d19c1ef43ccd9cb1b39466bb2f1c8e45c2b6752f1e13a3dfb60096543d1791fa

Resubmissions

13/08/2026, 14:12

260813-rh5vla1hlg7

13/08/2026, 14:12

260813-rh4brs1hlf

13/08/2026, 14:04

260813-rdnera1gpb7

Analysis

user interaction
yes
max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RivalMods/lib/lib/javassist-GA.jar
Size 731KB
Sample260813-rdnera1gpb
SHA256 d19c1ef43ccd9cb1b39466bb2f1c8e45c2b6752f1e13a3dfb60096543d1791fa
MD5 60974bfbf014085986b1d1eac44222c8
SHA1 50120f69224dd8684b445a6f3a5b08fe9b5c60f6
SHA512 f08d31069e208d1ecc2956445098dd54947db3c3f1cb719513b9660c152877d45a528482af937a58724b76f935d82849805ed2e6cb0161f06e9aab6a32389bc4
SSDEEP 12288:sG7wv+Ogw7Aauh7yUWp2D0TtIdCwTLfwo/QEur3cyVI7gX5dUr:sG7wGONAy0wo/QEm3cGpdUr
TLSH
T1A6F4E11DAF94A03DDCD3E1304450D162F7BCC9999057C09E25F4C9A7AAB0CA50BB2BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

