Resubmissions

13/11/2026, 04:36

261113-e8qgdags2r3

13/11/2026, 04:32

261113-e55f5af19r3

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    662s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    13/11/2026, 04:32

General

  • Target
    overrides/mods/ConfigLoader-1.21.1.jar
  • Size 848KB
  • Sample261113-e55f5af19r
  • SHA256 4c2944bdae36457daf1bb759cd5353173dd851aeef46931f83782f4973e87965
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\overrides\mods\ConfigLoader-1.21.1.jar
    1⤵
      PID:4456
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:388
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {eb32a1a2-7f21-4f7f-bafc-472f661ca828} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:1716
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {ca6df30a-339b-4f5e-84f1-0da671baa846} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
              PID:4000
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3668 -prefsLen 27277 -prefMapHandle 3672 -prefMapSize 270279 -jsInitHandle 3676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3684 -initialChannelId {2ce42e7f-9881-4a54-af88-58bfe905db3c} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              3⤵
              • Checks processor information in registry
              PID:460
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3836 -prefsLen 27277 -prefMapHandle 3840 -prefMapSize 270279 -ipcHandle 3936 -initialChannelId {06a8d533-96a2-4544-8070-c41b673178c8} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              3⤵
                PID:1844
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2716 -prefsLen 34776 -prefMapHandle 2892 -prefMapSize 270279 -jsInitHandle 2896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2836 -initialChannelId {347c0974-b0c2-45c3-94e7-a62cf3af2677} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                3⤵
                • Checks processor information in registry
                PID:2844
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35013 -prefMapHandle 2744 -prefMapSize 270279 -ipcHandle 4936 -initialChannelId {51e90a42-35fe-434c-9bb2-29f92e682e22} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                3⤵
                • Checks processor information in registry
                PID:5692
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 32952 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {d1ecf7eb-7873-4930-a807-ee204cbe3e70} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                3⤵
                • Checks processor information in registry
                PID:5968
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32952 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {2e7c93a8-f5cc-48dc-8f69-16b89913beee} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                3⤵
                • Checks processor information in registry
                PID:5984
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {a35dc566-d0b1-4206-b1b4-946e88f9c188} -parentPid 1604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                3⤵
                • Checks processor information in registry
                PID:6000

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                activity-stream.contile.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\activity-stream.contile.json
                • Size 4KB
                • SHA256 4d403a53631e28ba28b253399956d339a897918d3c19a3e5cc19b19be5ea3056
                • MD5 SHA1 SHA512 SSDEEP TLSH

                activity-stream.discovery_stream.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\activity-stream.discovery_stream.json
                • Size 75KB
                • SHA256 47dd7c1ea95cbcb637809180373a619c3cf62d6c2f001bb6bd1f097e0bb65b0d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                activity-stream.discovery_stream.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\activity-stream.discovery_stream.json
                • Size 75KB
                • SHA256 c6f2baa43e11d43d7d3b2ac0113962e5f2aa1e8b82c233e8dd44399fe1346a8d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                activity-stream.personalization.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\activity-stream.personalization.json
                • Size 1KB
                • SHA256 258ee2b8bdfffebecbb3bd15eeabde649717bbfefd523eb116d85e751145326c
                • MD5 SHA1 SHA512 TLSH

                13083

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\13083
                • Size 257KB
                • SHA256 ee255698c3645ec318b05c013c1d77d0dd01d91eb7782a14ab94923a9e706806
                • MD5 SHA1 SHA512 SSDEEP TLSH

                20162

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\20162
                • Size 52B
                • SHA256 8a5e46c18b265c929ca509b6385ca1a4634f2fe65a46153f16eef66fc53b862d
                • MD5 SHA1 SHA512 TLSH

                25663

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\25663
                • Size 253KB
                • SHA256 033e2318e49fc56d9fb6182835906bfeb7d8afdedf5ac0fd4b7519ac3419cd60
                • MD5 SHA1 SHA512 SSDEEP TLSH

                26718

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\26718
                • Size 253KB
                • SHA256 de637b510660055c8c2d8c7d30fc69bf9aa77b42c4803aad270fcaa0ba2bfba4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                32256

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\32256
                • Size 15KB
                • SHA256 f544ce6b11772871c45cc955e8d2eb17d67ad096ae90998b82b43f8309ef03d5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                5628

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\5628
                • Size 253KB
                • SHA256 05d389698d6ef166ee3acf14c2b04233552952368f62c3ad9a82834c35acdfd5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                7661

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\doomed\7661
                • Size 253KB
                • SHA256 03a2c5fb1d01cc65c293bc0b1f86af3034953e2bf60e90c39b5667f08397fcad
                • MD5 SHA1 SHA512 SSDEEP TLSH

                06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                • Size 16KB
                • SHA256 c6b2127b5548f8db3781e58cba293bfafd6e4ea55229fcf80843f2543ee4b546
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_arts_and_entertainment.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                • Size 67KB
                • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_autos_and_vehicles.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                • Size 44KB
                • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_beauty_and_fitness.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                • Size 33KB
                • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_blogging_resources_and_services.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                • Size 33KB
                • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_books_and_literature.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                • Size 67KB
                • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_business_and_industrial.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                • Size 45KB
                • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_computers_and_electronics.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                • Size 45KB
                • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_finance.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_finance.json
                • Size 33KB
                • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_food_and_drink.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                • Size 67KB
                • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_games.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_games.json
                • Size 44KB
                • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_health.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_health.json
                • Size 33KB
                • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_hobbies_and_leisure.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                • Size 67KB
                • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_home_and_garden.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                • Size 33KB
                • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_internet_and_telecom.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                • Size 67KB
                • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_jobs_and_education.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                • Size 33KB
                • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_law_and_government.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                • Size 68KB
                • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_online_communities.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                • Size 67KB
                • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_people_and_society.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                • Size 45KB
                • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_pets_and_animals.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                • Size 44KB
                • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_real_estate.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                • Size 67KB
                • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_reference.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_reference.json
                • Size 56KB
                • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_science.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_science.json
                • Size 56KB
                • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_shopping.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_shopping.json
                • Size 67KB
                • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_sports.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_sports.json
                • Size 56KB
                • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                • MD5 SHA1 SHA512 SSDEEP TLSH

                nb_model_build_attachment_travel.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\nb_model_build_attachment_travel.json
                • Size 67KB
                • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                • MD5 SHA1 SHA512 SSDEEP TLSH

                recipe_attachment.json

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\personality-provider\recipe_attachment.json
                • Size 1KB
                • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                • MD5 SHA1 SHA512 TLSH

                webext.sc.lz4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\startupCache\webext.sc.lz4
                • Size 105KB
                • SHA256 374046d963268526529bd218914a4339b923229ed6e04f0783963ce3ad3b5aca
                • MD5 SHA1 SHA512 SSDEEP TLSH

                webext.sc.lz4

                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\woy7kavs.default-release\startupCache\webext.sc.lz4
                • Size 104KB
                • SHA256 f309181301a850cfeae11d639fdb1c72a96c2237be5ca673faafc90c75a0eb6b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                remote-settings-startup-bundle-

                • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                • Size 573KB
                • SHA256 ce98614f1ea4559716f7c1de475cbb43d11973943343f15b56276ca69667e60a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 11KB
                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 502KB
                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tmpaddon

                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 21.6MB
                • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                4UWYSGIAMIRHJD7WC7R0.temp

                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4UWYSGIAMIRHJD7WC7R0.temp
                • Size 5KB
                • SHA256 cfd1bb5034ac7d3716e736a798dac170a7e00c25b0be66c2f12bacae6fe568b2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                addonStartup.json.lz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\addonStartup.json.lz4
                • Size 4KB
                • SHA256 558018c6410a020f5590de669b7d96448fe25ef468b4358281e840289381c844
                • MD5 SHA1 SHA512 SSDEEP TLSH

                bookmarks-2026-11-13.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\bookmarkbackups\bookmarks-2026-11-13.jsonlz4
                • Size 859B
                • SHA256 38e564098367dd74f2482758e8fd130d124c548ff426ff500ab903cc20ab4a20
                • MD5 SHA1 SHA512 TLSH

                broadcast-listeners.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\broadcast-listeners.json
                • Size 221B
                • SHA256 e72b8e652cc8f48ab49b68daf2cee32dd77b548b7daddb3ee101ac3d94303bce
                • MD5 SHA1 SHA512 TLSH

                store.json.mozlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\crashes\store.json.mozlz4
                • Size 66B
                • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                • MD5 SHA1 SHA512 TLSH

                data.safe.bin

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.bin
                • Size 41KB
                • SHA256 52f441dce1fe3e562a375f2ce39395be3be373923e8db8377f0f227d65aad67e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
                • Size 41KB
                • SHA256 762b882c70b545ba21901214c4aadc65da61a4c73ec1bbb6b75469e975af5617
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
                • Size 42KB
                • SHA256 34f3778ef552e5272af6f3ff26b5d074cf29df182792f2f25ddc8664d670f0f5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
                • Size 42KB
                • SHA256 85bc1ab6f033d48fb988f2aaa1170c0a9eb1a288fee89e457793a25cc0ae9cc3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
                • Size 3KB
                • SHA256 ff020eb66fbf78186e360490f2f59f383740e8fc1a301fdaf459543d0fb7011d
                • MD5 SHA1 SHA512 TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
                • Size 7KB
                • SHA256 c223dd99f9b82bdba298d1b15d3a41a4cae66133a4928c81e9d44e6e4dbef568
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
                • Size 41KB
                • SHA256 467c13f8a8af7bee2c159f4c72c2ef116a9c155c156f14d0890d879d8bb90692
                • MD5 SHA1 SHA512 SSDEEP TLSH

                data.safe.tmp

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\db\data.safe.tmp
                • Size 41KB
                • SHA256 8ced30c890b8e4ed00873bb2166da3033e52c392cb2c85ffa80985dc6d99e855
                • MD5 SHA1 SHA512 SSDEEP TLSH

                events

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\events\events
                • Size 1KB
                • SHA256 b2d963174d7b12c201b842b919873ca553be6c4b1c59495ecc6ded7382d3be7b
                • MD5 SHA1 SHA512 TLSH

                events

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\events\events
                • Size 2KB
                • SHA256 dde01443ef11b4b4f81b62a89f9ba253d8ec9acdfd3ecadc72c52507be8e9b0e
                • MD5 SHA1 SHA512 TLSH

                303b2ce0-6e93-45a8-93db-498da9e914ce

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\303b2ce0-6e93-45a8-93db-498da9e914ce
                • Size 2KB
                • SHA256 9f899eeb130d7015de33042fa20bbcb00fe3f143c0184454e506d2e3d6c18506
                • MD5 SHA1 SHA512 TLSH

                41145435-a417-4767-9226-b230e63d9a08

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\41145435-a417-4767-9226-b230e63d9a08
                • Size 883B
                • SHA256 15ac9486f0bb5fb5e07d561b709132769b628da77719c183d6b07ce92dee4a36
                • MD5 SHA1 SHA512 TLSH

                443b5476-096e-402b-8984-47a459b786a2

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\443b5476-096e-402b-8984-47a459b786a2
                • Size 886B
                • SHA256 46ca6c47d49217312342c700e4022b23f122d041949fa92784103de7fef7995a
                • MD5 SHA1 SHA512 TLSH

                5e79d9cc-540f-4424-b82e-3891e2342bef

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\5e79d9cc-540f-4424-b82e-3891e2342bef
                • Size 235B
                • SHA256 60185b869709e6c5b36ed7a86bef53cb03dc2148aaa73f2124a62a06d5db9f02
                • MD5 SHA1 SHA512 TLSH

                db27f5aa-f05a-4616-970b-f33082e0e992

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\db27f5aa-f05a-4616-970b-f33082e0e992
                • Size 15KB
                • SHA256 7042b025bd53e4646770249c5afcbfa32b793cdd040c22dc2e1226dc2c7c97ba
                • MD5 SHA1 SHA512 SSDEEP TLSH

                f27e1868-0d0e-4359-92f5-136348e8b243

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\datareporting\glean\pending_pings\f27e1868-0d0e-4359-92f5-136348e8b243
                • Size 235B
                • SHA256 76d5da7d0e07ad9a14069dc056cac504c9419e90271b9bfb095468bbe053dc9b
                • MD5 SHA1 SHA512 TLSH

                extension-preferences.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\extension-preferences.json
                • Size 942B
                • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                • MD5 SHA1 SHA512 TLSH

                extensions.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\extensions.json
                • Size 14KB
                • SHA256 37ded73bc770a1988395c515856c570a741657e94ef110b6e05ea8fa4a39fa20
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                • Size 1.1MB
                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                • MD5 SHA1 SHA512 SSDEEP TLSH

                gmpopenh264.info

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                • Size 116B
                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                • MD5 SHA1 SHA512 TLSH

                LICENSE

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
                • Size 473B
                • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                • MD5 SHA1 SHA512 TLSH

                manifest.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                • Size 1002B
                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                • MD5 SHA1 SHA512 TLSH

                widevinecdm.dll

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                • Size 21.6MB
                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                • MD5 SHA1 SHA512 SSDEEP TLSH

                widevinecdm.dll.sig

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
                • Size 1KB
                • SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
                • MD5 SHA1 SHA512 TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs-1.js
                • Size 7KB
                • SHA256 c6cfb96907724cc3ead378e29b78cda9a5c7787105b71e5a0601b74d78222aa8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs-1.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs-1.js
                • Size 6KB
                • SHA256 1a174dd0fe8967344d38d0c418f12474983f700651bb635bdf64e28275f2d34a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
                • Size 7KB
                • SHA256 ff26898f437495cfca5b144ea703748100a4dbd34dfe9739b68f9861bcdfb4eb
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
                • Size 6KB
                • SHA256 e908cce3d434d44b1f511cd89f6ccf3d520af9aaf2681afe9060b9ba2712b834
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
                • Size 12KB
                • SHA256 d406760f44ea80896c03800d77ac176bbae66b8985c5d4b64d08fd0413aab965
                • MD5 SHA1 SHA512 SSDEEP TLSH

                prefs.js

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\prefs.js
                • Size 12KB
                • SHA256 6d38e114b677a38874b69d69caa3de753013770007f6545ba9bb810aa2c7ff1f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                search.json.mozlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\search.json.mozlz4
                • Size 350B
                • SHA256 2a317a8ff64d03538667913a28d8769f7483b207d7949590e83bce951ff9fe4a
                • MD5 SHA1 SHA512 TLSH

                sessionCheckpoints.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionCheckpoints.json
                • Size 53B
                • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                • MD5 SHA1 SHA512 TLSH

                sessionCheckpoints.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionCheckpoints.json
                • Size 90B
                • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                • MD5 SHA1 SHA512 TLSH

                recovery.jsonlz4

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 923B
                • SHA256 8928a370ef842bad0b40beac8b4193e31933dda7bb23e192681109da63a9108f
                • MD5 SHA1 SHA512 TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 5.1MB
                • SHA256 f6918965588630e3fb17f5bec1fbf329e71401a5b30e6ab81d42c0d424487153
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 6.9MB
                • SHA256 a29ed8d4bf969919797f8097a2fbb54fb525ad4ea27be1177e9995eab4b573c5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.5MB
                • SHA256 ac64dca7c428c039423b7a5013702f1730eca47c61a654dd8282f1dcb2ea6f42
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.6MB
                • SHA256 926e945a94347cd413fb574643f7b698dc92a57cea24bbbaa571d06751bfbb68
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.7MB
                • SHA256 1f245ebeb828d389388eb093ac404272277b6775fea948c67b897f8aaa28a2a3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.7MB
                • SHA256 c973ab6a0608092ff9d6411c8982996ce47218b79f5d7dd88b188a01271ca1d2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                3870112724rsegmnoittet-es.sqlite

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.7MB
                • SHA256 fe2469c42a67dea8aabbfc9f95579d6599d3aba43b8cc99b1329b15275e3fb88
                • MD5 SHA1 SHA512 SSDEEP TLSH

                targeting.snapshot.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\targeting.snapshot.json
                • Size 3KB
                • SHA256 e2b550b0a2055d24dbb1ddfc5753c00e84ca86fe263d6f2a59642da8c6e193cf
                • MD5 SHA1 SHA512 TLSH

                xulstore.json

                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\woy7kavs.default-release\xulstore.json
                • Size 167B
                • SHA256 c1bed5f53e44f988d50469fe36ee52ab0bfe2215cc126514ad06b5c0c28dfd87
                • MD5 SHA1 SHA512 TLSH

                memory/4456-2-0x0000027180000000-0x0000027180270000-memory.dmp

                memory/4456-12-0x0000027180000000-0x0000027180270000-memory.dmp

                memory/4456-11-0x00000271FB750000-0x00000271FB751000-memory.dmp