hxxp://dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd[.]onion

Resubmissions

05/05/2026, 13:01

260505-p88m3agx2v6

05/05/2026, 12:44

260505-pynvxags916

05/05/2026, 12:23

260505-pkn9hsfx9s7

Analysis

user interaction
yes
max time kernel
899s
max time network
891s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion
Sample260505-pynvxags91

Score

6^/10

persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe
Token: SeDebugPrivilege	4392	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe
4392	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4392	4116	firefox.exe	84
PID 4116 wrote to memory of 4392	4116	firefox.exe	84
PID 4392 wrote to memory of 4712	4392	firefox.exe	85
PID 4392 wrote to memory of 4712	4392	firefox.exe	85
PID 4392 wrote to memory of 4712	4392	firefox.exe	85
PID 4392 wrote to memory of 3548	4392	firefox.exe	86
PID 4392 wrote to memory of 3548	4392	firefox.exe	86
PID 4392 wrote to memory of 3548	4392	firefox.exe	86
PID 4392 wrote to memory of 3548	4392	firefox.exe	86
PID 4392 wrote to memory of 5496	4392	firefox.exe	87
PID 4392 wrote to memory of 5496	4392	firefox.exe	87
PID 4392 wrote to memory of 5496	4392	firefox.exe	87
PID 4392 wrote to memory of 5496	4392	firefox.exe	87
PID 4392 wrote to memory of 5092	4392	firefox.exe	88
PID 4392 wrote to memory of 5092	4392	firefox.exe	88
PID 4392 wrote to memory of 5092	4392	firefox.exe	88
PID 4392 wrote to memory of 6124	4392	firefox.exe	89
PID 4392 wrote to memory of 6124	4392	firefox.exe	89
PID 4392 wrote to memory of 6124	4392	firefox.exe	89
PID 4392 wrote to memory of 6124	4392	firefox.exe	89
PID 4392 wrote to memory of 6028	4392	firefox.exe	90
PID 4392 wrote to memory of 6028	4392	firefox.exe	90
PID 4392 wrote to memory of 6028	4392	firefox.exe	90
PID 4392 wrote to memory of 6028	4392	firefox.exe	90
PID 4392 wrote to memory of 5932	4392	firefox.exe	91
PID 4392 wrote to memory of 5932	4392	firefox.exe	91
PID 4392 wrote to memory of 5932	4392	firefox.exe	91
PID 4392 wrote to memory of 5932	4392	firefox.exe	91
PID 4392 wrote to memory of 2708	4392	firefox.exe	92
PID 4392 wrote to memory of 2708	4392	firefox.exe	92
PID 4392 wrote to memory of 2708	4392	firefox.exe	92
PID 4392 wrote to memory of 2708	4392	firefox.exe	92
PID 4392 wrote to memory of 216	4392	firefox.exe	93
PID 4392 wrote to memory of 216	4392	firefox.exe	93
PID 4392 wrote to memory of 216	4392	firefox.exe	93
PID 4392 wrote to memory of 216	4392	firefox.exe	93
PID 4392 wrote to memory of 5744	4392	firefox.exe	102
PID 4392 wrote to memory of 5744	4392	firefox.exe	102
PID 4392 wrote to memory of 5744	4392	firefox.exe	102
PID 4392 wrote to memory of 5744	4392	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {694ad28b-a0d3-4cdd-9e82-ec0bd8ca2238} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27135 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {e96f6803-cfb4-43ba-aa35-908a386df706} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752 -prefsLen 25164 -prefMapHandle 3756 -prefMapSize 270279 -jsInitHandle 3760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3768 -initialChannelId {2f8970a1-8760-4d0c-a830-c3510cdbdea2} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27276 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 3988 -initialChannelId {fe5afe90-80a6-4897-96db-5747daaf233f} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2692 -prefsLen 34775 -prefMapHandle 2848 -prefMapSize 270279 -jsInitHandle 2856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1632 -initialChannelId {9d5f6663-c78c-4f34-84c5-a726b45115fc} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4808 -prefsLen 35012 -prefMapHandle 4812 -prefMapSize 270279 -ipcHandle 4788 -initialChannelId {b778e68f-fd30-4bd2-840d-7ad413918191} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4932 -prefsLen 32900 -prefMapHandle 4996 -prefMapSize 270279 -jsInitHandle 5000 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5008 -initialChannelId {af72af18-7d2d-4f55-8aec-aea1c6be3d84} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4568 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {e6d96b0c-de84-4386-9a23-508f14541e7c} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412 -prefsLen 32952 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {68e9df01-d5cf-4052-b7e9-ab6ada4978a4} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15148 -prefsLen 40379 -prefMapHandle 5808 -prefMapSize 270279 -jsInitHandle 3588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1416 -initialChannelId {bcb86bc1-0e02-49fa-bc17-b35122d906b8} -parentPid 4392 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4392" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\unfswcr7.default-release\activity-stream.contile.json
Size 4KB
SHA256 2699776e69bfdb6a4c9006349cc2d418e32eb6d8f1af89e5e09adefbf7cc82b4
MD5 f384369870a999dee0e2a3bedbb9a8b6
SHA1 6e26b861e83d2dee16fed060eea11b878b29c749
SHA512 b1ec1175922116f3275b7d1a89f71814a13c09d23010ca4191018a968e5fc18de39f9339c114238df7109c81d5505ed731e3b0411040b51f15473fe5261f7565
SSDEEP 96:qYmltFoMgU4cv3vP7EaTvHKYft4Yw6DSvol:mltWMg3cvvPnvGYwwSvol
TLSH
T19EA1F8AFA89CDC479BB12AC56C1F379CF10FA287E5CDC949BB44CC11A6C028F41AD985
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\unfswcr7.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 10KB
SHA256 3fca50dbad11c9d75626424afc2c2c71ffd1f7bfbf96ca99fc7ee60339a98ae9
MD5 210c2d49d67f760b705edd0f44eb6192
SHA1 a20cd2e44b3a6881db9e352506cb513bd306db27
SHA512 84cf9d2e10d9943543f504614e8d225d8518174df58e5c7bf91cfac2466933c2d79647c20fbb2023d3bf175b94978a1fb1ff3cfe8904da5204ee52e7b4f14d99
SSDEEP 192:HcypyOr4cXz5RqvAcdRPSHXFCPD1Oo1ZpXlfdd/WZjRCu3mZq/h1Vplpn:HHMO0iO024YpfdxW9ocmZGbplpn
TLSH
T1F5225BBAAF103CF81F17D0D4D8699619CE88A8BBEEE39017116C3845C641775B8F846F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

290e1d0e-6d5e-4159-a1ae-a3e44f49f04b.zip

Path C:\Users\Admin\AppData\Local\Temp\290e1d0e-6d5e-4159-a1ae-a3e44f49f04b.zip
Size 3.8MB
SHA256 6ae235b8ff5729383d3cf219320341b1456ad9c47696a519535abde34bc06004
MD5 22d280b2b7cf41f372676e1ad87a2788
SHA1 c191fa824f41a7785a4e4423e3bb19debeb9fe76
SHA512 0dcee546cd38ec992b9d4b722c96e5c20d42ec3efdf4c48b865ef1002662e6ddd274fcf259649fda5d9516e567c041e36b8bda2723a9eec852738708ec15043c
SSDEEP 49152:5trtdv2tUMTenCTqL2NQTpkMXjumT8XwQzqiUlUsPPMLvzhOF3myTIvIeOX2hxNr:5tr1C4FtkMp89JUlUEPMZOPTLmhxNsK
TLSH
T19A06E135F67C9708CDCF83BA810E2FD29C4C5F6680D8A57B6A6AA5715CA31E21F448CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 2c851a1fdb87a01f51bc990aa997779d18bcb315231c2a816aa40c24fa531983
MD5 91b73c30b5f04566b3be87241ebd6460
SHA1 4d5a4081290dd892f2278f3416d92f1c80ab3394
SHA512 220fa6658ffb3bbdad8b41100ea7987eed3911f51cd56097b69efe89b1af340cf7d9cc2b38ba3e9aedd6006761a2fd4611a3397f1a1fcd2101d49db56d39d3ad
SSDEEP 48:3KdrbJ5UgdwQuzUYddrbJ/6BdwQhQUYHdrbJ/adwQAXUvgDdrbJphwCi2QGiZYV7:clO/mn8/m4phaC5KxLU
TLSH
T15EF1FD410BFA1E92F9F38A31BE3577169773F901464B551EC28416890A337A089AEFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UHADZX7TZFJS6V3ANW0V.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UHADZX7TZFJS6V3ANW0V.temp
Size 7KB
SHA256 6afbf19ca5f0441b8950f160f865f434aae4370b86eae7479a017f9dc17b5e1c
MD5 547d9fda0f8d329e30a334843f57b37c
SHA1 942f7348ae39240884e3f5d10e559770e95c5a40
SHA512 5b4019f748417e5debd31e62788333695b1ad31764245b2e38817d9602383175c428b4a0b8b1819ea9f8ee1883a6c6c4ad95c2c0c7d28f40fb60f2deea128891
SSDEEP 48:SKdrbJ5UgdwQuzUZddrbJ/6BdwQhQUZHdrbJ/adwQAXUvxDdrbJphwCi2QGiZYV7:xln/mnd/mxphaC5KxLU
TLSH
T1AFF1FF410FFB1E92F9F39A31BE3577169773F901864B561EC28416890A327A0856EFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0965973207ec79972531f65f9e78aa3b72f2276a5c5d37ab769762b6bb67ea1f
MD5 69b920ca4601f0c89ea1fb5abef0adfb
SHA1 a48e81ae6d74f5b9ab587be60e987640562dfb55
SHA512 c62b7659d629d4185b03d83e2953a3d4fb20a92a809be01f4df1b11debac184cec85e850bc08468ace4bacdc62424936e4dff383b4330d5a1f0df98c2fa0bfbb
SSDEEP 192:TOv5zboPkZKxyjERb/j1d66JozGzgCl6mc0d:8boMZKxyjMdd66JozGzgC1j
TLSH
T1BBE122A8E628863FC418037BCCA51F814F39399AD84E3F19719C641D2D572EE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 46KB
SHA256 c66fc51b00e176470474bc21dc43e0bdec57f8afdca3c38d377b8e89af67ee93
MD5 a95a560deade2b822544c184f9df7791
SHA1 f4650991b921764eabf0492257cbad0c36514d96
SHA512 380fe940f6da4d443b28ab5ae4bbde145c2d7182568e0f435d8b2db74becae907db0950ece8ac79c404eef11260c2a77b69ab07f6767a3093032fba01e46e121
SSDEEP 768:RKm+rmjq+6Gcmhu9reKiI94FyJMU/sAbsbVbVbZbYbGb7bLbuIvheXV3Lu8rE/:RKm+rmjweMIvheXV3M
TLSH
T10323F044EB1E953FD42802BAECA50B003F79F889555A2F67375CA4786C872DC3D9E06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 43KB
SHA256 1a7896574d5d49b84ab95b909a56e906878c2b89f00b4e6618635c9bbaaf8a1f
MD5 594762634e747e53fe1351f2874981d6
SHA1 0f069e61e1112f307745b9002c62f49e52bb4080
SHA512 fbda11f1f0d3c1bb705a12e2a8fc70cda745197d06644118f884af20b9d706f74b1e791b4755b35c2ed237c5e05546ea6995ed92031b8abaebbbb4a86ec632c3
SSDEEP 768:WEyUd+zPJa92q6Gcmhu9+eKP4tpIsj5MU/YSbFbTbqbEbtbib7bLbQBv7cFKRvh4:GUd+rJJ+eNlBv7cFKRvq
TLSH
T1A513F044EB1E913FD42802BAECA50B002F79F889555A2FA7375C656C6C872DC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 43KB
SHA256 8267b540c2308e1aeb0dbf8eeced2c67a35233bf6969f3a3bd7fd5e2abdc1af6
MD5 53aa4828d3dca5f7a8c9efd9b28759dd
SHA1 af5b8db7283cf8af233a788e9fe1b4c9db616f42
SHA512 40707900fd2998f8c3514a248307605b2c5ee348fa97a177572c8e5c644fe5edd07426f5560b2d46cd3f250f018a77c4b8f794d606fbbbd74a9d7217ac5d46cf
SSDEEP 768:1Ud+zPJa92q6Gcmhu9+eKP4tpIsj5MU/YSbFbTbqbEbtbib7bLbQBv7cFKRvhy8r:1Ud+rJJ+eNlBv7cFKRv7
TLSH
T15113F044EB1E913FD42802BAECA50B002F79F889555A2FA7375C656C6C872DC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 43KB
SHA256 6f6584b83d0dfabd090f64869604dc392bc218fcca09721f812d151b1f8abca4
MD5 741b16bb46a57eb55dcbb81ea51e87ef
SHA1 84a4022e2c9ca54997a28e9bc78b4ee4217ffa2d
SHA512 f6a4d38a75892a1716dcb459cb790eba0b2b8dd64aad18544f28835273e00af7f389d207d8398a3938041bd3a7cde05891637b1a60c0fc6dd76d3279d82d2137
SSDEEP 768:WE68NUd+zPJa92q6Gcmhu9+eKP4tpIsj5MU/YSbFbTbqbEbtbib7bLbQBv7cFKRp:XUd+rJJ+eNlBv7cFKRvB
TLSH
T1A613F044EB1E913FD42802BAECA50B002F79F889555A2FA7375C656C6C872DC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 43KB
SHA256 09999fd30a14685839bd94c8eaf9fe2f1ee3e034347a2aff2acf7d483fbcd8ea
MD5 452716e1dbbb3a407b17a36bd0cd1a92
SHA1 4275225d521dff21d6721abbd1ea09b51fb6e6f4
SHA512 232bb78b7e0e3a7bda1dee38a5b4e4f2fb7dc1cef163443271b676b06e034e00ab4ac370375b677576b778403c2ce1ff13ace563a3313f39fd0ee37791bde224
SSDEEP 768:H8uEyUd+zPJa92q6Gcmhu9+eKP4tpIsj5MU/YSbFbTbqbEbtbib7bLbQBv7cFKRp:TUd+rJJ+eNlBv7cFKRvB
TLSH
T1F613F044EB1E913FD42802BAECA50B002F79F889555A2FA7375C656C6C872DC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a4d65bf85bd24d92710b4726acca6146433f5a50fa90c564db04fa69a2e195c8
MD5 386f379ef759bc3ca631d39d2d3471c2
SHA1 9b5885fa42cadbec76a770fb98e33e3deae5e313
SHA512 0f79850b7e3af7828a9113b7e9800495be75be1cd9a1e208e41841f2e33589e7c76f0c1e24857f44c4023fbd55f8c24eeca481961bd99c1173b06c5eff0ee7db
SSDEEP 192:b1d66JozGzgCl6mc0deOv5zboxZKxyj2I:Zd66JozGzgC1jHboxZKxyjh
TLSH
T121D1DD68E629863FC458023BCCA61F800F75388A984E3F15319C745D2D973EE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2ea532950c1ee0847edff195ee4232ed7e98c39542847786932c994db714b6cd
MD5 01d5d0643da2b6d9469d8d2e39475198
SHA1 9bc2496b889a25dc47ac465294bd03ef09928251
SHA512 08626bb4a137522c84858a71c1ba995ba3997d39cd6e4c843f5acbe7d2cdadac6d9ca356df86c867264ff22cc87a28beca6c478e63ca6eb521c33da632719964
TLSH
T15921488C3EB84DAAA987F26C7484028E93154A0704C71E474E52DE8DCCD59DD31AA83D
MD5 SHA1 SHA512 TLSH

Submit Download

2fda02ad-74c9-4f97-888f-cf13039d071d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\2fda02ad-74c9-4f97-888f-cf13039d071d
Size 886B
SHA256 2cb18cde2dd92d98afaac26e0df14e5db65d2c16ef57a236fbf10c1adfedca01
MD5 6d93497371a1d54c7ec1d7db7224f4eb
SHA1 d34d629487f47b6ddfc3627c00771c76dc9f1521
SHA512 42467d002b964f97c44680ec9a73d981f56c696de8f4264b7fd47bf50074d2a7adfbe3473c9193aec638663762f3f6f9745c87c7f4dda489dbda69b750e16f0a
TLSH
T17D110092CA3875F2CC38829BC9D47B528BE43513C0C70D043EA05D184DAA57F636720B
MD5 SHA1 SHA512 TLSH

Submit Download

37ca3c73-acec-41af-b7d4-219aceb3f8d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\37ca3c73-acec-41af-b7d4-219aceb3f8d9
Size 2KB
SHA256 69a8cdb1b8c25dfc4593829b26135a3d3496ebad16ba45c5d24878ed319e0bd6
MD5 77a2db4e905b5a50dff166464b71bc9c
SHA1 3487a19f1fe42e1eca7366fd9c8a01654ca45a56
SHA512 8753d26e4a9f75965039dbf6d395a98a6b27d74a8bd00f38a3f49c322564d8ce49b3f288d7897b1719c4ae3240b4bd13213a63531da4bf7c8544858dcc3bbcef
TLSH
T1C141315C35785D7B98DBE54DC482338F67A0890700C22C832E51CF0CCDAA6EA736B42B
MD5 SHA1 SHA512 TLSH

Submit Download

5c43ab73-d98d-4658-bf9a-fbf2a852b283

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\5c43ab73-d98d-4658-bf9a-fbf2a852b283
Size 883B
SHA256 8707467ba2bc41ea5f5d31f83ff4d9bb222d089c815a6b64555240002b2a2714
MD5 66cdbb39388abb8f33b0b3d4732bcb50
SHA1 609eb9f1093ffc7fb1590e2d5c8362064fa5ac19
SHA512 b6a257ac91aaf4c6a54ac2a196f38d72784ba4f86233e023b451eb292b5de36407602d2d1ef92e990a0726483269ebc99eddf036c68ffa83f94d57138e297fc8
TLSH
T1F811C045D634BAF2CD7C824FC5953B129BE47417C0C649143E6059190DBE67EE76720B
MD5 SHA1 SHA512 TLSH

Submit Download

7ea6a591-5f11-467e-be50-71148396d498

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\7ea6a591-5f11-467e-be50-71148396d498
Size 235B
SHA256 3729481bec79461968ddc8f9aa2be877bb2aca42858550bddbb86473f0959014
MD5 fee8f47adde0486ffeef4117f85b337d
SHA1 8ad11e6c6a863e47d81489885eed52f1efa08c81
SHA512 c680fd9a57ba2067292550be662b75462f9bb8041df38ac875d98661772b2b7faa465fba395758cfd453daa588c3114a30187a85ad2ebfcac4f471a0ba9203b1
TLSH
T1D6D0978024D877AE48008F0BB0B028C230884C3350789820DAB1427C99F9AC81261827
MD5 SHA1 SHA512 TLSH

Submit Download

a4877234-0481-4577-9a7d-ebbab163cc81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\a4877234-0481-4577-9a7d-ebbab163cc81
Size 235B
SHA256 fe20b810f640f108615b22a32bfa8b97780b0fb0ab59f1c12598a65407b25004
MD5 ee84d61f014cfea0b3ef4bea15f0a70f
SHA1 73c021120a66c1e2dd8d9365d392b3d6abeadccf
SHA512 723455ec0bd445b65624fac35645daee6bcd3c5f593e43f69b0e0fc74354b364d15a2ccf0866d8f7bba36a0336559cbef3471fd65995bcedd29b014ae55dfc25
TLSH
T1C4D0979018AC63AC08108F42F0A07EC230994C3310606850D961803499BADCA0216C26
MD5 SHA1 SHA512 TLSH

Submit Download

f6191598-3acf-46c4-9b71-4e9af65672a4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\f6191598-3acf-46c4-9b71-4e9af65672a4
Size 16KB
SHA256 0fb22e04f3d6e0adbef15a7d7355f1ebf32092eb0b78f13e9a69834cf59a3cbf
MD5 a8719191d60d754ef184e383bd12d503
SHA1 7651c6d5e0994b9c01a59d762fec6153bd04b6ca
SHA512 d314393fab7a3d2c519aad5ce89e5fb599186cc51cd6b1d7ba9b0c8dc3a730ec6c53ea1570b36aa9a55fc6f8b1611e129dcd6d38c68edb6e944cf052281ddd1a
SSDEEP 192:7DKgMY12jwxxQzRNaKPHGOlrhflSze+9epd0RUIwSsz4LBJw+3W/V1VTbiMqgS1B:o3rvSi4epd0RUasz44WWNfbYPc7KeuV
TLSH
T19C72DB16682059BB8691E35895F8BFC3E1F538CB4C429FC997E0BD092DDE0AD112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\extensions.json
Size 16KB
SHA256 8e162436f9c59b216ec909b2879c2573c08b63747e82f031350349db4230c11e
MD5 0ed2e5bfcb8d9d81e9c7a1c75228dba4
SHA1 6fbc0f660b93442f4bc314985f58183227a09f0c
SHA512 90e0c5742e36bfdb761870c529f8d5c980560f2bde20ed72a837212c7626ac9dd3d0d8eeb95549b4aa1183834d3340728448310f56be9ad383aa318a02b94939
SSDEEP 384:skI4vGUmldvU8dhW694zI96ohL4H5L4PPL4H1L4HDL4Hxf4hy:jI4ORfNXr4o6q4R474V4P4d4Y
TLSH
T18E72431545048EB8294F979BAA367E02C37D473B60845C78F4DD8FC842FA5B902FBA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs-1.js
Size 12KB
SHA256 419b16844c357a73868586fe28da4ab32fe64e3b8d248e2e01a9be14dd4bf8a6
MD5 bd584fcd24bfb543ba1060241cbb9836
SHA1 0e9329eeca0ec17c5e031ac90993d3434a9bd612
SHA512 4e09718806ad400e2fa2695dbb262b391242c0e6bd0affae86cb95b9119bb33d877a403cbda6d8fb75d4f5d7603b1bb5d5495f23a47d8f8b41b9f0cb90200200
SSDEEP 192:KyRwf7omYunBlSSGcTLRI2DDLmBw88VBlJ0Z7CuUs0t5MUgZlN1JWrJsaCZgDtd5:8VQ2RFIwWB+
TLSH
T15042BE7C6614CB3F2AF2727D6C2949B019614227B6BFBCD705F98491048CF2841E6EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs-1.js
Size 7KB
SHA256 7b15b478b3ce4cc49edfaaedadee4fb5dd21f29f3bfacf6dba643ff9042d64df
MD5 ac8e723c69eb360b23acac81fcb61c20
SHA1 b79a8bc88d4fcef95641322cd40b361f2ec06a3d
SHA512 d5e60d52042ff288f77a097a25127d6e479c45ce4657c454e3991809b01b059673c735cceec8e89b0894ece8e0033d279aea2b9d88f99d89e22909959cd5792c
SSDEEP 96:xHMUTU0qGqwfCjYunObzSXHSSl8pdv9jYn1lHQ25YAp9Bw88n8L4cnMV81t:KXRwfCjYunBHSSGcZQ2DPBw88lyv
TLSH
T1AEE12F7894088B7F64B6776C6C688C316AB2413BB7BF68C750B544C4054CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs-1.js
Size 8KB
SHA256 628679c40651d0658a816e71180b49cac387d7e8b18c4e7a9aa3cb4a11e7bf4a
MD5 14d54c3c5612d3c7b7f5a21c48e09319
SHA1 7fda7df414eceaa4561251fa02e8dfb425074368
SHA512 0c089022d4c8bc78aef6646a123075a5fd94a3704d4836b6f72595a50df76e6c437578f5c5bcdbbab7d077638be002ad39084ae07564d91e55710fc577eba217
SSDEEP 96:xHMlTU0qGqwf7omYunObzSXHSSl8pdv9jYn1lWR7M25YApjMbBw88+gJ8L4cnMVU:KyRwf7omYunBHSSGcQRI2DUBw88+gfi
TLSH
T1F6023E7C6404CB7F69B6776CAC6889705AB2013BB6BF68C710B954C4054CF3846F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs.js
Size 6KB
SHA256 94f012ed656934aa2a82ece85cfbe7433b50d50e1a18ddbb0e9c55ec7e6be922
MD5 de4fdaeca2add06ee67e075e0a9d2784
SHA1 e376ab2ab29e9ffaffb8c8225ddd08bd041ee511
SHA512 9004074b41e5beecad9c9c26d4614865b3d2ae8d712f9aacae91a483a33df0e47408fc7a44dcc141c180fa28802e2720abda05d8b4eff2192d335d5bcbf6ce79
SSDEEP 96:xHDUTU0qGqwfCjKjGnj81zSpMlSSl8pdv9jYn1lHQ25YAp+Bw88n8L4cnMV81t:NXRwfCjFgoMlSSGcZQ2DEBw88lyv
TLSH
T1C2E142785408CB7F64B67B6CAC688C316AB2413B77BF68C750B54484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs.js
Size 6KB
SHA256 7b6aa532836e15b0d9d3ce69775254be599040995f315a02352a83a459ca6a41
MD5 850b3d1e3830947fb4b892dd06657c68
SHA1 936dc7e3c3c57df8aacef4531e86416df750c379
SHA512 bf08504c68099e71ff706e67596d163e2b6e44e791ed7e9222d82f5e0c533c39c2673c2c97ea15a10a3da3899ab9754c9fbf0b8805f90a93415713c111019a83
SSDEEP 96:xHDUTU0qGqwfCjYunObzSXHSSl8pdv9jYn1lHQ25YAp+Bw88n8L4cnMV81t:NXRwfCjYunBHSSGcZQ2DEBw88lyv
TLSH
T116E130789408CB7F64B67B6CAC6889316AB2413BB7BF68C750B54484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs.js
Size 6KB
SHA256 72fa668494e2f0234c9e635be22bef5043b7855f0809d75935f75a85606a0c6d
MD5 1c08ef8f850779407e9279b9227c15cf
SHA1 580441f7238a9f70dcd12d4007264dea7a6b8527
SHA512 c41994a70c51d07b36f62f333cbc1c9a1b20ec136dbf99ab1e5099fefdac50dc6f4cf41b33e8d3d313b884f774fdbb0841717fe3b6204bdcf4864f9796690510
SSDEEP 96:xHDUTU0qGqwfCjYun1zSXHSSl8pdv9jYn1lHQ25YAp+Bw88n8L4cnMV81t:NXRwfCjYunKHSSGcZQ2DEBw88lyv
TLSH
T159E132785408CB7F64B6776CAC688D316AB2413B77BF68C750B54484054CF3846F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 f2ec85ecd784741d7f991c84a12396967e7d08ad74c2669952941f7ab8cffe0e
MD5 95a722121a4f6376d32cb45791b42cbf
SHA1 69280e84e83ec5eb7a65169fe5103b7839d3d3fe
SHA512 37bce01ba3e410080f57e7586f800bc03835e80f1d1f048db18ff800d6453c56a44008f77179b1b1994056319d730abd61702284ac2f98887861706223fcad8c
SSDEEP 96:S8f3KWp7u0fnnvNF3Nd0dFPx5tuelap9PanUI8yOgh9DiowbkQoeXRQ00:P627uGnvX3NCPx5tAbPw0owbklqR6
TLSH
T122D15C23CBCB0F48967EC219A1CF43E2F7F72014C7E94517485A7DA601EFA42567A068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 0b98aeab17f2fe7758f7543ff1068c7b4d19bd8089638305dafb3a1b799ff588
MD5 a413fe2205f8fc7181afa0b7377a980e
SHA1 62bfccf233f3e924b67e4172483a759c876d1bdc
SHA512 382594fce0d6cfd55950fba49d202b69fe68ca11909d4d1aecfb75f0e93220562c3429a9922425295fa872e0e94ccf20c85e717404ca32e9411010024ccccb99
SSDEEP 96:S8f3KWpwu0fnnvNF3Nd0dFPx5tuelap9PanUI8yOgh9DiowbkQoeXRQ02:P62wuGnvX3NCPx5tAbPw0owbklqRM
TLSH
T1A2D15C23CBCB0F48D67EC21AA1CF43E2FAF72014C7F94517485A7DA601EFA42567A068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionstore-backups\recovery.jsonlz4
Size 6KB
SHA256 96a237c9db7f919c028263bdceb345df831d1019132529c67d61099b0dadd721
MD5 977f3b183d898e51d135ed1a375a4605
SHA1 7c6d5b73ad9bf968068e0c849bbfe87b88151c21
SHA512 64ada6fe27808346d86d5882187d86b31865a7d8af33def478f19bc15233454a96c14d6966b5cf71e1bfa863e408254051ffb54efd04fea6da3ea71d835ee971
SSDEEP 96:S8f3KWpnu0fnnvNF3Nd0dFPx5tuelap9PanUI8yOgh9DiowbkQoeXRQ0M:P62nuGnvX3NCPx5tAbPw0owbklqRS
TLSH
T12BD15C23CBCB0F88D67EC219A1CF43E2FAF72114C7E94517485A7CA601EFB42567A068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads