99B25F82D
MD5 SHA1 SHA512 TLSH

Submit Download

33a80895-d57f-4e18-95ef-ca28d2cf93c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\33a80895-d57f-4e18-95ef-ca28d2cf93c0
Size 16KB
SHA256 ce027d637c50c010b4f58c2ea5ef56af0293d3987cd821fb0467519b0425f87f
MD5 6e7a45ce794f25a95134b5e8c5a8a628
SHA1 3588d1316e426f5a4945441bbcff6303f9cfabe3
SHA512 b2c03b62d687eecf9a627201f8b75241dfbe1d626c1446f637f3b6c4361ca5a7f5bca67b84fb37f4093a2c532565c9ff106995e1450f52738dd2ba5b2188860c
SSDEEP 384:0TPTtgM9y6/Eu3ZHliK/JKR56jTdPAybS:WPBl9yAnFJJm
TLSH
T1BA72DA16282055BA8691E36994FC7FC3E5F528CF4C418FCADBE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38342e0c-1606-4e44-ab4e-25ade2bd6ecc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\38342e0c-1606-4e44-ab4e-25ade2bd6ecc
Size 235B
SHA256 6ed4d308bea2cf18fcd3d2a5154f8071bca17e183ceff4ccef03bb1eb9de7347
MD5 be096d1522dc92daa3cd42cd07dfe253
SHA1 5a7c29dc1aa63bc97807bb42aba343a9000939a9
SHA512 5fbd48669d2384ea3cace9219302a35e75e68fba3230f574421b58a06e4fa4bcbf66d7643799ea2dcc1a4d589035bda3aca9b758baf698cec2a8c0561ce0dcc8
TLSH
T108D0A79968A8676D48148F1BF0A56FC730684C3364B69820D9B24575AAF9DC84191C66
MD5 SHA1 SHA512 TLSH

Submit Download

6f8b9a25-06f0-41bd-8b40-035ad5547b59

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\6f8b9a25-06f0-41bd-8b40-035ad5547b59
Size 886B
SHA256 a0a73c3d34fa2c7b6f721fa058920be3bb5498691f455928c4bee1d75675a407
MD5 144d612851a467d661e4db5e7f53404e
SHA1 0464e268cd320d5e88f78b4e79bde931663345f2
SHA512 d2e07743832aefb4c57ba14b9b0c8e3a8aa3aef4dcdaf0756439adced6d9f9b0dbdf9b1a9e919dc8658d0ceac6ee9270b3fe39be84cbe77b4af6c785aa507213
TLSH
T16D1123549B38BAB1CD2CD14B85D47746CBE0243380CA4D187CA18F2C4DFEA2EB366617
MD5 SHA1 SHA512 TLSH

Submit Download

b31a5a83-ffde-4ab8-ad26-c60bf8c1eb21

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\b31a5a83-ffde-4ab8-ad26-c60bf8c1eb21
Size 2KB
SHA256 5eaf4b31372217855eeeb6ee7eb5414be40388fa0b556eec60a318beeff6897d
MD5 2eba4a07d972d195f2c9ab444d078524
SHA1 4848c4eacf480c94d1de4fd7a708ef0e80600127
SHA512 7c457629d11d789382f41cef5f440402ac853b23e08f9abee02ae10b5018bde69956b625fe7eb92a3869f5d43b16b4c8792fba8713b7169bde0ca2c030915603
TLSH
T10841136C39B84EB6ACDAF54D9481334E47A08A1300C61C83AD52DE4DCD9769E73AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

e454b754-fd81-4e84-a36c-c9b512e7dc06

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\e454b754-fd81-4e84-a36c-c9b512e7dc06
Size 883B
SHA256 56f3801af7d0c3fe90ffb6a7f9b476585f130f75767185fab21b7a4b456f3c64
MD5 e8adbd76d70067f58f310348f677bd0e
SHA1 0b552e78d512ac2b3e3f924090ec93b2b1d8d9f6
SHA512 c7cb3810b0aeab0e988c288bc5594e2f5ff117f7e8ba576648dbb81ed52d47af86d98b4a35ac0db6fb63ba994f294eb0183720ed3fc391e919d763172f5e3e37
TLSH
T12C112750A5347AB2CC2C920FC99537469BE4252380C685143DA14E1C0DBE65EA3AA64B
MD5 SHA1 SHA512 TLSH

Submit Download

eec2a0ff-9731-47f8-b587-1ab1bad8ccdb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\eec2a0ff-9731-47f8-b587-1ab1bad8ccdb
Size 235B
SHA256 c6386da83254ed13ea8a5cc4d768648a2529f393c50dda1c0f951b02883fd544
MD5 98ef9c916cee664e96f67e3bae6b66b9
SHA1 962f001cefb4e5472b3f1cd53d3fd2ff14838d3f
SHA512 3ff95a6a6972e61f6ad5d7220b88a60c8c659022d18cb3d71a2b11f8e56c596ea8a06edbb29db0fbd3638dc029076971d853dcfceb99229b41391a8f2d186e8f
TLSH
T153D097C4188C732E09280F17F0E028C271C88C3714BCA82185A201789BFD9C40152D66
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extension-preferences.json
Size 942B
SHA256 a56a46aa7451d640626f9adbce3ffb26ea6ab549f15af56fc2cd69f0bcfda67b
MD5 8913f98eab4828647224c9a64b706b3c
SHA1 f886a4456ee44a4e73ef32a2b138193f2fa41d37
SHA512 28869c106812bf053c732469b0f67da993e42a471c7b576e68d45fe66d2f067bab0a66c5334e88c6460e08a06285daa643f5f34771bd0d7361097307137e1630
TLSH
T16211F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extensions.json
Size 14KB
SHA256 9795b210f2fcab9b31f2600f147bf4b0abff94ed1e74a52bd757d44505c61a60
MD5 f04c529a0d10aa0146d03093f8628e9a
SHA1 c446a4ab8dec05e92923b971204f8eb3025d34f3
SHA512 aa34cdf2c15fce60f112cb20f6af1983ae7045d87b6ff548f753119c28d9f9174891ce754645d1760d6e51902fef1f78551c01573b2cb4e15d9e13faebc403f5
SSDEEP 384:DkI4vLUmldvg8dhW394zg96oUL4HDL4PiL4HRL4HSL4HC:AI4TRfZXW4I614P4o4p4A4i
TLSH
T13262531545148EB8298FA78BAA36BD01C37D473B60445C78F4DD8FC842FA6B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
Size 7KB
SHA256 4ddc685b554310aa8c2fe17bea76a5f584c7151e40aa37f6afe9d0cd70ede241
MD5 8f77ce6b477c9100cc59a985a0a93c36
SHA1 31e8f9c6a8fc3db1645b8343fd6c5560bd8ed609
SHA512 c99d9b3a3c536c0324b35e0301c6155ee3445e43dd7ee36053608ff85b371c21f1b17f5021f6261a41bd82fe65ada6e6d397c751120dd592c7aa40e335f0cafa
SSDEEP 96:xHABTUvqGqjfL6OlObzSFSSledv9jwnGHtcSXtBw88HUZ8L4cnEK1/GJGS:+bRjfL6MPSSctrXtBw88H/uT
TLSH
T188F1EB7C5004CB6F64B676BCAC6449315AA2013BBBBF68D750B984C5055CF3881FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 01e4c58a772b9672a5e38a35c40510d1961dcedca6172cb0006cd9eb1a37db2d
MD5 a1bed0c9e2f3ce03c5a239bf60775829
SHA1 8f9b08f297682431e356e171a28d2ac16d05febf
SHA512 5cf7ad72f0e1c5b4ff7c3cc2c20a3b2a6e479167d9c7b22cc960bd63edb2d7ce3d7584b201da2b799efe9b0dea88e21d1e2e5bbbeb85939e25aa22bad51ab31c
SSDEEP 96:xHAUTUvqGqjfGrc1zSJSSledv9jPDnGHtcSXaBw88u8L4cnEo1/Gc:+SRjfGrcsSSXtrXaBw88zuc
TLSH
T1DEE11E789448CB7FB4B6766CAC6888315AB2013BBBBF68C750B554C5050CF3881F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 7KB
SHA256 96f3112fa83d87c08697499054d0f6af907fff1cde7a10fe31e9991004c62248
MD5 3bf7eb1d2af72d3f7a99ce2b1aba12fc
SHA1 ec0b561d4c6b041806eb5808012f0f67204eb0a4
SHA512 5a1f0f7b4e4110ca4e527a0f64c7e1ca9e6e861b669e45f5d0a385c5fb27be93323f04297c4e0538d9cb5bec49653c0e2fd6eeb8364d6010f130aae12633b21c
SSDEEP 96:xHAUTUvqGqjfG6OlObzSFSSledv9jwnGHtcSXaBw88u8L4cnEo1/GJGS:+SRjfG6MPSSctrXaBw88zuT
TLSH
T16FE110789408CB7FB4B6766CAC6488315AB2413BBBBF68D750A554C4051CF3481F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 12KB
SHA256 fc1ca5c1a8dd8dd64a2ff3871a74cb784e23f7d5dbf7e9cd161e5d2089b9fb62
MD5 09f5091f7bf1ab25e29d467b411e85a5
SHA1 0476bc3ffe293788d0c9557a1436da2d444879e1
SHA512 79f53b23a0aec44b2a418c908425e24ee9a1af8d1c8b3e87e3935805472ab89d0e65ed32ac7111c8140fc2dc765f85dcc910527a1bc3d47e080b3f89c8733a6f
SSDEEP 192:+bRjfL6MwSSgLRV5rXh6/Bw88H+I5N8pXTuT:IRRV5rXhIwBqjuT
TLSH
T1B542AA7C50418B3F60F672BDAC254AB01961416BBBBFBCD245B894D2045DF28C1E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 d220d1187f69735281561ae3c5a7a3cba66df582d6bb6f9de8386034104a013c
MD5 397a31bb19dadf475319de7e994c9c63
SHA1 94094caa741f1cbdfbf0821a9dc9a60d8a70a2f3
SHA512 2c4a0bc8c4031b8bb67ca9ba5d75d501a642ddb9e67bfd163d37c2e5275ec94de772f8ec731558ebf2513afbab287f0269884135e7e72b9580fa5e66e1fc4307
SSDEEP 96:xHAUTUvqGqjfG6Ol1zSFSSledv9jwnGHtcSXaBw88u8L4cnEo1/Gc:+SRjfG6M8SSctrXaBw88zuc
TLSH
T138E11F789408CB7FB4B6776CAC6488715AB2013BBBBF68D750A554C5050CF3481F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8e384930a11eb2462f0bf6af36263f4576118bd7dc45e1e4cd2584e86cf97a5e
MD5 3ab6dba2a6b90c3d5b984f4d57a59924
SHA1 84562dba81fe9cdd9a8cc4f8a9a3322a25efb1ec
SHA512 3f5a4648b7ed7b724d7e23daf64d86b67442ded2dc5c2a52aec36793c48959ed58b55a99054b0774ae0a83330f793d178982b01272c83107c6c61316024b8955
TLSH
T15531ECC2EDC437F32630D06575819F755EAD102F466C08F4B706AD7507B8549B79E389
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 78a523beeb65639840f3063bbf42d5ad607101063bbcd091242b53eff795a89a
MD5 a360021ac145c6d1a7fdee5a3a0bb6fd
SHA1 9f7c956589354b365fe966e0fca3686167e580bb
SHA512 b90d87b57f148da4611b8d49055485feb74618dbcd23aa53f17ee7b09351b33edcc592109951141d62d0a1ba04dfee9923f1a41aaa64bef6266f9bd118b0125e
SSDEEP 192:m1vS491aHnNkwVyv81kM6LskLmUWtHTtS:mL2HNrPmYFRtHpS
TLSH
T175D18F27DA4C96C2E9B4716610D1CB62E7BBB00486E40DED4F12537A44F70945FCD676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 12fdd9a108e2c09cdedee8f99edf368f6154d584aed46f8dbd5082a965d3ca71
MD5 dec7f241924de1dcd01833e2a665c768
SHA1 c3e701758a6ef547e1fa8756c159b2b2806ed7e5
SHA512 ff84bf3f3d8cffe1b10f83adcb44b5cc6c7706aef41031c3c46b684937ac6bb50deaaa33dce712454ec256becab9e295ed1047bcfa6d563b70e98347e8662bad
TLSH
T16431D78599ED0AF52411A27BE0C5AFF6EB68102606CC64B0C48DE90140A86C8BBFF14E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 d28597dd796dc1d0fe5106be92abfd4f27101d2ade90327b46a07f0d2d295b7f
MD5 2e38166838c7b0d13363bb031da31a4d
SHA1 9acc3009ea5add67d11d718d22925a981841c957
SHA512 809765528d2a0cc84218e7baea283ad6aad77e5ed9a6293d72bdf7d876047f29a8f64ad33e916ad2df418c7d691a9b5c88f5a8732101a76454061f83716499f7
TLSH
T13B31EAC2EDC433E32520D06575819F755EAD102F466C08F4B7069D6502B854DB79E389
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 44156d0301196504694fbb43e5309eee30d25282d90490aca8d24322afa57653
MD5 c8ee08344893728e9abc5820e4975c1c
SHA1 026aa3dcd5dc39e0dd913faad8a49057c27e9486
SHA512 ad9dd4b72cb533ccfffff014d135be7790eca53e855f6ab23788a4725249aec4a67fcb0c42cfdeae2435f913e31b0678fa8bfa48a691fd68abd3d5f4eb342b38
TLSH
T16231CAC2EDC437F32530D06675819F755AAD102F866C08F4B706AD6506F8549B75E389
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 06806d6a01a8cb0f7df012b37e475cc0e4373796dda983327af1edc320c36e82
MD5 7e0f1a37d9217a25e3de3f3b853370d8
SHA1 d08d2ba8acdfe48decf67a73de71f0096b5e0928
SHA512 bb1aa6a6a260c4730c60f687b7c51c9ac18b5d3207978311ea2bdc444e8b1455d923823fb897e39a3efbf6cdcdd0c36a148d484280f8b662537a6264167b36f4
SSDEEP 192:gvS491aHnNvMdwBB7QBtHlgr8Rcot/WVcl3uqOmfs9S:22HNOwBUH/t/iUeqOkWS
TLSH
T197F1B083E160A2A6E36030944959DF046EDD652E8DF405FC8EA259EB0EF86059BB251F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{dd600a6e-a54c-4973-b60b-ec3917419adb}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\storage\default\https+++www.whatismyip.com\cache\morgue\219\{dd600a6e-a54c-4973-b60b-ec3917419adb}.final
Size 79B
SHA256 f110b28a486ab66369b145302adc5ee6eb1995afa0fe19bface6093921f0ff1d
MD5 1a79c8562b1ea63861334c91fb16426f
SHA1 79d72d9c1afa754147fcfaa7f07a9e9a0be62641
SHA512 2f49a4849c47bb4c99d4812c956e841a1448ac4c452edc9bef92efced5d4d07f553fe07a8c562ad872d92d62e66b519fa66f2a06bf834b85afa7f6809d1eff4b
TLSH
T16FA0120FD402DCAB020420056023A29D882500180930905081C8080A041C5913518048
MD5 SHA1 SHA512 TLSH

Submit Download