b3ff005a689d3c723b1ed6a5f79891d8c2e03549ff8889c765c097a200fdf83d

Analysis

user interaction
yes
max time kernel
209s
max time network
210s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UABEANext4.Desktop.exe
Size 180KB
Sample260823-gvmvfaen31
SHA256 b3ff005a689d3c723b1ed6a5f79891d8c2e03549ff8889c765c097a200fdf83d
MD5 e3f3d7b7430caf9aa72a8a1ed5fd2df9
SHA1 20edf97cda2d289b8e4155b4b5919ff56f2680c1
SHA512 38e5379140207a36a785b6be52a33485dfdb2334ef0fe0dc59ea8f1292a8baa15efd997896d17f22217d2bc495fcf02248d1a11e236235fd09d740a4b47197bb
SSDEEP 3072:JqeXA/4yIg9vkNPNu6H6xCYOihUE2653JbqxmxSfxf:JvgvkNFNaxmpEXJbAfx
TLSH
T1D6042B03B2B58069E1729538CDDA48E2FB723D1D8B6066CF33567A750EF6A905E39309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
108	api.ipify.org
112	api.ipify.org

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\UABEANext Modified By Rayvo Cracked by Rix.rar:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe
Token: SeDebugPrivilege	4880	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4816	UABEANext4.Desktop.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe
4880	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4880	2940	firefox.exe	89
PID 2940 wrote to memory of 4880	2940	firefox.exe	89
PID 4880 wrote to memory of 4228	4880	firefox.exe	90
PID 4880 wrote to memory of 4228	4880	firefox.exe	90
PID 4880 wrote to memory of 4228	4880	firefox.exe	90
PID 4880 wrote to memory of 4272	4880	firefox.exe	91
PID 4880 wrote to memory of 4272	4880	firefox.exe	91
PID 4880 wrote to memory of 4272	4880	firefox.exe	91
PID 4880 wrote to memory of 4272	4880	firefox.exe	91
PID 4880 wrote to memory of 2196	4880	firefox.exe	92
PID 4880 wrote to memory of 2196	4880	firefox.exe	92
PID 4880 wrote to memory of 2196	4880	firefox.exe	92
PID 4880 wrote to memory of 2196	4880	firefox.exe	92
PID 4880 wrote to memory of 4888	4880	firefox.exe	93
PID 4880 wrote to memory of 4888	4880	firefox.exe	93
PID 4880 wrote to memory of 4888	4880	firefox.exe	93
PID 4880 wrote to memory of 1088	4880	firefox.exe	94
PID 4880 wrote to memory of 1088	4880	firefox.exe	94
PID 4880 wrote to memory of 1088	4880	firefox.exe	94
PID 4880 wrote to memory of 1088	4880	firefox.exe	94
PID 4880 wrote to memory of 2200	4880	firefox.exe	95
PID 4880 wrote to memory of 2200	4880	firefox.exe	95
PID 4880 wrote to memory of 2200	4880	firefox.exe	95
PID 4880 wrote to memory of 2200	4880	firefox.exe	95
PID 4880 wrote to memory of 1860	4880	firefox.exe	96
PID 4880 wrote to memory of 1860	4880	firefox.exe	96
PID 4880 wrote to memory of 1860	4880	firefox.exe	96
PID 4880 wrote to memory of 1860	4880	firefox.exe	96
PID 4880 wrote to memory of 4056	4880	firefox.exe	97
PID 4880 wrote to memory of 4056	4880	firefox.exe	97
PID 4880 wrote to memory of 4056	4880	firefox.exe	97
PID 4880 wrote to memory of 4056	4880	firefox.exe	97
PID 4880 wrote to memory of 5920	4880	firefox.exe	98
PID 4880 wrote to memory of 5920	4880	firefox.exe	98
PID 4880 wrote to memory of 5920	4880	firefox.exe	98
PID 4880 wrote to memory of 5920	4880	firefox.exe	98
PID 4880 wrote to memory of 1340	4880	firefox.exe	99
PID 4880 wrote to memory of 1340	4880	firefox.exe	99
PID 4880 wrote to memory of 1340	4880	firefox.exe	99
PID 4880 wrote to memory of 1340	4880	firefox.exe	99
PID 4880 wrote to memory of 3224	4880	firefox.exe	101
PID 4880 wrote to memory of 3224	4880	firefox.exe	101
PID 4880 wrote to memory of 3224	4880	firefox.exe	101
PID 4880 wrote to memory of 3224	4880	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\UABEANext4.Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\UABEANext4.Desktop.exe"
1⤵
PID:1124

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {2903a96f-188c-4ac8-aa9c-eff6f12901a8} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {3600a804-a7d0-4496-9a23-bf4d7f49b26e} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27274 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {e1316935-2445-4ddc-b3f4-8d1b58cee533} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4016 -prefsLen 27274 -prefMapHandle 4020 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {09129ade-34fe-40f8-9eae-3e6e0658139b} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4472 -prefsLen 34773 -prefMapHandle 4476 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4488 -initialChannelId {404e704d-76eb-4013-b889-c98b23c99166} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5064 -prefsLen 35010 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 1640 -initialChannelId {04944de8-79da-4d5b-91f8-8739e8b47370} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 5484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {c98bee94-970b-4675-81e6-1d68091e6762} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {b8a685eb-7c0f-4cc9-abdd-0e7330992088} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5816 -prefsLen 32952 -prefMapHandle 5820 -prefMapSize 270279 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5832 -initialChannelId {78bd5393-8781-4feb-ab28-e14f6bba2ea6} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6412 -prefsLen 33071 -prefMapHandle 6416 -prefMapSize 270279 -jsInitHandle 6420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6424 -initialChannelId {afcce4c6-9286-428b-bcc4-558ae75363f3} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6724 -prefsLen 37141 -prefMapHandle 6924 -prefMapSize 270279 -jsInitHandle 6780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6944 -initialChannelId {629d3cbb-3ae3-48fa-abf6-082c984e64ac} -parentPid 4880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4328

C:\Users\Admin\Downloads\UABEANext Modified By Rayvo Cracked by Rix\UABEANext Modified By Rayvo Cracked by Rix\net8.0\UABEANext4.Desktop.exe
"C:\Users\Admin\Downloads\UABEANext Modified By Rayvo Cracked by Rix\UABEANext Modified By Rayvo Cracked by Rix\net8.0\UABEANext4.Desktop.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4816

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\UABEANext Modified By Rayvo Cracked by Rix\UABEANext Modified By Rayvo Cracked by Rix\READ ME.txt
1⤵
- Modifies registry class
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1DCC11C0F915E3D314E5564FD7DC2D5610C77E51

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\1DCC11C0F915E3D314E5564FD7DC2D5610C77E51
Size 188KB
SHA256 4ff496c176e7aa8919959f25a9b6ac2d600a95ba6723ad4f7ba7bfdeb4e8b9f8
MD5 67da5baa1921ceeb9561612dfb5418f8
SHA1 01dd0f8f10f34a73efa78c4d080d4318d13f12c4
SHA512 e82874058149c7eed18bd378b0a4fc1894d24c6c8e778e932947f4c7979ce0c4890d5277f569af9fd5aeb3fad803121d49359c55def6c62364d2ec5abc8f8567
SSDEEP 3072:NmPIResqG1SFptEGW71o7NxWfAqXrpycgZRoTsDny91qdHk56fWlDhkaoyQv:sDsqG1KaGI1QN4XrvgZgnqNQQW1Q
TLSH
T1B8141263AEB420820CD59BFEDAED2C965CF1DC537EDA63067444294D8A953F22C071AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 2361acb50a78f76a780fcb3c6e3b463667428c9481349e52c9a9f969ab95a9e2
MD5 7142d5df9622c9cd907caf6dab3baf6c
SHA1 0ebef5cc38a3809e75044311c07f446a92ee13d3
SHA512 2eabcb7586ac5671d7c21c7944f7ed8ea35a806cd9dc39bff851837f0010355c48821d059f9d556db0b5458c5984e8d9dd929edf950a116bb9d09f34fc039ab3
SSDEEP 384:HXkRyiO024Y1+DL84KKDL849B7SOEAd9KVRaAcP+AWRMAxOLO7:3mZY1+DL8lKDL8CB7S/AmVAf+hRMqOLA
TLSH
T137727E3D4F003CAC25A7C0ECC5E592A98D18B7A7DEE680AD21583D0DCB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
Size 8KB
SHA256 b2241b45d6ed78b294a02ee660aa26b60200a9cbbb8739074fe539ef3e165418
MD5 14207c06c8f35e58540acb2cd4cd6a1e
SHA1 26e3c78de645e5882f35778d7b93a61aa3dea373
SHA512 cf4f11a40b38889439e968d952988613f70a2ed9f2816b65b862c01b8c2f4a3750648d5a20551174aa273029a28a84c9c80a29cca0b004e62871d22feba546c6
SSDEEP 24:RuhMZZi91Z69xqD9BYit9VviiO5q9F55A5EI9la:uzYoxeinBiikI56EC8
TLSH
T1D40245E75BB6A473F092CFB55099B14C9C73032519699584CA44D0F306C1BEA917FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b5554a83f9602053acfde2aafb9e23915ab4bcba7e512a911694880718d01b38
MD5 f9d48fae35c5a85bc0f34eb389f5dfff
SHA1 abe6e8876b88debc1d5ee6169716d6ac47f876d0
SHA512 03ad3cb3a6f952208bfe21776c4ab03e8a7ff9e65e0a3372cb11dc36f23fb14cd84592c980d431d3d1f9ef5745dead9f3a6c37a4b855d30383da23d38607a9da
SSDEEP 192:BOv5zbo7lZJnyjLMPHv1d66JoztdzgCl6mc0dz:ebohZJnyjmd66Joz/zgC1jd
TLSH
T15EE11E64EA39863FC408027BDCA61B814F39398BD84E3F1535DD650C2D5A2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 86d2e523676e578c010220afe7cf6d97ad7c5b7fd157716206a53f81b7977585
MD5 9a4108d760b31fbd2c355dad01791dcf
SHA1 d2afe51bc998daa25abd3641dd6514d7b436dcef
SHA512 d1611b544050459f76995a504081dc7ce599fbf20b6a654036b86ac69295a9260cf4d409ffc716924020a590a414cbd640f52a8940d42fc9c2901ad3ccd4facb
TLSH
T178214C9C39F84D6ABC8BE29D7481018E53658E0705875C430D12FF8ECE91BDA326A879
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 4KB
SHA256 7042885c80a6b1d5596f8f80ae6a36bd8b253264102bd4fdd023b8bbb370e551
MD5 07655ddc19a8902728bd68800fbb194c
SHA1 c27e0815587aa6ba84e218015433f5c8d5f7e398
SHA512 78d7740c140926971cb397101cba6ca1a23169e0e43bbddeeb260278a84890d4598d7c2549df34b01bc0abfef3291eb9c9267b1ccc5150d20bc989d64b23f4bf
SSDEEP 48:YpZMbYA9sdCbJGORsl0dai/Q+T2PUYInpsiUGfKZYEtF4WnVlSXCkBHz0G9iCmd1:SC0cds+qIAYi4x3BHP9pV22+2sy6J
TLSH
T1FEA1F05C65BA4CBF7DCBD39DB842028D8298470395C62C434CDBFE4A8E86799325F46D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a33eead-9e45-443d-a622-5edbcf7678d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\0a33eead-9e45-443d-a622-5edbcf7678d0
Size 235B
SHA256 c750b0cf551b2caf0e6416b3a1545414bab55bed496f6a4acd6406fe56df236b
MD5 83e493a4a480e03bf32f8bea2041f453
SHA1 e1d5af62a3880680c961b5371ea0a6fe3a0d688b
SHA512 2ea708d50351936272647f991b46aa18b2899a8d6919492e1907394ed0216826c2a1a517c9bb3aa3a575406221b879215916448296c0ebe2aa0e4a62f6a58256
TLSH
T16BD0978028A86B1D08080F03B0E028C231498C37A86D5820CE9005788AF9EC44252C16
MD5 SHA1 SHA512 TLSH

Submit Download

a3a0a329-244d-4390-b937-97662bcfdca2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a3a0a329-244d-4390-b937-97662bcfdca2
Size 883B
SHA256 34ef206f04df956a9d6c1c633b8665eff3295b702935bc6923c37f75726b9863
MD5 80d30a6a289d24c81d62c686fe938a8c
SHA1 5c12dadcb98701cb76310aa6de60b98781aacff8
SHA512 6e029c022bc303394b8e350ad3b5167a08dea851bc9fa9d8449098cb9be923b6612796727d31700a5ff1c7547e4f05d8d1c8a44eef115572f91c16f3d8e20124
TLSH
T1EA112380D6307572CC28838FC9A67702CFF8B513C0C645103DA19B180E7D65FA3A7647
MD5 SHA1 SHA512 TLSH

Submit Download

acd540ab-722c-4378-a9ce-61bd21fd71b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\acd540ab-722c-4378-a9ce-61bd21fd71b6
Size 886B
SHA256 08fb1b1d754b9909272effec101b0343f130fc6924315a84cc12365201e90100
MD5 f774433d70aed0f4f37b3287b27f5f57
SHA1 c5b14e979b3db7006ff00e26085e82d547f8e857
SHA512 9f30b7ea3eea8053fc3d248fc34ac4613b1d5466e5b1f0d5754eb192ab690b906466dea6fa145c55e7cc1049fe2050239bceef5e5d3e43b97538f79b0d9506c2
TLSH
T1A2110080CA757672CC6893ABD9E177838EE47513C0C71E147D945F084DBA64E97A7307
MD5 SHA1 SHA512 TLSH

Submit Download

b488989b-beb7-41f1-907c-d8fc810cc81c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\b488989b-beb7-41f1-907c-d8fc810cc81c
Size 2KB
SHA256 fc1be5856d3c7baa95e74a906250f75d4703d27cd4899b752d5b11daea50ae3c
MD5 8d1f95027a968d8055e0bd5c1200c762
SHA1 231e2360b508e2bce88daf8799cb1ee2cd7fbd5f
SHA512 c931a228aa7e3dacba99988032009b826a1e386a269b83102d2c46a244625ed5c9a6a2609e7a8355053a3bc52b64f51064cc6392d731ce5ca82bd3bed8518c8d
TLSH
T1E841215875785D768C9AE24DA49233CE97A19A0304822C833D51DF0CCE967DE37AB52B
MD5 SHA1 SHA512 TLSH

Submit Download

b49364fe-f827-455e-b8e7-e03318db7f8a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\b49364fe-f827-455e-b8e7-e03318db7f8a
Size 235B
SHA256 d87bffa5145b10a8226ccbc55e33ca2b83d39d62ef92a2cd3a6879458adc1bf5
MD5 a8b0fa2e9202b430fcb93ddb9cf91c9a
SHA1 2e3801bf3c769afce909dc856feeeb46a9cd85d2
SHA512 08778c59cb94a3d302436c72da686ca3d680d49de7ad44993d8f322645e0769f332455a82e01d593a6121e038cbd40f1fbd84b29055b4f1de8fd0df8cd650ebd
TLSH
T1CED097845498A72D08180F17F0F429C630A68C3360606C30EA6205748DBEAC8421280E
MD5 SHA1 SHA512 TLSH

Submit Download

bb60bd84-1835-4dae-91c6-dd438ba65deb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\bb60bd84-1835-4dae-91c6-dd438ba65deb
Size 16KB
SHA256 5bc9b1b8acc20352c091f859ac53233c09acef9d587940e4a429d13a58d897f1
MD5 259411d68fb8fa9bf9d240063f26d6af
SHA1 84fb7b98d012852acb06e62bf42eb11c557d8a6d
SHA512 f2d16736aedb2f1b907f121e6a1d1a526664d4d2340012de4d16a290e2992c1711fb4cf6c6b41f52bffefe2cb875dd4466a59c91dea70103065c12fce6243ad5
SSDEEP 192:3qhUOzx7iWKy+LSLL2xc61Eqcv0XiYjwyhn7haMTdYpNoVNJjeBUe1LdjkEGCw:3ZOl7iWKpLSLL2u61E+xYXoJeyirI
TLSH
T11572EB5668605ABE8651E3A8D4FC7FC3E6F528CF4C019FCA97E0BD0859DA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 3b43f9c76da68467f4c0682e135ee929a4a978f16ffa3d85c0b186047e336b91
MD5 f23a182498e8e8c9010516504170a22d
SHA1 e2479572bf62245c753ece821ef6e8918c977080
SHA512 e5f109500e2416a5a4fd85ebb4572c7cf03a83591194ffa9db89edea20851d64a16b2e427539f643867a06852f4728d900ada8da0584a59ca6fb699f59e7c61f
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4HuuB4h4K:NI4fRfsXH446+4V4Y4N4Q4RB4aK
TLSH
T1CB72531545048EB8298EA79BAA367E01C37D533B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 12KB
SHA256 d2fb3f84901d036f7da485a977a16b0d0aa5c37e15848d7ebd8bb8213a795055
MD5 6ab27b5b1e74347d68bb0245f32fcee8
SHA1 14d223eb590e1bd5e79b38c4131317544077e068
SHA512 5d770fe5854ae635f0989049f7207a8fd4e358b78e14b253e3a5adf0d3b7ba123aa06e676ab9d4db3298022fd637f16157d108d90716475f11392dc0ea45755d
SSDEEP 192:sICRPfhTx2XWSSELR537OOBw88Tuq6H0jHW:guR53VwiIK
TLSH
T1B242CE7C90448B3F30F6767DAC21497059A1422BB6BFBCD305F9A492449CF3485E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 8KB
SHA256 93bc2f83aea8b55266989458dccadeb08790aec92d0cfa8d0bb8aa7d6737588a
MD5 18aef77a6b6fe441eea9fa1f6391db1f
SHA1 3a5e3f7b71e55870f1befe7318f90800daeb07dd
SHA512 4e5cd59b47c9ba75a04c86bd737cd7ff378011f2d04d0484ff5021c878c2604a8cd5f05d4b29cb2f225eded9ee17f9ce44df556a6f960513f2f741a446422f58
SSDEEP 96:xHptTUWqGqPfhTxNbzSN9XWSSlvdv9jMn+cHjCaqBw88Shxy8L4cnAV7yGS:vgRPfhTx2XWSSAj7qBw88WuW
TLSH
T18102EE7890048B7F74B676BCAC64493169B2023BB7BF6CD350B99485015CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 47177040b095ea615273f86dae728af4a1cb9ed25e9847c07b5e47239a7173a3
MD5 578000ab82773aafc78ff29bcfd42a55
SHA1 eb39c9ec732dd670003c4c5f4f819306bb178306
SHA512 55d1a4156152f89b8f9e249bdb0bc6b6543688c80ff6cb6c1da6deffcaf642e3c1b842b8de7e6e363fe90b10a2b70dc1a61ad1d6bc35f84717b933d576605ae8
SSDEEP 96:xHpUTUWqGqPf2BTx1zSN9XWSSlvdv9jMn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BTxyXWSSAj7/Bw88qU
TLSH
T1DBE11F7890088F6F74B6777CAC688831AAB2413B77BF68C750B95485015CF3442F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 4a8c60eff01e85e2469d96f84659e4c4205d0760e1b19a18d16ae75970e83101
MD5 03e6c9a8d7e8a8a6f026100753fd5246
SHA1 3206349e960839f5fd95de66f74002cb6a8567ca
SHA512 2835791969723434d1d90bd69fbc3dc43587c267554c0e2bade4ba7e7bac7e2d1e2179946220ee6f966e6f0e01cb901d325175bd3075da0c88254681a74cc6dc
SSDEEP 96:xHpUTUWqGqPf2BRg1zS7SSlvdv9jMn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BRgGSSQj7/Bw88qU
TLSH
T187E1107894088F6F74B677BCAC688831AAB2413B7BBF68C750B95484015CF7841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 7KB
SHA256 a974849fa9894725d051f5e07352b348bcebe045917534d01613b5c98c4b1074
MD5 ad30e81fdb1ccafe277c220212b8d13a
SHA1 1e9753db1f6ee2e46c43dc9b1efe1066d00e17e4
SHA512 0850e3aa59c8259c01ae1f4a2a78d84dd12d3703bb4c6f0478230277ba9f5a22e9340531ae341e42438ffc36a90d4f423b889580eb7ca1c65b23a7b15d2fcb98
SSDEEP 96:xHpUTUWqGqPf2BTxNbzSN9XWSSlvdv9jMn+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2BTx2XWSSAj7/Bw88q7
TLSH
T175E1007891088F6F64B6777CAC688831AAB2413B7BBF68C350B954C5015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 12KB
SHA256 16d01d65dacfeefbabf31fc7ce3ff93722557a3cef9eefe2d0c521f449cde085
MD5 c1fa47ff7925bb5b467caa3160ecf008
SHA1 f504e80b61d73690497fe5a1ae6f20dbf5559665
SHA512 b3600ecb2e275c136ac50d665e1f37479962efa04dfef5d4d1fe99b732067774778048c883a69e1046b4a6b0f4ff931e002a1ec81f1228979cc24e5faa81492d
SSDEEP 192:sgRPfhTx2XWSSELR537OOBw88Tuq6H0jHW:/uR53VwiIK
TLSH
T1F342CE7C90448B3F30F6767DAC21497059A1422BB6BFBCD305F9A492449CF3485E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 b2c661e894f8bd9f03c64a25d6ecc38eead42351d0476cac76fac9eb38f9fd3b
MD5 ba27e12a76c0f50267f71711121f92b4
SHA1 63f4aa5453ee9c4f9942116da99a99183756de93
SHA512 84a08a4954822d787adce22ad969ce587825ac03b0fd96db04e0f43ea49c50239d080f4d223db6c0e76339547a55fbccaa68b9eb7fd428af4b37bf2ed1ac6dbc
SSDEEP 96:xHpUTUWqGqPf2BTxkzSN9XWSSlvdv9jMn+cHjCa/Bw88u8L4cnAV7wyGS:vRRPf2BTxpXWSSAj7/Bw88q7
TLSH
T19FE1117890088F6F74B677BCAC688831AAB2413B7BBF68C750B95485015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 4ca665716a972695520264211dd97333ad72d142fae4fd8217fe6393fc94bb81
MD5 f850defd53fca4bc4bafd4c1e04d1561
SHA1 fb659f72cf290b07707192ed95c37046eec073d9
SHA512 d4c56777c4e5a056012a7cb05d04c2f2783ac324901c55784e7bbc002a0d287dfe574c9b577131ddb76fd478980f0d28a7812b1efbb43957f46aab4fdc600d6e
SSDEEP 96:22O6rhjxWdwK9t8llsRrPH39RbGCd01VrqM4EcZZi6rLKJjNXyU:2pYhk6K92lIPH398i0v/4UX/
TLSH
T180917D675D1AFCE3B97ACA665CCE0FE9C1D12140D8FA54255679A93203BC90AD43C38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 8abba5a6516822383a221c6e22fade7a252cb769fad7cc3d088d4f6eb56e1834
MD5 d8d76635bafe3ab7f5a5508e286ffda3
SHA1 af858511eafe673079e9604c49a00309d0e3820e
SHA512 0f1e1292fd330cd4aec29df7d7f2cc6b1ec13decb2ab0f05b0366c8ee7817596026d9a0513238dc6b61a98da2e101760d23c40d70688404d63499cdac98f80c4
TLSH
T106516D6B1C1F6CFB3532C59AB89F4FD0CA63102045B991B5BCD8E92101EC209E855E2F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 0a5467c8eedf7f569d53be9fad0382c0206396944b87a6e5b02e9926a6f42ca3
MD5 0ce4165de90dac3da8d23a7ef07de289
SHA1 3acbe9cc59fd20fa4657d212c9b113417350464a
SHA512 969e30cb78bdabdb0d463aa795957807dd266cd89280c3be938f77828359457f7e35f426c389dfad8715cf78fcc7f3cf49b0d8f7eccb687ebc6d1f02b7dbabfd
TLSH
T1F8816C935C0BACB37869D9669CEF0FB280921040D8F940652A75AF75026CB06DA6C35E
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 5ae5d75ea473f45e5ae8d308f5da4a54afccb952809534e2f4646782673e2cd2
MD5 99eda9096f7e9219d2c727ba06cf4ecd
SHA1 64835fb9dc6f0e7a00bdd0132c9b173fe80c4bb6
SHA512 796e3afde5ef9ce4d36306411a7fe18c9a46b487fa554cc9fb55132b419f75b170679ee4c3e0f0e3984115a03f47c2aba503286640aa69499a18bc66b9a12dee
SSDEEP 49152:iQZLL7RjjSRvYcU3Y9nS9fj05p/JNocMc:bLxI9nS9fj6p/IcMc
TLSH
T1ED362AF820D1A257F3814033664593EF21EFD00C6037DA085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 85f4921a43c281e40a550259e18497308540d59a8dfec3c05c54c1a14593e258
MD5 4df14072624bdbef276466f85fa1cb74
SHA1 c1323a34c353aa066c09a4a2132c4b427d32f777
SHA512 6d00b94859b6469759a1b97fe649744ba79783546dc05f29695da55672a824305a10946fd85d7330ec4b5e24c4a464b6145b00493e34f84306c03090fe5227da
SSDEEP 49152:VQQLL4sEj0RVYUj3E6nSvfw05p/JN1cJc79:iRGU6nSvfw6p/VcJ0
TLSH
T1E64629F820D1A257F3814033724993EB21EFD00D5037DA085BA95AE9A574CEF9E17B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads