2fdb4377917e6802f2890866f11c56ec04083c54641286b1a4a259085cbc7a44

Resubmissions

25/09/2026, 16:11

260925-tm1sjs119p3

25/09/2026, 16:07

260925-tk1prs116k3

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LuaTools.exe
Size 489KB
Sample260925-tk1prs116k
SHA256 2fdb4377917e6802f2890866f11c56ec04083c54641286b1a4a259085cbc7a44
MD5 7d03ee132fd694bacd10ffb76eef80d2
SHA1 974fb1f199ab0a2ec8837aaf14567556962a3a01
SHA512 40f7bcdcbb0a7e9a84369c76bbf4a280946dc361670917edfa5ea5937bab12483ab5d9b8ddf77136857d59d6884940bc10a50424c50f828743706b644783a046
SSDEEP 12288:eSJJkYLauS67aQ2UWIgXgCtgLz1uXe+OuhKDxiKgMZBF:9uuS6eeQXe+XTM
TLSH
T186B49D327B41C0B2E04770B19E3CD72DCB5AAF111716CAF36E9735BCCDB82914A62699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LuaTools.exe

Checks processor information in registry 2 TTPs 27 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	firefox.exe
Token: SeDebugPrivilege	2820	firefox.exe
Token: SeDebugPrivilege	2820	firefox.exe
Token: SeDebugPrivilege	2820	firefox.exe
Token: SeDebugPrivilege	2820	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe
2820	firefox.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2820	1664	firefox.exe	91
PID 1664 wrote to memory of 2820	1664	firefox.exe	91
PID 2820 wrote to memory of 5396	2820	firefox.exe	92
PID 2820 wrote to memory of 5396	2820	firefox.exe	92
PID 2820 wrote to memory of 5396	2820	firefox.exe	92
PID 2820 wrote to memory of 2032	2820	firefox.exe	93
PID 2820 wrote to memory of 2032	2820	firefox.exe	93
PID 2820 wrote to memory of 2032	2820	firefox.exe	93
PID 2820 wrote to memory of 2032	2820	firefox.exe	93
PID 2820 wrote to memory of 3400	2820	firefox.exe	94
PID 2820 wrote to memory of 3400	2820	firefox.exe	94
PID 2820 wrote to memory of 3400	2820	firefox.exe	94
PID 2820 wrote to memory of 3400	2820	firefox.exe	94
PID 2820 wrote to memory of 912	2820	firefox.exe	95
PID 2820 wrote to memory of 912	2820	firefox.exe	95
PID 2820 wrote to memory of 912	2820	firefox.exe	95
PID 2820 wrote to memory of 3144	2820	firefox.exe	96
PID 2820 wrote to memory of 3144	2820	firefox.exe	96
PID 2820 wrote to memory of 3144	2820	firefox.exe	96
PID 2820 wrote to memory of 3144	2820	firefox.exe	96
PID 2820 wrote to memory of 4804	2820	firefox.exe	97
PID 2820 wrote to memory of 4804	2820	firefox.exe	97
PID 2820 wrote to memory of 4804	2820	firefox.exe	97
PID 2820 wrote to memory of 4804	2820	firefox.exe	97
PID 2820 wrote to memory of 6532	2820	firefox.exe	98
PID 2820 wrote to memory of 6532	2820	firefox.exe	98
PID 2820 wrote to memory of 6532	2820	firefox.exe	98
PID 2820 wrote to memory of 6532	2820	firefox.exe	98
PID 2820 wrote to memory of 6540	2820	firefox.exe	99
PID 2820 wrote to memory of 6540	2820	firefox.exe	99
PID 2820 wrote to memory of 6540	2820	firefox.exe	99
PID 2820 wrote to memory of 6540	2820	firefox.exe	99
PID 2820 wrote to memory of 6548	2820	firefox.exe	100
PID 2820 wrote to memory of 6548	2820	firefox.exe	100
PID 2820 wrote to memory of 6548	2820	firefox.exe	100
PID 2820 wrote to memory of 6548	2820	firefox.exe	100
PID 2820 wrote to memory of 6016	2820	firefox.exe	103
PID 2820 wrote to memory of 6016	2820	firefox.exe	103
PID 2820 wrote to memory of 6016	2820	firefox.exe	103
PID 2820 wrote to memory of 6016	2820	firefox.exe	103
PID 2820 wrote to memory of 6380	2820	firefox.exe	104
PID 2820 wrote to memory of 6380	2820	firefox.exe	104
PID 2820 wrote to memory of 6380	2820	firefox.exe	104
PID 2820 wrote to memory of 6380	2820	firefox.exe	104
PID 2820 wrote to memory of 5548	2820	firefox.exe	105
PID 2820 wrote to memory of 5548	2820	firefox.exe	105
PID 2820 wrote to memory of 5548	2820	firefox.exe	105
PID 2820 wrote to memory of 5548	2820	firefox.exe	105
PID 2820 wrote to memory of 1528	2820	firefox.exe	106
PID 2820 wrote to memory of 1528	2820	firefox.exe	106
PID 2820 wrote to memory of 1528	2820	firefox.exe	106
PID 2820 wrote to memory of 1528	2820	firefox.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LuaTools.exe
"C:\Users\Admin\AppData\Local\Temp\LuaTools.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5828

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {414cabe6-4fb0-4de7-a7d7-798d3415c4f8} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {6d87cac7-bde9-420f-8b09-6f87401fdc74} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3556 -prefsLen 27274 -prefMapHandle 3560 -prefMapSize 270279 -jsInitHandle 3564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3572 -initialChannelId {0efe74b2-ae3d-4ce0-9a68-c68126affd9f} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3748 -prefsLen 27274 -prefMapHandle 3752 -prefMapSize 270279 -ipcHandle 3768 -initialChannelId {a6e30ece-72b2-4331-8a0b-72b7f97ebfeb} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2800 -prefsLen 34773 -prefMapHandle 2676 -prefMapSize 270279 -jsInitHandle 2756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1644 -initialChannelId {d0f427be-a97a-45de-b724-f06cfc16724c} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5000 -prefsLen 34822 -prefMapHandle 5004 -prefMapSize 270279 -ipcHandle 5016 -initialChannelId {b8e98a3a-4b29-405a-999e-bb2d499ecdd1} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3116 -prefsLen 32952 -prefMapHandle 2712 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {9db0c8a2-d9af-44b5-b78a-a54aef7f7a42} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {9c53b5df-9530-42fe-8770-55c4b15ae76f} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5764 -prefsLen 32952 -prefMapHandle 5768 -prefMapSize 270279 -jsInitHandle 5772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5780 -initialChannelId {977846e8-fa25-4ade-ba30-31842c34e6c6} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6288 -prefsLen 33071 -prefMapHandle 6380 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6360 -initialChannelId {3e35473e-e360-4da1-bfe8-c59240e8530f} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6304 -prefsLen 35255 -prefMapHandle 4472 -prefMapSize 270279 -jsInitHandle 6616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6260 -initialChannelId {67d51957-abd8-4288-a8b1-b90f4fc9a4bb} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6796 -prefsLen 38807 -prefMapHandle 6596 -prefMapSize 270279 -ipcHandle 6636 -initialChannelId {9834e793-192c-40bc-869a-c069062761aa} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6688 -prefsLen 36754 -prefMapHandle 6528 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4804 -initialChannelId {a3c102fc-7eb8-493a-a8d3-933e9e0919a8} -parentPid 2820 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2820" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0D7C4389BFBF7FD38C0981CA0EE240D8008D974C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\0D7C4389BFBF7FD38C0981CA0EE240D8008D974C
Size 408KB
SHA256 e3bbbd70b6089d7cb641fe2376fc61ccc6919e997b8a042f027af348e136913f
MD5 fe17da609b425f8382db789464654734
SHA1 a08069b3c787cc142969bf91afd76cd9b6f4a687
SHA512 2751d70b952fdb42794616efbe55881f07f517145afbc83ac22fc5b5518b669c43e31559cab82db52be969f1f118b5d05e3ee65d8536e10639fee0d7072bc2a7
SSDEEP 12288:2YDHsCvmAMm9RtEx3Yhii34oZ0ZeTgvS5e:VXmAt9RCx3Yhii34oZ0j
TLSH
T1C5941954BE616922C12281BA00A74377333AE0D557C6C32F7F96F4E3BCA56682D72778
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

320EC614B2A68611E54E4FBFCD23B592BE9FF1E4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\320EC614B2A68611E54E4FBFCD23B592BE9FF1E4
Size 703KB
SHA256 3fa0300fd8bbf00905f08258b59016915a3abee7e9a7028bcd8436e6c9cd30a0
MD5 34564b43f76795665b36778973f681c5
SHA1 dc7762f895d16f8e4b15f5ee5a35a05253152d0d
SHA512 4abe494097bb92debc1a398a9825156a1f6b659fc1031839b64b45e7a1d7da6a21ef0505bcd85687cd63f27e1f46eed494ff20ab75a7ede72bf3f3bd35642a08
SSDEEP 12288:xFMqETAt1ht26Y9/1boHpFqqOK5MiQHZCfjvSYDr8OecyherZ4DZO:xFLt26Y9/1bIpFqqOKMZEN
TLSH
T14DE40A507D225E62C562027700D75233723AE4926BCBC32B5FAAF163BC66F1919B637C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4D0BF26560573B92D154A61E4171AB970C41F0A0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\4D0BF26560573B92D154A61E4171AB970C41F0A0
Size 1.2MB
SHA256 f28561fd332cccc13215847354e56cb70ab546463724fe1df254ccbb6f0d6e2b
MD5 95ce0115d3cf12cd8f931b3b971fa8b4
SHA1 3d2639275aa283ea39d30e6fed9ed7369ed0e12a
SHA512 e7ef397cc6559ee5a9c8d792262171cd8512d18985c59d578c0e710880c8ed8cc890d1c7705df07ee6cd7f299d0354b59a697278183fec6fe370223ab5a05c7c
SSDEEP 12288:+mvM3h8UN76/9gmpcouV0NeuH+Ta07E/HNvpRiWodTi8+1bwlr1WhobU5vqMgVJr:+7uk29gmKouV0NeuH+fClENToRbG4gn
TLSH
T16045D716EE465E53C82103B240BB53323B34D0856B96F32B2ECF7562FC697791DA52AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

667949263C44892EA6418A98D530EC46649502C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\667949263C44892EA6418A98D530EC46649502C0
Size 590KB
SHA256 d0f78a6c0612fdd2d1ef903032ad4d75f56644de561f7bbeec827f635c007ceb
MD5 6e9d0e0d6797f8f380088aab4ddefa21
SHA1 b9072150a2029bc86210a2558b672fd7f78f1896
SHA512 0606549195ca582f21ec6f11024e756e5965ae16b648e1630ad4c9d26a3b3cbad8b28d81a869673f76332ccab6079485b70008ee9b4dc284b2bd0ae9e41915d1
SSDEEP 12288:q8TmukXazzhwEadhXZQzP/if9jhG9Fc7dD:1TmuuyGfrgFcl
TLSH
T137D4D604BE535E52C161467784E72233373AE0D16FCBD3176B9BB062BC92A681EF526C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6F50642A476D2B682D2BC1A49E75B4433C46DC5C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\6F50642A476D2B682D2BC1A49E75B4433C46DC5C
Size 6.3MB
SHA256 0168ec97ad4c2674a340d60d7316b6035da0404b58bca731c2f60c8abe737056
MD5 dde394942c1b126248cfc7ed894e74f6
SHA1 c2a8c293065f1122981577f4176b62180774a2cf
SHA512 463c0339cfc2fc9604f3114a3c193b7e8e06cc67d0d9cac91c1678c53e1b94f8e437b964bc630e2d5149c44125c427cc8c4b11643121bf68dd50c80e872557e2
SSDEEP 49152:WbWNC3gHj8mkKwDxB8ezy39WeM3DRnDobrFxdaE2Nac2ieV:aCjPFxVnV
TLSH
T176660716EE525E13C43003B241FB63723B78D0856B97F32B2ACF7552BC697650DA62AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9B398045AEF19CA3558D4888F6D980852AB32E1C

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\9B398045AEF19CA3558D4888F6D980852AB32E1C
Size 709KB
SHA256 91b05b2d56910db1bffacaa6b60f0c05892933060c4181f09d225ec864328b0c
MD5 984380d15657ba9f18aad28da80c5f04
SHA1 a50ddc0118e0e52ac33050374f5e380b10887d50
SHA512 ecfa42f2674938b10c432c7182a595bce6c4b6020014f5116b139279e75a818fc523ab8c46bcc2b224f3fb0ef75c9bcd70ab0305cc78a879f9e862c0da125959
SSDEEP 12288:r22Rn9G76BeMq5B3y4C/IZzMHSOda4xWnzHrz:q2RM6BeMq5cYnz
TLSH
T169F4A156BCA65E06C252467744EF223336BAE0D17FC7D2175BABB032FC91D0845E92AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 8e9d1219914bb68f4a7c34b1391e66e76dd7be40f1360605b8aaa11a99756779
MD5 c850205a6952a6aed7966c9c6072c57c
SHA1 fd767bbf8917c3f61e005c8b27427eddae7be9d5
SHA512 89d877d6eea1d6b6c8c6346577220ec6efc901ded4508942b407c43e66ee1abf8620d701b013707e44a7b0791917c35c5d1bc2aad897759998e93ebcc96d4c67
SSDEEP 384:HalwSiO024YkWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAQL++fS++5:6l8ZYkWTToXJWTTogB7S/AmVAf+hRMdQ
TLSH
T1A7727E7D8F413CAC265790E8C8B983558C1CB7E7DFF5C06D22983E09CA44A5A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F7817EFDBA2275CCFB07E58DD85B0844A4DEE1F9

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\F7817EFDBA2275CCFB07E58DD85B0844A4DEE1F9
Size 47KB
SHA256 7a4d4b1010b57d0b5610aea55cf7d8d037fbf3b2bad44b51fd7c0aec85b97f0e
MD5 a529f34d47c241c508f1be24d0649978
SHA1 8820920873ae88bc1ba5ffa2b830098964936282
SHA512 345132534c88bb9f31c740870ed6cb2a2b718fddf5c22583e2b0df2414368f636d837dd29057b972848a0c74e73234f6a64521173f5eeff38ae6e0a6df97e966
SSDEEP 768:dplNoNfDNbrEYlhT++THfSvhB7xyjHutQzQ6NzIvHVQnDS3fv8FX:vlNkpbrp6+TuDQDzy1QxX
TLSH
T1D8237D3175622813C11644F6D14B536BBE0FB1835F8A8332BF94B3D1FCE5EA419B5AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 22KB
SHA256 f3242f6ffb8d689a3e600a2cad55cbf043068bc1474753d49549e6b5d4ffb4a6
MD5 6f9810315ab8105b3889436de76ce3ba
SHA1 cf3b294232fc5195baa59d23e094571fe2a263d7
SHA512 9ba125d30e5c39d42b17e1e4082bef5459735126743e916be86b437eb2f44c93e8af1d3719e5ae453537757faeadf20f630a8b4c06e87cae9e8361880d86da26
SSDEEP 96:Rmt94I56crBliGiwg+hBXyx2X2404nEe6J6hPQsjCEPbEbET9I6yMii:u22losLIgol
TLSH
T197A291F72BB57462F0628FB24098759CECB30235599C92C4D605D0E712D5BE9D0BEFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 22KB
SHA256 1d3f20d4c741f72beab30107db9272311152d6a158b8dfe8af62a77939a015ba
MD5 84a7b6ee06727e7c7ba864f232209968
SHA1 23b6cd84a5e79b8436ffb3f27ca402b5b543ec56
SHA512 f9652ded2069fc2cf2a9d30c539018b5907bf4ffd073f7331e8327337d83f27b8f44de40f1511af985d271db3da135f6218fc3bc0c1e9dc4aeaa55d7bf6372d6
SSDEEP 96:Rm8AHjyuZ/4BooyCYXyx2X24Se6J6hPQsjCEPbEbET9I6yMii:OjZZf22dosLIgol
TLSH
T133A2B5F72BB57462E0628FB2449C749CECB30235595C92C4D605D0EB12D5BE9D0BFBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 22KB
SHA256 eabf23569a2c7a5e38b7ae415a1ec61d5c385f4977b2fd92f9077bb4a9369e26
MD5 91411e558f79b41a9c22fa2da0f6ff75
SHA1 622d32ed750ff41733266abf1be557bb999ceb09
SHA512 676ac815221a9e7d8ab683df0f71c6e56f23a2604826f5e235087316c8b82ea38c8d6ac61207a271bd7b76519e355709003380c39a07e0d52fcb22285c6e6bd8
SSDEEP 96:5u8AHjyuZ/4BooyCYVyx29e4qe6JiAPQsOCEPbEbETvI6yMX:yjZZ9226os8Ige
TLSH
T148A2A4F72BB96463E0528FB2449C749CECB30235599CD1C4D645D0AB1291BE8D0BFF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 11KB
SHA256 e50ff2813958fb50e92ebfc509188cf48a95e6ef150c6d5ae2c52a934a6a785b
MD5 3732f1df28d6694286ad4b6e8a049e34
SHA1 3a8b232a53cf52a5885d57dd46b26057c8522df6
SHA512 3c553f52a5f4840887230b778be768c9db9573646ea21b1959372b0fd8de09c2fac05d07fcc2d828b502bce2af7c01eb5162fe83975709f015b0f601c712b7e8
SSDEEP 24:IuhMZW+i91qdB9xhoMY5q9F55A5yLV9VvDoMdi9BlUvo9lb+y9VR+z9BbpR:pNsdT7ZCI56yL/BDZinGix+gn+h9pR
TLSH
T1153291F72B76A462F0528FB1446D749CECB30334586CA2D0D604D0E712D1AB991BABB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\AlternateServices.bin
Size 16KB
SHA256 d8053ab441ec9a0efc4dc0b8dc931d96f44e5d4eba9178d4f42a274547b7de71
MD5 af5a42ac6d9bf2f1eabfd7e756fae932
SHA1 a0f9d610c2beb0abce25ce89455503029cb412ba
SHA512 6495d93ec8271bfd502b592e3d52dcb62bd4b21caf5097d1e25aa3e4be4940af78e51c967abf0719fb29bde97b655a4b9cf54a0e022a9fb5f6242724a8914c82
SSDEEP 48:R12VdT7ZjI56TL/BDZinGix+gn+h9pRF1HSD1HWHoC24D2QV/2X:Rmt9jI56TrBliGiwg+hBXyx2X24jV
TLSH
T14D72B3F72BB56462F0628FB2545C749CECB3033559AC92C0D645D0E712D2AF5D0BEBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1e4b25a307e7edd26d7d8be1ccbf8bc335d1815ad54d788175b26804852d9706
MD5 d7a735d1fedf4f4a621f6f36ee800f2d
SHA1 c248e9bdf42418473f03f418c36e43021403bc29
SHA512 208fdd17ba200169e1fbd8abbca7ff1caab3832cd267c3f6cffa4896a04ffe6c2b7ae0de60add533f08979e604460087c372ff348d440fe7d922023daad870fb
SSDEEP 192:fkuOv5zbo7yZ2DQyjIcdT1d66JoztdzgCl6mc0d:fklboOZ2DQyjIgd66Joz/zgC1j
TLSH
T11BE11F68EA28863FC404127BDCA61F410F3A388B984E7F2935ED641C2C572DD768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 44b25012b4cf98fe73f65563e08c00e181404a32139fe87113139c312c85394f
MD5 8b3712099912d09742d80f336b839f99
SHA1 bab587c8c7a724886a9ca8a867f3f75221b79176
SHA512 3d1f30920fac26da48f5d97a7ac1fa92ca63b07a1de90b3f38499b8f5299b6e44b6556a3b435acb5eb413ab56f75ad284109ac0c186a889d45ee02f446436546
SSDEEP 192:1kuOv5zbo7Q2DQyjIcdT1d66JoztdzgCl6mc0dz:1klboU2DQyjIgd66Joz/zgC1jd
TLSH
T11BE11F64EA28863FC404127BDCA61F450F3A389B984E7F2935ED641C2C572DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9ed4a229b35334da8b80943efa0757806947e782eb7a9bc14532ebd822e99b02
MD5 41da27d93989ef0c6c838677f69fdc4a
SHA1 c50c59dc47e579c78e4734e18e5d7074a185ee8c
SHA512 36537abb41bab7e7978ca0967a05f2d5929e163b11870ded52679893d7176236fec35834029088d00a827dfc73f95ccfb0db4b4b8ac26601b8f4233aa746fa91
TLSH
T133216A5C3AB84D6AAC87E6AD784051CEA3994A2604871C835D02DF8CDDA1AD931EE43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 4KB
SHA256 61e56908793225bb2a3b58faa81e27b22bd009d6d7c7cb2affe8e9fd1974516c
MD5 353cfb31b634566a9f03413ed8936bda
SHA1 0f7afb1c6130c347ff7b70312a5e2f3191ef69d5
SHA512 334e2e845bd925853c604c2687e3f9ac0e984fd8955fa6ea091c55793fa84d4d0ed694b038209b949f0362275d785ef33759408d5bd41c0e02cd2a06a6359fde
SSDEEP 48:YpOIsYsVEqWXKsI6+oi/2zZLOXZC6zTHsP44o7C1iskaagZZXY64Js5BXfMU72r8:9g+Q8XW44oukeo64ajXftK+
TLSH
T1C8911E1D62A90C7F69DBD79AB840829E83CD4B22D4871CC78CD7CE48DC95689329F43C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35e533b2-cd11-4715-ac64-f97160914b18

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\35e533b2-cd11-4715-ac64-f97160914b18
Size 886B
SHA256 efbb2822d76cc14f546fa3c454b5741842e58b6e9ead129d1941dd2e28c10c94
MD5 2526e21f6c6e37533f337b8095005fb3
SHA1 057597f2f6048bd3bc33af065c2ba6e5755b611f
SHA512 6463d78f5f01a87b463f251b06db1a085e96003fccfdba0d833bd4c6cc2ffeefc1db77eb779b4b862c4872818405dfe2cf603733c9496d6665a25df3467eaca8
TLSH
T1EE1100409B34B2B3DC68929BD892770243A0356380CD9E243EA45F1C0CFA11EA3A730B
MD5 SHA1 SHA512 TLSH

Submit Download

53db97b4-208a-4258-a5fa-a423ed4b2cdf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\53db97b4-208a-4258-a5fa-a423ed4b2cdf
Size 16KB
SHA256 4709e140f0dd1e6cad35773403d5c504ada3739d40d8b07105d790b684bc22b7
MD5 caa8c327b2b55d90f019a8dba2679e6e
SHA1 83087b9be44e0fbb79f3cdd35a4c32a854318dee
SHA512 4c9bde65715a8ac887acffb1002e4f316358cd0b0190a3d5101502f22ce0f8d70f2ee5c12efa64a5d003509e0fd3c5569c6c2c91521f2ca23bc26312b4073c27
SSDEEP 192:ZxkBCkkZga72cJRBuy2D+AtzYlrqVtER1UTocT1WvuJ4BMyhTG7W5+Rzj5bzFr7M:3YlPwkwfvfiy870+Rzj5bhCNzsVc
TLSH
T1B972D816686055BB8251E369D8F8BFC3E5F528CF4C419FCA9BE4BD082DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f90e4a4-65b7-443b-b344-19b9b4185f14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\9f90e4a4-65b7-443b-b344-19b9b4185f14
Size 883B
SHA256 ee16a640452ed0742ac4dd97309936f950d8631ae3aeda65fbaaf726219cb58f
MD5 01532164c1bc807ca4846706f9a28017
SHA1 8d6a936cc91f515c1799e1601b5c739b1dd00559
SHA512 445468108f6587292ef9eb18c1fa1a3312e0b80338aa00b14dffe4d3a7751107b11d78f4c452ba139cf25ce63bccaf63eda7d5114a99674e8ba7f00853c8c117
TLSH
T1CB1100409B75B5B2CC68924BC596370293E8665380CD99143FA54A180DBE51E936720B
MD5 SHA1 SHA512 TLSH

Submit Download

d76fdb7a-4d22-4073-88d1-0db283175e21

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\d76fdb7a-4d22-4073-88d1-0db283175e21
Size 235B
SHA256 56db5d1252d6e4a4f5c37316707c6332e6bb5e8f932bdc05b6c99eadbff404a8
MD5 aa6edd7ae8db21f606f7db64d25e3f3c
SHA1 798d919ebbbfc8bf61160a41a59d4eaa9a2a3a59
SHA512 8ef4ee781bbb8ffc3b4a0942e2b500a9c23e59e0cdbb592c15b91a443b7b58d8242207bc14e8c44f973f7602fa615cef2d0216a901bceeb473f307ba3b3faa6b
TLSH
T17AD0978528D8B79D48140F06F8E06AC234B48C3720A49850A9B00538CEF9EC8816182B
MD5 SHA1 SHA512 TLSH

Submit Download

f309dccd-5f6f-48a0-8038-e140567b615a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\f309dccd-5f6f-48a0-8038-e140567b615a
Size 235B
SHA256 9872bc3437a30ddb42b1f2cee5bf5f44229dfad7b8b70e7bede5e0e0e0cc2056
MD5 6bad217a7cb8b971b3e5465da8e7a974
SHA1 c22285a6945f3c23c416a1be96a306fd06f4b590
SHA512 956f92147986a23acd1e519d3080cde2638533469d60a7ef61ae5bf5268a0c07fed69351105c3a9be75d2ec8d503d19fe6dff9be4ebb8e343373e6a590d4ecfa
TLSH
T1A0D0978128886B5C08000F0BF4A078CA30488C331072A860D6A285BC9DB8EC8023284A
MD5 SHA1 SHA512 TLSH

Submit Download

fc211286-e097-4903-b521-4c1d58eea4f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\fc211286-e097-4903-b521-4c1d58eea4f2
Size 2KB
SHA256 feeff1bae350db1d380788518170d6fc3cef7f92c6cefe7d31a8f7606ab9fd81
MD5 08bebfabbe6addaa1d0453b679ec47eb
SHA1 aabe81ada01b38b92e0184914ebd9138747f67be
SHA512 fddb6bf8c2228e20598ade2248bce10fad6051f38cc23333f6eb803a73206c108b62d096b85b715c68324c395fbd62f3b036d697976ff7cbabd6a0cd656449d7
TLSH
T19B41345C76B85D379CD6F14D9482338E93B48E6300C66D436E91EF0C8DA67AD236A42B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extensions.json
Size 16KB
SHA256 49efe99e0ba2c6183672ad106ace81527896c142ba40c7e5231de27793904a4c
MD5 9ff5ce9706c0396d6d54c3f6832613af
SHA1 5316b834a9711d08fea149472e6ecbde5678b474
SHA512 462aad07b69aa09b0ae8da1bf6bff9f27c974e88ccd941dc55fc7bc0eaf9831bc2f6481e87a8d490440962336b5a21abe239443c2b544b7d615256eb153da7a1
SSDEEP 384:hkI4vkUmldvc8dhW+94zCN96oyL4HzL4PyL4HozaL4H3VL4Hvu4hx:SI4cRflXj4G6b4f444f4l4G4z
TLSH
T1A572531545048EB8298EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 7KB
SHA256 206ce73351ccda93fc77b21fc4c6b4ef9d368230f37539719d0843093ebcad8a
MD5 0eec5b396a44ef77d34fe6db483d0884
SHA1 ef8fc0f9a2d4ba947be275cd3d2528241202af28
SHA512 98edc7b2887170304d16ab934fec2bfe1821932629545d6973351bae6929f56154039b5fe2d5a13f7c9ae4c134004d31c87028495534fe6ccfb446c1f4cacc8d
SSDEEP 96:xH4eIDsKqGTUbqGq6fU21NbzSBSSl4dv9jhnXH/+FFBw88B18L4cnYQOSGS:urR6fU21QSSQ/4Bw88Bp8
TLSH
T1BEF100789104CB7F74B676ACAC6888316AB2013BBBBF68D750B544C4015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 7KB
SHA256 3e1545813752a66165bcd0e1f57645954cffb07d32e7c0151dd989a82ae51882
MD5 aa051ecbbdb35a27aa97274c2074f974
SHA1 9625f013a272dd7ccacadf5e04b91a4581c9a36b
SHA512 4e849aba48fe7c8b7b608f4690a2dd26d6963161f23c068a20e55f815d4c26590909041e77e25c184886f1bf650040733ba1cbfcba928376a2d0adf225fd4b33
SSDEEP 96:xH4eIDsKqGTUbqGq6flo021NbzSBSSl4dv9jhnXH/+FMBw88BfEo8L4cnYBOSGS:urR6flo021QSSQ/VBw88BO8
TLSH
T1E1F100789104CB7F74B6767D6C6488316AB2013BBABF68D790B984C4115CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 6KB
SHA256 daf6b0c46c0d44915b247c89e42fccb872cb64104332de11693667c0cb5933a5
MD5 9b227b06b5775288bc5476797d45fc8e
SHA1 11aae664c65b4382e2020d5f49c27dac4082582e
SHA512 a8f499cbe659bde6cc299528264cc396627771bdae1b5769074e59d98a52f32bf309a51b5527d2474b3194298ffb6edee6895ae5c7d26a89010af275cf835e2f
SSDEEP 96:xH4UTUbqGq6fU211zSBSSl4dv9jhnXH/+FFBw88u8L4cnYQOSGS:umR6fU21USSQ/4Bw88A8
TLSH
T180E1207894088B7F74B677ACAC6888316AB2017BBBBF68D750B554C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 7KB
SHA256 9935ed4b114eab618fe3a4d659b0cabc273d6c73146b0c01ba88c415168e4c5f
MD5 46ada300d60283937e7424a1ac2f09c5
SHA1 0f2a1515cecb1c1b2e872d3b8d71ad464482e4a3
SHA512 03e57fea0883ab9fa0b131e43336fce72c153702c8bafd1e600dc3e3adbb2b5f8ce2930dc75a7e4e8c00059a6e65a53cc51dcae4478a05e933e49eee7f0371a7
SSDEEP 96:xH4UTUbqGq6fU21NbzSBSSl4dv9jhnXH/+FFBw88u8L4cnYQOSGS:umR6fU21QSSQ/4Bw88A8
TLSH
T1EAE1317891088B7F74B677ACAC6888316AB2013B7BBF68D750B544C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 9854f74d5dc1d2503160f1b681071a719920f3599fe3e9458ede5c8b2ff78560
MD5 a93625bbfa9d03b3f73d8eed571ec6aa
SHA1 c39efa2392dd12db270d0753894889acc30e4ecc
SHA512 bb6dc8c31810902457662c0d673b2161304ee7441a396517bfa8d3f9f209c560e230365d2ecbc950ae90214f7be2fa8d61509a320622d5c8c0bcc2a06f25ec85
SSDEEP 96:xH4UTUbqGq6fUgC1zS5GSSl4dv9jZwnXH/+FFBw88u8L4cnYQO7:umR6fUgCAGSSP/4Bw88A7
TLSH
T147E151789448CB7F74B677ACAC6888316AB2017B7BBF68D750B54484015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 7KB
SHA256 50c634b4477ee9a5733d934513b219398395aa48096f5d38a1f6281408e49413
MD5 d5bf3ea9ec9aac9b34ee5617e03cd6f8
SHA1 8520a809b47316057d1107e0f7975d9160a8d899
SHA512 8ac1d7715cad477194f8dfac62c4f07537fb6874793a6df23a79b61230ff1fb7e38e48800845b4cb8f9cbc2eb27e96fa7820cba019c4dc3042de1fda58052228
SSDEEP 96:xH4UTUbqGq6fU21ObzSBSSl4dv9jhnXH/+FFBw88u8L4cnYQOSGS:umR6fU21XSSQ/4Bw88A8
TLSH
T152E1317895088B7F74B677ACAC6888316AB2013BBBBF68D750B544C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 7e9d62fd6f73b61f5a2ea8c66a8a9a0dd7c7b1bf6a0ae291a4f3ed0468b76af6
MD5 b6647a1b29b13a21ff13e02aaa0bafcd
SHA1 370bb44cef6d4ee43051190dac3ab8b5343fbd98
SHA512 96a0d81d1136c4d3796e9be1e91f29e7d4fe22efcddf636657720d0e8e677a06b858bfc417f08b91952d14d22376acb6ecb114f40e360d9f4665316f0aeab0c4
SSDEEP 96:k36xzjdhWl+X9B+1kanFhDWsRCd01VrqM4EcZZi6rLKJykD5cRX9DXIdRU:kqxzphWO9BgnPi0v/4qS9D4dRU
TLSH
T122A18EB36D3DDCEF7172C4A986AF0F99859128C0C4AC41559F24A935003C2AFA76C52D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 de811909adc2f539180666fddaba072045fb9e84894835bce544173a5b9c157c
MD5 86c1ebb1466db48799e044ecceb72abc
SHA1 3501eb205762b1e6b808384a5ad69bbc41d3b0bb
SHA512 003f46baf05fa50ef198f1128c55627f72c457926cb3224c23f3fce95a71c9a5009ca47035c469642a64bf028af0be1c9a10920947b4cdaea9dd7631d386cd9f
SSDEEP 192:m19ruefXFt19U8jTJq9ZG/dTB/bgei6cqi0v/4ksmw:mTueT128j1gZ+d/bTcqpgb
TLSH
T14C32AE37417BADEA1594DC45E95E8F499BE20E80C1F243065F4CEF62837FA08A5344EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f617f1fd8da114a633fa4dd5eb1befed0b59451a87415115e19e353dc6797208
MD5 8ec2dd84cac04990a5c4ef3df48a9e88
SHA1 e2fb9f17a43f394abb5b7ff6975e14d985a320e6
SHA512 2f28e73d6075f67cd06f5957384bb63a60e896645ed835da5c7b645e3f89c6981e3e0c82ad8982fedb036d9f6997828f0af47ef70c89292465f2a7c7469828ff
TLSH
T10421C5217A3F9EBBB741A204F15967B0C244355189D484E091ECEF06887904F33BA588
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 dd9c04c85cabe534b29de24266b378e0268dfbdb12cf3d53bde76d88727d5c1b
MD5 57f047f535906a8806179838bd31850f
SHA1 c4eb6e34a728c6983936cb1127d403be1ae1924a
SHA512 5fe69a346b71da4fb40cb8c2e7a1f348514725f20d4c4ec566f0a819af0b998d9ad55a680fa9c3a486081bd2da6c40dd62b49c458e114e7a25f2f1449300e72f
SSDEEP 96:g4HejyYJTd2XpcztF9By8AJWMHatdhmVP3Ywqqg2K2Rq9rYuybjxzhg:gyefYMtF9U8ZTJqg2K9klbjJG
TLSH
T17DC1AF37E1FA6DC507909C8AC31B1FCC1B5456C2C9A602418E8DDFA1C233986BB6C46D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads