darksiderat | 306238f50284e0df58e83f4135367e73ecb9e209243e627b3e9b4d9702deedf5

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 419KB
Sample261013-2fjjpact8v
SHA256 306238f50284e0df58e83f4135367e73ecb9e209243e627b3e9b4d9702deedf5
MD5 b4e88a0ac944f0e83f2580113cb5a56a
SHA1 c1773afb8397e3dd7c77333926f12a50339dcc06
SHA512 6c5f82b6445362535548c07cf6c1f749f64c971d44a8015c06afef4003cf54a33cd14eb1115a8cfe72f898b80c837f85aa6b2ad0e129e2a6658721d88fcd51cf
SSDEEP 6144:VzCV1Q8XX/WXsR6+DyPUT6aW7yVWpYFXDsBRHJeq7:gQ8XXT6+WPUT6aWPCFzwHJe
TLSH
T1F694AE42F79614FAE1BBC138CA424517EA72BC164760A6CB33A46E963F237D05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat persistence trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/5548-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5548-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 5548	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2196	firefox.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 5548	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2408 wrote to memory of 5548	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2408 wrote to memory of 5548	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2408 wrote to memory of 5548	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2408 wrote to memory of 5548	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2408 wrote to memory of 5548	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2408 wrote to memory of 5548	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 2408 wrote to memory of 3008	2408	2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 3008 wrote to memory of 2196	3008	firefox.exe	91
PID 3008 wrote to memory of 2196	3008	firefox.exe	91
PID 2196 wrote to memory of 3336	2196	firefox.exe	92
PID 2196 wrote to memory of 3336	2196	firefox.exe	92
PID 2196 wrote to memory of 3336	2196	firefox.exe	92
PID 2196 wrote to memory of 5804	2196	firefox.exe	93
PID 2196 wrote to memory of 5804	2196	firefox.exe	93
PID 2196 wrote to memory of 5804	2196	firefox.exe	93
PID 2196 wrote to memory of 5804	2196	firefox.exe	93
PID 2196 wrote to memory of 1352	2196	firefox.exe	94
PID 2196 wrote to memory of 1352	2196	firefox.exe	94
PID 2196 wrote to memory of 1352	2196	firefox.exe	94
PID 2196 wrote to memory of 1352	2196	firefox.exe	94
PID 2196 wrote to memory of 404	2196	firefox.exe	95
PID 2196 wrote to memory of 404	2196	firefox.exe	95
PID 2196 wrote to memory of 404	2196	firefox.exe	95
PID 2196 wrote to memory of 4492	2196	firefox.exe	96
PID 2196 wrote to memory of 4492	2196	firefox.exe	96
PID 2196 wrote to memory of 4492	2196	firefox.exe	96
PID 2196 wrote to memory of 4492	2196	firefox.exe	96
PID 2196 wrote to memory of 5424	2196	firefox.exe	97
PID 2196 wrote to memory of 5424	2196	firefox.exe	97
PID 2196 wrote to memory of 5424	2196	firefox.exe	97
PID 2196 wrote to memory of 5424	2196	firefox.exe	97
PID 2196 wrote to memory of 1252	2196	firefox.exe	98
PID 2196 wrote to memory of 1252	2196	firefox.exe	98
PID 2196 wrote to memory of 1252	2196	firefox.exe	98
PID 2196 wrote to memory of 1252	2196	firefox.exe	98
PID 2196 wrote to memory of 3364	2196	firefox.exe	99
PID 2196 wrote to memory of 3364	2196	firefox.exe	99
PID 2196 wrote to memory of 3364	2196	firefox.exe	99
PID 2196 wrote to memory of 3364	2196	firefox.exe	99
PID 2196 wrote to memory of 4144	2196	firefox.exe	100
PID 2196 wrote to memory of 4144	2196	firefox.exe	100
PID 2196 wrote to memory of 4144	2196	firefox.exe	100
PID 2196 wrote to memory of 4144	2196	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-12_b4e88a0ac944f0e83f2580113cb5a56a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
  2⤵
  PID:5548
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {36db718f-2a41-4782-a176-020a9fd93b17} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {7da8ef7c-6992-4103-b626-9941ceb5e6c9} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 27274 -prefMapHandle 3816 -prefMapSize 270279 -jsInitHandle 3820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3828 -initialChannelId {e2d89307-d52d-4118-8774-ba7b282c08ab} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27274 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {a2c4436e-b805-41b8-ba59-45321a5886ff} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1220 -prefsLen 34773 -prefMapHandle 2976 -prefMapSize 270279 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4420 -initialChannelId {e30a897c-2d07-49ba-9c84-8646bc0e68a1} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5028 -prefsLen 35010 -prefMapHandle 5032 -prefMapSize 270279 -ipcHandle 2564 -initialChannelId {184c4d2f-166f-4ed2-9f0e-7d3a570ed16f} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5444 -prefsLen 32952 -prefMapHandle 5448 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {dbb6269f-bd39-4308-84f9-af8a97bb205a} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {f98a7be7-d9ae-4e9c-a9af-e342769fac60} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3364
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 5652 -prefMapSize 270279 -jsInitHandle 5656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {42ce4e35-5097-42e7-9832-416df41b77d0} -parentPid 2196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.contile.json
Size 4KB
SHA256 d76b6615cd62df8d5320c34f3ecafb4a41e09e2fc13f8f37dc8e50e5ad0d55b4
MD5 6e7075b0f69570041bc2e1f65006b45e
SHA1 50e7555d0b674f60a4e12c577d35e8d5c06fa93d
SHA512 345a969d3a0f3e22c2760faadfbf5cb78b4629c25764140e34c629975cccf402746e70622edecd0d814cc6cf9543f77480936a6aed1e52b6810eb1efe26c55df
SSDEEP 96:TUrMynclmS3AGAJT+mRfdon4KYYvqT6DO5lz:EMoclTwGdmRfdorkwO5F
TLSH
T11191C6AB857888131730BAE96C0B26ACF417B015E9E5DA6DB16DCC11C1BC7EE80DF984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 f44e90d3c7ffb82a6408a2edabe59eae6fe3a757b13183f6fc71576199a3c395
MD5 f06c1c6b191d5b3ef588ddcf29ded71a
SHA1 5e51b86851e81f2e94f3c3f44392923251d9cdb4
SHA512 78d4e742101ad42aa055cfabe794aa6a3114bd264615e93c8138fc6d66aca52424720860d1c8c72eb5ece9f9e33e05ac77a45bc4cbcbaffca3e8b4611c0e2bb2
SSDEEP 768:dyvgSWOf4Ex+4E+Ui751Oom/9JmfOOrzXOElvXZMDIT7IoC:MoSJx+4zUiYomEXOE7MUHC
TLSH
T11F73F8A396E8B3BB1BD037C71C0F796762920195F34506CDECE9CA1C81CD698423A6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 f2ebad02cffad6ae51ea95656126af8fb8f4d2af4e9d6b8e1ee24d3b22fc1aea
MD5 1d790c5c9124702bcbdbeff4273dd445
SHA1 4d736394e0ca304d4e7d18ee488d2968e2259951
SHA512 f0b213b11766d15a72f9a90317338dab6eee454583458031e0f93ba5be1865dc1c0f0ea535aa9a08e7ed68fc3d0a7f36232d9498df288dccfc250d16decce80b
SSDEEP 768:dyp05FU02opyAk4mAYJym8SoDBoFvOEEsvZxWOYNr9gcndk:MpaFU02oQATYJyooDBIOJgcW
TLSH
T12D7308A352A9B1FB1B9173CB3C0B759B62E24145F38546C9FCEECA1C81CC654523B6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12110

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\12110
Size 52B
SHA256 5a020a729596eee10566c51f107d358a6f8fd4a2f752f0b0acd9d4be63bfba57
MD5 e2410d670bc9737d4babca8acb246e01
SHA1 5c74147a3e8384deec2e6ab7872fb7d21652d976
SHA512 445f2ccc7e6abb00dea4bef56a6cb59168f80803f3b464589e6fff66cc4fdcad1c233fb6a9156f3cc4bdab92196675faf475703c5d1635af2cbf1c9a9ee20776
TLSH
T1C49002D49252C911F0548071080080F42450BD004C80021234D20752C8234D24080158
MD5 SHA1 SHA512 TLSH

Submit Download

22168

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\doomed\22168
Size 258KB
SHA256 902f20d3152c7b289565f833b3f9a76b340aa16688390a76e54e5bf67c3c1bf2
MD5 19652fc5140d147ce9cd09f0d5ff19f6
SHA1 84adfe072f1e95a2722d8b75eeb2fec1d2715f0c
SHA512 e2deb6209848974c517464e0f7f57124b0f637efa2a6e78dc58842d81ee9a96e6caa3ca69b0debc1967d15e7f476dbf95c2f4a1a8ea730307c1644a0f7bad40e
SSDEEP 1536:zYCYPshaqc9xs8wrKQuPmSPrgoQvkcIwaL66aUxDgLYeAjLY09mMeK8Ct92ZFZWe:0qc9xs8wrXolc6L66aUNgLYrLl2Zj3V
TLSH
T15E44F7F796AC70FB075287DC6C0D72CF62AF4139DB5209DAF86C8158C3C9A6510B678A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 03645466e963cef123385f3565803190358096ddd3d00873a06a413b8bd7f62d
MD5 9ae01abca8e34690113599e9017d5c9d
SHA1 cd0b782627910adfb5ab4b39498f773ba8193758
SHA512 68202917ba6b00d1c05261e9deecf87615a802e80a973aed95c0821eb44c8e03aedd0426c48288b1c748e1b5175800fb605b99d74c655c23421c28a32f20f49b
SSDEEP 384:HGNQiO024YoWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAr:mDZYoWTToXJWTTogB7S/AmVAf+hRMO
TLSH
T12E729E7D9F013CAC275790E8C8B583598C18B6EBDFF6C06D26883D09C988A2671F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 dce403676f744427f43908342ad95f873458cd8f17460310628d2e74bfb15d18
MD5 30970ac6060301cec7f80f052faf64df
SHA1 f785475c3c7b530c3119a2aebdb279fef0e148c6
SHA512 f380e145280547306e1bb846eadd6c4de4db45104cecc2f47f7f24bbb5cd73ceb8274c8399486610f6abcabd28971fb32a761df5bc8bdef472fde841deb381db
SSDEEP 3072:j3lr3ARb1wWr9mRuiwTEMWXhY5lBnh4vbTVUo:prQfwWrERME1Xhy4TJT
TLSH
T18DB3AFF7DFA2CD2D69FFD42D9AC2843EFC262400B3A73419C923621562C6B74667964C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 31e87ec8b102b7dfcf894ae97e173a6a0597867aa119c8f3f1214b77f8c21f9c
MD5 5ea7eda2f664831836d5d3e813b7e996
SHA1 2fdca3e8dcf237a550d68b91cbf402c7e2ecb26a
SHA512 d7f808a7cb87bcc3956c3a1003cb428dbbf391381684a326d1703dc98771e3f0f6adcf5795a10f5cce9b31b3b7b127d183faa56e49350b91d5308885b852274c
SSDEEP 3072:X3lr3ARb1UjlPNL+I/ZEMWXhY5lBnh4vbTVUx:FrQf0/L+aE1Xhy4TJM
TLSH
T13AB39EF7DFA2CD2969FFD41DAAC2843EFD222400B3A73419C923625562C7F746679248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1OS19ZIUZMU9L13Z73LL.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1OS19ZIUZMU9L13Z73LL.temp
Size 5KB
SHA256 9aa93eb49fcd6d3c14404041a3e201b825a20f97c605a3d4d22ea567b5c4567d
MD5 c2e60af42ca27eaced68a0b89d880121
SHA1 d647a9544160321ccb03339efcd90f0b5c10de17
SHA512 e11690f660c4cd444f3c2310a35860f2fcdec050420cb0c3f44d0251495c5fea0161755fe2210e66613081a387da96a6bedb1dacb8dcd99b73ccbf0778e9c407
SSDEEP 48:9YpGUdoCJ5UgdwY6z9BpGUdoCJ/6BdwYG9HpGUdoCJ/adwYUs:2pScZCpSc/w2pSc/g/
TLSH
T1B4B1D1020BF74996F5F782322A317B075773FD00271A069EC2C66689497237085AEFD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\addonStartup.json.lz4
Size 4KB
SHA256 c6273234f5ee30461b5e41c3d3425ae7e04584c023635cea500551fcada191b5
MD5 0efef8e02843b0ca97f5eb75084448b7
SHA1 bf775c009ec1bdf789eb79b2be692f94e084a60c
SHA512 0ca64ff855361458029459a1605599358b82cf40f8525b28164dcc5f81a9c06144b3b563c097fae2e8d47dcffe132a5a29a4c652f060e115fc2b4cb8486d2263
SSDEEP 96:NbSW74sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NbT252xxhD8rGvm6ApwnHUuhN
TLSH
T13FA17DB6D141EFA1FD32C0435CD97FB2EAA6AB7420A9C8D4F1AAB1294D74E735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 36b0568aa69b874abfda54b14c37b5f81e52bc4b7514e6ac30c156eb203ed546
MD5 588ecd051f6fd84239b673d4d4f43a40
SHA1 9fa8bbe2f947a33dffb8ae59b935915b93e9506b
SHA512 2f2f2b792bf96b69d1a4e090f955acc2348048bdacbb8e1f82b3c33d7b0c1cbd9af378322738723eed2ac6a438a2cb1db9da6a5691e2aff5d0e038ec90072835
SSDEEP 192:zlcyEKHOv5zbofZxTHHyjiW9MN1d66JoztdzgCl6mc0d:zlcyEK4bofZxTHHyjiWad66Joz/zgC1j
TLSH
T17CE10E68EA28863FD408137BCCA51B444F35389B984E3F19359D641C2D5B3DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
Size 1KB
SHA256 9a7c69d2fa37fb493c6196e90a95421f4dd6ca7834b30b31ff43865ca582fbd0
MD5 87314d5647d550e25806855793204087
SHA1 093fafdc04c73db454f6e72566dcc118290a5d39
SHA512 70c5028197a020976805055618fb756b7ec65081eaeb82e459bce6c5f2502024ee94632b13bb07fa76143194486473356b01c06eda312fe2aaa90947d2b6ac40
TLSH
T17F213D5C36B88D2A69C6E79C745101CE57A18E0728875C570D52DF8DCDC1AD933BB42C
MD5 SHA1 SHA512 TLSH

Submit Download

2ca515ec-bec7-48af-bb60-28ecbcf6f9d6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\2ca515ec-bec7-48af-bb60-28ecbcf6f9d6
Size 235B
SHA256 6eae24d395db358d09dd1b843b054ee1467c5172a609618c93b5acb8ac6738ad
MD5 877cfa40f1da0206256124656ba588cb
SHA1 008f52c751cb2bf9e97494bcbea0f0af03038a9c
SHA512 c175d894bd52bb649ed1e3a9ab87cde38fc72e5d6bbb43003c1ed6256fc923edec4fe24aadab43aedc419b02cb3d431b1a54d2d36b277d4690bfa916d898f527
TLSH
T133D0978028A8272D08004F03F0A1A9C330488C3314A09820CAE155B49AFCEC9436284A
MD5 SHA1 SHA512 TLSH

Submit Download

350110e4-b26b-4128-aa9c-9dad01ba1514

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\350110e4-b26b-4128-aa9c-9dad01ba1514
Size 883B
SHA256 bb3b2dfcb6f322d40b6a56e823c4b3d15c03dc6c3fb76b9fc0130e99c281e642
MD5 d4c97876fef06d61b171199a747bfd7d
SHA1 23b3aaf8dddc5244d08b90e3764d1b3be81f30a4
SHA512 62ba198f57fa42684c4df7953db801714702e37e4b1a1a33cd821a77208fdcf759ea170960f86580ea6d7defd650d135980a7d5c8c25ce8c30e9dbfe66110df4
TLSH
T1E5112354A934BAB1CD6C920FC98437468BB4242380C985183EE54F184DBEB5EB3A660B
MD5 SHA1 SHA512 TLSH

Submit Download

44f11c53-69ae-4c88-9748-29a93fb43b8b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\44f11c53-69ae-4c88-9748-29a93fb43b8b
Size 886B
SHA256 eb79a6fcf2ee92c2bebdc4eca80fd186a00a603c5c536896a808f644189be417
MD5 3e1b5904b20627ff2e07eaaee124b4d7
SHA1 cce52706a01ea06ec130c2b3003f80570d5f6be1
SHA512 af5adcf5bafb9aa90369266c02c6517f773fb71d5d9da09495bf39fc75bcaaa5a93c656b6b0ba51cd45c4aeab7e10e3eb63ad4b0a620ea17fba51df30cff5be9
TLSH
T14A11C0504A38BAB1CD6C924B999477468BB4652380CA4D087D918F2C4EBF75EA3AA707
MD5 SHA1 SHA512 TLSH

Submit Download

ac4a4a30-92a3-4fb6-81f4-784a91048880

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\ac4a4a30-92a3-4fb6-81f4-784a91048880
Size 2KB
SHA256 527071177908b98912583365369c36dcb8f11813aefdf8c1eb755d4b018cb361
MD5 a0c4ceff2832e6ecebe7c5716faca7eb
SHA1 5ebf02ae4fa1851105b423df9905524a46cd24dd
SHA512 f107b5876621ff72408e2d25e93ffc0377001ed249c824e857d52f125dc926a5b77fb3a1c3ced0c141a211fbed9e42f4ddba7662f31ee9062c48116bea1bd4e9
TLSH
T1B141412C79F84E769C9AF14DD4D1338E43708A1340C62C876E91DE0C8D96B9D73AA62B
MD5 SHA1 SHA512 TLSH

Submit Download

c921240c-afff-40ef-93ac-2c4f1d486d52

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\c921240c-afff-40ef-93ac-2c4f1d486d52
Size 235B
SHA256 e284a3264381431ee3be9934d91f1a7e132fe0b0f8656001dc0e2ff928e5c875
MD5 702bec9af15fffc8d14861055094c5bb
SHA1 edda750ca3375b48fb580ad3ed0d23028043ba37
SHA512 b3a26af400a60013d25a5bdd15bebdaec4a61d8594afdc47b9cdaffc944eb105a6ff30464f41ea692b53b70194b55427d7d59e1bdf185ca9f3ca2d1cc497483d
TLSH
T1A3D09790249C272D08140F0EF0A228C630988C3314B498109B934074CEF8DC842A1D2E
MD5 SHA1 SHA512 TLSH

Submit Download

f292c458-c51d-4869-b0b5-2a9b3e431cc6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\f292c458-c51d-4869-b0b5-2a9b3e431cc6
Size 16KB
SHA256 bfd4cf62730de3808751bd4550165776b857a77f46a22d0c07d4fd87129e38fc
MD5 2290fb6c1a237fd646fc76ab675bb2fa
SHA1 ba74c58a576242a49a98461727c3de62be7e23f4
SHA512 4dfcc30342dd1e80722dc66af864dc264f93ec026dcf9b05d47888d9c81f94e9d4d3b629424d64bd5c2f27041216010af572d571d2de9c3a46302314158d6fc2
SSDEEP 192:Wh+DMevpJG7233JmzVINIUkfSQvVzx56pY4BbnuAA1kWALEflYQW4Cs9ue/7oHkM:5Ke3LkSQvVl56p9BnBWA49WnSu4oEX8
TLSH
T15672C816286055BA8291E36994FC7FC3E6F528CF4C418FCADBE4BD0869DF06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extension-preferences.json
Size 942B
SHA256 a56a46aa7451d640626f9adbce3ffb26ea6ab549f15af56fc2cd69f0bcfda67b
MD5 8913f98eab4828647224c9a64b706b3c
SHA1 f886a4456ee44a4e73ef32a2b138193f2fa41d37
SHA512 28869c106812bf053c732469b0f67da993e42a471c7b576e68d45fe66d2f067bab0a66c5334e88c6460e08a06285daa643f5f34771bd0d7361097307137e1630
TLSH
T16211F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extensions.json
Size 14KB
SHA256 9795b210f2fcab9b31f2600f147bf4b0abff94ed1e74a52bd757d44505c61a60
MD5 f04c529a0d10aa0146d03093f8628e9a
SHA1 c446a4ab8dec05e92923b971204f8eb3025d34f3
SHA512 aa34cdf2c15fce60f112cb20f6af1983ae7045d87b6ff548f753119c28d9f9174891ce754645d1760d6e51902fef1f78551c01573b2cb4e15d9e13faebc403f5
SSDEEP 384:DkI4vLUmldvg8dhW394zg96oUL4HDL4PiL4HRL4HSL4HC:AI4TRfZXW4I614P4o4p4A4i
TLSH
T13262531545148EB8298FA78BAA36BD01C37D473B60445C78F4DD8FC842FA6B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 fdb8173e6eae7ecbafc9c2c1e42e1b984f2de7acd59701f0e2a9bd57c5996c16
MD5 a3eb71ea25f806accf156332e10e1460
SHA1 d4275062f10abd3f86f5b965cf453f9e04a8a243
SHA512 109bd5ca788781d6f5c13fbb8ab98550153510c7fac568d0f581eb0dbaa46177ddd06e046ea592bc837c31b2a1b5c4b8f77d475d0d858f3c1c9576230fa744e7
SSDEEP 96:xHAUTUvqGqjfGHI1zS3SSledv9j0cnGHtcSXaBw88u8L4cnEo1/Gc:+SRjfGHIySSJtrXaBw88zuc
TLSH
T1F0E12E789448CF7FB4B6766CAC6888315AB2013BBBBF68C750A554C5050CF3881F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 9160ea069b50915e31adb30c385681e37ae7ab5508887f7cf4f76980d00b14ad
MD5 e75252d13619a32d5eed35d7c6b9d2a3
SHA1 416c99d44d3fd94e19eee700e927421702b56796
SHA512 25f2b0128e40e4d09c73f9b7727267c9cda76a125c163c2399480ef4e1d2fe7015e56ba89804c660953b31c0a71314a34e64d10e5bd6daac0eb0e51e8e849bb1
SSDEEP 96:xHAUTUvqGqjfGozObzSQSSledv9jcnGHtcSXaBw88u8L4cnEo1/Gc:+SRjfGoziSSUtrXaBw88zuc
TLSH
T187E10D789408CB7FB4B6766CAC6888715AB2013BBABF68D750A554C5050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 7KB
SHA256 a0cc9c3b802ce1df99c1da6247634116b344e568e625c3ae86ea96a718027c2d
MD5 1b87829e9b31cc86f2eb8ae965071c3a
SHA1 0a175514520fef116d3f6e6a7081c005fa7c40f3
SHA512 ad19215050da1bc24bb053c238b90d2ec8fc8adeace9873ac74b1262399213cbafc160a226b3efddbac8bf7f217bc43460da7e58062f9f4270ae6ec26b5fc0a0
SSDEEP 96:xHAdTUvqGqjfGozObzSQSSledv9jcnGHtcSXaBw8818L4cnEo1/Gc:+nRjfGoziSSUtrXaBw88iuc
TLSH
T170F1EC789404CB7FB4B6776CAC6449715AB2013BBABF68D750B994C4050CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 8KB
SHA256 8e7bd02ccff0d94d1a6edcf0ad951180ee85b98987fab85c28ae42cfc86ad0bb
MD5 65741efe16fced7b1c2a2d9c6b9d37ba
SHA1 02d0980c5040e2e210d64a751e5aa0136a1dc383
SHA512 934717cac94030ffbcf583e4e03c392c7e7d5aca7ab061078ad6805c786c902d6b3dd426e06c1b3da7a9e8832fa418f3baf642d7fa146737b383828393b20963
SSDEEP 96:xHAdTUvqGqjfTozObzSQSSledv9jcnGWRhBhcSXABw88fgyJ8L4cnEo1/Gc:+nRjfToziSSxRhzrXABw88BWuc
TLSH
T11C02FE385004CF7FB4B6776CAC6449705AA2013BBABFA8D750B994C5054CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 8c546839bfd59e0e23994ebf371ca8c8efc1c4fe3ed1fb79045690205358224f
MD5 a06eda74b6e9f89a748f742aa6e14c58
SHA1 0eddaf93c32fdaaf9d40a535238c02c9ecb60b42
SHA512 b96933142e2dc2030f8c21d9438e3a4799f111d9a165e8a43c67a24b5bbb7fd2ade617a7d45177fc4f6178a7cf6af56aa6d4332d1c44213066e7dc30c7eda96a
SSDEEP 96:xHAUTUvqGqjfGoz1zSQSSledv9j0cnGHtcSXaBw88u8L4cnEo1/Gc:+SRjfGoztSSJtrXaBw88zuc
TLSH
T1B2E10E789408CB7FB4B6776CAC6888715AB2013BBBBF68D750A554C5050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 e488b495272cba9a17b899ac0b7c7e5468a83ad2701844c38cb8eea7db9c5513
MD5 090fc3e9320a0816b31eb990bbaceeaf
SHA1 c5f3c91799355cf5eb488c1f837768e0145d9a3d
SHA512 de0a887a8cb65f9b94b17669ba9bce59587c722a33586f6b0da372ce3c65c839e46d795add405c53e9a8ae1a78d1a2eb5ca392122b983a321751f1a9fb25abbb
TLSH
T10221DA89ED2F2AF222C0C14BE0C90FE9FB5C6010052CB4F1D9AC7A5175DCA8973EE208
MD5 SHA1 SHA512 TLSH

Submit Download