37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf

Analysis

user interaction
yes
max time kernel
14s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer-1.0.6.exe
Size 12.0MB
Sample260804-srwtqatbqd
SHA256 37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf
MD5 82834a737ed33e0357711784d973255e
SHA1 f7c90d63e77ea58bad7fbebe88a451d9f6c03031
SHA512 19743f246415d57c578d15bb5f22548bb2f164f3be57e42bb7c0f8de0c0871e947554bab7384c6b3e52cf834a1db0f9143db190c58c232069e67db74fe632a6f
SSDEEP 393216:+b27r5L0PrKAdEVoALL3sAW0YmmccyTxhAN+x:+bc5L0jbdEVoALQAW9F6
TLSH
T112C6332351FA6836FAB89372B171D2818966B167372BC3FF2649C86508139DC1F36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4320	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Installer-1.0.6.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4320	powershell.exe
4320	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1104	firefox.exe
1104	firefox.exe
1104	firefox.exe
1104	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	firefox.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 4320	1580	Installer-1.0.6.exe	89
PID 2776 wrote to memory of 1104	2776	firefox.exe	93
PID 2776 wrote to memory of 1104	2776	firefox.exe	93
PID 1104 wrote to memory of 2792	1104	firefox.exe	94
PID 1104 wrote to memory of 2792	1104	firefox.exe	94
PID 1104 wrote to memory of 2792	1104	firefox.exe	94
PID 1104 wrote to memory of 1604	1104	firefox.exe	95
PID 1104 wrote to memory of 1604	1104	firefox.exe	95
PID 1104 wrote to memory of 1604	1104	firefox.exe	95
PID 1104 wrote to memory of 1604	1104	firefox.exe	95
PID 1104 wrote to memory of 5128	1104	firefox.exe	96
PID 1104 wrote to memory of 5128	1104	firefox.exe	96
PID 1104 wrote to memory of 5128	1104	firefox.exe	96
PID 1104 wrote to memory of 5128	1104	firefox.exe	96
PID 1104 wrote to memory of 4728	1104	firefox.exe	97
PID 1104 wrote to memory of 4728	1104	firefox.exe	97
PID 1104 wrote to memory of 4728	1104	firefox.exe	97

C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe
"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File bootstrap.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4320
- - C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\MadiumInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\MadiumInstaller.exe" --from-sfx --first-install
    3⤵
    PID:4296
  - - C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe
      C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe --installed
      4⤵
      PID:3536

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {bd95019f-9631-486d-9382-f42c4bc41258} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {2a0fa594-7242-4695-80b7-ae93bf60a153} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 27274 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {9ff530e2-7cd4-4126-b03f-ea82e2f88e27} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3988 -prefsLen 27274 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {e9af07ba-b4ba-42ef-b129-efe45899e376} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4560 -prefsLen 34773 -prefMapHandle 4564 -prefMapSize 270279 -jsInitHandle 4544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4540 -initialChannelId {dba91539-e3fe-4b28-88ff-4db06f7b234e} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:2568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35010 -prefMapHandle 5060 -prefMapSize 270279 -ipcHandle 5080 -initialChannelId {1a86614e-924f-476c-8ad2-8788f93f9416} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:1252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1596 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 4980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4972 -initialChannelId {ef25bcc8-60ae-4569-87a8-26d34c0fc3a1} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {4a52abee-3928-478b-ad51-4c314708b7b2} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:1460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5728 -prefsLen 32952 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 5736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {e47d734e-b035-4449-87e9-141dd20bc63b} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 dfaf03831ed16292911f7c425f58d03711b04da9bed35b75cf7f8d9c768dfe99
MD5 90d3f7d403a3dadcb8e7175502198b56
SHA1 b518de327f9dff16d87dd5d5c8325309f7eecbaa
SHA512 d699940038c654ca5fdab597f3d71a0bd36c68b34cc70a132a05c65a093a4e8559d79bef8d8cdd18e020b243037e530f698f6245eecf2f5db39d4adbe2b5e8e3
SSDEEP 384:HwCe7iO024YzDL84KKDL849B7SOEAd9KVRaAcP+AWRMAnru:QqZYzDL8lKDL8CB7S/AmVAf+hRMgru
TLSH
T138729D3E9F013CAC1997D0E8C5B992DA4C19B6A3CFE6806D21683D0DCB98969B0F544F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.ps1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bootstrap.ps1
Size 1KB
SHA256 e94f4f3efcbe350f34cc5d0a4481e32f9d8cbe554faefa741821fa618798d0eb
MD5 136886518d85e01aff60db54d56bad90
SHA1 25fe6604325b69ac1f50da2c3844526350070a81
SHA512 895aaf9dece99f9074811534d5f80d53d0a82efe3d4c71b85bfb310c8ed36bbc61d565991aa3a3df03b28cc650b607588fac52b6bacc1ac8af135b3e0eed9c07
TLSH
T1D621C5252A15107119F6537BDA1A45F0CB0E746F8075476039AF8149CFB64EE0FC6FE5
MD5 SHA1 SHA512 TLSH

Submit Download

payload.zip

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\payload.zip
Size 11.8MB
SHA256 672c80bc9a37fd04e46679772a91cb60b696d76c6d84f6853fcfd88a494701f5
MD5 6146888492aa259e261844c8fd73e482
SHA1 7ef84e8941266a27496fc7ff159bad8e4407c156
SHA512 9ec57be3f360c761f2688ac83b23927a053b1bf0af8edf92b23e3d1767b1cb09bb37dcd6ba91e2cbae9c4f9d5fb84112614704cfbb9fbe162869a6322589d071
SSDEEP 196608:j9vfDrVf/hcNqmMH0Ozbl7PWr0l1UsnoOsuMfZ74z56EwHddX4kqj0RkI0/eprh8:FDrDc8fblSrSZofVh74cE8dxA0KI0/sO
TLSH
T1CCC633A2A03BDD3A6FBD56F7B021D200818B8299A61FC7FB324615416C67FDE1F1650B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadiumInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\MadiumInstaller.exe
Size 201KB
SHA256 613678d816cfccd88a0f4dc506f5f63bbfa6eb222bb4f215217cca6e5395287e
MD5 b7442b75184293a49d6f7d67cf04e92d
SHA1 9302d28c6169e6636dee63da7de7350268e921cd
SHA512 81521602aacf2828647c7dc774c65e2e7dd8d0edca34cb51bdfe2c2114766168c51a6ee94283484afb916da851f46e889199482722e8c418c3691172e9eafcae
SSDEEP 6144:x/6h0bqhOCz3hu01iXdfditfnOO5rEH9pJfsEC:BsLPoi9nOO5rc9p1i
TLSH
T129147E16FA6500F9E25AD5BC8D534A02EB73F896073197CF17804A7A0F27AD85E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadiumInstaller.exp

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\MadiumInstaller.exp
Size 836B
SHA256 8fc56228ccf1eab527c30de992491c94ef499de6db4f0c93a17d29169f450273
MD5 1819e6afe8314f4369a45d02d4b1b120
SHA1 aa04d948209ba9878deb67414aa4708f915f99c5
SHA512 5cefa38dc65fcdb06ad726ced1bf7dc8d3dcb7daeddcb1e01ef976977616d2dcc482a2ddb7d41ec7c6a8b45fe7d4c2ce13a7e60e913649ded24deadcbb5a4a3e
TLSH
T1E5011010E3E25C12F6204C3E83AB67796083FD95C85063139B80130ABD0B6E9C8208D3
MD5 SHA1 SHA512 TLSH

Submit Download

MadiumInstaller.lib

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\MadiumInstaller.lib
Size 1KB
SHA256 1e2998f883ecaf4726628900f791e5a114ee9af80184dca4c6abc3dd286079b6
MD5 d36b5c5903a7b1c4cf390481483dcca9
SHA1 814485782b54b29a1060c9639d6444efbe3613fa
SHA512 23606b0f6f1d9397a425f9b2d4e27158b85e5fa92819428cc4e68f263e40e49af94f333ae7d5322b718035214c54d2294c493de44b8b836493af5ac0e138d745
TLSH
T11A41D2716DA21463E639D637935BAD74242C300A9326FFFF3C9D06D543865CCD6A2983
MD5 SHA1 SHA512 TLSH

Submit Download

bitsdojo_window_windows_plugin.lib

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\bitsdojo_window_windows_plugin.lib
Size 571KB
SHA256 e30c3b143bf064f7a2f8438247ae46ce7eada3850536ad0ea415952b3100c87b
MD5 c7e97a58ca8c875c5b97828290ae4cf3
SHA1 b6cd1aac71c892a7c8d2775740d5cb74095b0ee1
SHA512 d7810575de81352512c179617d5d1609e4abba3aa05f13c29254fb74a231805422e9f8d696b09772611d2ea74b5a86a565c3fce71651d7a4b5a8a94c238a10f9
SSDEEP 12288:P66m66K66K6FK66EFFH6FS66q66w66jFFSDDMW66m66q66gVFomDD2qSw66F66TO:P66m66K66K6FK66EFFH6FS66q66w66jY
TLSH
T14FC4445DE7868783F434EE3B88AD05F256A6EE512443FB0792FD23251F03A5E56BB120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\app.so
Size 5.3MB
SHA256 1ff379c029f8b24bbe86a34b61e633d32d41c88049ea50fe93e062465b89e210
MD5 eb5eaf14de56e59da68a5848d455cfdc
SHA1 ff31b5df0cd138fe4dab7e66a4f7ebe35224d0e6
SHA512 d9e3e0e75a9f1cc694c4aa3ee4624f1ef46cb15f9bd6181184e31fa360f19f82773ab7e0799d8846f467c182badca3266b6575a9cf8d31de6d66ff8d2fc5c3cb
SSDEEP 49152:RfVy+f06kKz2ELkfcGjChmcUWpIf3o2/yAhByBRSRpe0V8BxV/zNyzB570gKHoZE:RxUf57RpSBxV5yd57b5UT
TLSH
T19546F897C0E48770D572E772B75F26A55E2438CC4E70B68607C86B563E9ACE04ACF272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\flutter_assets\AssetManifest.bin
Size 2B
SHA256 f566cc6fccc657365c0197accf3a7d6f80f85209ff666ff774f4dcbc524aa842
MD5 0b0a3415aad49b6e9bf965ff578614f9
SHA1 db5b55a9b215f744db82517864984d073f2e8f8c
SHA512 0404c26467d39c9394c15c26d360cb48cc474aeefe2bae5fd5d46b72b5e9ebb8f1497d561dfed5a21942db92b648bab8167d8e02f5f19880a77e3afdc68526f8
MD5 SHA1 SHA512

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\flutter_assets\FontManifest.json
Size 82B
SHA256 28b1eb2b3d2e1ad60b8c8b0f9100b1ccbf492f7fa97f5bebb51ea97e73926e7d
MD5 7b2a36307916a9721811788013e65289
SHA1 f83d716c83a8a1cdf2a5c7b5fa387e9a62f2d49d
SHA512 0659dbdc8042768ce6e75c5e36fef1f93fde820dced5e2cf07f0949e59b25f87c01607f97c1926a792dbda28ebd7e4334ad942dfef3782e5ceb61de893f8df67
TLSH
T141A0120F005405D540CD9045F0957051E040284B000BC4CAD164064493E2130033C307
MD5 SHA1 SHA512 TLSH

Submit Download

NOTICES.Z

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\flutter_assets\NOTICES.Z
Size 102KB
SHA256 bdb492de2b031ec16101eede4cd2f26feefcd75c16a09239fa471a9cc552fcca
MD5 79e3b032d03665232fb84f194fc934bd
SHA1 cd30f816703e3d15a6c5d3f7c986005c044f7425
SHA512 4d2f906c47e088e8e8256063fa21425e8989e97a0ac94230ca1650177f68b332f65dcd800be281b12295596aa56d022cc88d444fa27a8cdf12e23206e7550323
SSDEEP 3072:n7tECDp05eSkCmIQ+P/sKr/bw+hoh5H3/P:n7tEC8e+o+H28oh5H3/P
TLSH
T125A3127E6A2C044171BC119D23498B64FEA6FBC630C94EFEB43352B41D7A889712D572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

MaterialIcons-Regular.otf

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ink_sparkle.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\flutter_assets\shaders\ink_sparkle.frag
Size 21KB
SHA256 1fe8436a743884cb65078fe8c7b38e18f5365f2a2961270916f426fd13c604af
MD5 0a8f4531af1d1a54aee8c7d23e640d2d
SHA1 0e13f340acb6eab5ddfcf70df99d06e3fabbb454
SHA512 e93fe163ebddb759a7f53c611eedb560fce18c5f5536b8a19781a3c5c3aabb0c0fcd65159b24d60c5113f3c542bf417132f3e8aa5b9b996b5b546cdb34683b51
SSDEEP 384:TThcP2xBwl0yU6iMRRLkgpXlp+TrlI+6QkopXlp+TrlIPLmNlkf/M+c3Vp3P9KP:TdcP2xBwl0yUNeRwoL+TrlIPzgL+Trly
TLSH
T121A23348D2E60E22DD166B3D556B21043F3EF09BAB67D2033748BA547F87327468A6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stretch_effect.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\flutter_assets\shaders\stretch_effect.frag
Size 17KB
SHA256 62a899ff4e168ac6ca888ce7c2f40e5d3fbf8ca20a1c3ded781a116a6d7907e2
MD5 4acf2167e56d604e5acd1928ac03f0cf
SHA1 38c5e7d5b2583906cc67f5c018c06c5b43bdd120
SHA512 097a61ba8ea49c29dd06c92358094a423c9baec14027f2fed616d8da24bb91beb9c82bfdb3fe42de2c1610028a2ae6dbe01ae3636a813c7f0d6fa55369e140f2
SSDEEP 192:8sVNLhNETx5kgIDkHs9tmogoxjaDViqNi6O9aNiqgiSuKRqDi64BaXiqGiaaZdBf:8Mph6Tx59HUtXYDc2/boE/
TLSH
T1FC821254D6730897CC5BA37D4E4F0218AB34C087968687037E4DF224AF8676A4AA9FD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-45b0cf7d3b7945a08f8e63e5d14c8875\flutter_windows.dll
Size 20.3MB
SHA256 a5c880a4218a04cfb3e58b103160334658122c5e43d3b818b3d9af5ab3e1fc0e
MD5 0c8c6ad1f023a515e37ab2bce12b4512
SHA1 d97f4ef98acc752a2ca6cd7fa89b605205f9cb24
SHA512 18445153a65b0641d85676cff4a17d736065822bd56a9bc712b3e61d96201cbc10e46f2e4fcf2568f7f29bd22ec15bce75bd7897c90773bf3cceb42d20c7c33f
SSDEEP 98304:B24Wmz6AP8+AmlPps4yoz95mYjH1x0q1KiROOUsMuZSxAwg5mByfcdrNh7k/WV4h:Bt8omoxj1IWEjEw9+BZ5vStib5HHe
TLSH
T1E2276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3872092-3656-4530-b623-c483ad3b57d5.zip

Path C:\Users\Admin\AppData\Local\Temp\c3872092-3656-4530-b623-c483ad3b57d5.zip
Size 3.7MB
SHA256 5294294bc8f81626cad76fa46c1fdec8df4f6d7a05576adfecbaa571149f3daa
MD5 6e6eff9cacb0aeecbbcebaf19691e55b
SHA1 f52be47f67201bd0482d31718b6b0febcbdca819
SHA512 b8e1995dbdb15440b555b070390840ed2cc818a236971cf1bb010e5066f21c800a5126dcc8fa1dd0ba537228c11d52d64e2f5de858c61de245d71ad0877a054f
SSDEEP 49152:5RbNPT07llToFbIa/uaVJJlHtxuCToqN1Si2GdMD2hOkilOU53nOKMJ74+wQfIcz:zbNvIXcDtxjuCdMDGOkM51ERfIc9d
TLSH
T13206F177D65C1609CDCF83BA850C2FC29B4FCFAE80D4A9EB6A6A95715CB31E21F44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 38KB
SHA256 61c7e00c236aa7240fda0adc00ee2267117a4095d87eb636f5d295f5b130bcd0
MD5 968be3f00697f57a0ee7ad6c3e704284
SHA1 4cd7aecbf75912cdb815a2609be14591874a6696
SHA512 9d2195187a1cd297623e0e6d93626f38bca44e45ea008ad4926812823b44db4508c25a026ffb36ac3f349e98484ee4b99fd250c8ed8806c1d31867ebded21d98
SSDEEP 768:56N1TPilMzMVKGcm+uhLufKDx3OemcJ8Fgeb/bTbubob2bPb0bJbLYX9MRG9EE:GPilMCRufdYX9MRG9EE
TLSH
T163031144EB1A953FD42812BBDCA217002F79F88999192F673A5C64386C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 38KB
SHA256 7f05b7c757836dd72c7311fd043f773e0db67ac8a27f4ba6a35cc84e1a643792
MD5 ce025beac238930ec937e2ab27a95615
SHA1 ecaa1e2726889e3d55c51beeccb86cd965764f84
SHA512 2cd446e9b48bfaaff032702d782010c491bd67eead4ae033b0f89864259feb47bd391e8333174d276fa2f4f032ddd0989071e79656e38b58b3f6e3184af6e7d8
SSDEEP 768:c1TPilMzMVKGcm+uhLufKDx3OemcJ8Fgeb/bTbubob2bPb0bJbLYX9MRG9ED6T:QPilMCRufdYX9MRG9Ey
TLSH
T131031144EB1A953FD42812BBDCA217002F79F88999192F673A5C64386C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 38KB
SHA256 06f30346907b79e2714f5cc5b88ac2766f09829ab7043811a5755244a7e920e1
MD5 9d13c059ac698ad30101f557b0464e3f
SHA1 ba0b40bebdd95567c5b095e1c24ccb5266a11aed
SHA512 e6f69446ecf4b85d418af8a2e7c61ac98f467e49463209b1c0388054f3da1a19b44ba55ca21e9d1658696d98bc5e9eeaeaa04cb27ae1125db5242537f255fc72
SSDEEP 768:c146fPilMzMVKGcm+uhLufKDx3OemcJ8Fgeb/bTbubob2bPb0bJbLYX9MRG9EE:GPilMCRufdYX9MRG9EE
TLSH
T1BA031144EB1A953FD42812BBDCA217002F79F88999192F673A5C64386C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9345c27693bfbab1158d91fbc6c9304e0f3fb1cf96655eb8321092b49f9531bc
MD5 e3c7e3f2b3b4ed12fa16aa8cf4ac12db
SHA1 7660e6ce1ef1138ed99f315a7d3284b002d85883
SHA512 1426dcaedfbafc771671a82932b2949e4591a2a43064cd67c5e5fc10653866e03227c9e2da6648aefeca8aebc1b7aa8aaeac89505354e968ccbaa94b09095215
SSDEEP 192:gOv5zbo78ZJnyjLcyHFz1d66JoztdzgCl6mc0dz:LboQZJnyjNd66Joz/zgC1jd
TLSH
T14AE11FA4E629863FC40802BBCCA61B410F39398BD84E3F1575DD651C2D562DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0cdbc4f00afc97efcf78fd18e7829b9d22b80d69b823ccc1a7977b0ba483f8b3
MD5 156ad9e9fbd83e0d88bb778a7e9d246a
SHA1 71689ad476bb098f7fc3b032ac99779c32d0b546
SHA512 034240919bee8503be36683360ae4f8d449447e8668699b9fd70c8651bf73fdabe3d720b67a9ae10b70692f18f4194ee7ae786b1a031bead8d6713d5a2ef32fa
TLSH
T14221675C3EF94E6AA8CBE39D7441028F53554A13558B2D431E43EFCCCE81AD9327A438
MD5 SHA1 SHA512 TLSH

Submit Download

2496f2c3-bb12-4a43-90c0-ae21e107b1e1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\2496f2c3-bb12-4a43-90c0-ae21e107b1e1
Size 886B
SHA256 a735a61f2e6351971c9b5638ccf387703bf94732e028cab9781ef098e77e10f8
MD5 65b7f2a633406f507b6925f4ec2e08c5
SHA1 46955d9dd74f1c95a8a5224aeecf7158d1b04cc4
SHA512 66495e4d949e54c9a649b584f37ef37406ed87194e95b9aee96c57bc184e764c4cac59b10946ca5780c5c2dd900452e53f92a2525b1b440af03a497be254d600
TLSH
T1BE110080D675B9B3CC28C38B89E577428FE4B01380CA0914BDA59B184D7A65EA7A760B
MD5 SHA1 SHA512 TLSH

Submit Download

267bc879-6533-44dc-944a-6dff0e101c69

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\267bc879-6533-44dc-944a-6dff0e101c69
Size 2KB
SHA256 431387b6654be4530b6f2ee22fbfeb7a13240af55cb7dd5c7329112f747e1f6f
MD5 388666dfc22dab143d77375b9e951c17
SHA1 1e511aaeebf329347d0a15520bdcf1f2e54e77d5
SHA512 344bd09389f634c92aeac02178d8e084f9a116ca4a1505fd8b23aa0947c103bd45215307c092869c256dbf76074242f5a671b73876764a43084c94fe8f12fcca
TLSH
T1AA41425C74785E779C9BF29D948233CE97648A0304832C836D52EF0CCDA679E336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

3d4387dc-5c89-4de8-af32-35a0866bebbd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\3d4387dc-5c89-4de8-af32-35a0866bebbd
Size 235B
SHA256 d1676d85e16b935d210f3194dfb58ea5d035a008c0d220569cfe94c425b72777
MD5 a2387dbb7958fb846992eb2c60fcd171
SHA1 026d25409417e47c22c6944df7a63fd37952c802
SHA512 b5564dd2a15c5acdb0d40ed9027cd9a4bbdb3d8a61ca222697704be61cfd9e521be714af46808b835fc66a1fac6e924deec9decf5485af771238543fd662c79f
TLSH
T154D09784388C67AC08040F1AF4A07ACA71844C3324B0B810CBA244789EFAACE0392856
MD5 SHA1 SHA512 TLSH

Submit Download

7540a5f4-468c-4ef0-a0d1-b120efa121fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\7540a5f4-468c-4ef0-a0d1-b120efa121fc
Size 235B
SHA256 76ac4c0250516bc7a195c3cd3bd93044c7645e049a8e395582f7e0fe2154d7e3
MD5 8a027f597ab18bffe94cab1b39a13e09
SHA1 0d2091aeac29aa9f7711a5946f53c469ae1b07ca
SHA512 b3bbc8748af4a29a6fa1375705ee6472f80ced25bc90bf21efea4e9ee17e7a80233464ef2610a2ff3cb32042c53809a7c47a14b3e7b7857679c399dc1f763aec
TLSH
T17FD097842498336C08180F06F0E168C232888D3324B25860C96046B499F89C811A2817
MD5 SHA1 SHA512 TLSH

Submit Download

7d9b864c-1853-4024-9cd6-d6b1bf8a817f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\7d9b864c-1853-4024-9cd6-d6b1bf8a817f
Size 16KB
SHA256 27750c9442a0257edf3e6e1677d83f30f4998627af91beab2cc298e9a88c69a1
MD5 ec7855a88dd7806d79423b0960788cce
SHA1 bc7e733d33e8e523d249b28b75515da0a5271a83
SHA512 efac568b85163aa67ae50cdf0878f4e45f296bf35ed9cc0d8d991564ecdd31e2ce8357ec65e34dddff33abf700e23cc7e1c9adb893a96ebd1763f1ca9a90d350
SSDEEP 384:EK7VbERUWMV/uRq4qs7nQLM0Fol2vOhA3:EQG8sLQLYl2qA3
TLSH
T1A172EB56686056BE8151E3A8D4FC7FC3E2F528CF4C019FCA97E4BD085DEA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdb992be-b287-4a1b-b642-afb64e2900da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\fdb992be-b287-4a1b-b642-afb64e2900da
Size 883B
SHA256 40e27f88db565949c96e28a24a706f43de1ea1d94557b843e7a614323de4e9d9
MD5 fbdb56dceb91217e0d611a127d184856
SHA1 bfb4dfe03626a451d94cc57b3888fdad748e4a0f
SHA512 f9dc36cd8a694206ea7c685681b5c0692624883bf260c10bcf874a537681ba5c1a3a4a51a5c1e00344a00addb2d6e11790f9e029fd8c71a649857ec2805fd189
TLSH
T1D0110080E635B962CC28834FC9A5B712CBE4B51380C745003DE58A084E7A75FAB6B24B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 d77b363b575808d950548ab85fe600660570e2f3e98fc746ec1934c1eebd13b3
MD5 2156efd688a33fd122422a23b5db1b14
SHA1 f0c9814b8320481124b1e6c6837009098b57ca87
SHA512 b3642ceb7aa552d7e4becb828ef944c9a2f32c88993c6a3e59e98cd67a12186572db1e21fe339a07fa938942cbb066f4e7998ac2c32ee534c959b3f26963f737
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4H9Q4hj:NI4fRfsXH446+4V4Y4N4Q4m4d
TLSH
T15C72421545048EB8294EA78BAA367E01C37D473B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 11KB
SHA256 4dea9e91356a9d66096a32bcb974afb27f4d4be81b490fb7674ddd0025474acf
MD5 ae8f85b13fa36a3a1e31c19bf3d82a44
SHA1 44178ce281a00e599242d6fe59f5de6cba9158fc
SHA512 7d0b8fe4a52681d53694004aee02f5a2359cc01e97a42378b79ae5fefe41df738ca493c18895bf74f02cce8d0f804fcd02ab67c6f133e3c4c3b2bfa255d26c1f
SSDEEP 96:xHyFTUWqGqPfNMjObzS4NSSlvdv9jmn+cpwoDRB/Ca33ylKBw88bx12A0JWr2s8A:sYRPfNMjiNSSCLRh73xBw88bCA0JWrRp
TLSH
T17842CC3C56408A3F28F2327DAC2549B15DA14227B6FFBCD615F88D82045CF2841F6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 8KB
SHA256 a673e0ad9f30d3ed454bf69bf4c67b14246447ef2b2435c33b3062f7fa713664
MD5 8f45640da801d9b05031ce89bc50aa2a
SHA1 70c78188d72037c4176db0278b8341a5bcfdcada
SHA512 ff03c973d3e8e1ed9cfe32a6f9b01e3c863088de6e69d900b3bdb25683df96a9063be6c693b6aafa5d455c4cbb1d058126654735e1343f3cd8f320f01a431c30
SSDEEP 96:xHpFTUWqGqPfNMjObzS4NSSlvdv9jmn+cWRB/Ca3ZBw88jP/s8L4cnAVeyGS:vYRPfNMjiNSSjRh73ZBw88r0p
TLSH
T193021E385504CB7F64B2777CAC6489716AA2023BB6BF6CC750B95885011CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 a28c286347ec50f913ca0e31f03590ef5239e5b5b6948c56d36462f094a433c3
MD5 663565ea89ecf8c6d44c04933888b5fe
SHA1 9892a52a5873397681d6115b1df77ca32de4be11
SHA512 154f7cbacae5bc9167ae695ec5e8e0a93f7661cd30a16a3ac91d6a5bb4c8143604af3f080a19f4ab0a1a3e3ba4d110ad4291c847784d43c502d0f5568c11e36c
SSDEEP 96:xHpUTUWqGqPf2BMj1zS4NSSlvdv9jmn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BMjlNSSGj7/Bw88qU
TLSH
T1EAE1207895088B6F64B5777CAC688831AAB2013B7BBF68C750B954C5014CF3845F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 2d8d0fbd136ab04f74588bdd9ebd5afabf694bd222d9b5a2e06138f8c1d4ac0a
MD5 04583cd1350eff3c453792eff1e20ed3
SHA1 64baa0f8a218aada2688c3ddc81c694bb42a4af0
SHA512 03a0b9954f1e02a6f065831cd9b9f519c671befc111307d2e0cfb1c6bd4d8152e8ca0863f7a4ad8238fad6050cd3e158f2711fe39a45dcc0b5a81c700ee77a3e
SSDEEP 96:xHpUTUWqGqPf2BMjObzS4NSSlvdv9jmn+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2BMjiNSSGj7/Bw88q7
TLSH
T128E11F7895088B6F64B6777CAC688831AAB2013B7BBF68C350B954C4015CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 cc4d1751aea28354a807e355c6d62b2b870b8967a46d19a1237f9782176044ac
MD5 c8e01ea82df39c7c9541b96fe01a0692
SHA1 dd36ba649975c6b72acf7bba594f505144734793
SHA512 e38178d9611b9f509d3d5fca74cfeef5586564c2641f21fa86ad5ee4a33e5b7986026b2994372b204be16d7b174b8f705319c663bebd2e104b47f16c1e6251a6
SSDEEP 96:xHpUTUWqGqPf2B4o1zSnpSSlvdv9jCn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B4oCpSSyj7/Bw88qU
TLSH
T106E1107890088F7F64B6777CAC688871AAB2413B7BBF68C750B95485015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 436f67f99878cb9382ab1aac6b8fb60a92ce98d2a008276454431f74150012d4
MD5 0b77804b7c19430c4f6745a54c166a00
SHA1 080b31410d714b09325adde08e16bb9df2b5cda2
SHA512 f7d124a99f5c16a53b68cbb56106be9b725bdf9bb2aec402a695428787d03cb5387d6b7e9f4df78b92d03c893f47c943bd51206699cf0c96de75c66abdfbb7b1
TLSH
T1D121B78AFF2F09A61265818BC0C51F94DEE56065872CE8F0ECD96A0132C8A1975DE318
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 0de6940896aee55f7d72803659b58eb568be2c4a56485d5f9d0733d8cfab2a65
MD5 f324dbf8d33e3b16e8bd98eb3de26101
SHA1 be861c85da97a2560ad92f01aa714cd26b146c3b
SHA512 5e9bce0c83efe4e4d8fd9349621120061da0a04ac194002c4eccdb6142cc37cf0884d40d008ae8053929589532d13ae247bb9f62afbdd3527d1dedf81d9dcd9b
TLSH
T15B21B849EF1E19F72779528FC0C41BB5CDEA2055436C68B1AEA46F0422DCA1979EE318
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.3MB
SHA256 8ff689d1dcd1d064d9178fb4d3256baa4dfe752e2cf858d2b1e4ea831552b2a5
MD5 fb640d7296e2b94ba99fdebcf5a419ce
SHA1 30e94932f46b7a903e2bd66a4d4efe9d5e4fb385
SHA512 1a5190ac07191000039ecf2fa6f1c239ededf8a095af14fd877f3c187644bdd3e6f647c6408e09473a27b976f6ef1c0756e2ab42054d42bac7ff9b2cece352a9
SSDEEP 24576:LSe5qxGu5m+dZVcWYY1YeUYdZwTfb2/PyEPDBnSE7zADwZAI2/JN9oSWcwfZw1QJ:LSe5qCTmNUYEfulnSEfAD5p/JN9obIg
TLSH
T17D4639E860D1A297F3814033724593EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 11.5MB
SHA256 9bd4cdc6a544ad7f1e4be123a834f778d7b2cd6e6c808dec4af941ed44757b24
MD5 d3b82ada4e68cdc05f156fd7d55374c5
SHA1 ab81bfb1b484cdc47939c541ab1bd9a2926c0bb8
SHA512 b0fdde9d92efc0cc9112ab7c82426c4317abf284ddc3fdec28b372c243fab036b843feffc40742731fda5487d519291ce0c1573d7f4bb035b2bbba18808f5654
SSDEEP 49152:ILELydaeU26QC5zYYHe9xWi6KnWurxaEeQXUqL3IScv46qa5YbUYgtpbnSs2DlFa:q+rbnSs2hFjio2Ep7Bw
TLSH
T120C67D9570D0D682E74145F7F34F43DB31BFC08C20A5C98417B8AAA968625DBEE6F368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3536-430-0x000001ED9C300000-0x000001ED9C380000-memory.dmp

Download

memory/3536-429-0x000001ED9C300000-0x000001ED9C380000-memory.dmp

Download

memory/4296-401-0x0000024D22980000-0x0000024D22ED9000-memory.dmp

Download

memory/4296-408-0x0000024D22F00000-0x0000024D22F80000-memory.dmp

Download

memory/4296-402-0x0000024D22980000-0x0000024D22ED9000-memory.dmp

Download

memory/4296-404-0x0000024D22870000-0x0000024D22871000-memory.dmp

Download

memory/4296-400-0x0000024D22860000-0x0000024D22861000-memory.dmp

Download

memory/4296-403-0x0000024D22980000-0x0000024D22ED9000-memory.dmp

Download

memory/4296-407-0x0000024D22F00000-0x0000024D22F80000-memory.dmp

Download

memory/4320-4-0x00007FFCAE0EF000-0x00007FFCAE0F0000-memory.dmp

Download

memory/4320-18-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-435-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-436-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-26-0x00000174E4EA0000-0x00000174E4EAA000-memory.dmp

Download

memory/4320-21-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-25-0x00000174E51D0000-0x00000174E5282000-memory.dmp

Download

memory/4320-24-0x00000174E4E80000-0x00000174E4E9E000-memory.dmp

Download

memory/4320-27-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-411-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-20-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-29-0x00000174E4E90000-0x00000174E4EA2000-memory.dmp

Download

memory/4320-19-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-431-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-17-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-16-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-30-0x00000174E4E80000-0x00000174E4E8A000-memory.dmp

Download

memory/4320-15-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-14-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-12-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-11-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-8-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-7-0x00000174E4DF0000-0x00000174E4E12000-memory.dmp

Download

memory/4320-6-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download

memory/4320-5-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp

Download