google persistence phishing

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
186	3856	firefox.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	firefox.exe
Token: SeDebugPrivilege	3856	firefox.exe
Token: SeDebugPrivilege	3856	firefox.exe
Token: SeDebugPrivilege	3856	firefox.exe
Token: SeDebugPrivilege	3856	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe
3856	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3856	firefox.exe
3856	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3856	firefox.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 3856	2364	firefox.exe	89
PID 2364 wrote to memory of 3856	2364	firefox.exe	89
PID 3856 wrote to memory of 1800	3856	firefox.exe	90
PID 3856 wrote to memory of 1800	3856	firefox.exe	90
PID 3856 wrote to memory of 1800	3856	firefox.exe	90
PID 3856 wrote to memory of 4928	3856	firefox.exe	91
PID 3856 wrote to memory of 4928	3856	firefox.exe	91
PID 3856 wrote to memory of 4928	3856	firefox.exe	91
PID 3856 wrote to memory of 4928	3856	firefox.exe	91
PID 3856 wrote to memory of 2256	3856	firefox.exe	92
PID 3856 wrote to memory of 2256	3856	firefox.exe	92
PID 3856 wrote to memory of 2256	3856	firefox.exe	92
PID 3856 wrote to memory of 2256	3856	firefox.exe	92
PID 3856 wrote to memory of 3484	3856	firefox.exe	93
PID 3856 wrote to memory of 3484	3856	firefox.exe	93
PID 3856 wrote to memory of 3484	3856	firefox.exe	93
PID 3856 wrote to memory of 2560	3856	firefox.exe	95
PID 3856 wrote to memory of 2560	3856	firefox.exe	95
PID 3856 wrote to memory of 2560	3856	firefox.exe	95
PID 3856 wrote to memory of 2560	3856	firefox.exe	95
PID 3856 wrote to memory of 616	3856	firefox.exe	96
PID 3856 wrote to memory of 616	3856	firefox.exe	96
PID 3856 wrote to memory of 616	3856	firefox.exe	96
PID 3856 wrote to memory of 616	3856	firefox.exe	96
PID 3856 wrote to memory of 2360	3856	firefox.exe	97
PID 3856 wrote to memory of 2360	3856	firefox.exe	97
PID 3856 wrote to memory of 2360	3856	firefox.exe	97
PID 3856 wrote to memory of 2360	3856	firefox.exe	97
PID 3856 wrote to memory of 4644	3856	firefox.exe	98
PID 3856 wrote to memory of 4644	3856	firefox.exe	98
PID 3856 wrote to memory of 4644	3856	firefox.exe	98
PID 3856 wrote to memory of 4644	3856	firefox.exe	98
PID 3856 wrote to memory of 1476	3856	firefox.exe	99
PID 3856 wrote to memory of 1476	3856	firefox.exe	99
PID 3856 wrote to memory of 1476	3856	firefox.exe	99
PID 3856 wrote to memory of 1476	3856	firefox.exe	99
PID 3856 wrote to memory of 4156	3856	firefox.exe	107
PID 3856 wrote to memory of 4156	3856	firefox.exe	107
PID 3856 wrote to memory of 4156	3856	firefox.exe	107
PID 3856 wrote to memory of 4156	3856	firefox.exe	107
PID 3856 wrote to memory of 4080	3856	firefox.exe	113
PID 3856 wrote to memory of 4080	3856	firefox.exe	113
PID 3856 wrote to memory of 4080	3856	firefox.exe	113
PID 3856 wrote to memory of 4080	3856	firefox.exe	113
PID 3856 wrote to memory of 5132	3856	firefox.exe	114
PID 3856 wrote to memory of 5132	3856	firefox.exe	114
PID 3856 wrote to memory of 5132	3856	firefox.exe	114
PID 3856 wrote to memory of 5132	3856	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\RivalMods\lib\lib\javassist-GA.jar
1⤵
PID:976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {7e6c866f-47fc-4330-9862-1329ff7bc6f5} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {7eb3ab3b-b0ed-433c-a022-6bfd6ec8721c} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 27276 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {4f601b09-3cd5-4253-a481-6c3fcd29cf54} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27276 -prefMapHandle 3888 -prefMapSize 270279 -ipcHandle 3972 -initialChannelId {70ddaf5d-53ef-4707-8fe9-9d5b9472feb5} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 34775 -prefMapHandle 2948 -prefMapSize 270279 -jsInitHandle 2956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {8e2d6a0a-d610-44f5-a9a3-abd73e2b9f10} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2856 -prefsLen 35012 -prefMapHandle 2860 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {de3a79ee-43e1-4fef-8348-dd1d539f231d} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5084 -prefsLen 32952 -prefMapHandle 5088 -prefMapSize 270279 -jsInitHandle 5092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5100 -initialChannelId {6d431abd-8d58-4f37-a092-e8e9ae47107b} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {c6c47326-e11b-42aa-9dbe-2624b59ddb17} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {aec1071e-257d-4075-ba56-b5fbcb50b618} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4300 -prefsLen 33071 -prefMapHandle 2912 -prefMapSize 270279 -jsInitHandle 2788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6080 -initialChannelId {1b440476-8bf1-4afd-8995-097e2788b0c2} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4588 -prefsLen 33071 -prefMapHandle 6488 -prefMapSize 270279 -jsInitHandle 6132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6468 -initialChannelId {a2be5695-8ac3-4b4a-85c8-b6a48d8d30cf} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6752 -prefsLen 35553 -prefMapHandle 6756 -prefMapSize 270279 -ipcHandle 6640 -initialChannelId {06cb0609-dbf0-4b91-a5a5-fd3ac807dd2f} -parentPid 3856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81437FE46A583F9E7052AFC450CBD5B98AB5808F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\81437FE46A583F9E7052AFC450CBD5B98AB5808F
Size 43KB
SHA256 f0d9515389d6d9427791a1c48840d677b101700f1eaec15bb0fabf063f2bbfd7
MD5 f466c62d265749679b9f27c605bfb275
SHA1 556f6a97015efb0d51780a947429bf62feae621e
SHA512 8c5fa4e0af1f7ee8794dc3ee43321c2c47ae6e32f6a7cba102012c0668d93285c9024cae32da41e4b7a6e5c698f00935f936c8bb82b210c79cd8d9969aade483
SSDEEP 768:Pr8FwJ2kfmG7rCq0GJtSBVRF0UGuEuOZejwpiUCTVwiY/AItRF4N2lA0AItRF4No:PVJ3fd7rCqduSduOZnIVVwv/4wlF4wlj
TLSH
T1C913F17A74022DB53F902F6098AAF0CD0F99B9431DD394E9EE0DC3068254EAE58B536D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 ed27d93a35988b75bb31b8cc32ecb8c2a34fb3d6dfce7dd7e8e49bce06a97644
MD5 bbd1846db3880e96e642a411d5e720b5
SHA1 77ab393d98fff73ccf15bf20f711b5b915ab5aee
SHA512 9f768aadfe3e268b4ce8086aa3eae9b1b0984ab05972c0a1565356aa2542a8ea5d5d046e8d38048e9d039084f4634a5478c80024e7f8e5c2a88744c4439e1f60
SSDEEP 384:HXkRyiO024YCDL84KKDL849B7SOEAd9KVRaAcP+AWRMAy:3mZYCDL8lKDL8CB7S/AmVAf+hRMX
TLSH
T127728E3D4F003CAC25A7C0E8C5B992AA4D18B7A7DFE680AD21583D0DC79896DB5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9FBFE753E1DC81147D0B20343E2D604D4E3CE767

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\9FBFE753E1DC81147D0B20343E2D604D4E3CE767
Size 15KB
SHA256 accc58c1b5233fab3a9360e5d14e122520a4ddf2d84bc8c51d100832283a221b
MD5 941e8f571d1ba2c7c5967defdd501dde
SHA1 6d9c2a189e7e00cea049d4e71c7a776235fd7a3c
SHA512 d0bd69af918aa8564b7502d0242ee79aa21f089d87b0f6b908a1b274977d6df600548c426cc24c0b80033e9f571085ac71ea573d82129156ce60acf0a4388b3c
SSDEEP 384:i0W1ZL2E/faTpru6DkACNPXddlQt7KDGpohq:iL1/HSu6DtCBX7C7K4ohq
TLSH
T10562C076CD12361A5B98D4C3CCBE4BC80E50A087DAB6C4F8DF1C3548C8997B55D7299D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\BCE77F27AF7DB788AE98BB53D806DDBEAF80E5E1
Size 23KB
SHA256 1cd6846b87c31a3a18658de83593b5fbb90f142a25897ff1f03769293ba5b833
MD5 3e0d043a35df807622d192ff5994d62a
SHA1 eb2607dda8f83fbccd82191c74f6cbadcf326035
SHA512 1f7cdb2d68a5a9ba33d288256a835d0bb3bd2e93b5694960b4db25f6976552fcdd4446cb4cee505c1795852eb57fdf8d3ae46c698293ddaec5c7d9048a52cf4d
SSDEEP 384:kjbMegNp7L7KCopFDUtCZvjU73zqFiubs8WpR8WMaGUzHODWoh1B9M0lpDIIMjoa:kjUp37K7D4CZvja3+Fk8WpR8WMaGUzHD
TLSH
T118B2BF7B5C634464CD9600F2A9BD74869D6EAB670EE46A1E6F0C3805C844BF4A7E0ECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
Size 10KB
SHA256 a52da8b4d2663a835147e9bf39304e772bc0fb9c9c8fc68509ddfde17ba3f12e
MD5 c613c196f767688a36474e1908b37c4a
SHA1 b4ff0d259e7ad6fc46caf7ce1a888d0512ce98a2
SHA512 0d5e28788748406c56632654814110697c6b79ca8cfc0d1a1b07c6ee691c470ed6134389cf63c4f54649e29e6b49b95050e19366ee0453161cba89c6d905b3dc
SSDEEP 24:ieUuhMZzjg3916H1zUtm9x+01zmtT9BSF1zbh5q9F55A5rF1zLAeC9l4F1zJE9V4:iDIqUGzokzI56bLAXKwBoB93
TLSH
T1732254F76BB2A873F0528FF08459758C9D370736196C9594CB4480F306D2AA9A17EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\AlternateServices.bin
Size 16KB
SHA256 4450f2ed8df5cd47ea877eeaf01256076ffbb8dab5c4be30ffa8e2ee1efde288
MD5 5d2563f1ce6c95f42edb341b7b792357
SHA1 e5d523699387e049f0a10be186aeb134180467c4
SHA512 be4918f29c6fd1cc89b11631cdf40b8c8dfcf5b20004cee290563c347daebb2eb77717dafd6e22995f1e15e5b6f2d738513e218008310dfe678ef83e33e8cc1e
SSDEEP 96:GzCGgA9GI56qr7jBZJ5MWQ+yzKqR2Mgfs4:5/WFJqQMgf
TLSH
T14B72B5F777B3A532F4618FF084A8758C9D3702361C6985948B04C0E706D2AA5A16EBEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 93KB
SHA256 3962f12f44e33997e8d359a8da2b3c4936fc0f2564d5062b75d61b40f4963f3c
MD5 20b346a5ca03e5fc1e8c611bebb67b01
SHA1 6415f28a32f44dc54b18cc750b06e09dc12e6b84
SHA512 c9b74854efdaa244921d0bd452de5fd5e49246410256297d325d475a7ab3234b4bfcfe2fffce82155c728194b7fcd0161f99396b73d731e5383feae5c4f1fbbc
SSDEEP 1536:sIXUqLbJSFntomNpoNWtPcYuft546uPaAM+I18a3m03jo4zNxmQiyF9vIFs:7XBvspfjoa0XtetXsWk5jo4zNxmQiyFb
TLSH
T155931084DB1A403BE82442BBB8D617283B35F4554B5A6B1B366C04752DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 93KB
SHA256 b4865eeb99a52a64549829082fe9d685d0cafc128f51d596a45139b8c4d9b17a
MD5 809631d52396facd89907da73c9e65fb
SHA1 087f824387ddcb1c6b63d82b08bb80c7e631200c
SHA512 a6f7e9e86af0eac161b359ec1970ff5da8becd9ebd9d91745c11bfd63efa4afb39d34c3a335ba68527606baa057dabe96877d01eee89c68f5fcc8890c876e290
SSDEEP 1536:hIXUqLbJSFntomNpoNWtPcYuft546uPaAM+I18a3m03jo4zNxmQiyF9vIFj:SXBvspfjoa0XtetXsWk5jo4zNxmQiyF6
TLSH
T1BC931084DB1A403BE82442BBB8D617283B35F4554B5A6B1B366C04752DCB3FF2D4E62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6c78bf38b271e25ee3720b0af5fd12adef270f67f032976285f886704b4fa41a
MD5 77e3f6dd2e9ccc1d2bf247759c6689f6
SHA1 c8b2d6e67341c28b43a1fa85efa23aa478bbdcfe
SHA512 42cb2832b9b9cfef0d626d017ac3539e6b32c9dac83fd79d6f6cd1f60bf7c4c43a19f3ff927ef7faf50c7ba4933a706ba5ded81fc7be8ec9d6e7a516a4e1001c
SSDEEP 192:H1/66JozGzgCl6mc0dKOv5zboP4bWyjOQ:V/66JozGzgC1jHboQbWyj
TLSH
T192E10E64E628867FC404037BDCA61F814F3A389A984E7F1935DC644C2C572DE7A9D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 86ea0564559a310770586f452fcc3578ad723df938e3f4496f22875c58ff05e4
MD5 2d77afe9231a64e7c85b0cc03a9a3b90
SHA1 58301a4d8976a1ea4d4ebea24867850eac270af2
SHA512 d9ff8a071567c68ea95e5b2bd54649bca1d9afbaf4a2fab1a348de6d3f852f8b8ab5a44a4363deda8374da95cd5fd7231fd8cc7725129bdef2f2bab806043ea6
SSDEEP 192:1D1d66JozGzgCl6mc0dNOv5zboPeZbWyjO+o:Dd66JozGzgC1jsboGZbWyjS
TLSH
T12DE12F68E629867FC404037BDCA61F814F39389A984E7F1935DC640C2D572DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 cd382dbc89b0154074a45d5765339f0c260f61a41669f95c9c6944db0db03764
MD5 042900b7d4666a12e7ca565cbf88e543
SHA1 9ca3c6c4216666dbb648d905acb91775a8e40cfb
SHA512 7fc24fcb912a6578cdc61c001b4577c00e94b4deaad69ab9c9bc97043a2131ceb6a67322adeedb576d72c1b27ca30ed5c476021b5699200e748183be11e83de4
SSDEEP 192:1D1d66JozGzgCl6mc0dPOv5zboPebbWyjO+W:Dd66JozGzgC1jSboGbbWyj0
TLSH
T127E12EA4E628867FD404037BDCA61F814F3A349B984E7F1935DC64082D5B2DE7A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0b765f6d412ad6f3905627c21458d8485f7bb58c6b5c6bc040a176848f9e3c54
MD5 f4bb1320f05d6403be5a0a38843cfee6
SHA1 cd14b7f95b5cb74d449fa97496fe8d2495b739af
SHA512 443e5d6aac1083453ef06687e26a3761bd87e7e301b62c10fafdfce8719f76e2fbc57c4e5f8a7d9213df7e0350add857ea07be0b9c820b5d8270e4550f40f31e
SSDEEP 192:1D1d66JozGzgCl6mc0dxOv5zboPeMbWyjO+o:Dd66JozGzgC1jIboGMbWyjS
TLSH
T1C5E12F64E629867FC404037BDCA61F814F35389B984E7F1935DC64082D5B2DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4083a1d8a962e4fe278dd1d22956c3e71affd0e1273c952451bd238dad062683
MD5 04bd065b94c0257a4844cd689d8600fe
SHA1 a88e6e8975f24aea3cc5e45225bc39db602b798a
SHA512 0f734b6b7674d6e48548843e0f80814a6090962b94d61f8a6797b34dc5f84ecf869b462b38c6ef7f3698eeade0b5e77ef00600dd477cfe639381d071421630a9
SSDEEP 192:1D1d66JozGzgCl6mc0dvOv5zbojbbWyjO+S:Dd66JozGzgC1j2bojbbWyjo
TLSH
T125E12E64EA288A7FC404137BCCA61F814F3A349B9C4E7F1935CC64082C5B69E7A8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 102b0f519dc704bc1ad51338682aec5e4b7b6612df1953328c4e9d74dbe824c4
MD5 a47fe1445d493b8fff4eeca6dcb0bec7
SHA1 5849627d4b7da25a716e143d9a4ef3bfaa54ca37
SHA512 c355d4f9e53b6f6952d88e6d207382428924d9fded8a48f2f213dc17703810930bcd4a3e54099878a4c1e6d273a478153c0add88f018fb6bc6ceb11d1a63f4bb
TLSH
T14F21286C39B98D2B99CBE2DC7541038E53558A4B0C871D474E42EE8DCE81AD932AA879
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
Size 4KB
SHA256 a7b23e3b970d7d254301001b136fcaa5fdf87d9ba1c4a6bbbfdb768707fcfd61
MD5 d18a34f8f2d012a8e33b188fe90f65df
SHA1 a83cc21c835ce9d3fdf10946362a95f5519cfb5f
SHA512 45e0a71854c582bade624aef620ada76c9bf7c8b8455c6aa7cd616e97a42bec02aec2f4dcf4fd3564fdbf8b356a60fc10921aca965a073a67222a3146251e4fd
SSDEEP 48:Ysb/bYA2/c3tWDRU5Ti/SsesZNPddpE0AzcCq+Y64a6zNiHicvUEi/s5TZrY9bss:7f5OdeY64hcF5sbspthkSE5T
TLSH
T11FA10F2C75AA4C7F69DBD2D9B881038D82DD4B0388CB1D434DCBEE4DCD86A99325F528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bf02e52-c5c2-40ea-80e0-0e2baed0d594

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\2bf02e52-c5c2-40ea-80e0-0e2baed0d594
Size 15KB
SHA256 668ac742b3f4b93629e3e2e02534e7e06868e7292d9051d96ac2954e397a2734
MD5 d5d01864851367753c7ab5a7ba8e5d55
SHA1 af3eb042aedfdaef608dc2983e86d9d126e1e34c
SHA512 0dc9dd7b2fe71500d8827d008b9f455946f3d306ee6c2942e7f4e93cdeb9ab93bf8e2326df8cce40fa79349af455aadefca5d787e9248c9b807120c3631ace03
SSDEEP 384:e7aNZ+gkOXlmCWuPXwIx0Ul5BeRcSTY8/LW:JXlsu4/TYgW
TLSH
T16072C9566830497A8691E36894FC7FC3E5F528CF4C419FCA9BE4BD086DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36ff6643-6093-4c6a-9ac4-1d8062d1b4f8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\36ff6643-6093-4c6a-9ac4-1d8062d1b4f8
Size 886B
SHA256 8471bc04bcb3a4c512a84e0279529616497b08eebc8384bb05c319a25a835113
MD5 e74fa55bd977288a8382441206174874
SHA1 c8a51cc6fbf64a7725b9c6643b82548efe12de10
SHA512 5d106eda6b34dc2607598fee947d29397e54ae7f829876ebdc848d1e914387d5e7340ba1219f4e6e6302a58bfd6c8e62e17dd3bf65f85bebbdbb9c8094674b7a
TLSH
T1A7110441D97579F1CC68938BA4A6779347A4742380CB58143F915A180CBBA1D6766707
MD5 SHA1 SHA512 TLSH

Submit Download

8dacabbf-f7cb-4503-aa49-457746227abf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\8dacabbf-f7cb-4503-aa49-457746227abf
Size 235B
SHA256 892f2ad5f4da882e945a55daca68875eb1b68295c38a33ebf2c6fcd9cb3565bc
MD5 3bf68abb732f88de1558d2296932b4eb
SHA1 c8ee4c956c78ed30486852091c74570139f99b0b
SHA512 9ae87b4017860cb16a04ecdb872a8c3d09e737f5f5395f7838f285e9e22c83217ab4c56297a45f516d85c064b01a9cb12d75bf8fa1c9f8c3509c64e22f831a11
TLSH
T192D0A7C46898776D08144F56B0A06AC678A84C3354B4A810A56186B599FEEDA426281B
MD5 SHA1 SHA512 TLSH

Submit Download

b50e626b-868d-4de4-8830-363b4c50f951

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\b50e626b-868d-4de4-8830-363b4c50f951
Size 235B
SHA256 f3510d7134317a3e2ed86aa4aa1f00383d3517160cac9f5cc995f7522c9201c7
MD5 a10579ede6e7a54a79c4bec99be1423f
SHA1 dedb568e416134156a605c3059864d8b2dbd313c
SHA512 4e443129540cffaa5031bae68d8223bd0610f4441e756c4875dc3ea151f3e0fcf00746b3d0c85917e3aa5a8c431d19aa5c84fd6ed187a6d0e1b972fd2513e25a
TLSH
T121D097A128A877AD08140F0BF0A038C2318A4C3310B05824C59080388ABEBC44221A16
MD5 SHA1 SHA512 TLSH

Submit Download

f5559ef3-6d60-49c4-86b5-b29b96248ec3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\f5559ef3-6d60-49c4-86b5-b29b96248ec3
Size 2KB
SHA256 7200adf97f8a144c5a290bebb335c81829ef17575ad7a13a752b0ed695fe9308
MD5 db460d3a8869fc8a34a8106f98815792
SHA1 cb505b07e7bd7636be26c27a3ba56abae45b3b23
SHA512 dbfa7e021a6657e9dc9822a80499ce664885f6b53cc513d8a0d2235128c20edd57c1501e23eb1066b2893dfa29513a21e05d4deff651dc2e413c6ca200ac4eaa
TLSH
T1A241235C757C9DB79CD6E68DD442238E57A0890310C61CC32E91DF4C8C9A65D336E57B
MD5 SHA1 SHA512 TLSH

Submit Download

fffbaf9b-56c0-46e5-95fa-cf22cbf4dc6e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\fffbaf9b-56c0-46e5-95fa-cf22cbf4dc6e
Size 883B
SHA256 fd00d0f877591f05ffbc9f8857344e0bb8640c3cc4a400e846c9dd54e9a0c6c3
MD5 71855a5576702c64bd9059a5ca6be778
SHA1 2727bbb99a3038630255906eab621eb0ce9cecea
SHA512 60f1db780f10ae532b89aee64717eae14e121634cc46649f14c520b1c1d0f11e3dfd11b30a5d49d3e52890800b9cacdd1356c16f3c8a9758fa8aefee6da71293
TLSH
T1B1110081A6357AF2CCA8938FC5623B529BF4A513C0C654143EA149140C7EA2EAB6634B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
Size 16KB
SHA256 6d7b0c1146e35c742e01602489539c9d5f82b13ee2bd22dd4629fcaccd9adb34
MD5 34c78de861576ff3c15d9d7425558b98
SHA1 84ce34cfdca8026b1b9798898f7dcc67494c0ab1
SHA512 91d16cc0f9a5f327f21a4fd7715c6bab13f97abd0d6ba8b5233dfcfd06c373269d5df62f2e806087cdc13f09f55b95b666c9673a7341f908ad4f79bd2f3e7f6b
SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4HCE4h/:nI4qRf/0Xen4K6W454d4P4j4v41
TLSH
T13972531545448EB8294FA79BAA367E02C37D433B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 7KB
SHA256 64800a98adb6b1e88333fa308960f71eee2fad05864a921a991b0d367404674d
MD5 1397767823a7b6347ee652b5cad76162
SHA1 5d49bd78947f7c7c2b3f0440c58f9c27f33c2fb8
SHA512 9e69534315b4fc9c2f3ece213a42b252d7eaf18361d2c986c44873e2779bbade26da8996842591eea1ca7b7ecbdc958403ee70d55375af584a1632a241588969
SSDEEP 96:xHHVTUZfvqGqqkfPEuNbzSiSSSlDdv9j+nnLHH4/3MBw88oY8L4cn/MVnPGS:9FRFfPEuHSSSYzH4/3MBw88BT
TLSH
T132F1FD786108CF7F64B276ACAC2849315AB2023BBBBF68D715B954C4055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 7KB
SHA256 53c80ff7a9f67d7c21b9d115e6322e411cb534984f27eeabc1a814f9797427c3
MD5 c889a60d16fc1a4cd4ad484c11d5a8fe
SHA1 beed1db173862fd3a56368baabc2ee361a1aa05c
SHA512 bcad6e42751755a5ce91642a70eccf4770edf896ec82208b2601687626b8caadf2cd1d09f2c9b55b19ab99e9f728e43f09cf9900f119984d7ebf1dc0b13e62d7
SSDEEP 96:xHHVTUZfvqGqqkf+EuNbzSiSSSlDdv9j+nnLHH4/39Bw88i8L4cn/MVzPGS:9FRFf+EuHSSSYzH4/39Bw88eH
TLSH
T1CCF10D785108CF7F64B277ACAC2849315AB2013BBBBF68D650BA54C4055CF3845FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
Size 6KB
SHA256 c61dea8019090af3ea5cee6938414c58e56b998749738c83472c464e076e4660
MD5 94d363bff8db7df503fc360233ed02d6
SHA1 1b3dfc9b39f3f3c797b7dbd2dd34225a9e0b21dc
SHA512 cec2858c0a167dfac2d8e777dd1b2d514cf33f9f6de8c55c9ff4ea19de6b8ec5de8c9cd961b132620edbf9a1ca873fbf61528fc356b2b174e6887f27f89037aa
SSDEEP 96:xHHUTUZfvqGqqkf+Eu1zSiSSSlDdv9j+nnLHH4/39Bw88n8L4cn/MVzPGS:9QRFf+EuzSSSYzH4/39Bw889H
TLSH
T162E12D7890088F7F64B677ACAC288D316AB2013BBBBF28D750B65484050CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 380d1a2d205f6e004ff7f17e696edf7212d9aead5d8a93be8b4c4a92c3f22632
MD5 cfbfa22c7337a74ac3c828ee796a5f99
SHA1 1876935742a059e3cc791004b0d9117801cb7881
SHA512 7817d87067ce153dbd919814025101ec9dc8a91eab45d61c04642e9b718892b6677233b3a85692f6ddb5c7a149844cb443750e64f92fa4933b3f7c8b361d6aef
SSDEEP 96:xHHUTUZfvqGqqkf+v51zS7NSSlDdv9jXnLHH4/39Bw88n8L4cn/MVzW:9QRFf+v5iNSShH4/39Bw889g
TLSH
T178E13F7891088F7F64B677ACAC688D716AB2013BB7BF28D310B55484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 7KB
SHA256 eb37f7d7ccd74535513a7f6849536a6ea73d97f3de8f78a871cf2c239e79c8d3
MD5 b16cd44a44650e0888de4b49392dc1fb
SHA1 97a8fb304f3362002d5458013932befefa0e9f56
SHA512 3d8c21a623ab3682437d5ab3ae867020bd75beaf7bf1db2d297613bd950f7ec446af280fb3ab33da47a385ec97c7d67c19585bbef59e644ac92a3164935230a3
SSDEEP 96:xHHUTUZfvqGqqkf+EuNbzSiSSSlDdv9j+nnLHH4/39Bw88n8L4cn/MVzPGS:9QRFf+EuHSSSYzH4/39Bw889H
TLSH
T1B5E13F7891088F7F64B277ACAC688D316AB2013B7BBF28D750B55484050CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
Size 6KB
SHA256 6e8ac889f0adf8937e3f93807e40bd185bc24cba28d22bcbd7b5c9821cdc8df7
MD5 d915041e2422b1265a5cdd39e487f88c
SHA1 f97517c3e4438f2fef6d11e64a3f4871b2afcb6b
SHA512 e79bcd416412837c6b349fa5d419c641a1db2c7a222c9db7e1741ab11d5c6af069ec51ec9bb537f6c75830b52f48c4bb6e7cc5036ce9c9fec7a59be6254d8d69
SSDEEP 96:xHHUTUZfvqGqqkf+EukzSiSSSlDdv9j+nnLHH4/39Bw88n8L4cn/MVzPGS:9QRFf+EusSSSYzH4/39Bw889H
TLSH
T17CE12E7891088F7F64B677ACAC688D316AB2013BBBBF28D750B65484050CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 e3a9dc9e83920663872be4f7b098ae09655c28f41645110f19c7b79f41286e4a
MD5 3ecdd8e91bd2ee9d2304055a23e76026
SHA1 21ea6361daff85c8924056190ce2e97cbd016d8c
SHA512 d87000ff49fe3c1becdc5e53c75e30d4b5be880012a7c6fa320d6928b0ada961b1eb4c9a020ddb7476b8db05f329738a29245a18dd790d610d4d1e6c2bb90ce2
TLSH
T1E0515C7B1C1B6CFB34A1C1D6B8DB0FD18B61242044A99079BE95BC5102EC20EA695F6F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 8c02d4bd0c90113d23d3d945206544d2b5b6033ac82f67cbfa75f42eb4c90c82
MD5 f4344c3f606436c31c589c64ec7f80aa
SHA1 b380cf8dc5dad82c8227994a4e29fbe69d9f72d5
SHA512 dd1cdd79664a7522b33b0a4cfb47d9794eea08734b4fdebe39caed2bb0f8cc96e30f053357d4ae89deed19bef154ced49835b5d154bb66dc652147fcc0e390de
TLSH
T19A412A9EE838369623D074D384C43F2806851083D7F603C48F141923415CE1AFADDF56
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 c14dd92409d7e8f4a6af96713e0bc8ba1677a17d9534253f4f54815138a3f389
MD5 7d825d9097c9cc682ea35c8251448f16
SHA1 0ae3504a3b2ca1c811336401651b36bc0db6aca1
SHA512 13482eb07ee9c157fac8c698c04183f4d5e596a1f4baecbd32bdc87768ea2cf8af4ffcd7861ea97957c39552edef204ef326c5dd4403316dd8b8c2273c8f8ee0
SSDEEP 49152:CLqLyiaeU06QC5zYY62HJgmJy6HZzuMyCypq73jVEgotkWaU7RbSNqq2JQKRQ0nC:9naU7RbhnQKRQlHFvey
TLSH
T178665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 816ee3fdafd1370dcd75fd8eeb2a392eb5f5d3aa516c0c33a01345b4b6720007
MD5 bc3733329bb46a945745126c6be69087
SHA1 9040c3cf9983228d74a19351d209b5ff206a6965
SHA512 421fe84e893cd94eb7da9f5c99dccb1f30d441e00ef5e33668ace68aa8459bf770616cf2df33a667b590d1b6f849ba8a32a10fc1a3fe702f26fffb33efe762a8
SSDEEP 49152:CLqLyiaeU06QC5zYY62HJgmJy6HZzuMyCypq73jVEgotkWaU7RbSNqq2JQKRQ0n8:9naU7RbhnQKRQlHFves
TLSH
T13A665CE420E29252F38140B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 1a7490da36daade6b8a3290eba3047d41b474db0c0cb98d542f540c782a55020
MD5 e96e51c821283b55ae459531a51aaaa6
SHA1 222068b44d08f6fababf4dc6d26cb481e20b700a
SHA512 ef580422d0e71a1fe12da61f901e673427ba535fc84f78ae5c7555e75d49fa1155dfff7477d539833ed1046c190f39fcbb91fd1f88c2b7c293d10d6f5874d04c
SSDEEP 49152:H7snfsJyaP6ryMtp6d5C9S8rRz3UghkR0bPGYRpq0:bqfsMaP6ryMtp62Rz3Ughk8q0
TLSH
T14F1639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 d9ea73c599c91d3a6968b8aede360cecfd59e0a3518c07dae97f63762f682f27
MD5 ab216d6ca3c06eee4b71a6aa37e97175
SHA1 8633a28745b8535c5be6c94a3f8a05f0cde0ceb3
SHA512 bb63a29f53686c6a657662c72d37e7de4725222f8c9f66d69f3fe274dad19737f54dcff8ba3aab88be679871d66062d1cb845140d3fb672d2bc78496135c7174
SSDEEP 49152:P7xufsJyaP6ryMtPHd1C9S8rRz3UghkR0bPGYRpqSc:jofsMaP6ryMtPHSRz3Ughk8qh
TLSH
T149262AF820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-2-0x0000022868740000-0x00000228689B0000-memory.dmp

Download

memory/976-13-0x0000022868740000-0x00000228689B0000-memory.dmp

Download

memory/976-12-0x0000022866F60000-0x0000022866F61000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads