3f68c47b27c7d7bf247e54e69925221fe9b71efc898929913acc507e926077fa

Analysis

user interaction
yes
max time kernel
299s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
audiodg.exe
Size 4.5MB
Sample261107-vybs8sdv8x
SHA256 3f68c47b27c7d7bf247e54e69925221fe9b71efc898929913acc507e926077fa
MD5 448afa1dcb16847ca7a211cc15ac5239
SHA1 2bbe7c3778716a56332c6d677b8599d136ddbe17
SHA512 a3027e260c5e348fbf29d0b67115a8c5b7c20480ba6e1726661f8667bf4b0e6ee10dd24b580c5ffb47410a0bbd67899d9b6fafb8701aafd39a3c2b2f9d392b91
SSDEEP 98304:OvmSJIy285d8f/jZzcGfK70YBRLuhClKKOHUT78ZQ/Tt6JdP8rMyL65WXHv4glq:OvXf285+/jxcGS70UluiKKOH+I656D8Y
TLSH
T1172633E6CFF479AAD05820723924A23D3BC35F4E9CA44929C65BB54B31146C572FAF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	audiodg.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	audiodg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	audiodg.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\audiodg.exe	audiodg.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5004-0-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-2-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-1-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-7-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-4-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-6-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-3-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-5-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-8-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida
behavioral2/memory/5004-9-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\U:	unregmp2.exe

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5004-2-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	autoit_exe
behavioral2/memory/5004-7-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	autoit_exe
behavioral2/memory/5004-4-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	autoit_exe
behavioral2/memory/5004-6-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	autoit_exe
behavioral2/memory/5004-3-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	autoit_exe
behavioral2/memory/5004-5-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	autoit_exe
behavioral2/memory/5004-8-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	autoit_exe
behavioral2/memory/5004-9-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5004	audiodg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	912	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 51 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5500	WINWORD.EXE
5500	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
5004	audiodg.exe
5004	audiodg.exe
5004	audiodg.exe
5004	audiodg.exe
5004	audiodg.exe
5004	audiodg.exe
5004	audiodg.exe
5004	audiodg.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	6080	firefox.exe
Token: SeDebugPrivilege	6080	firefox.exe
Token: SeDebugPrivilege	4264	taskmgr.exe
Token: SeSystemProfilePrivilege	4264	taskmgr.exe
Token: SeCreateGlobalPrivilege	4264	taskmgr.exe
Token: 33	4264	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4264	taskmgr.exe
Token: SeShutdownPrivilege	1644	unregmp2.exe
Token: SeCreatePagefilePrivilege	1644	unregmp2.exe
Token: SeShutdownPrivilege	912	wmplayer.exe
Token: SeCreatePagefilePrivilege	912	wmplayer.exe
Token: SeDebugPrivilege	2476	firefox.exe
Token: SeDebugPrivilege	2476	firefox.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
912	wmplayer.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe
4264	taskmgr.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
4264	taskmgr.exe
5500	WINWORD.EXE
5500	WINWORD.EXE
5500	WINWORD.EXE
5500	WINWORD.EXE
5500	WINWORD.EXE
5500	WINWORD.EXE
5500	WINWORD.EXE
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 6080	4200	firefox.exe	91
PID 4200 wrote to memory of 6080	4200	firefox.exe	91
PID 6080 wrote to memory of 5988	6080	firefox.exe	92
PID 6080 wrote to memory of 5988	6080	firefox.exe	92
PID 6080 wrote to memory of 5988	6080	firefox.exe	92
PID 6080 wrote to memory of 4252	6080	firefox.exe	93
PID 6080 wrote to memory of 4252	6080	firefox.exe	93
PID 6080 wrote to memory of 4252	6080	firefox.exe	93
PID 6080 wrote to memory of 4252	6080	firefox.exe	93
PID 6080 wrote to memory of 1644	6080	firefox.exe	94
PID 6080 wrote to memory of 1644	6080	firefox.exe	94
PID 6080 wrote to memory of 1644	6080	firefox.exe	94
PID 6080 wrote to memory of 1644	6080	firefox.exe	94
PID 6080 wrote to memory of 2176	6080	firefox.exe	95
PID 6080 wrote to memory of 2176	6080	firefox.exe	95
PID 6080 wrote to memory of 2176	6080	firefox.exe	95
PID 6080 wrote to memory of 2716	6080	firefox.exe	96
PID 6080 wrote to memory of 2716	6080	firefox.exe	96
PID 6080 wrote to memory of 2716	6080	firefox.exe	96
PID 6080 wrote to memory of 2716	6080	firefox.exe	96
PID 6080 wrote to memory of 4764	6080	firefox.exe	97
PID 6080 wrote to memory of 4764	6080	firefox.exe	97
PID 6080 wrote to memory of 4764	6080	firefox.exe	97
PID 6080 wrote to memory of 4764	6080	firefox.exe	97
PID 6080 wrote to memory of 3768	6080	firefox.exe	98
PID 6080 wrote to memory of 3768	6080	firefox.exe	98
PID 6080 wrote to memory of 3768	6080	firefox.exe	98
PID 6080 wrote to memory of 3768	6080	firefox.exe	98
PID 6080 wrote to memory of 4884	6080	firefox.exe	99
PID 6080 wrote to memory of 4884	6080	firefox.exe	99
PID 6080 wrote to memory of 4884	6080	firefox.exe	99
PID 6080 wrote to memory of 4884	6080	firefox.exe	99
PID 6080 wrote to memory of 4940	6080	firefox.exe	100
PID 6080 wrote to memory of 4940	6080	firefox.exe	100
PID 6080 wrote to memory of 4940	6080	firefox.exe	100
PID 6080 wrote to memory of 4940	6080	firefox.exe	100
PID 912 wrote to memory of 5972	912	wmplayer.exe	108
PID 5972 wrote to memory of 1644	5972	unregmp2.exe	109
PID 3532 wrote to memory of 2476	3532	firefox.exe	116
PID 3532 wrote to memory of 2476	3532	firefox.exe	116
PID 2476 wrote to memory of 3368	2476	firefox.exe	117
PID 2476 wrote to memory of 3368	2476	firefox.exe	117
PID 2476 wrote to memory of 3368	2476	firefox.exe	117
PID 2476 wrote to memory of 2888	2476	firefox.exe	118
PID 2476 wrote to memory of 2888	2476	firefox.exe	118
PID 2476 wrote to memory of 2888	2476	firefox.exe	118
PID 2476 wrote to memory of 2888	2476	firefox.exe	118
PID 2476 wrote to memory of 1552	2476	firefox.exe	119
PID 2476 wrote to memory of 1552	2476	firefox.exe	119
PID 2476 wrote to memory of 1552	2476	firefox.exe	119
PID 2476 wrote to memory of 1552	2476	firefox.exe	119
PID 2476 wrote to memory of 3696	2476	firefox.exe	120
PID 2476 wrote to memory of 3696	2476	firefox.exe	120
PID 2476 wrote to memory of 3696	2476	firefox.exe	120
PID 2476 wrote to memory of 5124	2476	firefox.exe	121
PID 2476 wrote to memory of 5124	2476	firefox.exe	121
PID 2476 wrote to memory of 5124	2476	firefox.exe	121
PID 2476 wrote to memory of 5124	2476	firefox.exe	121
PID 2476 wrote to memory of 2320	2476	firefox.exe	122
PID 2476 wrote to memory of 2320	2476	firefox.exe	122
PID 2476 wrote to memory of 2320	2476	firefox.exe	122
PID 2476 wrote to memory of 2320	2476	firefox.exe	122
PID 2476 wrote to memory of 4700	2476	firefox.exe	123
PID 2476 wrote to memory of 4700	2476	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\audiodg.exe
"C:\Users\Admin\AppData\Local\Temp\audiodg.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes a file named after a Windows system binary
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {410513c6-eb86-471a-8579-df3935ea09e1} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {0937c4c8-493d-46fe-a4fa-022c733c4929} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3888 -prefsLen 27323 -prefMapHandle 3892 -prefMapSize 270279 -jsInitHandle 3896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {c5fbc7a6-1715-46f9-bfc1-8629698e7d64} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4100 -prefsLen 27323 -prefMapHandle 4104 -prefMapSize 270279 -ipcHandle 4204 -initialChannelId {69dc6188-539e-4e12-b402-bfdb1a2cea79} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3216 -prefsLen 34822 -prefMapHandle 3224 -prefMapSize 270279 -jsInitHandle 3228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4748 -initialChannelId {329f4c34-92db-4926-8de1-154f7e1de744} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5116 -prefsLen 35010 -prefMapHandle 3192 -prefMapSize 270279 -ipcHandle 5128 -initialChannelId {f808a2ef-bc9b-4938-9dae-3f285578da44} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2756 -prefsLen 32952 -prefMapHandle 1628 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5520 -initialChannelId {11c400b6-b674-49bf-b7e7-d15e3941243e} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3400 -prefsLen 32952 -prefMapHandle 5464 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5440 -initialChannelId {2f9fb172-a65c-4e65-b1fa-bfc6e9e43265} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5896 -prefsLen 32952 -prefMapHandle 5900 -prefMapSize 270279 -jsInitHandle 5904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {94e53706-6e08-461e-bfc4-4a0601bfff1e} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4940

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2516

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\JoinCompress.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5500

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 2992
  2⤵
  - Program crash
  PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 912 -ip 912
1⤵
PID:4960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27057 -prefMapHandle 2036 -prefMapSize 270362 -ipcHandle 2104 -initialChannelId {2bbb99e4-d7b3-43a9-9a84-cc05c9feec14} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2232 -prefsLen 27057 -prefMapHandle 2252 -prefMapSize 270362 -ipcHandle 2376 -initialChannelId {1441938d-fb1c-47cf-944a-8c24fa6ed4ea} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3924 -prefsLen 27665 -prefMapHandle 3928 -prefMapSize 270362 -jsInitHandle 3932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3940 -initialChannelId {da29d1c3-8c99-4eb0-9c14-c5ae2b92cb1b} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4104 -prefsLen 27665 -prefMapHandle 4108 -prefMapSize 270362 -ipcHandle 4140 -initialChannelId {1565a1cf-d710-41cf-a77d-acc360f52f86} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4932 -prefsLen 35275 -prefMapHandle 4936 -prefMapSize 270362 -jsInitHandle 4940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4964 -initialChannelId {9a365e70-06a9-4b7a-873e-5b22d37a31ad} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3176 -prefsLen 35275 -prefMapHandle 2916 -prefMapSize 270362 -ipcHandle 2848 -initialChannelId {2846d80f-9070-4511-88c6-e01c90ffe483} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2936 -prefsLen 33200 -prefMapHandle 5616 -prefMapSize 270362 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {9c25eb5d-2116-46c1-b7bd-c7cc8ed8eca2} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2936 -prefsLen 33200 -prefMapHandle 5676 -prefMapSize 270362 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {32ed0753-02d3-4d63-a72b-2392e8b0d798} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5968 -prefsLen 33200 -prefMapHandle 5972 -prefMapSize 270362 -jsInitHandle 5976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5984 -initialChannelId {ea711436-5ff8-4f2d-87f2-202351ae3079} -parentPid 2476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 7f3fa39e916019d7e289e18d2ee1615d8924a1ac5e3c3d346a97474c1c6674ae
MD5 a4fcef3ef50a514381cab3f99144d690
SHA1 f51d4b172062fc37bc0d25c8c2fe7e3317f6e03f
SHA512 07a5bc4149ba74cc94a22bf7e47232783b598769cf5a69c666447132ce8ef683c8a5f7e794c7ec3ed5fd2b0f9c2ac4b387be76363094f27575fbf403bac1082a
SSDEEP 768:Df0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz9MjxngbCjPsgTV8:D698eoVYo
TLSH
T1E9840F37E5A0B098DB3C75B1E2AC1F4CBD72250B11E406421FB4B57EB6237D58A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 67b66b6f7fc209008c9af3fb5a8ba2903e3b2d280528bca9112f272663f556e7
MD5 eaf482a61734702522ceae3863d8f514
SHA1 8d7fcfc126a3d41a7435ddf8e9d197a9e480c50b
SHA512 f24938dfc80451e4349e33bee12ad7b6ea0a26df27f1bf6bffdacee21dc3a2a3ae3d0640a00c5fcbdd5d742466bafdb573738ca8072953395db5682db7313a3b
SSDEEP 768:af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr3UzfEwPRzitFrzAqUmNKX0AooJID:aNpZZQeoVYocxYCutFCJGAKt
TLSH
T1CFC42F379560A088DF3C31B1E2EC6F4CBD72641A12E016421F74B67F7A237D99A0B5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 75bb2b3e34130bf162501a198495115cc4c9c6dd6bff7f8cf553019ef3ccfbad
MD5 4b4cf5f110f95deea39f1dbab572e0b9
SHA1 9eb3ce3bc2a6810c333f453097f71eff96c78660
SHA512 9b8d236276d416bdb0248b12bf883717330aabfd134a050315c993b7ae4e4c90e3fe65ed05c2ff1de3b7fcb74975d3289067482a687a68999b67f9cdca8eb4e4
SSDEEP 768:i0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba8:MZP2tFP3vqY8mqEMSTaBacg
TLSH
T111258337D190B0C5CE2C7071E9ED8F09BA23A10B11A052465FF8A57E7A633D99D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.contile.json
Size 4KB
SHA256 46cacb09c803464103e81a1348914b2684797ad1958259be0e8008e66c525d83
MD5 2f08af65d022eb671238c46e36742271
SHA1 0890c92170c5c06ddb2dc3e059c166ff5ecf5823
SHA512 64c3a655d85d37514b220b6381345d836624c39f8d165aa46ad4c808a11f83a92df4d17548bfc02dcee80ad83970e74cb18d49987248526eec03a45f939dd6aa
SSDEEP 96:TOuMxmUqmJFaRT+mRBIn4KY8o+t6D88lz:bMxRqmagmRBIRtw88F
TLSH
T10691A64BC4748C172B72BAF55C0B37DCF10B700AD9F49B5871B99C2194B87BA80DA588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 ccb7962d30e6cd6764e8db5ab51eb46ed6dae2b227c6ed2a22258e7593aee6e1
MD5 dbc6888a8265d53ee44eee4dee8c5d2f
SHA1 af9e6b5aae7cd03a08e0de78267cf336b4d922b3
SHA512 a38e1e48c7d268b782df0630ae29f879ca5315cef2dd0dc4da4a13557ef065af506d09180bd14efcf506b6135dd7a32cd3c9e4c591cc70e3003dd9fccaab6869
SSDEEP 768:Gy5JGvQsD3squ+vYyBi+rPxiPtJq51oCA2XWOOriYFYDFB+G0XaK8BDBw:dTGwq1jCJiKCFfYFYDFIGHo
TLSH
T1E173F9A3A6E8B1BB0F9037CB2C0F795B62A20195E38506D9FCEDC91C81DD754113A6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 06564f2b865247503850efaef4166f35f402d66c8b5294babf6f04a3e18dca56
MD5 c202a48d6d70908c3ae2b7b89f55bd07
SHA1 2332f1dbba377b435059f9ad05e212eb3f62eaef
SHA512 e5083e6f936fb50f9f5d9da1d06f26fb348bd5d5774e2d1bbf215db168fa95322239a5d476abad8d3bda968e8d4896423532b2d132ffa0c7e57e52d672ba0c1c
SSDEEP 768:GyzbuNMn9hBkt2wA3icvL78U4mujRITZ9ct4pSNPPPsvhhJPiu4A8K:d+NEhBkt2J3Dgko4psPPPMX
TLSH
T18B730A7396B8B1FB1BA077CB1C0BBA4B62E2014AE38505CCECEEC51D80DD754527A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

17328

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\doomed\17328
Size 52B
SHA256 ce1de0f8d97e8cc1cd9b6246cd96038868cb64a2f2488c9b3ddcf41ea3cce63a
MD5 b0ecc241d85bd696258432c33aae6f5f
SHA1 f7fa85e8fa1c3e38b1bde93858883fbea8ada554
SHA512 d798c57b7b000842c6375b90e8395c604bcc69b68b53c226a102fbf35ad97bbcec9bed3a772d1c8c5f6a9c77573aa97f363189dce98729855e03df180b10062c
TLSH
T10D90020842618901D41891321940A6B408103F5045900B26F5925B9A44554D64410251
MD5 SHA1 SHA512 TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 e1b8116455ae862f8306bafee27d464b7d742c6453d4f726c07bf2d8802afdc6
MD5 4decbcb97fa14dfc5474634ecef5f8bd
SHA1 bd0cbf1c6d1a304b42cabbefa4115f79cb98cd45
SHA512 58d47c19fd34f8f3b0acca5fee8d78ddfdbd5b26a40a08892e16ccbd4f6689c54519a91e8fc01249b9996fa4cb17b4b37c61c854a23069688ddabf45c098adf5
SSDEEP 384:HXwIiO024Y+WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAHT9:36ZY+WTToXJWTTogB7S/AmVAf+hRMkT9
TLSH
T1E5728E7D9F013CAC2667D0E8C8B983558D1CB2A7DFB5C02D259C3E09CA98A5670F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 15KB
SHA256 7513e0e3ab174c17e6ce533832215156baff0344cb1fafd44e8c90bc9383d3c1
MD5 b7842de0b268fc1a5ca5ac2d87c47105
SHA1 2808a5dde46a7cca22911f14cce2c6f7de86cdc0
SHA512 6e7472f049276246be4aaafe06e238a32e4e5e5eb7252f53f23f554d971ef8bf5fe481b24687bc598f8a7cf4e2cd33ffefe29b7dbb8603bbec8f37e593d5344d
SSDEEP 384:ZdSoXyvDLuybJKTK5EaGUzHODWoh1B9M0lpDIIbwUiC:ZooiLLxbJMK5EaGUzHODxh1B9pD867iC
TLSH
T12C627C7F8D709C6A1E61E5E5DC9E29989C0FB00BDEE1E69C2AAC3801C4953BD50FD1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 11KB
SHA256 ca70de97eff2d222bf9b92459a75637cda832d8412200008e661a75039455916
MD5 05aae0c6e557248693acf41407a08808
SHA1 3fae4f9ae6505ef6b89eff9cdaec73bed67acc8e
SHA512 30a8b373ad0e1e364d8909de4dd8649fa2cc19d7a7fe026be743299a4b2dc74880ac372ebced9cff10f925bb54a830a5fa7481a11d272f7722630eb86a20c92e
SSDEEP 192:ijh5qmmPAK4ULt0U9h5qmmPAK4ULt0FaGUzcoOTH/E5oW65fBydFGf1e0lpBNDID:+/qmFTot0U9/qmFTot0FaGUzHODWoh1u
TLSH
T177426CBA6DD0642C0D9189D1EABE24580E19F913EDC2B1FD2C0D7648D8C16BDB1F92CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 256KB
SHA256 cd963f9fd29a5939d488f4a973aa53c610c02cd13a4f1be3b4aee6872fab6748
MD5 14351884e6675b3eb35780ce4cb47e3b
SHA1 4998ddb2f54dbc315ebbb9f27af141d3c54d8f35
SHA512 b71994140d173c1aa8051f56eb089d5d55df523dfff36566dc04f406b4c5aabd8bdbfa0767b9a6c8465f135f9c93d8d22298c97ae141f149cf3904f351bbd104
SSDEEP 1536:QYCYPsLuzd0FSPrhj9vkcIItML8t9p3zjMF7BFRQLYyQfUK8Ct92ZFZWkM1SCumJ:buKjWcvyYdMF7BF6kyQ52Zj3y
TLSH
T1A14407F3D6AC70FB175286DC6C0D72CF62AF4139DB5208DAF86CC148D2C9A651076B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DE5F6CB1BD71958EB146CDD974763A3115937269

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\DE5F6CB1BD71958EB146CDD974763A3115937269
Size 12KB
SHA256 f1fd4890e5030b5a89ae16eb2c855e8d457cc9bd17d020fb7b9df8f1301d6da9
MD5 ebcdc76b825ea601d91d238510eb6fd3
SHA1 08f63d39f239cb71a879017cff9dfe5c9e51d44a
SHA512 e4852a5efa39fc9065c4557830127641d565e456d31a5273d623b91cf12ae0f57d8ec6501ff5107e1d6a5c4ab6ed450cc9d1b3c21cca2c99f7393c3600c8a9cd
SSDEEP 384:ku0/qmFTot0U9/qmFTot0FaGUzHODWoh1B9M0lpDIIDs/b/I:R0Slj9SlSaGUzHODxh1B9pD8KP
TLSH
T156428E796E9014680D9196D1E67E20590E18FA13EDC261FC3D49B649D8C16BCB1FA2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 11KB
SHA256 6c846da5b7654540f0549a8e082a87eebb78bce3474d3c6c61788e2ff775f2bc
MD5 5fc6bf469c0857e1e87eb23f76daac8f
SHA1 87c05fd824a568dc3142f19582fd44d274615467
SHA512 1d1b4b4d7067f76d0bd29942c03376860cb61606da6610b35cfd4ff1c60168b05d1c23f28739c4e05f5084bc87aacce70ebbc2b4c6234d5f87c30c6c002ebaeb
SSDEEP 192:ttwZh5qmmPAK4ULt0U9h5qmmPAK4ULt0FaGUzcoOTH/E5oW65fBydFGf1e0lpBNW:bq/qmFTot0U9/qmFTot0FaGUzHODWohi
TLSH
T18C428D7AAD9024680D92C6D2E57E25195E18F913E9C2F1FD2D4D3248D8C06FDB0FA2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6DB2CC802065A948266A380F89F5EB80BB1A349

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\F6DB2CC802065A948266A380F89F5EB80BB1A349
Size 11KB
SHA256 194e8ae6216500d46066117e89e14478edbe9f1b9f263ad1e75e81aae8f77634
MD5 a888f3478909fe775c294d999bc8a885
SHA1 96e4df5dfce5968dba654894b119c5d6ee6a9119
SHA512 a63b1bbd006a8ef846a28d73094da37ee800187d6545c8c8d1b53650d67f503c59962f2bcdeb214be9c5662b8f2b2a8a07114cd3d077a39ba6ab202e96458436
SSDEEP 192:mH7h5qmmPAK4ULt0U9h5qmmPAK4ULt0FaGUzcoOTH/E5oW65fBydFGf1e0lpBNDt:mb/qmFTot0U9/qmFTot0FaGUzHODWohl
TLSH
T1CF427CBA6D9054680E9186A1F97E11590E18F513EDC2B1BC3D4D3648E8C16BDB1FD3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-child.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\startupCache\scriptCache-child.bin
Size 595KB
SHA256 d5f43f8c48902a8221c7c270349e8d48dd666f907dff1ca570df4b8ed84fbb7f
MD5 df177e2b2c1affd89df2e437d91acdc3
SHA1 7f9b9821c2b19f08dff4a064afc7c97734b04926
SHA512 91d6dfd286a10d1129ebb2163beaa16d03450e902d40e2ed5daeb15f659f293206bbe3625fc390fe57d44ecd04284e74e6260de19c889aa1f6243ec658e11c9c
SSDEEP 6144:5FCUbu1hjktpJn2pmYXHqjOcpEavSW2pshURAv:37ubotPnpvfh4JW
TLSH
T1FED47111EFA64E23C418037A48F753313A30E1451BEAE3176F8F7629BC677A91D8A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-current.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\startupCache\scriptCache-current.bin
Size 9.9MB
SHA256 823dbc204ade43bf3fb93ffb27382408f2ac7e44471562779c01daa187290e0b
MD5 773eb35ad8c30a304475d24fa9a98e7c
SHA1 171e48c60c57ef7bc592ac4cca4feb2f8ae8bb06
SHA512 d3b3b336bc6b08eedbe1693f5b245aa43499509bf7b9393a765df60b249e1761ea678080d43ac96ada733686173cda7526a41e647fb1c58cb9704f1a154e5cfc
SSDEEP 49152:JkVvxHNHhFDzwH6f8a5v8bX38zYPHpJFVFwjdhCX2Ee/3UbSQD:wv1F/wafI5PnRmS97
TLSH
T1EAA69315EF664E23C468027A48FB53313A30E08547EAF3276F8F7129BC6B7691D8995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\startupCache\startupCache.8.little
Size 8.2MB
SHA256 a336b643eb293b3655cdb3c2f207192c539ec3f35a3f0135e16c295d46b2b5e1
MD5 759f8a6edfe385415048ed2beeff6a42
SHA1 6a8f8e27fe43b5c89c3a870394ea6238151090bc
SHA512 06dfbf69e1f13286f964cda56e03a936cc44eefd6d979263d447994ccdcb3183e550e750569be8ff9d46cf0b323b0eb8b4be23846a2127b09f0733e1156ccbdd
SSDEEP 98304:er3aLiJPeeNrxrqh8fVmoui6lwvfNTng8VXKFGHhOR:SQi8ko89GiuwHN71oR
TLSH
T1929602B7B3590697C425191AE87A0A3937A3414203E166A9CF78533FFEC724C1BC6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlCache-current.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\startupCache\urlCache-current.bin
Size 3KB
SHA256 67faca9ac002fc644ec5276b1f14db00c44c394c5e4958934b535e12b2fc4259
MD5 d6e4f0cb9fccaa2308e6dc39bcf1f27b
SHA1 f303fdcf85b5f398ce94b64140afecb6e76b5783
SHA512 77e449682eb2d609fafd46bc1ff1f5907294747c03bf92e47f59e23607f429e23574b7f02b386bf5e885a0e4217244f5e050c692c46cac204915a6086b208dff
TLSH
T11081C342E43B743B7D66A8FBBD858075F820088ED1CD11DDF696639420AE7DC038EB1A
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 10f2c0f09982a3d841444821dbb29d455f92e450a7cb78c938d7135e1274a62a
MD5 b190ba42cd110c6af0ac3baa54d393cd
SHA1 d0dd907f1aae86695ffd3ae294ac2fe1979f0919
SHA512 825dcaef28d124231774184605af9e13759eca1e3032139f7fded0fe31a74b6602bd8b7450a3b7d3a3defa191381eae56399e2931472c20c9aef89d320424160
SSDEEP 1536:jTrliE/psD4fOh6V9pKmESeW6hZpV/6yf49a1fIiQwRXpuhnCGKm5eftzOl/Wq6/:j3lJW6V9qRIaVQwRXrtmkcliZJt9
TLSH
T19DA3AFF6DFA2C97D59FF802C9AD2883EFD262404B3A33409D963275452C6FB87675608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 ad7fa0e204c628b920ef82480820f7cd640767892d2a8f4c8de83ffc07c7bd2c
MD5 a683ecbc0042353593dd65a4f14d6152
SHA1 b67b3bf0ef82e6cc5e9d56a7a0c7015328f9aaf4
SHA512 83b45879208a3efbf293c834ff349c1f2708afcdbb42c27ab9f93c6cf6dd0236d7646123288ed72ec35ea4f9735f56c3550fd108320c9b23ad4f3f43370250b9
TLSH
T19C1181874A0AE475CD5147B359CC8A2773B6A7DF5364D025738EA01E890213E173D17D
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 378B
SHA256 f730541c6862c79eb0d83715b8e2ab7a3575557ddbec4973c16dcc5e26487ae5
MD5 b6e108a1397c246b774071d3069418aa
SHA1 c7488bfc508d91bb9e81a5dabd7c30b00c6b05f6
SHA512 6fb4eb2262cdead23d784da3fc11b07f45789e0b5cef1da25fe88c51058ac23e7fb86751e3c9df02925411929ff1518451935da6b1e342596c367e5b01074be2
TLSH
T1B2E0DF5B3B15F3F28BBC82587E3E5CE203F36CA4E35D202009CD1C810D08483085300E
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 c3e234ccc933e623a0c693f29cb8604b228d66b3b690a258a4f19920858a9aad
MD5 9e9579ad3d0dd6d78bb6db88e2d747c1
SHA1 f9e12a2fb2d8dc8676eec1ccb0e533b89e49d0ef
SHA512 2165364c9bd4ae072166c972236b91ee6530d7ef8ae69aa20d6721122e52a392bd22649acf12aa6818d634bb696678d34686a447d1137533eca8c1888e292c9c
TLSH
T13D31EF0067D14209F1B34673FC776705BBB6FC01AB1D868A428D921A4C64604B93BBBE
MD5 SHA1 SHA512 TLSH

Submit Download

BOO1L6CVOFM3Q7XZH0Y7.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BOO1L6CVOFM3Q7XZH0Y7.temp
Size 3KB
SHA256 9c0ddc69bdc14e6ea6a706e20ee3fdcadc7dcc8ce62a10cb3a8e5f674cbd5875
MD5 a000229b904ef5109f57c69334cda0f8
SHA1 dbfdac739350ff164d75585fff809cf3bb1a0715
SHA512 eb72be45f37bbb81d4e8b7d5e1bc3969b71aae071aef67b3c188086b090724369f8447ab8d99f552a6a7bc13b2bd66318a1e1ca0964b312738c0751d4dbea42d
TLSH
T148711F0067E1410AF1B24B73BC776705FBB6FC02AB2D868F428D521B4C64604B97B7AE
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\AlternateServices.bin
Size 1KB
SHA256 5473035bd27ef2a1354a1c013eacc65759869bff2f0e2fd8175d6603958e745c
MD5 83e05c2003e56bd9a957572450701b14
SHA1 9b270e05db9e330733f478a7df58e1c612f62cbe
SHA512 96ce6b2baecd8ea247019a90ab2cbf2b742272a57139088b304db1cb985eae38431e957e4d8b846a01a339e03df0f6270ad220e861576a1f266db9b218fe43eb
TLSH
T101214CB781730030E0249ABCBD1661044D2753C956B6508D67A1F0631982DADA0FC062
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 70e03c08d8c7037333f057a24db70997d6ae53c09a3a9749154ecf1bbe7eef79
MD5 baaaa17b3401c12ba6f9687832c29d34
SHA1 6fc952cc6257398268f78255b6f6535e123ed503
SHA512 cb4b4694e26d0afcf5ce7d0bf9581cd49c7ac23b3b3310cf057cc93fb0c7344d40f8aa971c9f9599a43810bc841f3fe35e21f528cc4f641c5bdf4cf2880d4b95
TLSH
T11D21127D8C9BC135F5F6C9B4795F4C102C172B5AA197F2A83D9141993198EB9219C060
MD5 SHA1 SHA512 TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 83e2a5c9d65ed4f819fd9bd6a52715e7d92eb7665d12e9f6dc431496c2b758f6
MD5 87b094ee8bf6b3236413e045af531f39
SHA1 35b84680882ae729f75eaaaf14047adaf5f6746f
SHA512 0c47f8a39b1342ee8be869ae5e146cf2693fc118f9ae9588a03f08a26a756e2c1453c860d42060f505fc19bd47512d7becf73bf2680e233f1e7c3c10f6d88a4b
SSDEEP 12:DBl/WhnB8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLsB8akrEDE+vED8YfAlO
TLSH
T18CA3C68F0E702680EDC420B0D7828EEEAA1EC32DCB13279202A000B29D0206019220B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

content-prefs.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\content-prefs.sqlite
Size 256KB
SHA256 fff6c2239e0d2ccc2dfe16bece3f51fe2831ce8baaa337827bbde444207a727b
MD5 d3941a15a96fb3023cf1587a47b586b2
SHA1 94996d072eea6af88a1d96b8ef900a1fe3ea56ca
SHA512 d627318f49a185b6ad4dbd76c9eb5aef82c360ab76fed195641fbd258e045e1f04c0d6359827a9c31c677414bc656e183770c0d1b829821388db8bfd2608f364
SSDEEP 24:DLCKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DmWwae+QtMImelekKDa5
TLSH
T1234426174AA17408C0B014B1D4636F22AF3D405B8933E7B23ABC143A4F886AAFC791E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.bin
Size 31KB
SHA256 ebc43f09237d2c82b4f6703c2f32841bfd99ebf0264c9ab2333f888bf0821a6d
MD5 279cf7892c6d7f08db775bface607a1d
SHA1 8d5e7a1acaa1efb95875d69253a213bf863e09af
SHA512 054f304b4dc29c7aca84ac0ab6f8928fef6e43743e4d9b7de7e4f12859e26ca72bd706e9879801bb147471960de5053fba1f955f1e66a895e4bc50d75abbc6bd
SSDEEP 768:fNAN93ZfEVe/Gcm+uEbKDsnWsVnbVbebbbmP1wLN:fNAN93ZMVIb9A
TLSH
T168E2F144EB2E953FD42412BBDCA50B002F79B88A59492F973A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 9ab1f796f0cd24b49a8c23e23883d9147754586807e0e0f7f7030f8270119ac3
MD5 0ff871f92af38d5443a550b45f3abd62
SHA1 aabe90e28968e930039f4cd1d65c541256caff5d
SHA512 82587465397ce40bc49d66f739062a917cec739b366e1a6478725751126ef230a466403accc5e881399ba492210cddc56007bee0ff6434bd3d85fcf4950bcc30
SSDEEP 768:546NAN93ZfEVe/Gcm+uEbKDsnWsVnbVbebbbmL1/:BNAN93ZMVIb9Z
TLSH
T1CDE2F144EB2E553FD42412BBDCA50B002F79B88A59492FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f242ea7ed19e1e051c107da21e0d9f07b10c81ee73e4b23b8adcf54be33f6ad0
MD5 09f71d87dfb3e9f2d04b455661d0bdb8
SHA1 c322e2246c46bc96b9609814865ade3c65f2b6f1
SHA512 b9ee51096fd9636d7753b5e47d8ad9090b72dfa489426903fc65d5008c536202124407c2f11f6538b2d6b62a1c157bdbdcf6251d469e75454c902f0b31ef1321
SSDEEP 192:nOv5zbo8MjlyjHM2K1d66JoztdzgCl6mc0dz:Ybo8Mjlyjcd66Joz/zgC1jd
TLSH
T1E3D1FF64EA38463FC418523BCCA51F404F35399B984E3F2935ED64082D9B2DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 25efab70abbad8ae0bb6545cabaf9c559c41970428b3754096beb73cf688d00e
MD5 a56c85f6626efa33d2ea4d465b177c3d
SHA1 1ebabf8fcaaedb89e802eda96c35fe717249f12f
SHA512 13f85c2ade61e8388f5de42c607d03355776cd3dfc81909d84035ceeab9015a2a32ba860bf367d1c50d271e0b457c248a42ca7bc219bf9013d9ad464bcd22a81
SSDEEP 192:bK1d66JoztdzgCl6mc0dUOv5zbo7VZjlyjHMN:Ad66Joz/zgC1jVboZZjlyjG
TLSH
T1F4E11F64EA28463FC418027BCCA11F404F39399B988E3F6975EC601C2D972DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 2444c09f947408331ab9134c848e814106f09ef02b349ba95cfc4850865a44f9
MD5 535c4d6520ce037c55540d9df1e8d2c3
SHA1 03ddb7df1dde7455f1ada1d841a0a0857f32f37b
SHA512 08c3411c212c6fb27e067933aa66d3a34acb573c1c01438b86cc345048572f6c26a8ea8eceeec98f7cd58575e3d49290623e230ce3fe946b5ecac399483ae525
SSDEEP 768:vNAN93ZfEVe/Gcm+uEbKDsnWsVnbVbebbbm3mn1/:vNAN93ZMVIb9y
TLSH
T102E2F144EB2E553FD42412BBDCA50B002F79B88A59492FA73A5C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1e6f671b200f81a844aea9cbc551baeb3026fbca386df895a1f060642915390e
MD5 ac99610be38535ae4225b406af0d31a2
SHA1 f3cdc4ac7823873ef7c33d276475432f037ab3e6
SHA512 d8986d25c4e75f9b1a2fb9e8cce4d25ba604665ea4cb2075eaf279822898ca8b5d1c39cb3972ba8adffc6c58b85d80b3bd6052458c47cb9227959cc28a3ccc72
TLSH
T17F217F7C39F88D2A688BFA9C7940138E53568A0604471D4BCD73EF8ECD816D931BD83A
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e1578b782b1f524898aa2426ef44838b9b5f01cd990de41af3b2c749a5e0556b
MD5 129aec7c0510bcba6d2daf0f2e0c2322
SHA1 1d0733983364595d54e6056c764fc53315de818f
SHA512 1daa1f61bb37de30c1a04266208d1f61c3be03b9d201a6593aedd47217e6eecf9f63a9278a6b2473523339d07770412b12c46a768f243417c47b9286c4764ff2
TLSH
T17C21417C39B88D2A688BF95C7940038E53564A0604871D4BCD63EE8ECD915D931BD83B
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bd5a35a3b828e2e3b317d0fdc98f41bff23d585f686711fd5be9257061dd46c9
MD5 865b71ea2c9fc2d60a0f067b9e109422
SHA1 b0fcec6079071e598afefd89a745a9565ed6d73d
SHA512 a2cea7a5619d6913eb2b563244b60f6abdd6d44683cd6b5726625eaede84029e879755f58e183c3f9db8110a1eaa397f01e307724cdad5def01f27e005a101d6
TLSH
T138212C7C79B94D2A6CD7FA9C794003CD53564A0B04871C4B8D62EF8ECD81AD931A943D
MD5 SHA1 SHA512 TLSH

Submit Download

09e9f1f9-f05f-404b-a6d9-ead5deb7363c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\09e9f1f9-f05f-404b-a6d9-ead5deb7363c
Size 883B
SHA256 17190cee10905b3bdc5ced0bb218e5c7eade3c02a5043109b40134a5143349ce
MD5 eb8eeb230e5aded9d94d68e813693689
SHA1 008111a8893cd34fe977e63128c61448c4174cf7
SHA512 df54ede8146aef5434107a15a91c36e9f2348d8b59c862762779799ecbc3096775490b4f79f419529efde40a3a1a2a6ea40dc9e4d1731a67ad625ebfb05eabc4
TLSH
T12E11CC80A634B5B2DC7C924B89613B0297E8752384CE95583DF59E044DBEA6EB37B207
MD5 SHA1 SHA512 TLSH

Submit Download

1bf18e99-7d99-42d9-861a-7313a4ca539c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\1bf18e99-7d99-42d9-861a-7313a4ca539c
Size 16KB
SHA256 0831c4a81f6e47f4f7823f06744b6ed079352de703230d26fda8af6d931ac119
MD5 dc0a547f7f80968d76683d7e9507ddeb
SHA1 827aac706448b8a588ca21b4858c42b0c1d03730
SHA512 76580037d0eb10ddc48871679bd348601a9ff781136bbb3d4cd2a42f9b9d49c8cb44e137eccf846e673d8da17b0a1eb5d71becd96ea89f4b75964f0cca612f08
SSDEEP 192:0yCMrgmdTTVnLaTCFKL0TdZTu2Bg17ShSz+7FxR5nBc+dswkwEGYvC//4sLfJ+zn:HBTdLcCFKL0TLa2vSC7FxR5na+qmb/Jw
TLSH
T14872C956586045BA8591E3A9D4F87FC3E2F628CF4C419FCA9BE0BD086DDB06E102794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

421e5ec6-6580-4487-a9a1-6767b69c7783

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\421e5ec6-6580-4487-a9a1-6767b69c7783
Size 2KB
SHA256 2e9b6d00208c84f70da9d6cf7a56ee6ecfc98595b7505ace4af587268167230a
MD5 c2bc03f1fbc6c0f42c72622ef907cfa8
SHA1 ccc76936a40f1773c3b4c33b6181b6c8ae351786
SHA512 ffa67d7f068a94657c3c0e26590764f49d2a6d68e9976813b133439b12088889afaaae68d941d40b5ded888c538a9b7e151db440c3bb7a57ac37275e6765233d
TLSH
T11E41657835788C369C9AF94C9841334E53508A4300C62C8BAD72EE0DCCD269A33FF427
MD5 SHA1 SHA512 TLSH

Submit Download

46bb1f02-5300-44cc-8bdd-c32974d9e96d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\46bb1f02-5300-44cc-8bdd-c32974d9e96d
Size 886B
SHA256 223943e6d64a199b643c57de31f4491473648ee4bdf8e6e4d3e1bd28c0530b97
MD5 2abadb57f46d4ef9fcbfbb778e1e044d
SHA1 e655d5b3d76ff302895b7afbc12edcff9f417fc2
SHA512 96a1bf4f1d6bd9c65112c2e969b89045fda81f51eb3d13e8b6658721e594631df01292fb3991336d271da1868dd92507568bb80128e861aa6d3d0a3b2fcf4e8f
TLSH
T11C110040CA3575B2CC38924B84B0370283A0716380CF598CBDA99B080DFB66F6367207
MD5 SHA1 SHA512 TLSH

Submit Download

4b58a548-f168-4a46-bf17-c7e4379dcea3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\4b58a548-f168-4a46-bf17-c7e4379dcea3
Size 235B
SHA256 aab1279de66fce5794e3596cc515900c4c67088ba10ce85321876324cbc731ff
MD5 8a0858e48dae2e3e67a16f0f4f8d65e7
SHA1 61ddb53d041713405a72c9b103b940eb6dc37672
SHA512 c8308febd69c51e29c9ae30fcbbee8a87191da05eb4a499afbc59cdfb00a7552d940dad47496d362d8e048e5816823c103b0c1e98e0ecf7ae70c7b306ba3350e
TLSH
T1E5D097812898E76D18105F0AF0A029C630468C3370F0E820C9514B39A9B9AC45361857
MD5 SHA1 SHA512 TLSH

Submit Download

518860bc-a95d-4aa4-9575-f4afc6ad3d4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\518860bc-a95d-4aa4-9575-f4afc6ad3d4e
Size 2KB
SHA256 0786248f998d700a04c9b0af1bfc0ec6018150da664a43a86771daa40693d793
MD5 95f66cd7fa6e71aed3ec743c2cf66f19
SHA1 91515a6889ab9531c848dab44d15a868239a87fb
SHA512 4211144a186689af1f1462a436807eb539698bbaf4951e36abbbc0e1358995f050c6b1e9a1080bf57122bc9431b50ad278861d136238af528756582eb9abf13b
TLSH
T11941235C75B84C779CEAE54D9491238A53704A4300CA1C876D51EF4CCDB6799337A42B
MD5 SHA1 SHA512 TLSH

Submit Download

55e57ed0-d759-483b-bb9d-caab06582b3f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\55e57ed0-d759-483b-bb9d-caab06582b3f
Size 235B
SHA256 0eb1ae7188ac9b55badc189407af17500d77204ed00d78b35946d9e9a158a328
MD5 033cc214c3762b1134e6e59b5b5ea311
SHA1 ee5ee5b746a58624705e6e97d8e93f891d1e8b18
SHA512 5decf584c091b8cb05b191efb6d11eb5d33a38778859e0fb56dcb0d9d7b445efb96bd1f7297c49a71f69a0db2fd7a4b3070c5a057bda124ebd5148dee0a5168a
TLSH
T139D0979018A8236D48201F03B0E038C270AC8C3320B4A81086614678AEBCAC812A181A
MD5 SHA1 SHA512 TLSH

Submit Download

956a9017-7e66-4911-8364-7a9b9f143404

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\956a9017-7e66-4911-8364-7a9b9f143404
Size 235B
SHA256 65faf1a4708b32d7353e9a8e0166aa59e4bee464143d34b91bacf2e781717dec
MD5 979961ba200bda8176a3ee56a466b8ea
SHA1 db7f701c25652054d34840fdcf5e21f23655cec7
SHA512 014862cea131042e60ba2f7e5a3c4ee70843a8fd9ed080928d84e15f63b6c574330c907f0acdeeb08bd8cd225761c19e87d807be0bd350ac55b4e5e893a4d39e
TLSH
T1EBD0978474C8637D08084F06F1A02DC631884C3328A49C20EA904135ABF89C80221C07
MD5 SHA1 SHA512 TLSH

Submit Download

e1d2c7ac-5b9d-47ee-8d78-f739f73bfecf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\e1d2c7ac-5b9d-47ee-8d78-f739f73bfecf
Size 897B
SHA256 d71e7d30632eb6932bd8ca959a54ad7f233a0c0b8cba2ab4b00d0523d96b2c53
MD5 b53f1e28dd61aa684d87d9145e60b427
SHA1 8ca600d6622cb40cfd0a71f54f3b3fd8c3ce42a1
SHA512 564d7048f89f3bc3b1c2e489046e02e0cfa3e35ce2bac55af3e5e112563db181bf9a8b6fbd3967d3b5ca9a24642675dd76d8353e437d35bf5d2ab01445038ffb
TLSH
T16A1100408634B9B2DC38924F98A0370287E4356380CB59587EB55E080DFB66FB36720B
MD5 SHA1 SHA512 TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 c7baab1cd8662625bc822a3c3c7b57973b927cd5c26192d6cda60ed9ecc0ed07
MD5 7231237395096e88196ba0ffd7ac0ac6
SHA1 d303ddfed1d4341f30ed79abbc23ce51f651bd35
SHA512 6220c9908bfa889f1db84625dc214127ee76c40c97a0d2b81df251253d4a8cc7ba6387d94f751a8f092850ce8a86d5c7e0d7938b85ef763813c4ab4a0834055c
SSDEEP 12:DBl/ATMbUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLbbv5XvtQhP8W5/b
TLSH
T1A6A32B1F1B1CB840D4C356F26D8329067634D50B8913BEF03B9D84004F066481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs-1.js
Size 7KB
SHA256 ef330b6ff946f786650ab647f56d22242e54e0674f42617662a012d9605a7ec7
MD5 44bdf568042d7c091aad3e7e1c5b72cb
SHA1 64ff3e2473bf8a7a8cd86bcdd127e1c7e5df8532
SHA512 6298fe2172cc7069a1306360bcde85edbf0fc1101d1bdfe4e29d8c70fba5ad438c0e57fc882fe04f77d6a3edd7bb2301376695d7f60f628c600c8f6634ad2c28
SSDEEP 96:xHSUTUNqGq3Jfb4seObzS/OSSl4dv9j4nbHtXsdSBw88u8L4cnKMY3UGS:EAR3JfssetOSShtX6SBw88b
TLSH
T102E12D7894088F7F78B676ACAC6888319AB2013BBBBF68D750B554C5015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 1c59e8581fcf9bdbf8f18c9fffb2f34208e8e803abf43c6b49a2e8fea9e22f61
MD5 6909f6d67c31e044fd7c1af7dd3d710b
SHA1 0f2dbf1d545a41f6c9dc81c6f10443eac94ac4bc
SHA512 77ef7b2d9c62087ca3f39195b38af3bf6d5e2c399b5ffc42e071e789521a2ca7b5048aeab8a632662837291810c8e64c48e95ac8ef1dc9b9c57a52acb5b2ca5e
SSDEEP 96:xHSUTUNqGq3Jfb4Iz1zSGSSl4dv9jAcnbHtXsdSBw88u8L4cnKM5I3J:EAR3JfsIz7SSYtX6SBw88y
TLSH
T1F2E12D7894088B7F74B677ACAC688C31AAB2013BBBBF68D740B55485015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 8fe03f1244b5b7181a53ddc627eb208724a2ca3990cdcb25ddd06c42f5dcd373
MD5 540c4c100f0e05370dc8d4a2ed2de17a
SHA1 0a7592f9bda55d04bf9a0323db098b30becb5064
SHA512 bd009edf2daac39c540739890a599473b64a124503e9ad146490e23f12a6ab42a566931a3b8ba8dec3d888cc0cf1ee07181a7ab5851be8b5255bf3ac0b0c5f12
SSDEEP 96:xHSUTUNqGq3Jfb4seObzSEfSSl4dv9jpOnbHtXsdSBw8Ou8L4cnKMY3UGS:EAR3Jfsse2fSSsqtX6SBw8Ob
TLSH
T15BE13E7890188F7F78B676ACAC6888315AB2013BBBBF68D750B554C5015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 7KB
SHA256 b47fb92751e859041e359fd33bf40fcd46cf4c15cfb169bbc911f4ebdfef5cc2
MD5 2f0acfdf528c23b1950f0fc20f54df72
SHA1 f1ada2d30627d3c59bac996df6f468a67f24f51a
SHA512 2a439bcf56458db1af3a93f96c98b78531b2b30a145afda77806ffa3ea306810e3e709102157b168673fc16de40d9212bfbee3343bc11d0825be8746543c5687
SSDEEP 96:xHSUTUNqGq3Jfb4seObzS/fSSl4dv9jpOnbHtXsdSBw88u8L4cnKMY3UGS:EAR3JfssetfSSsqtX6SBw88b
TLSH
T1B5E13E7894088F7F78B676ACAC6888319AB2013BBBBF68D750B554C5015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 cfe46e9ae1d828ef33eb6415c04b2b306bae6e61e1e4e488e6b65ea12b59e5b6
MD5 195f5c71d601bcfeeb274175c96b4b4d
SHA1 564bbafe192583e2799723de8b0a5b45a59777c8
SHA512 28945235608f80fa453a915a86372a389322ce050714fbc70f07f724e86553f2ed1d5e3348854156432c60a40c9140807aa112b281bf698665dad0d870714850
SSDEEP 96:xHSUTUNqGq3Jfb4se1zSEfSSl4dv9jpOnbHtXsdSBw88u8L4cnKM5I3J:EAR3JfsseFfSSsqtX6SBw88y
TLSH
T1AFE12D7894088B7F74B676ACAC6888319AB2013BBBBF68D750B55485014CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\protections.sqlite
Size 64KB
SHA256 f47973dd13805200a469d534a0ec50e224f0c12ae77d93a0e5bcc267af19c145
MD5 63b6f9d979a2cd96d93c105805cafcfc
SHA1 5fc70ce8799617202d1b2a350f6d596b65d48e54
SHA512 ca475720928bd40abab686efb8b890fdccef59c292b26263d41bfd9dfe8f35d21405820e10505fa7cff49eea5ae57ffdbd6ca73d5cf6e1cfe67f5994d2823b90
SSDEEP 6:ltBl/l4/WN1dR4BEJYqWvLue3FMOrMZ0l:DBl/WunddfJiFxMZO
TLSH
T1BF53225E47387021C0891372ABD323923F3CD2FA93232E836A100C358C0A023B822AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 181B
SHA256 16b7be97c92e0b75b9f8a3c22e90177941c7e6e3fbb97c8d46432554429f3524
MD5 2d87ba02e79c11351c1d478b06ca9b29
SHA1 4b0fb1927ca869256e9e2e2d480c3feb8e67e6f1
SHA512 be7e128c140a88348c3676afc49a143227c013056007406c66a3cae16aae170543ca8a0749136702411f502f2c933891d7dcdde0db81c5733415c818f1668185
TLSH
T112C080C7C5491075DDC32A5D73D47F519D3F04F776711545B56C594C187B0278547843
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 228B
SHA256 df49028535e3efe4ed524570624866cca8152de6b0069ebb25580fce27dccebc
MD5 66bdbb6de2094027600e5df8fbbf28f4
SHA1 ce033f719ebce89ac8e5c6f0c9fed58c52eca985
SHA512 18782069ef647653df0b91cb13ba13174a09ce2a201e8f4adfb7b145baf6c3a9246ef74bdad0774a3023ec5b8b67aba320641e11dd4b8a195e1c2b448202a660
TLSH
T190D0A783C6055075CE83696CB39C7B519E3E04F672640245B1AC954C187F027414B843
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
MD5 c8dc58eff0c029d381a67f5dca34a913
SHA1 3576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA512 b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
TLSH
T1F8D02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 0b52515048cae6a5ed745cea6e3c49e37971342b68e71478ad3ff8cd6fd0db04
MD5 dd4025220ad2be5fd5ff4ba5b8c23a5c
SHA1 99927d9c3519a8f72a723507ba101d3bfdb301e5
SHA512 c1702960074789158c42da32ce8a60c64f237242fa20b07409474eca6dc6149a02802d37d3eb000f8293a29637621184baa8902ae0b59eb7ed0c88ab54261e7e
TLSH
T15821CA4164DF29F6791DF02AB0D65B7519026036439684D1E0DBE300865D4DF3DCFB0E
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 35384a97d928621cf31633571d5df064d2e747316eeab91eaf8112c2d9cd9b88
MD5 301ae32526f7a62005b0dce2cc6b33bd
SHA1 6901fb343e50dbb1f599c1cc103e8659b67cb731
SHA512 a9e5a30d03b91091f862207733570bea300427dd3a1116db1f86116a920bb2be5527b37cf2c669307e12bf0bdc81cd0495af29e64f0374a31ba5da5435f4ae27
TLSH
T1A111B991599F0A7663A4911F67812FAB0A4F2020C871B0D1A24DA78095D500F7BADA8E
MD5 SHA1 SHA512 TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\storage.sqlite
Size 4KB
SHA256 1db39598ae2ee67e7a598723a6ec07a3b74ab17ef166a2614785c74c43d1c5c3
MD5 701bd81ab9bb9fb95ec393a557d20be7
SHA1 7f6d6f5a146ac2e0c5f5424da7d7199ca8b6662d
SHA512 4f6b7a82f3361c2f452f0093fb0286acfa898528a2933f501bfe627993899cc77e136c435a0cebd95457c72c604b030b46dc07fb7b2b937d67ce3dd46179fc5d
TLSH
T1CF815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B95C72EA011FACAF35966B164BD
MD5 SHA1 SHA512 TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 b0a46b647f205aefd86c6df117b2ddeccbdb620e74ed4b36b80361caa2e713ac
MD5 c7d3c86b320f9ae959a89b730e84b733
SHA1 5e0b3000ddcb9aca2a44ea22d1908bef1f6621c0
SHA512 a226e0167e317d45845d87b1a9fbd7dd59e158566b63d034d802be48ce64ec9a059f8c5a26ed00a01fe78aaf1ef065b7b91311ac522dc462e4613d88a3febbcc
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEmkB8:Oa16S6CKnqlizbxV+2xVeU7X2B0mK8
TLSH
T112237F8E3F07A511C53AF0B178A08D51BC5E321D07222AD669D0DAE4C8F215AEA1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 af593ac73739030f7f99430aefb26540153d33b4b772cf14b6bbff438ae0e11e
MD5 5b98ac9f7553bdf4caac03c35e5af62c
SHA1 f18ae75ed1742bd18343726f64f16568da2dc8f6
SHA512 8e46fe1ba4a0144d87ef006589d0fd53aa84f2b698cbd2d3a2557efedb85bcdde5bf7b5ec14c58f0831d9f735fa3d06b0b52c1821c4de8a6df30ca9b6467ced1
SSDEEP 24576:kNJwu7DmsTOPjPh5YoMkhjQbDQWsPLQXhTSxK9Z15P7UBqspAhe3QNoK:kNx/kDbYQhhMSxmT5P75zhsqo
TLSH
T1E3362AF820D1A257F3414033764593EF21EFD00C6027DA085BA99AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 a7622d4a734af055f90a491357862b8b360b5af5a8eaca6246cac8c63301f2b6
MD5 e228cf100f036e2a3447ea17053b5a1d
SHA1 6064fe9cca9561f473fe5e8447027ca5e783c82a
SHA512 8834a0e8a0731c9e783b0ea904a27e26c69aa5b0c8c98531896607ce0df4a2de34210f3edd804f4d8198eb2d9cdc514f43bb84143dad22c28810e579d4f17d71
SSDEEP 24576:kNJwu7DmsTOPjPh5YoMkhjQbDQWsPEQXhTSxK9Z15P7UBqspAhe3QNoz:kNx/kDbYQhWMSxmT5P75zhsqo
TLSH
T1B8362AF820D1A257F3414033764593EF21EFD00C6027DA085BA99AE9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\targeting.snapshot.json
Size 3KB
SHA256 a4f5fa760f04ef70777e7590b59334a0329608b3455866e54e28883b75524372
MD5 3e9cf4ad499847f01758e7fc87d2a2fa
SHA1 d8df8ab272406b2991a9c2637eb5c43ce5b3cb82
SHA512 17daf80df90545fd919f551b15508dadc140ef48650978304711b0c9f4c5360fca76c2d4ca09f10c938b9317245464268898677aeea51659dbac3bbca7537303
TLSH
T18D71710CA61CA4BEA66BC3C0E644BF978BBD053770447468DAFE460C45FB5FB162621B
MD5 SHA1 SHA512 TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\targeting.snapshot.json
Size 3KB
SHA256 99f4f6f3b33e4ef9bbcbadc115e8126978a6da14c62f6081fdd66e4a40e83deb
MD5 71313dc8baf423790eb515f66cf53c51
SHA1 424aa5b320246a88238724b89404a8f865171cf8
SHA512 55ca3248d8643e256c33b607bbfb9af3dab55b58d2bf1c81d2b4cccefa9c2f72524a60c54f8ab702acc56f839da026c4b2fd2e39919b322cceee006fb58b0a65
TLSH
T1AD71700CA61CA4BEA66BC3C0E6447F978BBD053370446468DAFE460C85FB5FB162621B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\xulstore.json
Size 138B
SHA256 a02e97cea0637af9194a127b910c439eeecfff4c1b1ee384bee600b8afc5f088
MD5 799f594f01d16a72a8e09285553b5173
SHA1 5fd2f9cc03519d5641c2e1b9a02f09abff5f9e19
SHA512 d0d83a3d75448d3ffb1166a2d33c208f95531fbf3e24efe08fb408c6e6e37a3665a75d6f4daa74c4e5fa655127da16fb8cfdc726af5328988fddb21f720f2a38
TLSH
T11AC02BB0229FE8087F178FCF024D23843E29851081C012667BC214A0008430F4C1C308
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\xulstore.json
Size 167B
SHA256 46437afb5f16356a036444f2a7f05b6a2b64039ff14453b2b188ee2efa57574f
MD5 19ccc7090a14d74ee5471d54448be6b4
SHA1 fc51545db1847bf5ae6a8d209b6960c8010d121d
SHA512 14e840b578545839e239d6a46265ce8435139302071d5da259d07cb512239aea2688062df38220ef07699c0f660c742748301dc5aa193ceb0e7eb94a42ab6d41
TLSH
T1E3C08070217F98047E178BCB018D21943D3D895451D0165676D558B0188470FDD18344
MD5 SHA1 SHA512 TLSH

Submit Download

memory/912-532-0x0000000008300000-0x0000000008310000-memory.dmp

Download

memory/912-533-0x0000000008300000-0x0000000008310000-memory.dmp

Download

memory/912-534-0x0000000008300000-0x0000000008310000-memory.dmp

Download

memory/912-535-0x0000000008300000-0x0000000008310000-memory.dmp

Download

memory/912-531-0x0000000009560000-0x0000000009570000-memory.dmp

Download

memory/4264-433-0x000002282AAB0000-0x000002282AAB1000-memory.dmp

Download

memory/4264-428-0x000002282AAB0000-0x000002282AAB1000-memory.dmp

Download

memory/4264-426-0x000002282AAB0000-0x000002282AAB1000-memory.dmp

Download

memory/4264-436-0x000002282AAB0000-0x000002282AAB1000-memory.dmp

Download

memory/4264-437-0x000002282AAB0000-0x000002282AAB1000-memory.dmp

Download

memory/4264-434-0x000002282AAB0000-0x000002282AAB1000-memory.dmp

Download

memory/4264-432-0x000002282AAB0000-0x000002282AAB1000-memory.dmp

Download

memory/4264-435-0x000002282AAB0000-0x000002282AAB1000-memory.dmp

Download

memory/5004-3-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-6-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-0-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-2-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-1-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-7-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-9-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-4-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-8-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5004-5-0x00007FF7AEE30000-0x00007FF7AF97E000-memory.dmp

Download

memory/5500-452-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/5500-453-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/5500-457-0x00007FFBC1110000-0x00007FFBC1120000-memory.dmp

Download

memory/5500-456-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/5500-458-0x00007FFBC1110000-0x00007FFBC1120000-memory.dmp

Download

memory/5500-455-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/5500-493-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/5500-494-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/5500-496-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/5500-495-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/5500-454-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download