f87660a5228087f71da4ef7adbfed11fc6049d3da9a9d2b7af14051c9bb6741f

Analysis

user interaction
yes
max time kernel
300s
max time network
283s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/08/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
requirements.txt
Size 16B
Sample260811-3fjecseq5x
SHA256 f87660a5228087f71da4ef7adbfed11fc6049d3da9a9d2b7af14051c9bb6741f
MD5 f3709681510ef184a1ceca944e33e60c
SHA1 a20bf3b6fa3672f365aa2da51b07cf2e8cc1792b
SHA512 1c453ce1304e3823230ff4327fddef17d9fc99e476f7b51f2e572eef19581919b5034e5e2abde49ead60eb9c94329e96f258d525e9c96ac5b78b7810349159c9
MD5 SHA1 SHA512

Score

6^/10

persistence ransomware

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1956	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4880	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 4880	1992	firefox.exe	87
PID 1992 wrote to memory of 4880	1992	firefox.exe	87
PID 4880 wrote to memory of 4216	4880	firefox.exe	88
PID 4880 wrote to memory of 4216	4880	firefox.exe	88
PID 4880 wrote to memory of 4216	4880	firefox.exe	88
PID 4880 wrote to memory of 5328	4880	firefox.exe	89
PID 4880 wrote to memory of 5328	4880	firefox.exe	89
PID 4880 wrote to memory of 5328	4880	firefox.exe	89
PID 4880 wrote to memory of 5328	4880	firefox.exe	89
PID 4880 wrote to memory of 2180	4880	firefox.exe	90
PID 4880 wrote to memory of 2180	4880	firefox.exe	90
PID 4880 wrote to memory of 2180	4880	firefox.exe	90
PID 4880 wrote to memory of 2180	4880	firefox.exe	90
PID 4880 wrote to memory of 6108	4880	firefox.exe	91
PID 4880 wrote to memory of 6108	4880	firefox.exe	91
PID 4880 wrote to memory of 6108	4880	firefox.exe	91
PID 4880 wrote to memory of 5540	4880	firefox.exe	92
PID 4880 wrote to memory of 5540	4880	firefox.exe	92
PID 4880 wrote to memory of 5540	4880	firefox.exe	92
PID 4880 wrote to memory of 5540	4880	firefox.exe	92
PID 4880 wrote to memory of 2592	4880	firefox.exe	93
PID 4880 wrote to memory of 2592	4880	firefox.exe	93
PID 4880 wrote to memory of 2592	4880	firefox.exe	93
PID 4880 wrote to memory of 2592	4880	firefox.exe	93
PID 4880 wrote to memory of 3752	4880	firefox.exe	94
PID 4880 wrote to memory of 3752	4880	firefox.exe	94
PID 4880 wrote to memory of 3752	4880	firefox.exe	94
PID 4880 wrote to memory of 3752	4880	firefox.exe	94
PID 4880 wrote to memory of 5356	4880	firefox.exe	95
PID 4880 wrote to memory of 5356	4880	firefox.exe	95
PID 4880 wrote to memory of 5356	4880	firefox.exe	95
PID 4880 wrote to memory of 5356	4880	firefox.exe	95
PID 4880 wrote to memory of 2500	4880	firefox.exe	96
PID 4880 wrote to memory of 2500	4880	firefox.exe	96
PID 4880 wrote to memory of 2500	4880	firefox.exe	96
PID 4880 wrote to memory of 2500	4880	firefox.exe	96
PID 4880 wrote to memory of 3488	4880	firefox.exe	97
PID 4880 wrote to memory of 3488	4880	firefox.exe	97
PID 4880 wrote to memory of 3488	4880	firefox.exe	97
PID 4880 wrote to memory of 3488	4880	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\requirements.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {5ffe0839-b03e-4e22-b7b9-1fa635c40756} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {85ebf315-a59c-49d6-b49c-5b5b73261f67} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3688 -prefsLen 27277 -prefMapHandle 3692 -prefMapSize 270279 -jsInitHandle 3696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3700 -initialChannelId {e193d0f7-db13-4918-a766-835549ae1978} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3852 -prefsLen 27277 -prefMapHandle 3856 -prefMapSize 270279 -ipcHandle 3940 -initialChannelId {8426b0e1-4e41-424c-9057-ec178fbe1f60} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4432 -prefsLen 34776 -prefMapHandle 4436 -prefMapSize 270279 -jsInitHandle 4440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4448 -initialChannelId {1dab9e7e-2cc9-4198-a150-25afb57a5c69} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4884 -prefsLen 34932 -prefMapHandle 4888 -prefMapSize 270279 -ipcHandle 4896 -initialChannelId {17372ed7-1138-4b5d-890f-3b7a8b5b4ccd} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5252 -prefsLen 32952 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {268655aa-7b12-45ea-9153-e7f394f09be8} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32952 -prefMapHandle 5100 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {9c348238-7360-4d2a-894c-efb54a0d7b93} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32952 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {07cc8f75-4f2e-45c3-8abc-7b7d5a5a9f67} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6372 -prefsLen 33031 -prefMapHandle 6312 -prefMapSize 270279 -jsInitHandle 6348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5976 -initialChannelId {bf2c1f67-a904-4880-ad1c-e35c0ef37250} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10006

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\doomed\10006
Size 29KB
SHA256 d956dabfcd9a028a21cfa9eb4f6af573b132596cbcd4a717c0fe6431a761f339
MD5 7f03ac15004c1b85e96c4d07aa44ba0a
SHA1 eb87899f5a2455202abd6994eb32e13f8f832191
SHA512 71630e0b87d43642de4ffa1cc69e2a68eb8fc39465a8eaf296af0dc4a6dde165d560daa34fe1da19c2d12efc4956811328a53f1923c031ee30fbf18413f85dd1
SSDEEP 768:muJcfZxGFU6d7f79M8NjP/8q+kXzNpmG3n8tGT3oSU27m/dP8G8emhpaR7:9wOZR9r8YjTmy8t4TUy+7
TLSH
T165D2D07AFB204E8ED70186FD5A058EB23D01D893CE2BF4E25481759C6F8927560F05EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18480

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\doomed\18480
Size 13KB
SHA256 80dfc0395766ae1e031575bc8d867103debc5edeb574c4a9becd15f514809002
MD5 33a8d669bf1700537d8f828db217d6c3
SHA1 e15d71ceb119d4e0f34cb793debce24a2a592381
SHA512 eaa5be5474b87f59e559234b00001ada2d4ae9efc3f50b62b26e98902b7750ed1fddb50ef574344dd656bf72cc6e0bd1d74fd07755a497a50dbe1c13611beb8d
SSDEEP 384:yO4PyoYjz7YWpLiUDFFAqZxUdP8G8gev7mmhpaRxarHv:y31oYunnAqTUdP8G8emhpaRsr
TLSH
T1AD52AE7E2F3978A417439B719E83EF197E15E583E452FBF8742431D88BC4BB6248144A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22171

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\doomed\22171
Size 29KB
SHA256 baa130f7af8cafd3fa449fe41ce8ab7b10b91d5edf28b1883fb24df8c1827109
MD5 faf9d2ecedd871495df856a4ea3d5b7a
SHA1 cfc82d74493ddc932a085ce82f8305c6b6088212
SHA512 73cd5dcfc046070e3b46a16f2cb00dc49dcd5b8a162bff65b096b0b11a9c115716df6f8b1593913dc5a6c7a2418667e0d3e2fb5bca69921a2fb3a26179fee9ac
SSDEEP 768:v4A11FHNuzh+ZKiaOIF2uBcqxUeNdP8G8emhpaRs:v4A11rU+ciaOISqOL+s
TLSH
T1F9D2E1B9BF246ED21FD0AE671F12CA41EEA9EC838554E7FA1481704447C0BB2D5E2D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26346

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\doomed\26346
Size 30KB
SHA256 29dead49514a2bf181d8cd98d7b346ee0d7381f513a61fe0439b8e39fcc98995
MD5 c84d986f987adc2f2774eb3637f8978c
SHA1 d44a96143177790750ca7e2e38bdfa67c7a5f004
SHA512 2b4d64321dbe6cc093bbf975ea33e82bf239436dfc3c18c9ad957a3d141879acd134ad34d25d2f6fcdf915a6c888630d9f769e35a8afb0adaa2fe870fcc03041
SSDEEP 768:gaLozXeHrwr7NwkCMnY5uscKWNnK/1HnRA63jdP8G8emhpaRk:/KXeE72SnehbWNk1le+k
TLSH
T135D2E07E2F002DD42B046FB34D564BAF9C86E54309E5D8EBF040558D1398BB8B196ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3150

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\doomed\3150
Size 20KB
SHA256 9d52d3bb74492a477609500e5b4b68088163371d7d6e9646eda4a7a2fd0714c2
MD5 0158c079cfe59db073ee37382b39b766
SHA1 cede616d5931b606637a42baada6c0709b50d4d6
SHA512 3d22d73410765049473797d2a090d757e211e477d23795c0d39dfc3ffcda5cc4e7f8fa3434a272b0f39add02edb974a5519937021c0b3725fc9249a76be96397
SSDEEP 384:EcGWTwhrdTusKbdrS3uEkBcnlT/mWuC7NsAkDIdP8G8gev7mmhpaRxarOB:ETspFQKBcnlT/mWxJ7k0dP8G8emhpaRl
TLSH
T11192CF7E7A19627E1BA49D53891A5F293E05E5E3CAC2D5F93E0031984DCA7B430D029B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

771

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\doomed\771
Size 29KB
SHA256 0001fb718909afa81886508399e21b25e74a4fa81ed7ad608d13c28973e49079
MD5 9edfc293e78bc0f3b412e404f69b682a
SHA1 113d2a0505c0c2f2b29b1b6e6014951aa598ccd2
SHA512 f7c2e679724828471d9e4ecd23ff9efe50baccaf82c5de09e6f55964443ce3c384b155715e563baf8b2981877fbab40acd55c2c13976de369cc7517dc787af59
SSDEEP 768:rfEeuzM+MFSoHqgS5TOjr+QTUVPuSQ5IdP8G8emhpaRe:rMeubMkoHqg1jL4kl+e
TLSH
T1DAD2E17B670068CD5B34CEE49771EF3A3A1AF943E06AEEFD1064106D4AAC790A0D509B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6F9D52BDC217C3050051CA1A75B9ED8D80B7FA25

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\entries\6F9D52BDC217C3050051CA1A75B9ED8D80B7FA25
Size 98KB
SHA256 c564c8de92756079bcf8e26941dd2097b5a0777cdaea489870190c8b06a1ece4
MD5 f0d01f0e54d73bd5e966098bea61f4c6
SHA1 fb309eb864b84676a28563e67938a1f341c900ea
SHA512 4d75fb89c7797cd47cca1c3e9c81a1cb5c53faad6cd795fb357450aee8847ea8f3219343bffd2a91a6b47ca4625a90aecc9e64c2184feea96b007c40b3a92e17
SSDEEP 1536:opIxFi0w4b2T/vRjTfPXkwdhSQZi+TA+sm:f84yTxMwdh58lm
TLSH
T1ACA32BA6F550307E6C2BC998A694FFAD67266546CF074BA0F043165863CEFF50A12ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BAD79F5EEC0437AC70AB9FDE14FB4A1F1AEA9682

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\entries\BAD79F5EEC0437AC70AB9FDE14FB4A1F1AEA9682
Size 2.2MB
SHA256 8219d0e0ea1dd70e5367e8b325ad5fcdea15a510358c1afdd3f061cfab8f9e69
MD5 0807e907d2d5133660009ac0ed807c29
SHA1 ad4075896b6582fa592aa5f253981917631406fa
SHA512 85772745a54241adbf9e727a1854c1fe2d8e60112f641aac6f86bf06cc56a74b4926ce860eec9c2e87e5e0b4030f10198f322601762aa542fe5323f2ddd218f1
SSDEEP 24576:NBycgM8dLPWfr/ofAWgjYb4XMzaE7gXMtSRIde3DW9qhK9bJVyp+gKo0qRmcQsNt:N0cgM8pWzIjgsbfNzCGYl
TLSH
T1E4B5F82BEE896F57C860827480AF23753B74E0826BD2F72B65DF7011BC193794D625AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C9DC5718FF3DB29DD4489BBBE60AF0F8B85EF7B5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\entries\C9DC5718FF3DB29DD4489BBBE60AF0F8B85EF7B5
Size 1.6MB
SHA256 5c7c641439a38d6b1c384343a055359fd46df3e74f0d4752be3352a0fe6a325c
MD5 46173a39117e7a98fffe0b4dee912155
SHA1 be5c7c6de50bea80c47b68ec31d4d98a5f260190
SHA512 9071fc5a6937f03aa0b1981e0658d635e3a4451fa945c62be11f4f81bdaf32ed7cdfa5cc253a7466a9e9b4e5c1f57e88d0509e05e0319b5185ca9d3e5c8ab7fa
SSDEEP 24576:JJZnHtMzQulo+mq0/9Z++u7QkA7mWzStV4LmQ:LZHaQAZHwmQ
TLSH
T11085092BEEC56F53C961427440AF23353A74D486ABD2F32B59CF7061BC1A3B90D616AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D754CD72FA20A7572A4D6DC5BE013EB253C9BCB1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\entries\D754CD72FA20A7572A4D6DC5BE013EB253C9BCB1
Size 29KB
SHA256 22313bcd084dc8642bdc1d27e0630cc32f22f1d4edea0ad512ab9079d8354a93
MD5 100972e9f0ffe53212d29a61523384ca
SHA1 88ef2cdd9ba25daea8ec33af0396791c2f9934cd
SHA512 e19b77a7a76640982f02aa9adec3d8221f133de83f4d2b3b9c8880381f35722a4c98e142b86380089528155fdad70023d144c70f4d160fee90fc3a6f1744aaf7
SSDEEP 768:aTPn4k+DQUhz317iDwKhcR69axF3UdP8G8emhpaRsf:IPn4k+vZ0wKhc09axF3p+sf
TLSH
T113D2E17D1E5504AC2F00ADB8661793264E78EAE3C5B8E9B8F000318992D9F76A1C5DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FLHZ2F2GPB6FHDWIFRS2.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FLHZ2F2GPB6FHDWIFRS2.temp
Size 13KB
SHA256 ed4982d87ff2946e6eb9c765bae6550229225a019c9d8a1d98ba7282b8216b8c
MD5 b1f076160c6986c05b0bd83756801036
SHA1 017791ee216beb0f804635cfbb8142cd1e49ea94
SHA512 6c5b83752a2f328fd652287e9ed231a9b643590473aedae3b7e7100fb73bbed2ec5c5714e3755f76633627165395f57af61ef9b5f0cf86cbf040f60bbc87a52a
SSDEEP 96:6e36e3/3e3/4e3bSDVCSWBe3h+De38Ce3ztWT4tWNt:TTW/x+TWwx8ZWGWNt
TLSH
T1D452440017FA1AA5F6FB5532BE727312AB33FC114B07421E818191465E737209A7AF9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\AlternateServices.bin
Size 10KB
SHA256 0460abbe5ffbb004ecd79e492244dc1a983e11edd39361d1f4bb53fbb11ebdeb
MD5 2f740cf62921b28ca22ec2bbb595825d
SHA1 483c899e469033eb8967ca1a02bbeb7264a2cfec
SHA512 1a60a0b221f384873ede1724888163b98aee935c2213209d370a7627062f817502fe8564ed20fb9b6cf87e92983b4792df2b415f86ac16619cb7e443ae39be18
SSDEEP 96:2ngo96oiVzomBosrgzgo3ukYZoCb23go:2gH3HX85YZ3
TLSH
T1C822F5FB2B767532F0568FB6509C70C8AC33022A9964A488CF14E09A43D6794A17FF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\AlternateServices.bin
Size 12KB
SHA256 974d44eb696d62c50200e43a0afbfa45867fb6adf8e098379dd0cfed8c9c7808
MD5 f0e9243cd2e8a8706fcc536557de3e8a
SHA1 84852af097687d5112e92b972671840d38b3fbe3
SHA512 0adcc23ad9312c9ca461402e51a93651c286295b0b174b937a23d4515e607f43012da2dae0d62ea2b3b17a94e1cbc7f904f4acc3050afc1100fb0d7a2569be45
SSDEEP 96:1ku9o6/o6VToexoMrgzso3ukYZoCb23gojRYtpok47:C0DzzD85YZ3CGtpQ
TLSH
T12142C9FB2F756432F0968FB7409874C8AC33022A5D64A488CB14E09A53D6795B17FF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 4d1b966ba8b9a76299c15c02053c93dcb26abe83abdbabd82c0d03444ec7a5f9
MD5 e4fedea74e087b9b41bfbfd74d00fdef
SHA1 8f72d9dbc505349ad3a9f101bcd42dda00ed6609
SHA512 618190736bf1f4b770e315b8f598c95e4a07319cc774cc147e577dcc6bf5d3089699711b06f0cda1ad389740e21da20e37ddec0bfe6e1320dad6acfbcf1042d2
SSDEEP 768:mPWZK2oeeMxtGcmhuxRzQ51zfbibZbab0:G2oeeMZ3
TLSH
T155D20244EB2E953FD41912BBDCA50B002F79B88958192FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 6a2d6a76abd97e3adb4ea067612edcb305bbd8fc57bdd58992ca06d3043f1e91
MD5 7118c0feb231ec2642ff6dc092c57833
SHA1 c2577901a714ed8eb89dae1a22ed23402264b965
SHA512 2114cdc8f5aa5a46c62c810bb90467ca35cdf206e8fae2740daf9ed13ed6f15e2847f03e5e4c6ce687fee504e241f275acda881a883ffa04f3b560b41d4ae365
SSDEEP 768:mPYs22oeeMxtGcmhuxRzQ51zfbibZbab0:12oeeMZ3
TLSH
T13DD20244EB1E953FD41952BBDCA50B002F79B88A58092FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 024c5649670aa1f128ff5bd55adee36f7e7c275d104aef2ffe74583febb7fa83
MD5 cdaa2867bb63ddf8361238b8e0a91949
SHA1 941012b5ae4585dc4891cfc011a2eea8275714b8
SHA512 3cb6362496477dbfe4b41443f8e39ff39d3455ff338c378ed484c3d9e13516b4ee15e35237d913c6df245c418382ae75e25cb22de2f70d17fad84be73cfd2883
TLSH
T13B21484C3EB84D2A6CCBE25C744002CE57A54E0B04C71C878E12EE8DDFA1ADA326E42C
MD5 SHA1 SHA512 TLSH

Submit Download

47a33cff-b85b-4a9c-bb86-fbe86612fddc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\47a33cff-b85b-4a9c-bb86-fbe86612fddc
Size 2KB
SHA256 3a7313c0606184586ef8f0dacfcd8087ad15f97155902b43737939708b542da4
MD5 9753cf59b767464c7ce562a324e5d177
SHA1 aae322a56ce23f6c3f87386d2b3185dce7807b4f
SHA512 269eda33dcc42737a6fc02b3c07e2a1dae939844b2a4394e949b274d6b00b98a209c052ab6180dac70afc2deef83a77645f70d8e26c6606b80c73e28a3b3c69b
TLSH
T18B41675C79785D774C9BF1DDD841339E57A04A1300C22C431E52DF0CCDA9A9D236A577
MD5 SHA1 SHA512 TLSH

Submit Download

52b63302-13c9-48a2-93e1-8c7fd5d7af54

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\52b63302-13c9-48a2-93e1-8c7fd5d7af54
Size 235B
SHA256 fcb485f50063eece64336c8a3d81e280047206d81b7c1ccd00f36e5073a3dfd0
MD5 391a77f03e82f67b5748646d094b0234
SHA1 d6af58bcbc603ef0d732f029470db74facf4d25d
SHA512 5e1d560f5c76c8f63308092bd173c34b366ce9ab0e98d50d7a2b38d27e6e12746e021fd0a204e527a9f02937ce81bc314ba57fa459978494b8f32ddfefa7599c
TLSH
T19FD0978414D877AC08151F07B0A0AAC330888C3710689824E6A025388ABDEC84222A17
MD5 SHA1 SHA512 TLSH

Submit Download

5c0d6bd6-0c51-407f-8a50-9fd7401bfff3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\5c0d6bd6-0c51-407f-8a50-9fd7401bfff3
Size 871B
SHA256 6cbbeb172da030a0a4d1cf2604cb9db0038712e1749885fcce893c1e381b27a6
MD5 86a7035b42fab1a8d474b4ad2e27b73b
SHA1 b398c56a2c376c4af606eb34a78478f8560ffb6b
SHA512 7872a127fea4ba5d6f3099d10a96fcaed5312623eb6bca95ac524fbf6b75ea23a908b94cd405015082de9a47da46863fa082200b83e08d1be130154453f8b18e
TLSH
T143112351C675B5B3CC78D25FC5517B528BF8712340CA54043DE41B140D6E61F979A30B
MD5 SHA1 SHA512 TLSH

Submit Download

b1eff079-6ec0-4fc0-8773-38172cb820bb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\b1eff079-6ec0-4fc0-8773-38172cb820bb
Size 886B
SHA256 6feef5f6cf6cc801391cdf406fed4c02d1f3cc3ec9dbf883d96621c7c35e8c2d
MD5 0ebafb2096f7498a5b71f8d76a784fc0
SHA1 0e0f520682bc8c4895579a3b2039d6a4063365d7
SHA512 b2ec9f0709f531ddae0105ec55dd7b77a46c8036e16642761ffae87a9b61f872a1156fc70912ee560b981aadfe884f6623ccffb9d75fc125070cc5a1498c7ae1
TLSH
T1121123519A69B5B28C78E39B88A577538FF8301380C719047EE45F184DAB21D57AA307
MD5 SHA1 SHA512 TLSH

Submit Download

f5307002-7b60-4732-9f09-c9eabdfc0d3b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\f5307002-7b60-4732-9f09-c9eabdfc0d3b
Size 235B
SHA256 82b26d6f13a905b012905d02808d5ada26c3914659ac35aeb5afdcf808356272
MD5 4b35788b712545eafcf25fd6beb27a96
SHA1 a6af1e1becd92b90e251452e106f084d7e72a40d
SHA512 e6a64faf28a550406fc8543708dad33c9d5f594be39ca151ece4b0ffa50c934f5d30da7fdd896e0d9669c8a2d1491497b260ba92b4607064b64dd6d6f7c06ef0
TLSH
T108D0978014CDA72C48140F16B0E8B8C630458C3324A09820D9D60074ADB99C90122817
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\extensions.json
Size 16KB
SHA256 c1ca7500e05dacfe7ec64f48d9c5cf602f8f20f1d670843f2da8d7b1218cb52c
MD5 02ad0fd1acc794466aa2e7ba260287d6
SHA1 842c6a1e54c06219177c34fa517450d2ce61a84c
SHA512 546e8c145e14396ff15d21168e3a747c11d2d7a82e622c2f7be31ce1e488a9164b3fada93feb99dbde82e7be3a646f66e5efb787cf112cbb28861ae626eb5086
SSDEEP 384:xkI4v4Umldvr8dhWp94zJ96oaL4HmWL4POL4HnL4HRjL4HV34hu:CI4gRf4XI4D6D4Gc4c4r4xP4F4I
TLSH
T17D72421545049EB8298FA78AAA367E01C37D473B60845C7CF4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs-1.js
Size 6KB
SHA256 eb515f6141ef212537d1e0c9ef40e726e563df4c7818005eb11864946888c364
MD5 e9804d48cd10037b8372fce83b7fa300
SHA1 1c583bb86aff80df19b4fb2e2a14459df8dc0036
SHA512 25cfdcb1613cb38f27d3956d70a65c7ec9fff84ccf32def16adb35461ff5634a5802f5599ab6bcd701c1cfbb74f5c0429b00c8b49fa998b33ccf284a08a73322
SSDEEP 96:xHIUTUrqGqMfYEsAr1zS0SSlNdv9jwnqTRH4BnSWBw88P8L4cnlKSMGS:SWRMfRsAr9SSl9MSWBw88z
TLSH
T1D2E1307894088B7F74B677ACAC6888715AB2413BB7BF68C750B984C4414CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs-1.js
Size 7KB
SHA256 ab0d589a5981ac173dcf86f38ace014a044a2ba5966992fd299bd6a32a358807
MD5 9406571b069b086c240dadb9ca6cf4c7
SHA1 bfc0dbbffdf6a48d548ece6a9134b6f6bb51424e
SHA512 41d5a831f748a01c2aaace236d121b842cdb4d2f6e78701770a638b1ae7a0bcd063571a92df0b392af776c204558f1417d5965655758228d7d592acec4e67492
SSDEEP 96:xHIZ8XcoYBTUrqGqMfoeVsArObzS0SSlNdv9jwnqTRWRakBnSreteuBw88P8L4ck:SDRMfJVsAr+SSl8RrSicuBw88z
TLSH
T1FEF1107C6508CB7F75B6776CAC6888705AB2023BB6BF68C750B59484051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs-1.js
Size 7KB
SHA256 1c5f0eeb7f6d93859e4e685a091a638c97564fefe3a430fd644e0501fee6f0f5
MD5 fb7a92fdbe94ebe8aab4c3f89ccbd1f9
SHA1 0710d4ea0b5aa7beb5519550064a0bf97598589f
SHA512 87d82f9720256c369d99c21a9a11a866665577f3f0a930beeadfb8e868e2d610fb9b2907dacede3656c2b485fc8052e410cd6480f64fd061d41fce236e09edc7
SSDEEP 96:xHIUTUrqGqMfYEsArObzS0SSlNdv9jwnqTRH4BnSWBw88P8L4cnlKSMGS:SWRMfRsAr+SSl9MSWBw88z
TLSH
T196E1307894088B7F79B6776CAC6888715AB2413BB7BF68C750B984C4015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs.js
Size 6KB
SHA256 8a43c4c1ff06233c52e367a75d3f5d3ebf2a5d9456bb78639864c60e2d9d464b
MD5 f050b1df7a0fee1ffc9ae497b5fb3076
SHA1 d901cd073d6519223eb2b6baae7d08d48066a7a9
SHA512 afeedf6a559675880e489667ca8717380ac4d06bf36e539614fbb5896b0b31dde576a8672cec13108c683de714f7248639c1402573586be976896c7ca7c4176d
SSDEEP 96:xHIUTUrqGqMfYEFY1zSTqSSlNdv9j7+nqTRH4BnSWBw88P8L4cnlKSx:SWRMfRFYeqSSvz9MSWBw888
TLSH
T176E11F7894088B7F65B677ACAC688C715AB2013BB7BF68C650B94484414CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 12526e3ae29c51319f2908ab182f84ae7c5a49cc583f737f5016ddb9bf8ad6b6
MD5 fef4a4f90ebb9bc77c2fdb3fe0940d92
SHA1 8f85fc95a005b7d8e9b114d80c71a9ec8bccc5e6
SHA512 fb90e1628693f55235cdcc5ab64fd211ef834c46d9c388b432b9447ac7f4776ac49e7b1c6ae6254d057d932e76c370ba162bb962e0cfe64e48d1c1112e574ed4
SSDEEP 96:m2XZiUfmzFk49Ej9AdrqH5Vhe+OTleg1l7Faj+YB4aZzMpTU0hEwkIyvbozOz:mnamG49E2m9eXlD1/a+kxehEwPzC
TLSH
T161918DF592BE3887AE1D926612C03F4EB7873C058648248C1B01D151C50F98EF6E5315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 8371c3555f3f1feda25680e59911b730d556e2d343e6b221913d84326528db79
MD5 a02d07f9c457c4213f1352ac51009fee
SHA1 fb7ce71959a1ec0313033d3775e2a4abb8f9057f
SHA512 4ce30e601259622991afefdeba5a619a86114443819370909ef21e780e7b35248bdde196d1f80be461b9db5796d1f04606d8ce3d8389907347fd2607feb8d76d
SSDEEP 96:m2XZiUfmzFk49Ej9AdrqH5Vhe+OTleg1l7Faj+YB4aZzMpTU0hEwzIyvbozznP:mnamG49E2m9eXlD1/a+kxehEwIzz
TLSH
T1EE916CF596BE3887EE1DA26613C03F4EB7973C0A8689248C2B41D191894F98EF6E5315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 cef2e42980067d4246c1d08f0d88b4d4c0ef1f18a5df318a08a48644f1f066f2
MD5 d1a2ebb0d88291d09dc4d1a4004f1cd5
SHA1 26fed59ab6f16cf6e4e6face9f92a3ccc16eb3e2
SHA512 cb278a5746550188c218cf372e802e45ac4ea6d88b4f60559acb1403b708736ebd206e7a749b2160d26ac0c54743e0a8600566df0d9ee3ff13be4a9c4ae89783
TLSH
T156310A60DCBE1CFA5A94A20E92C46BE5D75124224684A9D4D888D70401E88CA373A706
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 1496fc2593f156188f0c9da805f515f9b1371dc139ea151244005b72202ad34e
MD5 3ce9651e53ccb6af5af95732d893ff8f
SHA1 c4b44415754ed529850831b9f3dc97d3d2c6cc52
SHA512 db4c4ae248779b0b019d84d6841a09478b3e1aba2aa75e9c47f33d46730a75829e7b1ab1aa21a98d5604c9b8748818a4d692eb5fd0e2a3726f8e0c10c426c7b3
SSDEEP 49152:lDmgBuOjA5lUT2loNcNeaKvgmRBbFOYTg/:VmYuO856T2KOeaKvgmc/
TLSH
T1D01639F820D1A257F3818037668563EF21AFD00C6467DD484BE966F994B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads