e201f5847b309d6092779929f3064fa8e71ecc84bc9c48b8ab58d6ea1e8afefd

Analysis

user interaction
yes
max time kernel
167s
max time network
168s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/10/2026, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jewish L_0 song starts at 8 seconds.mp3
Size 1.7MB
Sample261018-q8hmbaez21
SHA256 e201f5847b309d6092779929f3064fa8e71ecc84bc9c48b8ab58d6ea1e8afefd
MD5 e49b663476549862677368a3212d2cb8
SHA1 229319a06f68a63c3fe357fc0174ef2768d2ffc1
SHA512 81be4b3ac42ba56d65c904057263efb4c537d0f09a0eb617e28d9eff4ffaab2feb79a6f255b02d34d352ca81614a3a1cf3ecd6a42d52c9997ad189dcb5709cec
SSDEEP 24576:vThmkfHxnFBKr3NckpvESA49HAUthejUCE5402nakexCdczsoBiUasviwnI+fWxO:L8k/xFBZkpvt/heol4rajoGzsr8DuLM
TLSH
T1488523434A394C3DC2FF96710AA329689091FCF61E94A9DA690EE4E894073FB1571FD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\RwDrv.sys	Rw.exe
File created	C:\Windows\system32\Drivers\RwDrv.sys	Rw.exe

Executes dropped EXE 2 IoCs

pid	Process
240	SetupRwX64.tmp
5884	Rw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\RW-Everything\Rw.exe	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-3A5GU.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-ULU92.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-BI08S.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-GJG9I.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-BFFBO.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-CD5CU.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-L2TU4.tmp	SetupRwX64.tmp
File opened for modification	C:\Program Files\RW-Everything\Rw.chm	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\unins000.dat	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-PN84P.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-8S5E6.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-RFB70.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-EK32Q.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-Q10TI.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-J4ORD.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-Q5KKU.tmp	SetupRwX64.tmp
File created	C:\Program Files\RW-Everything\is-M1OI8.tmp	SetupRwX64.tmp
File opened for modification	C:\Program Files\RW-Everything\unins000.dat	SetupRwX64.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4444	4780	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupRwX64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupRwX64.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3128-1315-0x0000000000400000-0x0000000000427000-memory.dmp	innosetup
behavioral1/memory/3128-1386-0x0000000000400000-0x0000000000427000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\RwPortableV1.7.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\RwX64V1.7.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
240	SetupRwX64.tmp
240	SetupRwX64.tmp

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4780	wmplayer.exe
Token: SeCreatePagefilePrivilege	4780	wmplayer.exe
Token: SeShutdownPrivilege	468	unregmp2.exe
Token: SeCreatePagefilePrivilege	468	unregmp2.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
4780	wmplayer.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
240	SetupRwX64.tmp

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1728	firefox.exe
1728	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3556	4780	wmplayer.exe	81
PID 3556 wrote to memory of 468	3556	unregmp2.exe	82
PID 5920 wrote to memory of 1728	5920	firefox.exe	85
PID 5920 wrote to memory of 1728	5920	firefox.exe	85
PID 1728 wrote to memory of 6124	1728	firefox.exe	86
PID 1728 wrote to memory of 6124	1728	firefox.exe	86
PID 1728 wrote to memory of 6124	1728	firefox.exe	86
PID 1728 wrote to memory of 5564	1728	firefox.exe	87
PID 1728 wrote to memory of 5564	1728	firefox.exe	87
PID 1728 wrote to memory of 5564	1728	firefox.exe	87
PID 1728 wrote to memory of 5564	1728	firefox.exe	87
PID 1728 wrote to memory of 1364	1728	firefox.exe	89
PID 1728 wrote to memory of 1364	1728	firefox.exe	89
PID 1728 wrote to memory of 1364	1728	firefox.exe	89
PID 1728 wrote to memory of 1364	1728	firefox.exe	89
PID 1728 wrote to memory of 5656	1728	firefox.exe	90
PID 1728 wrote to memory of 5656	1728	firefox.exe	90
PID 1728 wrote to memory of 5656	1728	firefox.exe	90
PID 1728 wrote to memory of 2656	1728	firefox.exe	91
PID 1728 wrote to memory of 2656	1728	firefox.exe	91
PID 1728 wrote to memory of 2656	1728	firefox.exe	91
PID 1728 wrote to memory of 2656	1728	firefox.exe	91
PID 1728 wrote to memory of 2504	1728	firefox.exe	92
PID 1728 wrote to memory of 2504	1728	firefox.exe	92
PID 1728 wrote to memory of 2504	1728	firefox.exe	92
PID 1728 wrote to memory of 2504	1728	firefox.exe	92
PID 1728 wrote to memory of 1864	1728	firefox.exe	93
PID 1728 wrote to memory of 1864	1728	firefox.exe	93
PID 1728 wrote to memory of 1864	1728	firefox.exe	93
PID 1728 wrote to memory of 1864	1728	firefox.exe	93
PID 1728 wrote to memory of 2496	1728	firefox.exe	94
PID 1728 wrote to memory of 2496	1728	firefox.exe	94
PID 1728 wrote to memory of 2496	1728	firefox.exe	94
PID 1728 wrote to memory of 2496	1728	firefox.exe	94
PID 1728 wrote to memory of 6132	1728	firefox.exe	95
PID 1728 wrote to memory of 6132	1728	firefox.exe	95
PID 1728 wrote to memory of 6132	1728	firefox.exe	95
PID 1728 wrote to memory of 6132	1728	firefox.exe	95
PID 1728 wrote to memory of 2788	1728	firefox.exe	104
PID 1728 wrote to memory of 2788	1728	firefox.exe	104
PID 1728 wrote to memory of 2788	1728	firefox.exe	104
PID 1728 wrote to memory of 2788	1728	firefox.exe	104
PID 1728 wrote to memory of 2136	1728	firefox.exe	105
PID 1728 wrote to memory of 2136	1728	firefox.exe	105
PID 1728 wrote to memory of 2136	1728	firefox.exe	105
PID 1728 wrote to memory of 2136	1728	firefox.exe	105
PID 1728 wrote to memory of 760	1728	firefox.exe	106
PID 1728 wrote to memory of 760	1728	firefox.exe	106
PID 1728 wrote to memory of 760	1728	firefox.exe	106
PID 1728 wrote to memory of 760	1728	firefox.exe	106
PID 1728 wrote to memory of 4068	1728	firefox.exe	107
PID 1728 wrote to memory of 4068	1728	firefox.exe	107
PID 1728 wrote to memory of 4068	1728	firefox.exe	107
PID 1728 wrote to memory of 4068	1728	firefox.exe	107
PID 1728 wrote to memory of 3420	1728	firefox.exe	108
PID 1728 wrote to memory of 3420	1728	firefox.exe	108
PID 1728 wrote to memory of 3420	1728	firefox.exe	108
PID 1728 wrote to memory of 3420	1728	firefox.exe	108
PID 3128 wrote to memory of 240	3128	SetupRwX64.exe	112
PID 240 wrote to memory of 5884	240	SetupRwX64.tmp	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Jewish L_0 song starts at 8 seconds.mp3"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 3428
  2⤵
  - Program crash
  PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {65d79841-e405-4df9-a284-bfca99d885e4} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {1c44b758-d71b-4249-986e-c034a0627066} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3580 -prefsLen 27274 -prefMapHandle 3584 -prefMapSize 270279 -jsInitHandle 3588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3596 -initialChannelId {de95a169-2813-4eb5-b253-12f40c4363c7} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3776 -prefsLen 27274 -prefMapHandle 3780 -prefMapSize 270279 -ipcHandle 3852 -initialChannelId {2255ebce-2b81-445f-a6eb-9ba4770b74aa} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4472 -prefsLen 34773 -prefMapHandle 4476 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4488 -initialChannelId {872cc61a-aa36-429e-b434-305a7a00d559} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2612 -prefsLen 35010 -prefMapHandle 2788 -prefMapSize 270279 -ipcHandle 2792 -initialChannelId {8aedfece-3e7a-40c1-90c8-01580041466a} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32952 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5352 -initialChannelId {74d255e6-9c9f-4c49-bde1-ad7af28212ab} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {37d781cb-9a2c-4b90-8269-50692c552660} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {dddac7ad-9e1f-4bc0-829f-7a63819518c9} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6252 -prefsLen 36885 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 6260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6268 -initialChannelId {575c3e11-d33d-4c6b-8879-220fd2c1053e} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 36885 -prefMapHandle 4792 -prefMapSize 270279 -jsInitHandle 6660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2948 -initialChannelId {0e35d6ee-d1fd-4518-87be-e70950df2db8} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 36885 -prefMapHandle 5428 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6648 -initialChannelId {dd98e7a6-7ca3-4169-9634-7a9f238c1204} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6696 -prefsLen 36885 -prefMapHandle 6552 -prefMapSize 270279 -jsInitHandle 6480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6032 -initialChannelId {b2b0da95-13c6-495f-b6e9-e6540df174e5} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6356 -prefsLen 36885 -prefMapHandle 6340 -prefMapSize 270279 -jsInitHandle 6344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6376 -initialChannelId {0e54aee6-d39f-4547-836f-f563f13788fc} -parentPid 1728 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1728" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4780 -ip 4780
1⤵
PID:3184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3144

C:\Users\Admin\Downloads\RwPortableV1.7\Win32\Portable\Rw.exe
"C:\Users\Admin\Downloads\RwPortableV1.7\Win32\Portable\Rw.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:5048

C:\Users\Admin\Downloads\RwX64V1.7\Win64\SetupRwX64.exe
"C:\Users\Admin\Downloads\RwX64V1.7\Win64\SetupRwX64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\is-GHB0D.tmp\SetupRwX64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GHB0D.tmp\SetupRwX64.tmp" /SL5="$30402,2541098,119808,C:\Users\Admin\Downloads\RwX64V1.7\Win64\SetupRwX64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Program Files\RW-Everything\Rw.exe
    "C:\Program Files\RW-Everything\Rw.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rw.exe

Path C:\Program Files\RW-Everything\Rw.exe
Size 12.0MB
SHA256 5e009cdfc283d7f0d3dd777d40bcd23ecd78d8d7e93fc9cedcfb6d9dbe0b7701
MD5 199f61f5fc23c39dc2b263479d1232af
SHA1 01211988a0d4f1a2f4e70f60bf828ce52b87da83
SHA512 eee5cb1c43861ca10531b6051f7e09de5ae8258016ce7f5455251e97e8a0232b640c94872633abede25fbf564006f404fed59c203ca6db787fe175d228470a0b
SSDEEP 98304:SDaPSrhZQERPoWo+Ry+TZeeqOSyhUNvbymDQlsYJN1K:SDsSrfQEhoWoeJ6
TLSH
T13AC65A17B6A5C06AC48AFA38C9CF9B70E637B885A231D37B1260CDA95F617C54D7F210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rw.ini

Path C:\Program Files\RW-Everything\Rw.ini
Size 271KB
SHA256 192d6e119c68fb57fd64fe784d53351da4ea1fb5df787cc4d3d23748f2dcb65e
MD5 5aef9916b2550066ff7260206d0c0443
SHA1 9e42a37a2dd629088e2640ca07eb36c166c6a90f
SHA512 20c379ab1d33c2df0dc37aa9bf7494f0e01f79bbaae142a7feccf5d84bc8e403d120265690a014e950fc1a5c220923c11f66f095367428bc8c7bfd9799090ed3
SSDEEP 3072:aEnlDaMR4+To/GZxQOVGtyQW1AKbAPX48SJTuqFi8xEJx86fMsWEfL9RDYftjIFg:/VuFuJqYZfnLSu4rGVIo/phS0
TLSH
T13844A39F3A3F24510F7CA23466C73B91A52DBA9C1EC91B05E518D9053CEC42E0BBF689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RwWeb.url

Path C:\Program Files\RW-Everything\RwWeb.url
Size 134B
SHA256 742b170b125576ba684c63780f09be48f9ddafc049e528392d8e0dd124407f5a
MD5 9b058dedc568bb200a6575ae3c37ea06
SHA1 81266012f500c816cc23a89c1b67e7270263d1cd
SHA512 5326020749f307ffb75af492e5b7167926cdc93c57c7e139b789a740b12373146778cc085f81b67ad10e3591e5b453d659e552d154cd97477cd755785eca515f
TLSH
T1CFC04CB5D92441C664418D19E0FE8056979871A480C796E9D14ADA99385E447B054614
MD5 SHA1 SHA512 TLSH

Submit Download

unins000.exe

Path C:\Program Files\RW-Everything\unins000.exe
Size 1.1MB
SHA256 d630e60c655600b1bcb9b5d8979df699ae6b4909f628afb7229f6b466c78e5c2
MD5 3a165498ed2bc12f86eb064ab3204ac3
SHA1 75399add6a29b827aa657f4ecf18c2c4becbedfc
SHA512 0d4b45c0a99c21cf08d60eeeaeea4a9421b24cbbd0f8f0330ecd2ed6ca6bd3c597dcafefb8887f0ed28c6c479d79ca55aa37b535e18e5e44234c508fb9f3d035
SSDEEP 24576:WtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5yTx9CU:WqTytRFk6ek1Ud
TLSH
T116451822A3D24437E5732F759D6BC2945C367E202EB4E54A3EF89E0C0E79B41AD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 795cc4343926b056bcdc3d089d7cd264db53c594050947fd2f581bb09a73f4b8
MD5 468ded5e48a449d77258e3996f7f8c72
SHA1 5692c89479ba34736ee6ef4626ec43c26507a4e7
SHA512 7947a3cc8e84d8f7415388c588aac18b9b83919f63c7749afaaed8e4891c17ff83eb601e577a311baa894183e4104d588bac5c90d682df5727f2dc99e58e1587
SSDEEP 768:r7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjPC:19tQeoVYo
TLSH
T106841037E560A098DB3C75B1E2AC5B4CBD72250B11E006822FB4B57E7A237D4CA4F5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 b668453d83b95669573680b413ad3061f07ef48b88f48067790fab53212ea7a3
MD5 5c5affa70952ca9b0761b9c813d3923b
SHA1 d3183acf66087dfba753ccb59a70056b84a72688
SHA512 075a8a12dff1a9e331d32606d44a27bc8611104485775d3dbb7b48bf5f76659a58e30ac877c3691ee791ffe49a762c27ff4e15cbd285d4cf751e7be6c044353e
SSDEEP 768:d0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbak:LZP2tFP3vqY8LqEMmTaBacg
TLSH
T106258537D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\activity-stream.contile.json
Size 4KB
SHA256 c8a935350b6ba72641fae5ab0cb5a77c603881fedc2f0a5e634774d45f738a50
MD5 36581dd00c00c889859fb9efc36a5162
SHA1 3936723ba4a8573e572987622ec99cc66b90ada1
SHA512 b1a6073a6453390a450c6c23456f9ef2f81ff8aa72a16b9fff9949a7c5da75b8fe75caec1fdcc45aef23d3e88bad641d43af6d838d46efeeae2df68db4895c8b
SSDEEP 96:T78vMbcn3fmBAkQMT+mR+FInysLEE0Ielz:PoMA3fujQNmR+FIyswE0IeF
TLSH
T178A1C65BC5B444161770A5EB5C4F12ECF017B00AC9F0DE6CB39AE91296EC7ADC1DB988
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 db4a4c637d07e66a0d3b09f15cb9c4b3c5c021417549fe8bbeadc33052e9d527
MD5 fba15f295e88e9b6a20f3bc7bfa6eca4
SHA1 7978905cfe27df7d848f02c3837fa11be8234d37
SHA512 d24d59f42998f6c0a294d4ddaa1d1d43a8d6fa4575586c8b2641604b6825a63ba78b3e3e66b778266e89fb38b2037c1b62805a2948bf38280e7948b657334776
SSDEEP 768:0yNirWAT+n/Lp++VaLs4UOQ51HiueCzEOA7tgkpOOrGd8:vNW0/LQ+szUOQVRjEftgN6
TLSH
T1BA7308A3A6ECB1FB1B9037CB2C0FB95766E10146E34906CCECE9C91D81DD654123E6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

12818

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\12818
Size 113B
SHA256 8f011aae3920a52abaaa1c732dd4b0b7c43bc350bac364a1352707d2c4c84741
MD5 c46eaeff97f1be8bfcafae9fcff5d47e
SHA1 e3810a688c7117993684fb65361c31ff74e5aa5a
SHA512 48d815a18d091192eaa67b756471060adfbc7ff91a2a1c949ed672faffe8c059da8767a88ba6923eb93388b66c8bdca683997a174301f16e2191bc3437483de6
TLSH
T1FDB014F30FD75451F5515D745CDDFC4C455535055404D37F75510304013D55355137C4
MD5 SHA1 SHA512 TLSH

Submit Download

15509

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\15509
Size 110B
SHA256 6af9b9420edb1ea7ddae0de195fc993b6f884af264ac9d0d530cad5869801b20
MD5 f3521f871efad1663c7fd0d7a5fb02eb
SHA1 7554f187fc52ce4f4dc98690ed5641d28063982b
SHA512 4f3984d6d815cc0ecc148ff68c7c8b951a0ef021050b3851ac4d6c7d9f9f892d27c8a516922377ba22dff8e2a06ae647229f75f4c527befdb55ebc2b49912e29
TLSH
T1ECB092BA8A829934F20498750CBCE59AA8022845AA200305B7B0070510BAE90581D768
MD5 SHA1 SHA512 TLSH

Submit Download

16256

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\16256
Size 7KB
SHA256 59a64cc1eba03071fac3db2e5ae4a38e9cb85fe89ec11078fda4138c1d65f067
MD5 4bc4a00e9642c523903c8139f9c6673a
SHA1 80c51837e93f53e3d25c130cfd25c9722984d64b
SHA512 f70a32633dcd81ecc191c42ee4c83ee2a07a10410f6380b65ac9197c2b5dbaf1815c75a0692d34c5903b3fbd7ea269ae5db379126fc5a383f62cfbecc52a0882
SSDEEP 96:4HNtoRgbxV3pkYctoRgbxV3SivjCfgp+fY3GxGLxNGLxhIQ90:HRg7C0Rg7CWXp+fY3aOxNOxWg0
TLSH
T152F14C7F4E0930190AD25AD2C04A674F5D51BB0BE9CB89EFE28C3356DCC46B0979D1AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\5
Size 52B
SHA256 8c8be561a6bcf2a18955587bcdebc99351d149a8c45d7502e892e87cb85db798
MD5 93b90447e092803d7b4fe30df44cbab4
SHA1 25a375d9f27ff9fb7bd858016ed6a8f1cf58b334
SHA512 5994a8daddad9f63a19f855a07c662b1e0a958b2e4e052911d31f51b2e3545722d0c1901ab7a213d93b49bbd57274efa6a5fc062792571fc265652cac97c29d1
TLSH
T13B900404CF51D500F01CD0350D00C0F404103F044CC473333CD1177D04130F71445000
MD5 SHA1 SHA512 TLSH

Submit Download

6406

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\6406
Size 257KB
SHA256 90faaef43e970b46169c1e2984a252e8572a88fdcefb3576413da9a559bce763
MD5 bd1b8d35d578af1eed2740d5076a39ef
SHA1 1ebda46f94ef08545dc011e20ce6e32b2b5fcc43
SHA512 2fa5dbab3a8e6b287eee960bdabd7974f6bc3a0caba82af913be46d462abe09b65378c86e6b1d46c30d6f36e81ff482b51e108e4478c97cfd3de0907dfa49a9f
SSDEEP 1536:jYCYPs8HZ2RGkSPrsZSvkcI2ATeivYyhdy9yeUK8Ct92ZFZWkM1SCumR3HHkwTE:TkaZjcqSv2Zj3j
TLSH
T19544F7F3D6AC71FB075296DC6C0D72CF62AF4139DB5208DAFC688148C3C9A651076B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7395

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\7395
Size 13KB
SHA256 d0c4e7226608cbcbad44b1371e6ab4479d8f66154150515741d44275f411584f
MD5 66ac2f3ac93c5b58eb4f6df3df0db68c
SHA1 e7aa78002d0acbd283558b24a6046e8ac392e793
SHA512 8bc6e8bc54e47372d8e9aef4e6df79e11b272ae46a74f7de91962513d742200b2565c8204e0110eb68bd0bdc71a4e7c9b66fcd659aa3267627c1c5b0fdd75c95
SSDEEP 384:59MXV9RLyLV1+yPouKAIzbUwUDWbUwU7p+uL:AXBOVtRFIzbaDWba4uL
TLSH
T15E529FBF8D4C214197E3C1E7E805AE44ADB0BA8365CEE8CC95BC1B511B84A245DE68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07FA11F0C59C4EDE172C6D436E90D1AA460038F4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\entries\07FA11F0C59C4EDE172C6D436E90D1AA460038F4
Size 352KB
SHA256 98b591e05ed0c20d20377e195e05c58c32e77c0ad81797204afdc92f6ada8714
MD5 b606dba120588a6b32232b2563a8dbbb
SHA1 aaa6c5848dcac4e7d118f93c46db0e6c0e39ed68
SHA512 008e99a74bf03155d56a1df601f39351cf8e2c197ae5e752088ded402c603dd4a4eaf8a0cd9f7891bd6243bb7572bee22f9aa7faee11385f2ee897c777ca4ed3
SSDEEP 6144:5JterkJiB53lK9lud6XRJs4GqwCXjiKjvZbJ7qVZQf/C2v4gOcpv6kWWNbu/:5ebsk6zGqVZt70Qy2v4gth6R
TLSH
T1177423291F6F760D59889B50BD9A3B918C559B7D9501B8FC920386EDC609FF9C2CE0CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A3AE17E7A9DC3ED904B9B47E307B7686C51CCDFE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\entries\A3AE17E7A9DC3ED904B9B47E307B7686C51CCDFE
Size 204KB
SHA256 c62d3c51992469476f1b55beeb15d3fbb1b7903430bd31c5d0364d51717243a6
MD5 6b16a4e88e4a3c56c77b145c7a94ed59
SHA1 cfcbb06c7f9454d8de231d5bc07ef4735166631e
SHA512 ef0dcb77398b1aced04e112cc2fa500cae97564dd9d1241c8e00919b59d36e1aca21caaa48be31d9cb76d57c356f0364ed365acfb58b76723af606eabc9a87c0
SSDEEP 3072:p2j39EnpcQmcric2r3Tmxn8gUavOb8siy1TqLTSOyfzd/knMHmhaJwajMlrMO6Kt:c4uXrcxy4u/+5MJwNImLr8Je
TLSH
T17A1423B28F4C735BB10284DEB1641D882442BAF95967937AC00B1772BF9C3E5CB2B59D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 2617acc32cc80baa2553ca4778e02d50ee02605f47f73112b67899e8b715520b
MD5 75baa34a545563be467bb99c16f539f4
SHA1 81660e92c794a1cf9d7325d652c4a218a24f142f
SHA512 637fcd2a3a39449c33d726868fff74d1fb3228c7efbcb098026fcc2adabca01d5de36596e4911f42064f22324999a4ffb7097b3ebdf6ed187a6840282b043807
SSDEEP 384:HGNQiO024YeWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAo:mDZYeWTToXJWTTogB7S/AmVAf+hRMJ
TLSH
T10B728E7D8F023CAD175780E8C8B683598D18B6EBDFF6C06D25883D09C988A5671FA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTneYTbeoEBTcBcTruXfLof4oQe4Zg75QaCwS4Vq9Kk=.ico

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\jumpListCache\NTneYTbeoEBTcBcTruXfLof4oQe4Zg75QaCwS4Vq9Kk=.ico
Size 691B
SHA256 6574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8
MD5 42ed60b3ba4df36716ca7633794b1735
SHA1 c33aa40eed3608369e964e22c935d640e38aa768
SHA512 4247460a97a43ce20d536fdd11d534b450b075c3c28cd69fc00c48bdf7de1507edb99bef811d4c61bed10f64e4c788ee4bdc58c7c72d3bd160b9b4bd696e3013
TLSH
T15D0194C2B2203025F81A82B05613C895D04E81EE0998A42A8CA7D1F6A848A23958EFE4
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 a3cc68193118acba97759d32cffb936160a9c6af692b7041e9500eb21734c02b
MD5 c5e5780ba1a61233128d612165353b7a
SHA1 5658edec06feb0ce659cbc368cf9184c8275b5fb
SHA512 56b4dfadc7b2172312a1b0904f3eebf26e0954eff7ebaa5b112826accf3a3d798ab46aa41503585f1b4eb2f325de03074a601261df29f2ad3b2d54b982b1b4ce
SSDEEP 3072:j3ldHptLHn9Tqvyn7aibjFRMJesiVGYIwF:pdJtT9uy7aiXF4biVB
TLSH
T114A3AEF6DBA2CD7D65FFD42D9B82893EFC222410B3A7200DC963671161C6B747279648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 1ad0134f137a817b93062f4ef88daa971665d93d2867a2a5c782fbf78476c0e6
MD5 6c864aab74929f339226c469ab651b91
SHA1 fb83a300bea5cb9f0ef3228a61765d44983a8295
SHA512 0ce0e47d43edac55651b87c98f84883d23b5b49bb0becc9c58f7a6d02689cf2aea311fe76f8c9cddac5ffbddb1aca1e7c6f07e829d1b2845f09f6e39ef805639
SSDEEP 3072:X3ldHp7W4VFcfd7qs5n7aibjFRMJesiVGYIwL:FdJ77udz57aiXF4biV3
TLSH
T19AB3AEF6DBA2CD2969FFD42D9B82893EFD226410B3A7200DC863371161C6B747679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupRwX64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-GHB0D.tmp\SetupRwX64.tmp
Size 1.1MB
SHA256 6e8a32bafb0b2099074fd092cc6b326bd4ee4c0dfde10bdfffd5cd84fc687497
MD5 74713fc3e9983c6e148c083599177e66
SHA1 3421bfe392a1c66cadcb3497385f5887463451d9
SHA512 021977dd715c8e6741c6a431a19d57c1477b9de43fabdae665e9963de7ed67b838721e91d7ab1a8dba3c8b30fd96a9966b33785728e986fdc0d790cc2c11acf5
SSDEEP 24576:etdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5yTx9CV:uqTytRFk6ek1Uu
TLSH
T167453A22A3D24437D5732F759C6BC2946C367E202EA4E54A7EF99E0C0E39B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 ba5bbcec26babad88707fa67addb100fe0413982c01a5efe70eb3c542fe4adaf
MD5 292c65d331471d8859d17c2733e18060
SHA1 1433976e0029c04940a0456a0de4c6d07ad6efa0
SHA512 fad77036de54fdb26e9a6b32e97f363a6cdd12f019a47e84993fab10d9ae825fbe88bc682d1ed331e5e8f06c7d1ec0277662c0902b18f82e4ca7a16897dcfa36
TLSH
T13C2149970A0A9470DEA007BB79DCCA36B37AE7CB5764D126B28A982E480513DB73D05D
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\AlternateServices.bin
Size 22KB
SHA256 96402b08634cc866aef6e536e06661d84fb4a5cd80a150640a7e3625f9137e48
MD5 d3c6fc20b3c8a6623b40ca8dda195dc1
SHA1 af1bae94c1e499751d452b8062d41844eb68a2f5
SHA512 b390ad74aa225352f837bec88c8eb7e4c54853a97e2dca45f289bc8926e38831a3eaeeb503fd16efb3fd31a92e611cbb47ef5ef409300fd414cb595dff545e5c
SSDEEP 96:KE47msvRbHB7R+I56WR31R7BR9M/pqRKuR5nRLFRRbR5ZlRCyx2ER1yuZTRpy8tl:oNQwk22YZZfFt
TLSH
T10FA281F32FF16463F1A28FB054A8745C9C331729986CE2C5C65990E20685AB5E1BFF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\AlternateServices.bin
Size 10KB
SHA256 6e9d7f760a2a7feaa932470583b04badaedff75e0e6e1e89eda6eeee7921c503
MD5 99ab577e8aae394182d9a0ef9df99f6e
SHA1 20489729e99b8d6ffe47cdb09f83b862a6982a06
SHA512 8864348c3f3dcb4612324102876b5319c6b79302faea4df6194bd8966785863c6591e702f92099bdb4816c183b6e50f5b9800c68f59f6cfde17cc76c7274b60c
SSDEEP 24:juhMZqjnfM+lzLnfE91ufJf9B9jfJA9x0fJv/9VvhfJu5q9F55A5gfJ39FVfJ:KE47+YRFPjRK+RvlBhREI56gRN7R
TLSH
T1892283F357B5A063F0A28FB15058354C8C331725A96CE1C5C65590E356C1AEAA07FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\addonStartup.json.lz4
Size 4KB
SHA256 d6b8ce7ef3076968dcc917d712b82fe03a8fa89a0fea54ed45da3a8a82abf0f0
MD5 6208d2451e11e8599b281c4bcdc77f2f
SHA1 31c4aa4bc6b73462fb11b446441c7e823715370a
SHA512 c33b55483f697668d7d951dd4b5b40183c78565789486b60282944ea4370a34da9ef21411e8cf363437fbb191026e263178f0aa58951e15cd9a4673b4acd379d
SSDEEP 96:NxWG4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NI52xxhD8rGvm6ApwnHUuhN
TLSH
T13AA17D7AD542EFA2FE32D04758D93FB2EAA59B7414A9C4D4F1AE71294C34A735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7ee349cac4f7a077990046b456fdf11ebb2236f2360c56f22b3eefeec2f972de
MD5 ea3490500deff4d2c87ece6eb702f6d6
SHA1 e05ab77ae27008761d653626fa957ff1f9b649a6
SHA512 4378c5ec7b94b7208c9369c337344c24f7c9f053c2d0a6c6edb4243c387485d35c1d66956faf2d7b790166909d3534701eb10178d5474d0b76f3322c0017b63e
SSDEEP 192:oOv5zboH+yFyjwOhl1d66Joz0dzgCl6mc0dz:TboeyFyjJd66JozQzgC1jd
TLSH
T12DE110A4EA28863FC408427BDCA51B410F35399B9C4E3F19359CB55C2C4B2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8c43e806aeadab647065e62d14035a59630e5b52d62581c681d2852674b16d35
MD5 2b2549d0e74acaceca9f3d2857d303a3
SHA1 1e7cc5ef2e1350e2a09f90b20d343512add9fce3
SHA512 e664aad1a69653414487aa19346bd07a0447be127340a2755a3ab2e73933d658adad22200992c4525ee21199c34ee8130025e7f271a7d7828b033bada9c270cd
SSDEEP 192:oOv5zboHTyFyjwOhl1d66Joz0dzgCl6mc0dz:TbozyFyjJd66JozQzgC1jd
TLSH
T1BFE111A4EA28863FC404427BDCA51B410F35399B9C4E3F19359CB55C2C4B2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7e219e5b3526972ebdd95166ebdc2b8363a70e4bcf544366e7fbbae61a1c3274
MD5 47986d4e5c35b4c84e744b0ca00e8dc6
SHA1 863c57434949a0c022c5a8eb903ead1e1b0387a6
SHA512 887927bd1e06ba22ff69c8dc0987872499972e9ce98f1116564886c97307df662a5751957cfc2c53cf011be03b282a200d65d222d287b0039a2ce5f0daa4c56f
SSDEEP 192:jOv5zboHLZyFyjwOhl1d66Joz0dzgCl6mc0dz:sborZyFyjJd66JozQzgC1jd
TLSH
T16FE111A4EA28863FC408427BDCA51B410F35399B9C4E3F19359CB55C2D4B2DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8f69f096fc40e975a1c97213de9e264f4c8d0cade8956db0ef568fbde1e3418f
MD5 b0fe9446a2e700837805f9f2b31dc9e7
SHA1 85ae0684e5ac45346dc3ce9bf3260a26fccc352c
SHA512 1cdfcb666955ec0867d24785fbe7a1dc9984083925a7b3f8ca0992a0dc7e288e84e70587e8c963b80bc64ba27034a7f2ed27b7b3f4fccb60bdd799bd94ac12b8
SSDEEP 192:8R1d66Joz0dzgCl6mc0dVOv5zboH+yFyjwO:id66JozQzgC1joboeyFyj
TLSH
T1C7F100A4EA29863FC408427BDCA51B410F353897984E3F1935ACB15C2D4B3DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 96a3479ab9f45c4f72b70ad7f79a1acdb2699620f7cd308617511176f0fa1912
MD5 b459f3bf157c519c73adcb18aa129f96
SHA1 6548b871d17b459a9c7500fecba65a40c4350288
SHA512 704cceb3e6952a7efddf0e2d519509170b1354bc968445e725b9b4de739e733562af608b12fa1d288cc611a30121ab52e5ee588dbda4bf816964fc7da7024744
SSDEEP 192:tl1d66Joz0dzgCl6mc0doOv5zbooZyFyjwxI:Zd66JozQzgC1jtbooZyFyjf
TLSH
T132D1FDA8E729863FC448427BDCA51B400E35399B984E3F1931ACB55C2D4B3DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\events\events
Size 1KB
SHA256 dbef2c68c1bb7f6cea87f4c7eebe1e4832140fdf4ce4a6b10ff65fe22d41897e
MD5 391fc9f1fdb2b9dd50bf1ba57f1bcff4
SHA1 19ea6358869d6669009d7cb8d88f738e9e4dabf3
SHA512 757b3d986bf03481be49142a0c6d97207b0ba8d45412fce69218e05e7202a265130e5afb10cf4a85359e861b99ba333e592397a7b6895239c105576d450bfed0
TLSH
T19621795C3EF84D6A9CCBFA5C7491028E93554A0B048B5C430D42EF8DCDD1AD931AA83D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\events\events
Size 5KB
SHA256 8127495e8bb13d140c3dbf285c12a1b9a2e12e5605f79ddb17ec87c215099329
MD5 83cd7032d0e90f46960674155e961569
SHA1 94ce36c2440fbfab38268e80fc76f2ca54b6d689
SHA512 8ca90c7952048c81372e9039d3ba4b08150dff9f32c9e6613c38a6a5caf0536d3a600211881f8ec59ba88fe34732c2e0879b3ffb6b108d25b2a04dce9446adf3
SSDEEP 96:yDrhcYZ4WopSe2Kj6oTZYiZY4mKrKyT3z471df:K1WWBe2un+xCIf
TLSH
T120B1FF1C2AF90C7F68DBE6ADF441069D83D94B06D08B1C474CDBDE89CC86A99329F42D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

205d313d-a3b3-40e6-962e-b67ede1fadb5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\205d313d-a3b3-40e6-962e-b67ede1fadb5
Size 235B
SHA256 b1b375b1480d42c3a196b1ca3df1fc4984fc0b401a8af6e23538aa45acb800d0
MD5 73c3856a9de5f2ce83a65d6497155236
SHA1 1786bc245851af116a852fe950dd5d9f0b71bf86
SHA512 465c6fb28e97b565f8250887e2b346b8c7247f2144fd64a6950c9c16eb419e401d2e5e95012657d2c183b2dbd774fc975822d1f360e0d3c60fe82950e5fbecf3
TLSH
T1E0D09784A8A8279E18184F07F0E26ECA30844C3311A49C64C9A188B48AB9FC80321807
MD5 SHA1 SHA512 TLSH

Submit Download

2f9acef2-cd51-470c-ad2b-4805fc81bb8d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\2f9acef2-cd51-470c-ad2b-4805fc81bb8d
Size 235B
SHA256 30625db6602f7f131ce7fe55cfb543eba7de2aa7079fc9955f557cda74f9d3db
MD5 106b2ffe122718165055ef7482e767a1
SHA1 fdee674b3c863eefac731c7aa80cf25705d4dc9a
SHA512 80badd3daaa12e2e00d77825aeed3c6404afea1ff1a3f7096f9529f5e85b4f0ba50c1f2dd35d0ac713cc6a2494aba4f1d2852f802dba4cb825c3c80fa8e8cbb6
TLSH
T1E0D0978424A8631D0810AF17F0A078C230C84C333478E850E99100B889BBEC641A282A
MD5 SHA1 SHA512 TLSH

Submit Download

4300d9c8-a5f3-4997-b3d8-48e2f4380069

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\4300d9c8-a5f3-4997-b3d8-48e2f4380069
Size 16KB
SHA256 a19abf4173af1f336dc1ad8871a5d3be4212cf1914871c7c91fab0eaa8197fce
MD5 5a6041159189bd83f04845167c2c19d0
SHA1 3fcae1e9a5256952b9c1ffccfe38b808c43f2571
SHA512 aa0a882e4bfbbce0b6ab8179230495066072469d44ce17467197abdd67137235d2336f0b48317c7c99ca586105d3c35f4b2d350fee8626dc70c6ff2d8fbf8614
SSDEEP 192:kyyd3/zHi7dSRitUHxAFZWLdfW8QgrGRdreUUnNPEAjxRQFoaPQDdD8Hxm1pk9N8:kZvbi7dSRitUHx+CtGWDA9NO4KF
TLSH
T15C72D956282045BA8691E36994F87FC3E6F52CCF4C419FCE9BE4BD0869DE06E1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c3c08a7-2948-490a-91b3-6095ca33b94a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\5c3c08a7-2948-490a-91b3-6095ca33b94a
Size 886B
SHA256 41962940232df815801e63494bea32119d3059490959271a0c122011ef4db76e
MD5 a36d1a7617cd80e8552a38f2dc483d5a
SHA1 06a7c4edd4addb895f8461ee2c0962065d922724
SHA512 556c7df7b3b16fd559a8d60d5ac158971b7a235da0de62d57b3b7ad1366e89dca954e7306736a8c437f2ebba1d38714768a7cfce77c564bdfa432c72950aec81
TLSH
T18411DC918B34B9B19C68E28B98D5B74246F07023C0CA19087D64AA184DAE61FA6A7607
MD5 SHA1 SHA512 TLSH

Submit Download

b057233e-d58f-4dea-a971-907466a4a588

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\b057233e-d58f-4dea-a971-907466a4a588
Size 2KB
SHA256 702d4c697d0f5f0876e7c8e8da43d558781a93ab6fcc23eb72f9398cab407756
MD5 7cf728e9a813c5770c379f19d2593697
SHA1 d646ecbe5afe855f7129f1111f3c616865a728b6
SHA512 d6913c7f2d73dc2faaed23de35331b854f4e2fb6a8f0ff690324ae0a393971f14c58a1aa1024da1bfe6d52d102ebd064fd2ae5f67d4bd361d0e18687624dc602
TLSH
T1A6411158B5B88CBA5CCAF55D9481338E63248E1340C63C836E51EF0C8DA769E637F527
MD5 SHA1 SHA512 TLSH

Submit Download

dc44d923-a624-4e18-ae20-998d656fdad7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\dc44d923-a624-4e18-ae20-998d656fdad7
Size 883B
SHA256 3558f9b72d845af4e00b66035047d363d01595317ac96737888570526f6c69a5
MD5 afaeb56f6f51f9524d82d85f5c09a144
SHA1 5918e6a48f366605f185e4e2561b0da8109ceda8
SHA512 6238b767df81b477c440f8d67850a62539d26f8b543c40e35ef68b0928767e621707c4b4581345992db84792587dcfa60f6596e3162ae1c9ab21d74851ffcd91
TLSH
T14211DC80873576F1AC6CD24B8995774656F4352380CB54083EA4EA080CAE62F93AB207
MD5 SHA1 SHA512 TLSH

Submit Download

ffb1ae56-3da0-4037-8fcb-05b91f76ef8c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\ffb1ae56-3da0-4037-8fcb-05b91f76ef8c
Size 13KB
SHA256 9e583aa511cc4d0a41637685c212c3e8f0d8ced5b04008c8157066f31e9eef0b
MD5 a2cc5d9775040fb91bb4b3bbdff69fe8
SHA1 8bcc488266ab686b3711b8e8142a40ba6f08ddc7
SHA512 4ce913e260a12aad206efc20b1fbdd2ea04834f4494064294ce535c52aa8159dea816a3b5f5e6815933cf275bbe21a26794a29e883c78c24ffc35475dd47ac4d
SSDEEP 96:pvlxN1U8eX2BhKCrof4X/6dYtbs7LJfSS++f9crxHDRLTfc+qmnNEiMOrUka5Qzj:pvlI/S2mJyNF+I5pjT6N8bO3FkopmnAB
TLSH
T1EF52CBFEDD2240433A65F629F1E8BDAB0066293149CCC79D6AFC4C3A32D2AB71517715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\extension-preferences.json
Size 942B
SHA256 00dc2290dbbdce30a85e06ded26d7ee786412fa45c1348a801bfe2c13b9c63d0
MD5 b9aeb15420f1636d61ab0f72e3852464
SHA1 34f4c6b664d0d5b663678c1552686723e8cd9cbd
SHA512 f5d138a42649ea001273d8f516dd0e5f91aae04ccedcaa1da9a27e3f5aed14859f02733629a52af8c98fee0b5dc70998b4c27821fb8a459349eef4b1dc15b14d
TLSH
T15411F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\extensions.json
Size 14KB
SHA256 d09ca0123f66c361cbe597b432ff7bbf7a1a5ff2d3f874d43103f676fbaeb523
MD5 b171d4f5593ac0a0de195f2a996541a2
SHA1 27190efeb3b71f2b0af5923ef412321279b005b5
SHA512 f2d490e87c5fe3be745c6e7fb074f55660c3c5d99ac11e3c55a61baa39a9eaf0508e06f51e4f96894c5d7bd5aa314d3e474d945d6411a02cb77a86e4683f14be
SSDEEP 384:gEkI4vAUmldvTC8dhW794zv96oAL4HwL4PbL4HrL4HuL4HC:gLI4oRfDXW4h6N4S4f4X404i
TLSH
T14962521545048EB8298FA79BAA367E01D37D473B70445C78F4DD8FC842FA5B902BB62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\places.sqlite
Size 5.0MB
SHA256 586d75606da5bae31ca7590f044aae1b752709e06a43748d6c9401ac42c2bc14
MD5 18a5aade6f77c80bd8d247dd8bc75380
SHA1 6039f86d4cb388a1e8420400faf9c5fb24e32fc3
SHA512 691b60876f304f06f569505c5d0ad5954ca6fae6efa394bb8bee1fff33e1bb15ae67fe7dbf707be8afcdac7e9695391a2dcf6960c6b9ce4e823da4767516139a
SSDEEP 384:M8r54w0VW3xWEQhzolhY5dLz21NJi64mux7z3:rqVW3oCEFx7z
TLSH
T13B36D96B6B205052D4DB9231ECE32B180C3F71168E3672A23C94296D4DE4B23B95DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs-1.js
Size 6KB
SHA256 916ca3e4a5a8a62ce83b6ab29464d74162332bc1d19dddb2a93ca3faccc5c7fb
MD5 7bcac2737fb3b43eeed1965b07a7feb6
SHA1 dbaf2204bfeaf3dd875852bad195e2c0fce844fd
SHA512 a12949bea335305802f45c785be152b56fa350ba711c9eab8a4ca72f2b2cd3db72078ea47c259be47a1691bcd54bd3322f8da99bcf39fea88bcdb21419555783
SSDEEP 96:xHsUTUSqGqnfSlE1zSJSSlcdv9jSgnuH6tZBw88H8L4cnGLEB:WFRnfSlEESS/yZBw88bs
TLSH
T11EE11E7895088F6F74B6776C6C6888315AB2013BB7BF68C750B95485054CF3882FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 6KB
SHA256 f3827f00d88804e3805c59a949b57ffc5732c32fa2e8a12d0c355b38c1d0ba35
MD5 55f4599e8adfd7aff49ec01eb386e8b8
SHA1 5fe0e48a80b265fdb3512c0e15b6fa4d3c7595a8
SHA512 a9d7c9f1fd749e8457e1351b86c075804419a16caf180679a71fed2db1e4fa23ee9c6ac43ab452d2ae275e8c09d96c7f431529fbff4d8ca06564aa4855ba73da
SSDEEP 96:xHsUTUSqGqnfS+q1zSTSSlcdv9jtBnuH6tZBw88H8L4cnGLEB:WFRnfS+qqSSC2yZBw88bs
TLSH
T15CE1207894488F7F74B677AC6C6888715AB2013BB7BF28C750B55485054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 7KB
SHA256 b6a696ebc4a95ec197428ef7d3178dc847d55a70a77ba330f23d8c9b1ab165f8
MD5 e5117fb308414e33b880f3eb9fa0bbfb
SHA1 22c3fd93c16e0f7f31140cb116084985b8db21c9
SHA512 9300faa19454d04ccce2b85c55d7e1a9ae29954d527b92122a5819d6135cc69de76121d563273e9918adbb356078b9ce5129cabec47b6bcc54aab5db49caa2d2
SSDEEP 96:xHsxTUSqGqnfSlEObzSJSSlcdv9jSgnuH6tZBw88La8L4cnGLocGS:WERnfSlELSS/yZBw88YP
TLSH
T14DF11E789444CB7F64B6766CAC6449315AB2013BBABF68D350B944C5094CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 12KB
SHA256 f6f4693b506b14e966ea9b05a6e0326fc09002ef432438d02844e89d2f301d21
MD5 29e3b8005f9ac3d091bb21cfa534ebc6
SHA1 7b62ba44dce378b0060d7c79b3b07f86df7ce0da
SHA512 17755f0a1f2a8bf441a45ee47549554b503b885db79a77cf255e96b9a108b5fb2a23cf9c4a2ea6cfef111c1fb96786c2c48a53ca124f78c81b0a83bca593470b
SSDEEP 96:xHsxTUSqGqnfSlENbzSJSSlcdv9jSgnupwoDReWGtIGzOBw88a4wWo958Jf2r8LY:WERnfSlEgSSBLRwxOBw88a4E958JfeP
TLSH
T16842AA3851818E3F60F2327DAC654AB059A14127BABFBCD349BD84D24C4DF2451E7AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 12KB
SHA256 950751ab4ac582b4f12cae91f40d583fa440b3d699665cd5470c4c3636578889
MD5 dd7caa0ce0a6a7a23de5e4e639afb49a
SHA1 43ca19e083bf82859858728a42148e271f64c82b
SHA512 739fa5abfbcf0d86e2524dd52473aa9fcbcd7b0c160ba3482c0693bef917df0621f2cc9b93a92f6b43c2581187bfc4f90359c670cba08826836322547c243de0
SSDEEP 96:xHsxTUlPqGqnfSlENbzSJSSlcdv9jSgnupwoDReWGtIGzOBw88a4wWo958Jf2r8s:WECRnfSlEgSSBLRwxOBw88a4E958JfeP
TLSH
T1C342AA3851818E3F20F2327DAC654AB059A10127BABFBCD349BD84D24C4DF2451E7AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 7KB
SHA256 280a284ba65ef112458714c6170ebdaa5b9791fc0b8d9d5e4c29cba2a74791d0
MD5 383edda60bdb92c26f43bd63e4cb0f7e
SHA1 9508552ab21b599e6a6959dc7607f59f9a3908fd
SHA512 4235f9453d696f9c0ca0353432a5b881152ea9645a4d2530cde77e029f269ca1d863aa74206c057928166f5d8e6ba0688f18b4317decd66b6de102b4e3bcafc3
SSDEEP 96:xHsUTUSqGqnfSlEObzSJSSlcdv9jSgnuH6tZBw88H8L4cnGLEcGS:WFRnfSlELSS/yZBw88bj
TLSH
T198E11E7895088F6F64B677AC6C6888315AB2013BBBBF68C750B554C5054CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 193B
SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
MD5 2ad4fe43dc84c6adbdfd90aaba12703f
SHA1 28a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA512 2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
TLSH
T165C012C2C6565071CF8365ADB26C7B659E3E04F67665064470ACD54C147B027421B443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 08b6544a6c25756424b7708a24c35b1c510e5d37cc7a9aa3faf1f9bf1cb50798
MD5 a795b7e3bdf24708b0c5c37a0314da99
SHA1 aeee4676580b675e61ca1d27dfa0a278b211e157
SHA512 177a19f6d7957893475e7d453b150dd1fe4f3e1092cfdbbe2ba4ce3acd0f79cd8f2610bed2fdeefe6d69214e60fea31fcb1c888d351e005c167e71ad468cb58c
TLSH
T1CF2163939DBB2DF97A66A22690815FE5CB1E2031C4B604B0104E4A02A88B84D63CA11E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 30fb04217ba47ae507a0aec2caf9f57fbc2a1c95ff22853525c0f62f01fba212
MD5 18bc292f595b96a8ca2831460043e8e4
SHA1 51acf1f6e1bf4322bee49fd13c7b3a77dfd4b94c
SHA512 a4d62e9b2b5df4fd8e6af55d680fefccd77309ee9e023d87c97dd9ac08c9183b33dd09a0e798d67d3007a557cb81352c7f2440a1fae90e40f5a1f779c0e5d741
SSDEEP 192:ataCE9xocQx0z+AOeKwyVcwgB3Di0v/4S:QXE/I+DOegcwMpgS
TLSH
T1BCE1B077AD3265E27178F1744CED1FCA8313149446FC16DF9F09AD3585D8B228591329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 933B
SHA256 ee6411f3b45eb5b9b13baeffbc1dcaaeae6d6e80eac9b0395e3b17f429daac46
MD5 44910bf80fb0b6b6a15a1505bb15c271
SHA1 5f582e638393d918b1309438864ceb3d844f7af2
SHA512 91ef222912af9626ef006ab364fd25188a2f08732c8d81f7386da0c12b06711e76305987ff80e83ae0999116aa7d14bebceb765c26e1f3d775339215d533cb8b
TLSH
T1B91184D5EF3F28723950A005988A1BE18BE8207506A550B4F84F5A424BDC25F76FA347
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 8KB
SHA256 0a47834d9622394a493838003db7d6018c6191a264c376df03f3a2fa6a0c6be4
MD5 df52bf9f0d82f6416bfc7eb79a014472
SHA1 0f2fdc32ed068eb63004ddd1a91f82b78ca4c2ff
SHA512 3bc893168f6cb37ae28a4192d0d69f67fefb0f09c9f46e13db40186fef93da31875cc42311368e3f2ac66beff69e224029cc5394edb36440261e423d9d01f170
SSDEEP 192:eHtaCE9xocQx0z+AOeKwyMDBS5DaBiSFk9dCl1g4Gcu:eNXE/I+DOe1NS5DaB9i9wl1cJ
TLSH
T1B9129EC7F4B42D945279B1E500ACBEDB0B46046E83F422CEDF087967CCAAA654A95171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore.jsonlz4
Size 8KB
SHA256 4943c4166bee11dfdcdb25d1d92caa27c0672ff70164ff8cf95d725030adc174
MD5 607688c56719d2cd9539b8ce7fef44ce
SHA1 ae1f210871e1dcdd9ba91b6ab56f52eae182c9f1
SHA512 e0ae1cac2ef098b1fcb896fd42c0bb4bbd87f789935a6cdc48537412a1e501e4ebb600f492ff2a1bb9bca08410a4e802375bebcff01575649626b376eec85bbd
SSDEEP 192:JtaCE9xocQx0z+AOeKwyMDBS5DaBiSFk9dClsgh2k:jXE/I+DOe1NS5DaB9i9wlscR
TLSH
T1B2128EC7F4B51D95567971EA00ACBEEB0B4A046E83F822CEDF087927CCBAA590995170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download