hxxps://snowstream[.]vercel[.]app/

Analysis

user interaction
yes
max time kernel
63s
max time network
67s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://snowstream.vercel.app/
Sample260420-jpf6tact2j

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	firefox.exe
Token: SeDebugPrivilege	4332	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	firefox.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4332	4888	firefox.exe	79
PID 4888 wrote to memory of 4332	4888	firefox.exe	79
PID 4332 wrote to memory of 2184	4332	firefox.exe	80
PID 4332 wrote to memory of 2184	4332	firefox.exe	80
PID 4332 wrote to memory of 2184	4332	firefox.exe	80
PID 4332 wrote to memory of 2880	4332	firefox.exe	81
PID 4332 wrote to memory of 2880	4332	firefox.exe	81
PID 4332 wrote to memory of 2880	4332	firefox.exe	81
PID 4332 wrote to memory of 2880	4332	firefox.exe	81
PID 4332 wrote to memory of 4284	4332	firefox.exe	82
PID 4332 wrote to memory of 4284	4332	firefox.exe	82
PID 4332 wrote to memory of 4284	4332	firefox.exe	82
PID 4332 wrote to memory of 4284	4332	firefox.exe	82
PID 4332 wrote to memory of 1232	4332	firefox.exe	83
PID 4332 wrote to memory of 1232	4332	firefox.exe	83
PID 4332 wrote to memory of 1232	4332	firefox.exe	83
PID 4332 wrote to memory of 444	4332	firefox.exe	84
PID 4332 wrote to memory of 444	4332	firefox.exe	84
PID 4332 wrote to memory of 444	4332	firefox.exe	84
PID 4332 wrote to memory of 444	4332	firefox.exe	84
PID 4332 wrote to memory of 3292	4332	firefox.exe	85
PID 4332 wrote to memory of 3292	4332	firefox.exe	85
PID 4332 wrote to memory of 3292	4332	firefox.exe	85
PID 4332 wrote to memory of 3292	4332	firefox.exe	85
PID 4332 wrote to memory of 956	4332	firefox.exe	86
PID 4332 wrote to memory of 956	4332	firefox.exe	86
PID 4332 wrote to memory of 956	4332	firefox.exe	86
PID 4332 wrote to memory of 956	4332	firefox.exe	86
PID 4332 wrote to memory of 3540	4332	firefox.exe	87
PID 4332 wrote to memory of 3540	4332	firefox.exe	87
PID 4332 wrote to memory of 3540	4332	firefox.exe	87
PID 4332 wrote to memory of 3540	4332	firefox.exe	87
PID 4332 wrote to memory of 3204	4332	firefox.exe	88
PID 4332 wrote to memory of 3204	4332	firefox.exe	88
PID 4332 wrote to memory of 3204	4332	firefox.exe	88
PID 4332 wrote to memory of 3204	4332	firefox.exe	88
PID 4332 wrote to memory of 4960	4332	firefox.exe	89
PID 4332 wrote to memory of 4960	4332	firefox.exe	89
PID 4332 wrote to memory of 4960	4332	firefox.exe	89
PID 4332 wrote to memory of 4960	4332	firefox.exe	89
PID 4332 wrote to memory of 5088	4332	firefox.exe	90
PID 4332 wrote to memory of 5088	4332	firefox.exe	90
PID 4332 wrote to memory of 5088	4332	firefox.exe	90
PID 4332 wrote to memory of 5088	4332	firefox.exe	90
PID 4332 wrote to memory of 800	4332	firefox.exe	91
PID 4332 wrote to memory of 800	4332	firefox.exe	91
PID 4332 wrote to memory of 800	4332	firefox.exe	91
PID 4332 wrote to memory of 800	4332	firefox.exe	91
PID 4332 wrote to memory of 3248	4332	firefox.exe	92
PID 4332 wrote to memory of 3248	4332	firefox.exe	92
PID 4332 wrote to memory of 3248	4332	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://snowstream.vercel.app/"
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://snowstream.vercel.app/
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {382bc219-5a61-4b65-8a26-8315e756f988} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {d44b95cc-5591-4aa2-b24f-ddddae814bd5} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 25164 -prefMapHandle 3908 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {99c58725-7c3a-41da-9fab-073af14bd555} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4056 -prefsLen 27274 -prefMapHandle 4060 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {ff020b79-c771-429e-9d1e-8b4472d3cd39} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2828 -prefsLen 34773 -prefMapHandle 2708 -prefMapSize 270279 -jsInitHandle 2712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1652 -initialChannelId {c4a7900b-ce91-48ff-a3cf-1c770b89e45c} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5064 -prefsLen 35010 -prefMapHandle 5068 -prefMapSize 270279 -ipcHandle 5040 -initialChannelId {66ce2bcd-7793-4ca8-8a7a-90193fd4a7c6} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2868 -initialChannelId {c5ba17ed-1875-4181-a222-4a824424dd3b} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5768 -initialChannelId {b89ee949-0eaf-4002-bf67-f3cd7151f2ed} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5944 -prefsLen 32952 -prefMapHandle 5948 -prefMapSize 270279 -jsInitHandle 5952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5956 -initialChannelId {7dea54af-1f6e-4f10-8c9a-8f88912b32d7} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6192 -prefsLen 32952 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 6392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2624 -initialChannelId {46c64ef3-d85f-4c0a-bf8f-c7bf0ee4abd3} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5688 -initialChannelId {8ae15f34-ee96-4850-b6b9-34709132d9ac} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6620 -prefsLen 38314 -prefMapHandle 6624 -prefMapSize 270279 -ipcHandle 6632 -initialChannelId {e57b3746-6df6-4e96-9ea3-c9d2274a2b9d} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6776 -prefsLen 39756 -prefMapHandle 6780 -prefMapSize 270279 -ipcHandle 6604 -initialChannelId {bf6695b1-063b-410c-bbe5-129f9d7bebdd} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1208D57AB480854979743C844DDA67C66A0624E3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\1208D57AB480854979743C844DDA67C66A0624E3
Size 35KB
SHA256 4d17382ef0bcd2973a2a20c1c6ac4f160ca918d3d21b0ce03dded081084d10b0
MD5 17aef51933a656337bc53c1c832627d0
SHA1 b839277d6374f273ccc638d5ee5e873653a64741
SHA512 f12acaaa0895c50cd0cab67c2f22457e5ca5b86d0ad7051c1cf546ea4f024a4ca4b7df2a158a37003d6d46bf75ba34c4d0d4d79fdac8417f534df0e560f1b904
SSDEEP 768:XW1l+s2xC8LSs2P2yitawWU50zcnfkjCepKAvKiw2Bx:XWvNo52P/vt2kJhw2X
TLSH
T1E6F2E0372F003218BC8063C04356AF897F64B22396B9D9B07479AF4D7ACA139643D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 7b09ecf89d158a0502afad70baab67521d139d3c4e1ba9d465d675e1387fd503
MD5 8c11ee08412e9562573e413cdace8552
SHA1 7c6143708933aa4a2cb699fd20d411bf49987ca4
SHA512 ea8118ba08df4adfec5732c10302834872c9c61257096dc38e025d11a0ae9a8cf7ba4992ceab9baec9ae93de88689d97a373fab06df8ad0d14f789365952d7cf
SSDEEP 384:HbaFrLiO024YnFuhw+5EL1pPsac4j0lpDII+iTETF:7aAZYnFuK+5EB9sac4ID8Li4Z
TLSH
T13D528E7D9F0138BA1A6BD2D4D9AE9605CE04D6BBEEE2D15605143C44C7803B8B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 c9c4b7c0698d9dcd6396b8b759ee2421315a7260c6702788c93d5dcc6f4b127f
MD5 73cf7577760047a70a07a44c28b557ee
SHA1 9f843d6102f22fb90a530fe37d44413d364886da
SHA512 5c100fbb355e07da1024cff7f47b63518c409c3c44033b5d34eb0ef9089f044f99b35887ed9f9886bd0f102f41161f60082d66744aec2f33dd6bf5dbcab7513f
SSDEEP 1536:jTrliXeViDAZl6xUq/D2yJtJdjrJK164izEsO70sqEBnqydqbhl41BKF68Ggz4e9:j3lLl6xUqHDdjrEYy7oVj+26wtKhw6HM
TLSH
T13AA3AFF2DFE3893D65FFD02D9B82853EFD266400B3A73009D963275061C6BB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\AlternateServices.bin
Size 16KB
SHA256 c05881d750826f7326c629d969218dc74302143605294b57fb82f13635dbab9a
MD5 93816c047e1f67e11c3a5520341c1dc7
SHA1 448299115e6a58f58c596553de76bf733c3acbee
SHA512 7d9c6e2c199a0d3313350c01ca202cb1bb08d01e332f80f02bfe6c3c26b775546f0be3a3e0afd484d4623e350602a74d8f61bbf2a9af5d061dff4b9d5d014ff9
SSDEEP 48:9777I7K6z7q1bk/q0puZC7tVAAEQn4ooJ:9777I7K6z7q1b3CRVAAEQn4ooJ
TLSH
T1E172E8FB27A2D225F0210F7440EC794DD8AB01165CD482659715E8CB0AD77A1F23BB2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\AlternateServices.bin
Size 10KB
SHA256 d56d51eb2a0c949302770330ac7e4847a4713109d232b3543f378fb52189a579
MD5 f49df4a5734b0cfa7d450733256bfd1f
SHA1 004a6484e54ea62908c938179b182f9811496ffe
SHA512 6bf5bfbfa1879699eed0f25c4d6b22cc612b779456804dc7443f9c5dc2f297f4f0d2e42838cea045bdcd795bff11745559e950f5906b51e041eca902e8addddb
SSDEEP 24:w+vRTdqe/vRTdIRTdwYgOhuhMZbZqeez3OBBW71dYgOxcl1OR8uRqdORjRoWZjRh:d777I7f6zuq1HE/qepubC7t
TLSH
T1D822C7EB27A2D226F0210F7440BC7D49D96B11166CD483659A69E8CB1AD37A1F13B72C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3ac3d9d046eec28154c6e6567994c7c3b20f08620f8ddd8ac28e7ecf498a23d3
MD5 f3ccb7e1047afb9bc6274d7097019ddc
SHA1 83b81268bc90680f7cebc8138a116e3ea4f520a6
SHA512 c67c3809aad4d5ccb55d6786bf07f83be291d473642c3bfb3304aab28982a5ff627dfd8c1fe9d406ec7a0740672db702056ba990d2905bfa392d140aed9cddbe
SSDEEP 192:w/1d66Joz0dzgCl6mc0dHOv5zboHSZRJyj982:qd66JozQzgC1jqboyZRJyjr
TLSH
T1F3E1FE65E628863FC40403BBDCA51F410F36389AD84E3F19769C640C2D576DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 81KB
SHA256 f5bf079e7a04f1f90f9afa04476c63dc6e1586c6e9feec16d681b07ccbfe2a72
MD5 3a72b346b2b0f3f3998ddb0f79298886
SHA1 1e5216e96357064e953f82a24b5b82bf5ebc008b
SHA512 d7142fff0cf069a5568e94c5dd124f1acaf06d27ed74ff1a8713d9dafd5322d9c16a8f51f30a1203ffbcfd52d63fd990de8884033f6299eb8ce0f70097fa88fc
SSDEEP 1536:ZIqQ37oQyT62fzAQVdX64F8C+xLn1CIEXf9dR64OvhMU8rETRld0:KhrIHftKZMTfUzK5OV0
TLSH
T13D832344EB5A953FD82802BAACD61B143F39F8895A1A2B57371C54343C873ED3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 d729e0a8351cd746bbbe754b08e367ddfaa31c6347a86784b5ada186dbb29ca0
MD5 f8f952877248d936f503f26b7307a7d2
SHA1 6724f635cdd99f52f86ba293cc1ef8d82abe820b
SHA512 7962bbf9106fb43731fe07615fea39b0ec1c79b9ad7789e595b992d4aa35ecb64ca01fd56835d12a340a16f1cf29137a667224d9894cc3543e5c90caca07439f
SSDEEP 96:FShSdF95/7bkW6QXjrcEq0JyUR6F9x2WZwV52FCF7FOcFV/dd66Joz0dzgClKtm5:0Ov5zboobRJyjtxW/1d66Joz0dzgCl6s
TLSH
T167C1BB25F6398A3BC844023BCCA51F401E36385B985E3F1932DC64492D662DEBA8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 21ce27c35c157ba1ca6181f8880549539dc569c86945794e2a99734ff20a8d31
MD5 4f853ab590ad0f9699cdbc9fe83f9464
SHA1 f241951e27ea5028a085f161f3ae19d6752952f0
SHA512 a4941a4706c7921e99ed3be7a6a54dca1ccd63513d5b0b6033e4e03359182ebdfb1ce4b51bfda63f41bc15ec9b1d1718d4cf953579866275f168bce64518e993
TLSH
T1F7216ADC39B84E2ABC8BE6AC7451038E93154A0B48CB5D431E42DE8DCC85ED9326B43C
MD5 SHA1 SHA512 TLSH

Submit Download

02e1bdc1-7f0c-4d2a-b115-d0e754ced61d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\02e1bdc1-7f0c-4d2a-b115-d0e754ced61d
Size 235B
SHA256 47168dc12ef077544c41bbe0d4b7056f0954ac1246e7c32b6a8b8e97b01f59be
MD5 13db56fde0c8840e3514139c1d4bd17d
SHA1 c5e557bdc79abadfbfb25782fe7b459a8fd19a5b
SHA512 3d2e00ca4842bbc6fb40c85fd870772d0147f8642365de3a32769ecf0b6519a42baab5ed23e9d4586216366c3d960c443c10fcf7e1f5381ff633866354ccb963
TLSH
T199D0A78029A86B5D4C151F1EF0A069C671644C3724B4B850DA6589B49DBEDD843A2927
MD5 SHA1 SHA512 TLSH

Submit Download

4f6d4749-67c8-4709-a260-4c84c2cfb500

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\4f6d4749-67c8-4709-a260-4c84c2cfb500
Size 16KB
SHA256 a43365dac97e9a07f47aeca34403b452b13e2cef0c0a754ecd86f9024634a282
MD5 193979a93bbc5b50dbc2910afc4c6b44
SHA1 c0977af135ab31b2dd1ea99cb9786e0b696294bd
SHA512 ed021b3535161d0a6dbec3ee4ed78d32302e6beb062ced201ee17142ac78c1ce0150c8b0d2e27defe97f5c619fecda4f324b65902e1ff0fa4ad505c27a60d35b
SSDEEP 192:+f/803KVKjnuL8zzmbSixR7wiiJ4x4VY9P1X1qfb2ABw0UXifLC+yrLUWeXNDgva:C/80oKbuL8ubSixR7wcbdaXqQES
TLSH
T1B672BA56182048BB8691E39994E87FC3E2F528CF4C419FCD9BE4BD086DDE1AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59d7e646-0235-4986-a48d-7ac0f86dd2fd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\59d7e646-0235-4986-a48d-7ac0f86dd2fd
Size 883B
SHA256 9a0493a00d6196b49790f1193eb23ba1947b1c8ebb90ca9981df2285575c4500
MD5 971ffbdbcef9ea169eed679fd35fab02
SHA1 fe030dc5696a1924c898169ee1056202a48cd46a
SHA512 0998df22a1119208c790d8a3d02fd4e593e9d59ea2dbaab6f01c6c0c9d35b15c7a07e3dfbf041a4f197468d890e66711da32e0ddcb02971f2c65e3a38150c525
TLSH
T1CF11C0529630B972CD28838FC5967B8257F87427C0C944147EE55A140DBE91EE397647
MD5 SHA1 SHA512 TLSH

Submit Download

df0bf699-5922-4690-bf27-2476abcf9b7c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\df0bf699-5922-4690-bf27-2476abcf9b7c
Size 886B
SHA256 73665e9d24d9b176c19ecfdaea63f9bf0f4cc821d6bf52d8be8b86da69ca10a8
MD5 f718d3fc3451eb930b65d7a74697f230
SHA1 897216214f138866a98f00717e7312adaa2366b5
SHA512 be497430ad7b7fa8e45a514e5c81efe8632b4f7a8f878d4a291410e36f002a5ce0652634fa99653cad946449ef7f7e070b2a6d20ff7f5de8ef81aa626f4f522a
TLSH
T12011DC41867479B2CC28938FD5D17A8256F47023C0CA0C04BEE99B180DBAA1EE397607
MD5 SHA1 SHA512 TLSH

Submit Download

e70422d4-33a1-43eb-ad46-ebd48967c3f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\e70422d4-33a1-43eb-ad46-ebd48967c3f0
Size 2KB
SHA256 534d7536ed4d7e36e57176f3a79be982f87898bf7e17cdd000f538939c0f75a8
MD5 0fd100b4708a679394accd2ffee1883d
SHA1 3ef4b1133bcf8aa7cfd2951e9563342941d49d85
SHA512 732c91c62960513958336b7d5379149b8fbbf1dbf8bc81ca2733558a7b4244709ec1a7d9f471b4ce4d4f3dc0cd93d1bd8566d09359731c90da4d3c7f3dd5d254
TLSH
T1F941335C31785C7A9CC6E68D9482338D53608A1300CA1C436E92CF0C8C9A6DF736F52B
MD5 SHA1 SHA512 TLSH

Submit Download

f7ef80ab-7072-4aec-bb1e-77b5f322192b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\f7ef80ab-7072-4aec-bb1e-77b5f322192b
Size 235B
SHA256 f1092e0ccbcedccbd58349894b303f16e9f4b9a1516fcd1897e8f645cdcbd240
MD5 425edf009220781a8b9dd2876ba8520d
SHA1 6bd227f7b3780bed91f83c251bba76c7e49bd67c
SHA512 1df3c61654de8f78bf6bca9d164908f00af9752253eee6758f6fea983fc2e5c25897396c22a3d43ab11f905559b00e9bedb66202c46f4055d751e8a4d8253641
TLSH
T1C8D095802484A76C441C0F57B0A079C131554C331474685086700178F9F9DC84151C27
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\extensions.json
Size 16KB
SHA256 585a393d1813344382f38407d8ca87a4edc8c24ab0a3d86496447e3138162321
MD5 c1379d03c2ce94aa6ff9bca69e49d65c
SHA1 179a43dd8e70b02a9bb61b79544ad7210cd620f0
SHA512 fed993e16664494e56710b4f60d762c8c2653b3c7a42bb1aefb99d5c7dc6e56c7f2ae2d852e55832651e8ac93d4c679fd5bf6affc3c3c5048331206a01267a18
SSDEEP 384:MkI4voUmldvM8dhW894z896osRL4HmL4PKL4HGL4HJL4Hy04hb:DI4QRfVX94U67J4s4A4M4B4f4F
TLSH
T15272321545049EB8298E979BAA367E02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs-1.js
Size 12KB
SHA256 d43ad05ff3430ac4db6e9ebdfa2a214b37e587608758f6ff812479652847ac08
MD5 21e727e0132d457d490fb03db68db103
SHA1 36490a4bebecb753772e3ee5febad4d652497318
SHA512 d609a7e4b8b546fa99c2fdff6e13346cd2c2e1e5ac7506acc2c50c7c3e977b27f1efb72d34cb9c4f6b419c51bd603031be9653c0bf54747aa126c834024dfc30
SSDEEP 96:xHGJVTUtBoqGqV0fOSRObzSTXSSlldv9j6pnYtpwoDRmxLCi//mBw88tCKaYPSj1:CeRmfOSRlXSSRLRWj/mBw88gUPSjT5
TLSH
T17942ADBC55048A3F70BB327DBC6549A129A1416776FFFCD216F98882085CF2442F6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 fceb62a255c07317e9e5597578b2b5eb79f983d861d5a91e7845d16778076f74
MD5 5e49f54892635d4a4d9297436b46c1e6
SHA1 1a0d0744454eef5f4f2a15430a9e2dcf25246d5e
SHA512 943f0c55d17150ed27ca597dd5d3fb187b0633f405d3595aef6bf1e5063531ad684ecdaa1c489249abe2688b2a07e09058425c64648aecf867886f36d09f4056
SSDEEP 96:xHHJUTUtBoqGqV0fYKjzDnjb1zS3rSSlldv9jUnYtHFLkBw88H8L4cnZhLMR:njRmfYcDfmrSS5FoBw886s
TLSH
T136E1217895088F7F64B677ACAC6889316AB2413B7BBF68C750B544C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 7KB
SHA256 5e8dd7fc434993b0b942c27f4c120db4e03c0130c13c470f80302fc8419e77b6
MD5 f9b247a04bf1ce762983f8966cabc3e0
SHA1 e343740b82c5cfc9ae9caddeed59665f835d622f
SHA512 e0c965f573291d00f3f52665567d2172fd6c2d6fae2b65bdecb241ed89122567ea50a8522d51b0c41e7fc35ffe191d658b90934d6021a22312dad5c28b2bd911
SSDEEP 96:xHHJVTUtBoqGqV0fOSRObzSTXSSlldv9j6pnYtHFLFBw88Vw68L4cnZhLMR:neRmfOSRlXSSPFxBw88Gts
TLSH
T1ADF1FEB854048B7F74B677ACAC6889716AB1013BB6FFA8C351F94485054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 85c3cfa8367ff8afc1facc8821509a5864ccf6bc29aab9ceeaafc16edfe87bd8
MD5 40ac1871b2de204d3efcce6aeb46e597
SHA1 254d490e2d7befe34bba3bd219bb8cd6664ae5fa
SHA512 76be37312f8af8cf2a6e140c2c459b88da8d763707db06cc394248edf47690b337996eb8160df4b7cfb05400290d5b5536133b05917c8173648e472497a3082c
SSDEEP 96:xHHJUTUtBoqGqV0fYSRObzSTXSSlldv9j6pnYtHFLkBw88H8L4cnZhLMR:njRmfYSRlXSSPFoBw886s
TLSH
T1DCE1217855088B7F74B677ACAC6889316AB2013B7BBF68C750B544C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 8a706f12beb524e26f22d581ab46fd45a4ed0c9c00be54cc79d953ddb2748b02
MD5 51c370df8a69c5bf1fe967253ccabcbb
SHA1 db2a4cd43719c3f76d5bd728053f5d04b18d18cb
SHA512 5c3b88b29d491fd9dcb7cb630f086b434d6bffe8927dd5227626c5dbdc5a93c64cc830c80c6952734d83c52dfa28481f6d808eeb64e8daaeafdc592996aa0069
SSDEEP 96:xHHJUTUtBoqGqV0fYSR1zSTXSSlldv9j6pnYtHFLkBw88H8L4cnZhLMR:njRmfYSRaXSSPFoBw886s
TLSH
T1F5E12F7855088B7FB4B677ACAC6889316AB2013B7BBF68C750B544C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 740KB
SHA256 f7d52e5bb4ce195cf81c0a53719501b24f4bfdbeec1820cd3115addb930895f7
MD5 ac1c1b8e457bc7fd7260b811d6fc04e3
SHA1 3d97f30ff74cc488417f799d2d3a6ada2ecaf820
SHA512 2d8ef38a840b2149c29e4dfc3f5ddb5bc6c15865b24d430a2f6e7daa75548ae98ed50d50c53d729de6d4471b30940d70ea492d1f28e3fe9cd0b9958cbada80dd
SSDEEP 12288:zKXSKFIYkJRoQwB7j90bCZ9l597R0tonN7R/tnBk89LmdTwQeAWH+6h6q9YSbHCX:zgfFbQoQwBjjZfR0MZR//kumdTwUVC6Z
TLSH
T1A3F423E134921EBB925AC3EDF12D6A1BCDE95E77C19EA9C901B078C0253F366474B434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.baklz4
Size 739KB
SHA256 0926efd5609efd884426fc7308f81cd914a42a6ad51a98a0fcd3fe2677dead54
MD5 ecb801c617fe0aa4a3d7a3a6c01501b4
SHA1 d00bb06bdb6faf2def2aa22020dbcd97977420d3
SHA512 add44a6223d33202ad0d86307b5d3e69807a1711fde2fd0e311388cb3ec5d724eb7bed18f8e7f6d16b095176f58d525eb375ccf9705ab3785696414cbce07350
SSDEEP 12288:rKXSKFIYkJRoQwB7j90bCZ9l597R0tonN7R/tnBk89LmdTwQeAWH+6h6q9YSbHCs:rgfFbQoQwBjjZfR0MZR//kumdTwUVC6m
TLSH
T123F423E134921EBB925AC3EDF12D6A1BCDD95E77C19AAAC901B078C0253F366474B434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\sessionstore-backups\recovery.jsonlz4
Size 740KB
SHA256 b4d306b7278ca6c90c0a96a98787bf405f085b7b7944fbba915a3b857e36c7ee
MD5 6ffce83e6ed8f241a881f71a9406193c
SHA1 699f53fbd0a010b97a98a4a6902f7052a49012e6
SHA512 f04783aba69889f7595bc52e0ff7feaf9458c428a1a6ae5bf80e26b08142b970c40ca3fba5552d8defab7046ecde85a7a246684303d5e5b54899b09d11590086
SSDEEP 12288:sKXSKFIYkJRoQwB7j90bCZ9l597R0tonN7R/tnBk89LmdTwQeAWH+6h6q9YSbHCy:sgfFbQoQwBjjZfR0MZR//kumdTwUVC6s
TLSH
T1A9F423E135922EBB921AC3EDF12D6A1BCDD95E77C19EAAC901B078C0253F366474B434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 3ac156bf412ade255b2305bdb4afac3b1298d0c7cd38fef3b55c116efac1ae24
MD5 43575ba5dec91eb34e2a8ac0cdd3e23f
SHA1 dfadf8cf063697b148ae88e3fe1668a9158a92ec
SHA512 4e2afaf43235001cffd2c65a0040840aefa4113002fd6e9b795705f2cfcd3beeddd469f3c150893db24664e571068659e8c7d7c7389fdf90157866fe01097ef0
SSDEEP 49152:kvkrRVaAIoW8zN6wlUdXxlxIDrBky9uwkw5LoOc+kYKau6Ngek4vs9xQA6T36GiB:cdqZhiMoqYfEAFAX
TLSH
T1DF566CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 9e69cd1d21c597126a39db1dc177156a5a177476e44e8c36f70de8298f1450a1
MD5 df7b08c84d76272bd0e1e79652a84444
SHA1 25df46fc1de3a558ab696d7b1b49b398cccea0c3
SHA512 4df90eb96578f75a723602f5b8a1da33265159c020d78c3894d2d27b58933d3da1aeff231f37763782e3956e625a73ed142c7dec8f76f600ee200a825a9d3bbc
SSDEEP 49152:UvkrRVaAIoW8zN6wlUdXxlxIDrBky9uBkw5LoOcIkYKau6Ngek4vsWxQA6T36Fiz:PoqZmiMoqYfEAvrX
TLSH
T10D566CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 c533f0af9ae07a04821d6e6f8d0a56fa7c18af29c6b28e0b1aca9bd4972106b9
MD5 f75d6d990e7aca7b9a8a5dfd6ead8a9a
SHA1 cf8ae84e41aa562970e38216a2738dda87921df7
SHA512 4bfa796e59ef0f23f586fb899f10a59ba9a443aec3a0674df10d868060d8dc8dc8052506dd8588378b0017caa54d4474e5add9686d5c2f4fd4e47ee0b6ed9d64
SSDEEP 24576:JNXGl209jHKYh9DuyO6FDqX+RIqUXmw+fZn4V:JZsjKYh9D7O6JquREF+hn4
TLSH
T1B0F52AF82092B357F3418033A64553EB21EFD00CA467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads