hxxps://filerift[.]com/file/w3Zpjdoc10

Analysis

max time kernel
298s
max time network
303s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://filerift.com/file/w3Zpjdoc10
Sample260517-xpsrhact5v

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	456	firefox.exe
Token: SeDebugPrivilege	456	firefox.exe
Token: SeDebugPrivilege	456	firefox.exe
Token: SeDebugPrivilege	456	firefox.exe
Token: SeDebugPrivilege	456	firefox.exe
Token: SeDebugPrivilege	456	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
456	firefox.exe
456	firefox.exe
456	firefox.exe
456	firefox.exe
456	firefox.exe
456	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
456	firefox.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 456	3984	firefox.exe	80
PID 3984 wrote to memory of 456	3984	firefox.exe	80
PID 456 wrote to memory of 2984	456	firefox.exe	81
PID 456 wrote to memory of 2984	456	firefox.exe	81
PID 456 wrote to memory of 2984	456	firefox.exe	81
PID 456 wrote to memory of 3272	456	firefox.exe	82
PID 456 wrote to memory of 3272	456	firefox.exe	82
PID 456 wrote to memory of 3272	456	firefox.exe	82
PID 456 wrote to memory of 3272	456	firefox.exe	82
PID 456 wrote to memory of 1032	456	firefox.exe	83
PID 456 wrote to memory of 1032	456	firefox.exe	83
PID 456 wrote to memory of 1032	456	firefox.exe	83
PID 456 wrote to memory of 1032	456	firefox.exe	83
PID 456 wrote to memory of 740	456	firefox.exe	84
PID 456 wrote to memory of 740	456	firefox.exe	84
PID 456 wrote to memory of 740	456	firefox.exe	84
PID 456 wrote to memory of 3176	456	firefox.exe	85
PID 456 wrote to memory of 3176	456	firefox.exe	85
PID 456 wrote to memory of 3176	456	firefox.exe	85
PID 456 wrote to memory of 3176	456	firefox.exe	85
PID 456 wrote to memory of 2856	456	firefox.exe	86
PID 456 wrote to memory of 2856	456	firefox.exe	86
PID 456 wrote to memory of 2856	456	firefox.exe	86
PID 456 wrote to memory of 2856	456	firefox.exe	86
PID 456 wrote to memory of 3340	456	firefox.exe	87
PID 456 wrote to memory of 3340	456	firefox.exe	87
PID 456 wrote to memory of 3340	456	firefox.exe	87
PID 456 wrote to memory of 3340	456	firefox.exe	87
PID 456 wrote to memory of 4808	456	firefox.exe	88
PID 456 wrote to memory of 4808	456	firefox.exe	88
PID 456 wrote to memory of 4808	456	firefox.exe	88
PID 456 wrote to memory of 4808	456	firefox.exe	88
PID 456 wrote to memory of 4856	456	firefox.exe	89
PID 456 wrote to memory of 4856	456	firefox.exe	89
PID 456 wrote to memory of 4856	456	firefox.exe	89
PID 456 wrote to memory of 4856	456	firefox.exe	89
PID 456 wrote to memory of 1896	456	firefox.exe	90
PID 456 wrote to memory of 1896	456	firefox.exe	90
PID 456 wrote to memory of 1896	456	firefox.exe	90
PID 456 wrote to memory of 1896	456	firefox.exe	90
PID 456 wrote to memory of 1828	456	firefox.exe	91
PID 456 wrote to memory of 1828	456	firefox.exe	91
PID 456 wrote to memory of 1828	456	firefox.exe	91
PID 456 wrote to memory of 1828	456	firefox.exe	91
PID 456 wrote to memory of 1820	456	firefox.exe	92
PID 456 wrote to memory of 1820	456	firefox.exe	92
PID 456 wrote to memory of 1820	456	firefox.exe	92
PID 456 wrote to memory of 1820	456	firefox.exe	92
PID 456 wrote to memory of 4972	456	firefox.exe	93
PID 456 wrote to memory of 4972	456	firefox.exe	93
PID 456 wrote to memory of 4972	456	firefox.exe	93
PID 456 wrote to memory of 3048	456	firefox.exe	94
PID 456 wrote to memory of 3048	456	firefox.exe	94
PID 456 wrote to memory of 3048	456	firefox.exe	94
PID 456 wrote to memory of 3048	456	firefox.exe	94
PID 456 wrote to memory of 3364	456	firefox.exe	95
PID 456 wrote to memory of 3364	456	firefox.exe	95
PID 456 wrote to memory of 3364	456	firefox.exe	95
PID 456 wrote to memory of 3364	456	firefox.exe	95
PID 456 wrote to memory of 2836	456	firefox.exe	96
PID 456 wrote to memory of 2836	456	firefox.exe	96
PID 456 wrote to memory of 2836	456	firefox.exe	96
PID 456 wrote to memory of 2836	456	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://filerift.com/file/w3Zpjdoc10"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://filerift.com/file/w3Zpjdoc10
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {a665ea74-2725-4450-a536-f663f90ac1fd} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {c29bb654-811e-40a9-bc02-4991e1c038d8} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 25213 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {0cf02c52-faac-4e66-8923-769cafcf3e06} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4056 -prefsLen 27323 -prefMapHandle 4060 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {052a6c4e-202a-444b-9017-a852e72c6794} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2900 -prefsLen 34822 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4424 -initialChannelId {55521a76-3fcd-424d-83be-4745accd0965} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4720 -prefsLen 35010 -prefMapHandle 4584 -prefMapSize 270279 -ipcHandle 4672 -initialChannelId {3181b7ed-6b7b-40bd-a5d0-448eee56fbe9} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32952 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {b18d3b5f-b95f-4df5-8d7c-2f4c75a165fb} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5836 -prefsLen 32952 -prefMapHandle 5840 -prefMapSize 270279 -jsInitHandle 5844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5852 -initialChannelId {a7344d6b-e5f3-4f30-97ea-6a360c9c8fda} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6028 -prefsLen 32952 -prefMapHandle 6032 -prefMapSize 270279 -jsInitHandle 6036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {7c05fcf3-14e0-449e-a045-99681409d68f} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1276 -prefsLen 32952 -prefMapHandle 3180 -prefMapSize 270279 -jsInitHandle 2932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6336 -initialChannelId {8d6406d8-917b-4a14-80c6-2f32b785027b} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6508 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 6320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6540 -initialChannelId {1f5ff51b-dd0d-497d-9a7f-604a0b1d2fe3} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 3100 -prefsLen 35062 -prefMapHandle 5208 -prefMapSize 270279 -ipcHandle 6628 -initialChannelId {3a08cfb6-b2c3-41c4-9853-00bedc7e5c02} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6560 -prefsLen 35062 -prefMapHandle 6564 -prefMapSize 270279 -ipcHandle 5664 -initialChannelId {4f6e67df-0485-4973-97dc-5455cf20a034} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:4972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7080 -prefsLen 32952 -prefMapHandle 7084 -prefMapSize 270279 -jsInitHandle 7088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7096 -initialChannelId {457241da-2957-41e5-a11e-b4724a604806} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7320 -prefsLen 36639 -prefMapHandle 6992 -prefMapSize 270279 -jsInitHandle 7432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {da7d4071-2b7e-4384-a7ee-9a3003e2bbaf} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 36639 -prefMapHandle 6252 -prefMapSize 270279 -jsInitHandle 5844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7392 -initialChannelId {8a948d26-dc72-4d04-957a-48e9754558fc} -parentPid 456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu37ckd4.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 41728cc6f4073331e9e9ccfe544d9115bfd511bfa401aad5c601afd66fed38f4
MD5 bc1699e85c79957ab3e14d995746aa55
SHA1 61b1204827d8cc68f7cef15a98e32ba9c289466c
SHA512 ddcb4bcddcb7af7e1ec0a96c24550583c8f844f541194360bc9da03cb7d1ca99ea9222a771e98dd5c8d71dc940f371080e548151cb8277110f22f12bb118326d
SSDEEP 384:HUr7iO024Yto6J+Sl1xDnZBPsac4j0lpDII+mt2jt2W:0SZYto0+Sl7zZlsac4ID8Ld
TLSH
T129527DB99F0138EA2A27C191D9BE9245CD05A67BDEE2D06605143C04CA447B9F4E68DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu37ckd4.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 71519ab35f5e257ba093d6f8abda762e312efd8ac11257d89267530a6c09173f
MD5 97ac152bfb2b244afe155f863a8c4a80
SHA1 ab86524f4898d98c72e2f4bef6afb9b61b8cb662
SHA512 f9130b3af544e0247f45154f601d6e99a95daa584ae2f8eedc351978c8c101f4cf7578f0772a947ef4d7daa0c14d59a574639f924f71ac6be40db7ae0cd8ff26
SSDEEP 384:HHMO0iO024Y3o6J+Sl1xDnZBPsac4j0lpDII+S4qhs:nrZY3o0+Sl7zZlsac4ID8Lt
TLSH
T14E528DBD9F1138A91A23D594D9BD9248CD04E67BDFE2D0661A143C00CA447B9F4F68DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qu37ckd4.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 96f0e00b981d03a202e9a22d8b1119cff382e6c6766cef60fdbaecbc41057f18
MD5 fd095fd7ca1c1098e627ecd6c9d6805a
SHA1 7c149ba3e8355ee973ebb263fd341c76233e351b
SHA512 82f299659f47bd3eb38a92a614db685deb799a52cf80b42c140bf637747041d3b516d91319cc701f74afc5d78e3f30871997bb071a6a2ef831f75c8d60666c42
SSDEEP 3072:j3lKtRoMSK3o/nQ51mlts3mWn/4HzPn5IU85B9:pcnofY1nm3rC5D
TLSH
T161B3BFF6EFB28A7955FFD41C9BC2883EFD262404B3A3340AC953275161C6BB86375648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 0399a9d001dd5989e5a5c1510f66e4a1f1e6445fa48244c22f39fd1bb5e41d79
MD5 4467416747fd36696a4fcbd8a12becc0
SHA1 b2cba14f12818641c7a6de359a93e4ce7f985879
SHA512 b653932703b88f721d5d070d6421969b5e1e54bce0471059fc8f9e5d146cde819b76a98640478e835287c03def11578c30491fba40dc9823b22820ec88bf46b6
SSDEEP 48:vqZiZkd4J5UgdwWzGqeiZkd4J/6BdwqGqwiZkd4J/adw4n2q0iZkd4J6CPDqziCE:mi3wi3/Xi3/pi36jrfluJ
TLSH
T11EF10D0217FA0A97F5F78A717A767706A733FD914B0F065EC14062890933B6488ADFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 761b50fe2c6cb9d107928ebbb8954d3d779f0db0a2ae488fe2512a0120fd0aa9
MD5 137f80b874fd72962a89359ddf5c56d7
SHA1 11a32bf3cf877b363f4ba556b1a858d87b56f755
SHA512 ee3711e5458a6dcffd535f959717025a8cf65e3f44c57834f2d49df9281ff924b47270efa71172fb6109784fbc6ae2e94f03030e45683332465458a8d039e341
SSDEEP 48:mZiZkd4J5UgdwWzdeiZkd4J/6BdwqdwiZkd4J/adw4nt0iZkd4J6CPDqziChKiZS:ai30i3/Li3/ti36jrfluJ
TLSH
T188F1FC0217FA0A97F5F78A713A767706A773FE81470F465EC14062890933B6488ADFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\AlternateServices.bin
Size 10KB
SHA256 358270f980b760447087d8334335c339b7c6a69b6aa4540995cf7e461fd4cb2e
MD5 209adffcd0e9fed57fb3a1e1e1bd4d05
SHA1 8606aeb8545b0ab002091c424dd4305299394e94
SHA512 9c20f1692772eebcc47bf1d5d751bbd7a04019074e818e6a4a22050112690a453f25a1ff8a27a2ccbdf5be108f444bf06065ff5efd7a31b1130f30caa614ada4
SSDEEP 24:AMuhMZtuX1e03KlXxKYSoPXFQeeXhB+UFXMJXlCXujXlS3tSXRtKv:8o0aNoYSg2tv/FOoXaY9irKv
TLSH
T11D22C6E74BB53852F1A28F7C50A8358CCC33062958BCA598AF64C09712C63A4F17FF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\AlternateServices.bin
Size 11KB
SHA256 3821c200a7df446d445e38d41e2e1a971b5332d585e536ff034c1955c8083ad0
MD5 c60b986757ad1f5fac401d22c02ab5e2
SHA1 83ea7afe73f6fb4b882d1ee9575b518a06917039
SHA512 65369f46709abebe4316a8c4ef1e4e11f374ed9152688da40328a667c7e4c533ad281b6d065cf8b81d49015783dcb031641fa8aecc2cfa92688e64c96eb04a38
SSDEEP 24:aMuhMZ1uX19dKlXxKYgOPXF61ueXhBrmJXlo4jXl4RtSXRtKpqcXVH:Sj8NoYgaM1dvr0G82rirKpZF
TLSH
T1B73294EB4BF67811F1665FBC50983988CC33062959BCA1989F64C09B12C53A4F17FF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2ef49c98bb40f1b39e14e1a16ec5fe38ac5272ae55f54559d26ceac44fc136c3
MD5 7cb029a46ab2a4f2c5c0d27484b9f8a3
SHA1 7c52c9057ff78a106bf19a2d4fe46cadbe55ad4c
SHA512 9b5bee21fb7e3d5892c409339602646728bff73bd2e80de81cf4f2253d545f46c7bf7116c3ce486f858aecd755959a30791a5a7831bafd3154f8967f0baac2a3
SSDEEP 192:tOv5zboNZQgyjtdd1d66Joz0dzgCl6mc0dz:CboNZQgyjDd66JozQzgC1jd
TLSH
T1F2E11F64E628863FC404027BCDA21F410F36395B984E3F2935DC65192D9B2DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e000092d8871c9169765628cc5a2e18f66dfffb34f5b26ec6eb2cc3ade97c00b
MD5 556f9f907849a99f6969f67423ba66fc
SHA1 03d435061c00defdfda3af86daf47d1acd83aa26
SHA512 8e394c3c3fa88af6400ce22c4bfc77b0e91dfb730577a77a6a390bd79b9433a7647f9f61e32d5ec1be48161e5d4344e33b7daa5a75a77c82dd3b6eefd5becb10
SSDEEP 192:zOv5zboNZQgyj9dW1d66Joz0dzgCl6mc0dz:cboNZQgyjYd66JozQzgC1jd
TLSH
T178E10F28E629863FC404127BCCB21F410F3A395A984E3F2536DC65192D9B6DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d870c56a557b6b9da8d9c5e2595c8bc9755ddd0a46da852e09b01b483707a71b
MD5 ba832e594deda33badfe9fb68c281874
SHA1 83f02c6a9daf0880daffe46c8fc397c10ee1186d
SHA512 85de2b9f8d3b7feefe5745207e5587784c204e60728435d22ecbe0fbe9b2278c960886aac0c2b3277952ac9df73fdd302d667659b8a8f00c334211b405edf81f
SSDEEP 192:iOv5zboHLQgyjtdW1d66Joz0dzgCl6mc0dz:BborQgyjId66JozQzgC1jd
TLSH
T151E11F64E628863FC418127BCCA21F410F3A395AD84E3F2935DC65192D972DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e0480bc7dd6c276f726ab72b7dea85d8dfe023a8a5a9c5e311ea9ec5cc261d96
MD5 857de567436bfa55057edf6c7aad1ca4
SHA1 648f7088477a7c0858bd747f4783d4fc5db58f02
SHA512 4aa63892228ede45264adbbc0159d89de52e69550201ca33f96aa63d8466e3ef91ca7ea1c11ec29940d1e4747eee3c9d32015ecffb9841377e4c59ca53658965
SSDEEP 192:b1d66Joz0dzgCl6mc0dEOv5zboHgZQgyjtdJ:Zd66JozQzgC1j9boAZQgyjh
TLSH
T121E12F68E628863FC418027BCCB60F410F3A395A984E3F2935DC651D2D972DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\events\events
Size 1KB
SHA256 45b5216d1c113d9a11e92c7934fbe9263b2548ef5e3f86ed2a17e19660324842
MD5 08770704bf8553ab0691dca5d8b9db48
SHA1 95fec47b7029af8adb69e1a115c7aacc29859f53
SHA512 8fa284f9227e736684568b8ea87ea715732726ede00949dd4e3d945a372fe01103ea2f3f7eeff559ed064612dab0284ed99213f76ace5d2c538ba41bfa4c041c
TLSH
T18A21795C39F94D2A58EBF29874400A8E53558F0654CB2C434D02DF8DCCC9AED326A47E
MD5 SHA1 SHA512 TLSH

Submit Download

16651d91-8df2-4ddd-ad23-5c52f540b6e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\16651d91-8df2-4ddd-ad23-5c52f540b6e2
Size 886B
SHA256 79d92cf77cf04b034012803894a358ee6845329092220cae5a6c618f0e21f8a0
MD5 b75284934c51b3dd9e4746a60e074566
SHA1 db2eb9bf7d2615c2c197ae5eb71e9436b25489bc
SHA512 29314d7f908dbc5386cae95874077a4cbc8acc6317e8fcc9be78194cbd952a6ace62b67765c374c8a5341818d7a163bcbda5831bfae01a9924cbcf620aea9b03
TLSH
T1E31123408A74B9B3CC78D257CAA27B838BE47123C0C75C147F919F184DEA52E9317607
MD5 SHA1 SHA512 TLSH

Submit Download

22b7dc4c-9b8e-4bec-ae03-236cc9855e6c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\22b7dc4c-9b8e-4bec-ae03-236cc9855e6c
Size 235B
SHA256 f31a7a0c6ff231f95bd8282a5aca509491236070e5f404db708a72f961e384b8
MD5 39ac2df7cdb3d4d3b621ae10b9e042d6
SHA1 b3fa5dd5e0cffa1a32c7fcff39935689c0280d1e
SHA512 9fee10a20105f98295ddd52dd6f1326b7df27b4e924e1d6e631ad15a92fd9df2a7a8310ed5f5bb99cea3e0d834592d197084b1360c007f2050806db40cd6f145
TLSH
T17BD097C02888635C18140F06F0E16AC230858C3324B46A20C5614A749AB9DC481D1807
MD5 SHA1 SHA512 TLSH

Submit Download

5e825526-833a-4f3a-8932-888170ef3c42

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\5e825526-833a-4f3a-8932-888170ef3c42
Size 16KB
SHA256 4def63afcefe38e5192b49ef144e45ec21513523196ff784a0c374e43dd6b31f
MD5 1b8e48d0c9185a70daa1d2e56bef09bf
SHA1 f2f3a32f109c051a18c35f458d55fa674f727a5f
SHA512 b803992a78ad6ff3c43ff994d63281fae1888b559475834493fc0279798e93de7c2a47b3196e4fb36c73695e40426cb60437ff137edd2bf657b76db54f5c794b
SSDEEP 192:eMWBPrcbnHWgLSbdHOXxowBDJ2VTyqcAILg/xADAg1M1BAFUNK6ziR+9iS9JheA:eMWBP6nEALDsUUNK66+9iS9DeA
TLSH
T17772EA16682055BA8251E368D5FCBFC3E6F528CF4C019FCE9BE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69e28ef0-aa7f-49e4-aaa4-2f33a6ba936f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\69e28ef0-aa7f-49e4-aaa4-2f33a6ba936f
Size 2KB
SHA256 5c09f1f6b1c1d18c946b9b8fd29d640c65e93e231b59fb9a419dc2dff1e41d92
MD5 03441743b2c5598fb4ca5a23634e114f
SHA1 f346bb068db828aa7fd9e2c1d93162ad1edac27c
SHA512 ecebb6d4f5823fde47e341cf1071c78425256dedac178688c5afc801a64ff5a12ac1eceb3e4a2e3dd4bad5179f55932ffd9c7b7c467eecd9bfb6ad4a5763d7cb
TLSH
T1C141545C35785CB78CEAF5DCD542238E53A44A0310C62C531E52EF0C8C966AD336E57B
MD5 SHA1 SHA512 TLSH

Submit Download

6b9764fb-200f-47ef-a29c-4a5d979c5228

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\6b9764fb-200f-47ef-a29c-4a5d979c5228
Size 235B
SHA256 7ee25ce6100c38d727114b522fe8d1767cb9c75ec93d44ec424ee1acd445b3aa
MD5 0c7e535b6a33ae21f8af1d97bfa6fb27
SHA1 4b181f6192162501672148c79b504ea31901bbac
SHA512 9063bed6d951401dbb498832055d4fbe119d80b3a54d60665cae5adc19e33b619f2c66050459a6471f4163a0c93976e15e605bdf7916d7c25ad09b9686cbdb9f
TLSH
T1D5D0A7C82498676D4C140F17B0A069D630488C3B15B99D7097918578DEF9AC8415A81F
MD5 SHA1 SHA512 TLSH

Submit Download

e8859428-a2c9-42f1-b8af-4dbdb9402137

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\datareporting\glean\pending_pings\e8859428-a2c9-42f1-b8af-4dbdb9402137
Size 883B
SHA256 7523ea9933b56ad4da2cfc20fd059fce2c66812151be263e9d57877ddce6c83c
MD5 8c90bd8ee828ce399cd88117437163d7
SHA1 221e8d0ac479a1f60c622e284d1e9a53cf25f786
SHA512 6918e666b83fb66b55250e75c7a9a0b09caccd03d3daf01dfe42cdac6761ce821da840f9674d2d007f82980f7141be2f6910b8aabef391e5f5a70a58c65af4fc
TLSH
T105112381DA35B5B3CC68D15FCB523B434FB4363380CA58003EA15E184DBA56AD32760B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\extensions.json
Size 16KB
SHA256 1ea5e8c8a87c67f486cbd8b0133332537c735b897cfe0acb950c3693cef18b30
MD5 541b89041180774b8f0de2e52ba9297a
SHA1 1c952c514be9fd78558f9b30521005402081abd1
SHA512 2686c342665435c79d73dd07892ce0fa22f74211e83e78fad149d3caca9fdbe2c51d9b5fbc82cb9cede7f2aef6644607e5ae5c1b1b035b0db6e36776dc55ddcf
SSDEEP 384:mkI4voUmldvw8dhWh94zw96o6L4HhL4PCL4HUL4H2L4HV+4hF:pI4QRfJXg4Y6T4Z4I4u4c4o47
TLSH
T16772521545049EB8294FA78BAA367E02C37D473B60855C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs-1.js
Size 8KB
SHA256 340dceb0e6c6ac125e60c6ae6a621fd6d7e42684057468ef34bb7b95e6555900
MD5 a9e7c5982b3f3b4806ac254ad6e6a2c4
SHA1 1eb54fda5b9d3c41fd865f60a13a70d2b9181f29
SHA512 fd51a6c8f437dfd9b40be1e403b209d05c0ce0f2261bf8cabb2f2bccd1dc0550bdde29ce1a4134f45ae7184d41f78396d16aa697b1e4ef4030d3853fc75e3804
SSDEEP 96:xH8tTUgqGqLflhgObzSjeKSSlPdv9jFInOWRx5qmABw88qSK8L4cnUzq4:yCRLflhgJeKSSmRPqZBw88VA
TLSH
T1E502FB389044CB7F64B676BCAC258D715AA2013BB6BF68D710F984C5014CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs-1.js
Size 6KB
SHA256 b64f4ddb952eccd03dd07e58ad35ac774123a45c0731909f2cb3bbe1e73a0ec7
MD5 b867f68ec67fba1e042a73a283fa049c
SHA1 fb8be2764cf6f224761d651ffa237e806d9da0f5
SHA512 e3dc4095ec7d89fbfef3f920150ccc4386c358c76a80a49f78f9f9c3abc956436d377faf7795752b3a88676cb6b33839050c3cfae3b1c1465ab27b64ff51ea62
SSDEEP 96:xH8UTUgqGqLfQhg1zSjeKSSlPdv9jFInOHtqmoBw88H8L4cnU9q4:y7RLfQhgweKSSXtqFBw88b
TLSH
T103E130389008CB7F64B677ACAC688C315AB2013B77BF68C750B95485055CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 6KB
SHA256 5c42b2dfecba3e0781c337a9e454dd3272b926a64431aefc65ddd06820c1db7b
MD5 3435f2c26f1a723227faefcc5484e9a8
SHA1 14d2191fb3d8e7453f0a10bffa86ed30773f8c64
SHA512 9a4515f64cfb2254011b059dde8c46aecade9b9997ff6fba1a0375b8e9bdf0bf8e7adbdccab4b5656a932aad67bd564293c46475646eec0db25dbde6c2a92b45
SSDEEP 96:xH8UTUgqGqLfQuO1zSoNNSSlPdv9j3nOHtqmoBw88H8L4cnU9q4:y7RLfQuOrNNSSOtqFBw88b
TLSH
T12EE1203890088B7F64B677ACAC688C315AB2413B77BF68D750B99485054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\prefs.js
Size 6KB
SHA256 6d1259b58f29f96cc4deff6fb57dcdac76a0d5cbe9dc926b59124fa7bbc2b76b
MD5 942159746360ecbe704c4fb6330d37e1
SHA1 a127fa7704e476540a52392ed5435a796409ad7f
SHA512 d79cba3fbbdb125d162e0d5154c7ee0475bc11ebecae3bc16dc945e741a679f398f4a744c34b280b92c77439479fe411ac6441f61230543eadb9aea6a08d2fd5
SSDEEP 96:xH8UTUgqGqLfQhgObzSjeKSSlPdv9jFInOHtqmoBw88H8L4cnU9q4:y7RLfQhgJeKSSXtqFBw88b
TLSH
T1EFE1307890088B7F64B677ACAC688C315AB2413B77BF68C750B954C5055CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 7c2fc642b9a018b331613fba74ab452084f8ea0d89b3197e7f13f6e500958703
MD5 673df3e4432a121d1ae8bccb16f8016c
SHA1 899f93f9b5216bbfec7cd3d1bb41ecbcb45cb3ab
SHA512 2bbec3b519ac1c7e887facaf0b5cc71b0fd7625ac02474b231e6536c58f876333ee606cda19d2187b002b658fec090180eb15345a249ea48a5341a62c0fe0c62
SSDEEP 192:Jx9/pGIyFt/t3lisT2yg8A4YZC2oezekJQEvF79+:JxfnoL3lisTM8ARZX1z/CSF79+
TLSH
T155D19C5FD0D6B281D7C461E67ECA0F34E5193857C8F0B850D159F90762ED1A542CA88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 afd4c78d7572e30941f85d9a36c062474e4ba1076c74d44dcadb97015ed57578
MD5 ed10f41b61df26de3d54786ec53981ac
SHA1 e236020c10422bf642316b9985bcfdb14cc730e9
SHA512 e4b669beda4a65cd5564268a9afbe94c8c9243446d3ac311852a7ada0b8f6b80e131441f050c7ae5f3bbb518ae6635a55a0d3af0c991c35ac741167e73efe623
SSDEEP 192:Jx9/pGiFt/t3lisT2yg8A4YZC2oezekJQEvF792:JxfbL3lisTM8ARZX1z/CSF792
TLSH
T1CBD19D5FD0E6B281D7C471E6BECA0F74D5193847CCF0B850E159F90752ED5A502CA88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qu37ckd4.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 c61733c9cb3837fd238aeba8ffa68ea21815c0771a6cfe60a4205addc36cc6f5
MD5 3ba4eddae242c1dee9a8953ed8eb0db5
SHA1 48f0da713b95f81c04e61a4fe974733c1e59fe17
SHA512 c43e2648ef61c92162482e8fc431fbb08c6faafba50cdbb9c8561e046e3a25dd9171dcf941ed0b836db6b5a34908c88b3c20410153460669a3294cf7233ee3cb
SSDEEP 192:Yx9/pGXt/t3lisT2yg8A4YZC2oezekJQEvW7YmXk:YxfmL3lisTM8ARZX1z/CSW7YT
TLSH
T1F3D18C5FD0D5B181DBC4B1E16ECA0FB0E50A38A7CCE0BC90E058F64765FD6A502CA48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads