89328a225f7a24fd445e04aa939a309df87a55d709fb7914bd9df5abc50b3680

Analysis

user interaction
yes
max time kernel
574s
max time network
572s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rex_sp.dll
Size 2.4MB
Sample261023-ank9psvxcs
SHA256 89328a225f7a24fd445e04aa939a309df87a55d709fb7914bd9df5abc50b3680
MD5 4254dd61f7b3d1b6b8f76c10a6340c9b
SHA1 1001923f028628c37714811ea3edef00dfa4d2f1
SHA512 12282a84219b1f775ced86bf7e60bfeef2d67a82ef4d9e1268151e4296d237f2b34bb2952820c5829133ee497ef151b842ac028f2ba7966042d418950cebacdf
SSDEEP 49152:F7XFGuJLkTDMx/oR9x6PjWE31RtMhhzJZVRIPu4TGqegq2:3LiDbkprI3Tp4K0
TLSH
T171C5332BFB1D207AE315C5B4C7860BDB2A627C955980BF9763100EF54D92EAC3A6D3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
40	2880	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\rex_sp.dll:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1908	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	firefox.exe
Token: SeDebugPrivilege	2880	firefox.exe
Token: SeDebugPrivilege	2880	firefox.exe
Token: SeDebugPrivilege	2880	firefox.exe
Token: SeDebugPrivilege	2880	firefox.exe
Token: SeDebugPrivilege	2880	firefox.exe
Token: SeDebugPrivilege	2880	firefox.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
2880	firefox.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1908	OpenWith.exe
1604	AcroRd32.exe
1604	AcroRd32.exe
1604	AcroRd32.exe
1604	AcroRd32.exe
5412	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2880	3992	firefox.exe	88
PID 3992 wrote to memory of 2880	3992	firefox.exe	88
PID 2880 wrote to memory of 4044	2880	firefox.exe	89
PID 2880 wrote to memory of 4044	2880	firefox.exe	89
PID 2880 wrote to memory of 4044	2880	firefox.exe	89
PID 2880 wrote to memory of 968	2880	firefox.exe	90
PID 2880 wrote to memory of 968	2880	firefox.exe	90
PID 2880 wrote to memory of 968	2880	firefox.exe	90
PID 2880 wrote to memory of 968	2880	firefox.exe	90
PID 2880 wrote to memory of 3656	2880	firefox.exe	91
PID 2880 wrote to memory of 3656	2880	firefox.exe	91
PID 2880 wrote to memory of 3656	2880	firefox.exe	91
PID 2880 wrote to memory of 3656	2880	firefox.exe	91
PID 2880 wrote to memory of 908	2880	firefox.exe	92
PID 2880 wrote to memory of 908	2880	firefox.exe	92
PID 2880 wrote to memory of 908	2880	firefox.exe	92
PID 2880 wrote to memory of 1088	2880	firefox.exe	93
PID 2880 wrote to memory of 1088	2880	firefox.exe	93
PID 2880 wrote to memory of 1088	2880	firefox.exe	93
PID 2880 wrote to memory of 1088	2880	firefox.exe	93
PID 2880 wrote to memory of 6028	2880	firefox.exe	94
PID 2880 wrote to memory of 6028	2880	firefox.exe	94
PID 2880 wrote to memory of 6028	2880	firefox.exe	94
PID 2880 wrote to memory of 6028	2880	firefox.exe	94
PID 2880 wrote to memory of 3288	2880	firefox.exe	95
PID 2880 wrote to memory of 3288	2880	firefox.exe	95
PID 2880 wrote to memory of 3288	2880	firefox.exe	95
PID 2880 wrote to memory of 3288	2880	firefox.exe	95
PID 2880 wrote to memory of 3224	2880	firefox.exe	96
PID 2880 wrote to memory of 3224	2880	firefox.exe	96
PID 2880 wrote to memory of 3224	2880	firefox.exe	96
PID 2880 wrote to memory of 3224	2880	firefox.exe	96
PID 2880 wrote to memory of 4420	2880	firefox.exe	97
PID 2880 wrote to memory of 4420	2880	firefox.exe	97
PID 2880 wrote to memory of 4420	2880	firefox.exe	97
PID 2880 wrote to memory of 4420	2880	firefox.exe	97
PID 2880 wrote to memory of 1680	2880	firefox.exe	98
PID 2880 wrote to memory of 1680	2880	firefox.exe	98
PID 2880 wrote to memory of 1680	2880	firefox.exe	98
PID 2880 wrote to memory of 1680	2880	firefox.exe	98
PID 1908 wrote to memory of 1604	1908	OpenWith.exe	100
PID 1604 wrote to memory of 4976	1604	AcroRd32.exe	101
PID 4976 wrote to memory of 3180	4976	RdrCEF.exe	102
PID 4976 wrote to memory of 4284	4976	RdrCEF.exe	103
PID 4976 wrote to memory of 4284	4976	RdrCEF.exe	103
PID 4976 wrote to memory of 5024	4976	RdrCEF.exe	105
PID 4976 wrote to memory of 5112	4976	RdrCEF.exe	106
PID 4976 wrote to memory of 5492	4976	RdrCEF.exe	107
PID 4200 wrote to memory of 4080	4200	cmd.exe	111
PID 4200 wrote to memory of 4192	4200	cmd.exe	112
PID 4200 wrote to memory of 228	4200	cmd.exe	113
PID 4200 wrote to memory of 1560	4200	cmd.exe	114
PID 4200 wrote to memory of 4872	4200	cmd.exe	115
PID 5936 wrote to memory of 5012	5936	cmd.exe	122
PID 5936 wrote to memory of 4956	5936	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rex_sp.dll,#1
1⤵
PID:4560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {082ee68a-ceda-48a2-96af-853bf3d8826d} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {7756ac67-d94b-480b-a66e-ede58ffb3155} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3600 -prefsLen 27274 -prefMapHandle 3604 -prefMapSize 270279 -jsInitHandle 3608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3616 -initialChannelId {8c526f09-a275-402f-ac97-4e55825bb79e} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3764 -prefsLen 27274 -prefMapHandle 3768 -prefMapSize 270279 -ipcHandle 3868 -initialChannelId {9f9fc10e-32c9-406f-b2d4-886775c7e623} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1652 -prefsLen 34773 -prefMapHandle 2632 -prefMapSize 270279 -jsInitHandle 2468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {09097b74-58ef-4855-8d46-b17986a4e691} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4768 -prefsLen 34929 -prefMapHandle 4752 -prefMapSize 270279 -ipcHandle 4788 -initialChannelId {3887d4c7-3e12-488a-8075-ec7909a45030} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1552 -prefsLen 32952 -prefMapHandle 3076 -prefMapSize 270279 -jsInitHandle 5304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1540 -initialChannelId {ce5aef01-e136-4348-adc8-65d7b3b19955} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {6e45811e-40b9-4647-a825-478474da25f3} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {71ed8337-67f4-4bba-97cf-72a06d00b76f} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5896 -prefsLen 37041 -prefMapHandle 4388 -prefMapSize 270279 -jsInitHandle 2760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7084 -initialChannelId {94853de7-464a-44f9-ac81-36b20b399e2a} -parentPid 2880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\rex_sp.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3AF79BB1ED24BDEB5B08FB73C3FCF911 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4187EAD7663102103AB5DEA3734718D8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4187EAD7663102103AB5DEA3734718D8 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4284
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6B2EA6BC4394526CE9761A86D6B16734 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3AA48E2308CD54C345D16469E83ECE8C --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5112
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EC418ADDDEEEF6A3F1EE01DBC9B57C75 --mojo-platform-channel-handle=1868 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\system32\rundll32.exe
  rundll32.exe
  2⤵
  PID:4080
- C:\Windows\system32\rundll32.exe
  rundll32.exe
  2⤵
  PID:4192
- C:\Windows\system32\rundll32.exe
  rundll32.exe %PAYLOAD%
  2⤵
  PID:228
- C:\Windows\system32\rundll32.exe
  rundll32.exe %PAYLOAD%
  2⤵
  PID:1560
- C:\Windows\system32\rundll32.exe
  rundll32.exe %PAYLOAD%,r4v3n
  2⤵
  PID:4872

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2040

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Windows\system32\rundll32.exe
  rundll32.exe
  2⤵
  PID:5012
- C:\Windows\system32\rundll32.exe
  rundll32.exe rex_sp.dll
  2⤵
  PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.contile.json
Size 4KB
SHA256 b9efc2d5de55827173fc504c89068083671537920c17c08eb900717862685473
MD5 67033e4a99c2ce41440939b7e22680fe
SHA1 aa8fa26d6e2999eddc6a39e727b98a7a0ecfcfa5
SHA512 f38d3d5ccc3ea73f8a9f1a72a1dafe93d649a059e002ed8a8e42f79b196a776432bd48e6649617d74827caf6129c366fbc6dd53647fe02c51997cd9c6a4d8b79
SSDEEP 96:TdLvSMv3WiPmjqpOtT+mR+Yn4KYL/RyJd6D7Iolz:puM+y8sO8mR+YORSdw7IoF
TLSH
T1F991859B847888521B70B7F26C0A36E8F217B007DDF09ED4B2A9DC2086997FE51DE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 64dfabea7a554e20c1fe17ec3f9d07cd718a6de2bb85fc98b4505c304a5dfb3f
MD5 3e50bcbd6176c7d592bdc41294e282dd
SHA1 503e46c526b6fcaa9064dfac8be60f7502ba0d11
SHA512 7f9dd8de3c41ee4deac89242cee90e6c0f10928e3293c7f79c50d34fee1bea4b276546af1d199ce1ab0de7fa610001091bc4df9f4344a01e6036b802340c1d87
SSDEEP 768:vyfdZOHBdICDIsZni8uYLsiDK51/fFBOqW/OvOOryB+GH:qfdZ6DI+AYbDCdfFBOqW/O5GH
TLSH
T108730AA3E6E9B1BB1BA037CB1C0F795766E2015AE34605C8FCEDC91C81CD755023A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 fb0174d7d85a3d58e94cb95b22f52fa8f176ce8105a03e5397d93f559ba22dc7
MD5 5e4830b9428fcfe671489ef726b3fc1a
SHA1 fa339eb2973579adca221037cc132b75e6238fd6
SHA512 48e34e3b1346ce790802934024dc99c9756fb37dffb601a64956944e4c15ab66609101fbf0b33aa18fd5947affacbd8f4ef6466816dce765e55a27d3f2b8ba29
SSDEEP 1536:qR2lmcSVppW6TndXwR84AHsLRKme7g88im/F52:qkEVp9dcRKme7BUF52
TLSH
T12E730AA3A6A8B1BF0B9537CB2C0F799B56D14146E34502C8ECEECA1C91DD754013B6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

12277

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\doomed\12277
Size 257KB
SHA256 f47733a4813b4a0cb106a1cd5e9307d7d5580bfa88125c59f78ae413f28f01b2
MD5 adde5d73ee86bf4c99035868f0506ebb
SHA1 96f13cc2da707589a8b4d78f0cccb924306801ee
SHA512 d40fe2d36423b5d106dbd7432a84f36113bb60784a048e93e1040155c8370084bdda763783c32a19a274bff7de3746daf687973082e3af27ff026966904e6f0a
SSDEEP 1536:2YCYFsSHLwlSPrxwBvkcIM+/Ugobj1Y0Zz1+pia4Buh7IMoPYeo8s/ThIK8Ct92y:o2wicE8bjH1U7IMoPHYTht2Zjbw
TLSH
T1B244F8F7D6AC70FB075286DC6C0E72CF62AF4139DB5209DAF868C148C3C9A65107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21036

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\doomed\21036
Size 257KB
SHA256 85523c5f3563e17758244022a407f967ecad630cf0c72008489991a6221f9078
MD5 e4fdfe435cf1cbf180db515f15b81409
SHA1 61f234172b065514b562435c747c6e6f3a484b57
SHA512 0d44e3729d967c2b983709f6ed8ea4e854b23e67afe5362f7cbcd532ca391825d89bb38d567745a090df938dcc8543facfd2627af900d8ef5452dfe06b2cc281
SSDEEP 1536:pYCYPsSHLwlSPrxv0vkcIM+/Ugobj1Y0Zz1+pia4Buh7IMoPYeo8s/ThIK8Ct92Y:j2vRcE8bjH1U7IMoPHYTht2Zj3i
TLSH
T15244F8F7D6AC70FB075286DC6C0E72CF62AF4139DB5209DAF8688148C3C9E65107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8173

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\doomed\8173
Size 52B
SHA256 eb35ab0aa4f79620a8672aeb5b4dee675be951dff110c44748310587ced7f799
MD5 48c8e4f9460a53d585ab534116c0dc1d
SHA1 e5a52ebca0305329147986e6bf3a71f497ab8b5b
SHA512 d8f6e46f3bb3c00abd1519dd752cd7e9b3734789da97b4103ea4cb96e525ebf3ba106cd0477cc67ee7977eda7c4072328ea45e9761f52aac22000287d6eeb26d
TLSH
T15C9002659A71C640E16494790D0480B915903D408885426335D14B9504110D30009000
MD5 SHA1 SHA512 TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 8f6ac9cb0a8809fd0ed10ad3f16fd60282a5e6f7071f4b79795f640402578a73
MD5 c4dc64f593a32cf009dc58743189d8c1
SHA1 687484482892a010eac79abc5f027f58facece8f
SHA512 b57a0c58e2924b806e66633ebc3cfb4e276474124237248b831eadc988fec68247f2fc95b72a5e7b68293f46b46e3a58566dc64c9b74b2e94dfc68bc2de5ea6c
SSDEEP 384:HGNQiO024YkWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAq:mDZYkWTToXJWTTogB7S/AmVAf+hRML
TLSH
T161728E7D8F013CAD2B5780E9C8B583598D18B6E7DFF6C06D269C3D09C984A1671F944E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 7399f6e742bf35a23719023c2f85f32cdae2998e94133775733e7c60c35843df
MD5 a481ad20a96117af84673e4b70aa62c4
SHA1 d01bc9cdda33af2c41565e9ddd9ab05d022f8bb0
SHA512 5dcba6f05988610fbd1d922a391d4b9569947f01b3ae4bcb431911f8045bc1998bb22d8e442c8f06acb6af065e38290de4cd289508cd97e8dfebe9e3a60a340d
SSDEEP 3072:X3lNX+B7gvKoeoHf7/B3PCdjHzLMGWMp5:FNggyof/rsd7t
TLSH
T1D7B3A0F6CB92CD3965FFD42D6BC3C43EFD262444B3A7301AC823225466C6BB86675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2bubq5l2.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 c38763807dc3db9772be2ac688f79737c2156d32a9edb1af37f9153e5f4f32eb
MD5 2f65ee029c31869079a73c26e8707edd
SHA1 7557a883876786a5de7f875aeecc68e59abcd18c
SHA512 aa3cbaea1b5f7e4d36e8685a7435c174c9acb1e1d7d911f12bd7e30ad6cc0f30af824d14ce091361cf06686087d46362c8e0042fc74a5ebb38c57a3e84cd6eca
SSDEEP 3072:j3lNX+B7kzi+jBTSW/B3tHdjHzLMGWMp/:pNgkziCsCfd7r
TLSH
T1E7B3A0F6DB928D3D65FFD02D6BC2C43EFD262444B3A7300AC923235466C6BB86275648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchHoverUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
Size 20KB
SHA256 88bd0d7ab7fa62f7cc4c25b21e0c609031b8c495fe78eaa796963c72b534fc6f
MD5 32c521998af6fa3a975afcb504e953d0
SHA1 e9da5c275c176cc7962ae235ff0cf54ba79d8bb5
SHA512 f723f2a1a78881d80d3f85db2d8d7c3c180096a04e84790718ecc6b743a880189c5350f142d6849fe06841999e2b6c1bf8d0d91ba127b1f710f6d5d356bc31d5
SSDEEP 384:UJWJWVca12krtuVm+RglBOVjeQ8RJojYghnjUocYW65Pom5s+GDa50R7HcT3MYXX:g+WVcWrGl8RJoYg9jUocY/ds+GDa50RA
TLSH
T196A25A743AF41715F3B29F759AF1A95A643AB866AC00DB4D0122028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

763692bf-f602-4aa8-b253-0a7038256f3a.zip

Path C:\Users\Admin\AppData\Local\Temp\763692bf-f602-4aa8-b253-0a7038256f3a.zip
Size 3.8MB
SHA256 2f366d99bd4871bb6af4b45b330fef2d39f8712d061cb504cbded5cb29a4feb4
MD5 f086c983f7b56dce7db52224c9584d15
SHA1 3cf6f19eb31ae4ba5213d8748ba01dedece79540
SHA512 abd57dd377a04e858f607355dcfa7f7eb658c4ba6444e32171490aa8a7f098a1e3e8acbf9a018affaf2e68ecab3456fc44b4aae5fc8bc16a5f486d514bc47433
SSDEEP 49152:AlBU+EUXUbUEdj4d7EEjIlEL1wEhniB3IpDetlIsNQMxK0k/12MXvC6xASKH+3U7:AzU+3dLErEhZAUsNQgK0C2z7e3UeWR
TLSH
T1C506F175D69C1E09C9FF83BA850D2FC3984C4FA680E4E96B7A6BD9715CA31E21F448C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 accba4e7ebc292e6765c9bee242993f0b732e0efb8c227ff2e7051ad692b2d6c
MD5 cb86a2f0998cab7fd282ee8d00dcaaea
SHA1 05f6689ea7686ff9ef382d8e94f5f03fae2f84e6
SHA512 fb658fcd30217782684612a6359a9e5217340d447450251044ba118021e1acc44ea904e03aa7d2f129213e027653b955084ca543e7350d6bd1b4b21009f9e920
SSDEEP 48:qZdnJ5UgdwbzvBydnJ/6Bdw9vBMdnJ/adwfvvaYdnJQ5akPiQiZ3kfTuqiBxvBvx:oMi/ZU/fPQ2kfTEltBYU
TLSH
T1CE120F410BF60995FAF78B353B357713AB73FA015A1E461EC082628909337A495EDF93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HPMBU2R0I6YB4MDFUYOV.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HPMBU2R0I6YB4MDFUYOV.temp
Size 9KB
SHA256 f7a160f50827658522ee8243e022c6038b9aafc7a17153080fe1d97361071325
MD5 84c82550a6724be90dbbd6cc56d20663
SHA1 26f4e538e1346a410502dee00b55beb0a769b96c
SHA512 b6f102131f9fcfa522eac38fb3c33658dcb0dc88b8122459ff4d2c4c10411b4dfd380d1648f4aa62ea2101d950bd3af55ae2e903f57be70c2b3a01a8e52c3c14
SSDEEP 48:BZdnJ5Ugdwbzv+ydnJ/6Bdw9v+MdnJ/adwfvvxYdnJQ5akPiQiZ3kfTuqiBxv+vx:3Mx/Zf/fgQ2kfTEl2BYU
TLSH
T16F121E011BF60995FAF38B353B357713AB73FA015A1F462EC082A289093376495ADF93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\addonStartup.json.lz4
Size 4KB
SHA256 a42dfdaee2347fd55bda922c507e5508d3d3e0263e06f7959d7cdd9f9b277e4d
MD5 f72eb82f2e1488a95e32069fb1918d27
SHA1 0d29134a732fb3084945143081d23a0b78a249c9
SHA512 3da82d9db5c32b29489589291ed7191c6b420f153b40934ad465fa06392c2ee56b150d7ea4a9aeaf38af687a91817baf1990b1d8d26ee0f994d67fe26a7268a2
SSDEEP 96:NR/4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhaFs:Ns52xxhD8rGvm6ApwnHa6
TLSH
T1D0A19FA6D145EFA2F932D0434CD53FB2EA969F7410B5C4D0F0AE72250D64AB31704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\broadcast-listeners.json
Size 221B
SHA256 d7ad8e05bd8cb164c7b6340e873d67a003a7b8dd4b9ba1e50fe1a3cfb03b153a
MD5 4f09b3906d3daf3e816d06a079af6560
SHA1 b575288e0826a56beededd1819633f1a7114e3cb
SHA512 bb251c2826710579cae5277738bfe924f67e0fac2e065ff078f026b165cce77988330ce6a09f19bede2ad72149b9bf7d39f575b086722cf050ea9a12ab398213
TLSH
T1F8D0221E24133C7F8B4CA63DF00427D20BDA21097670913DC3FE22940A2BAEC40485A0
MD5 SHA1 SHA512 TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\broadcast-listeners.json
Size 221B
SHA256 17d6ef663550093fb9b74f73ad66419168988f6b3dc2003ea9dd3847401ccf4f
MD5 4c91e9fe8a0301fabac800a55e26c9d5
SHA1 222f34026d2ea2ee9e560fa630bb3ede7bc4f1f3
SHA512 69862e4aa32a8c653ba0899f25c1ab90fd40a904e201853c1af6e0bb6c25ea667a1a7a40fc29458f9de54829c91d394b8fa0c6157dcfcf6d6011c67fbd21e54b
TLSH
T18CD0220E19133CBF4B88772DF4042BC10BDA20093270D03DD3AE22A40A2BAEC8089190
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.bin
Size 64KB
SHA256 c4a64e59d4fe8369f3c9c2c12a17be0bbfd05d3655c3365db01c8b77ed2ec5d6
MD5 d59ef64153bbd6ced48d5c60cfab8ecf
SHA1 23f4102a7de6ec40c64e1b37922764d7c08e0d58
SHA512 f15df29ecf4c9b66297bbd5083622f42990e030ed68f1e628f37fe3c5890100d5ade033900f26ea04e7fa3946e422b14136e403cf46e0c97f9157b69a801b3ca
SSDEEP 1536:IDZEx5kvHrvWRoyWFnmWEtmCDtrHnaf+CRKoVNpCOrJv8LI:IDaxKDeRVemJAC4rV7YiR8E
TLSH
T1D2531345EB1A953FD82802BA9CD21B003F79F889591A2FA7371C54786C872DC3D9E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.bin
Size 63KB
SHA256 51dba30b4770aa84ab716c2581b066a4ccde65eb2c8b598b80aa60fe7e6370bb
MD5 2f035d9917cc43ba9cb90dc04fe675f2
SHA1 df5a6a4252e30f4c2aaacfa7268d04d158edfe47
SHA512 90674c61360ceca7f43d18494a6354177e390c49d8f353bec6da5f0bac0751ffeb86d4bd709ae2f42e76d0f68f176889f338380f9ef96f5883a31e2e1f423b41
SSDEEP 1536:lpZ3BPbqveU5m7wa3ATmWPYFRvrlPoIqCMIPT7LHUfLPLI5:lpxBPW5Q71QS8c75/LH0jPs5
TLSH
T11C533444EB1A543FD82802BA9CD217143F79F8894A1A2FA73B5C54786C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 58fb9af3398cba0e47ba200fa3d0c3c20d46925e40425af3c17e40fd57ed37bb
MD5 e3991ec4606e418e8ae931fc0e71a030
SHA1 40dbd307272f53c058be614db51fef0c48dcb7cc
SHA512 ab1a1feea99fae035eeed397ba2cbaf7b5c6aabd07ecf1fe482d0154ec83e174967927e1c097380676bd8880c75caeb97473b4ce60511ae96a43683d7132e254
SSDEEP 768:WYBHrfrm6GcmhufxxRNU6/80JbxbBb0bQmm+LI:WYBH7rzxxrv
TLSH
T14BD20284EB2E953FD42852BBDCA507002F79B8C959192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 8009d844761c059a84a83b30214e356904d8a757065624e1a127f1602f1f6a7a
MD5 2610efb1d755bdc3f7e9d5b216d518d2
SHA1 e67b5c2cf1e6e825889e59f21809b39ce46c0ee9
SHA512 24c656cbbf4e46d21be6e406ba6a75e69b3d225099aa638e30bc2c0b074b65da07c37c0aa00d7df6a57930250041eccaac7b17f2b73354e8d9796a1f44f2cff9
SSDEEP 768:xrIYBHrfrm6GcmhufxxRNU6/80JbxbBb0bQmm/:KYBH7rzxxrx
TLSH
T166D20284EB2E953FD42852BBDDA507002F79B8C958192F673A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\db\data.safe.tmp
Size 49KB
SHA256 fcddc097f51183f2ef37b94632af411e08b30fd160098d9b284dafe075dee182
MD5 49c69fd61300d6776352d649f6b77cbe
SHA1 47d4c0accab1d01270247ef4cd0fd856af3ba363
SHA512 907ea8f8ae217d5bc82e4678c7966c43ee4a73cd023199e43f3249d6e2454766890c465a63162b43d96e3b2946326b4873cf46752c5196549c15390ba7aa50a0
SSDEEP 1536:6pZ3f7JygnT24OXA266k4W1dLXH6G1koUW2Op:6pxNtnT2T3OVXrCBWhp
TLSH
T188332344EB1A553FD86802BB9CE21B043F38F889591A2F573A5C64782D872DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c8c5f0e6c8233b44d110ce11af6aab86a1086c2da8303d9eff2703a0a9b9cf7b
MD5 01b59f53204be6a286c41f04b688fdd9
SHA1 5fd6f75fcaa9afc2ffc8ceefc5b73f901e7ed66c
SHA512 0197fc94a1e5a46f4c015f2dca154fd2e3493b326be04f524e62cfea025bdd7f1b5e00907747567cbd13f4fd74eb50c78ca2d4e5ef5d11e0a05db605b022350e
TLSH
T1C6216D5C3DB84D2AADDBF698744101CE53148A0B04471C834D52DF8DCDC2AE932AE43A
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\events\events
Size 2KB
SHA256 fdab273d00b87fd07e7b759b80c02209d304d455b847aed828497d135e7fc2c4
MD5 6b5ca73e31055dfebc22d72840340508
SHA1 2cc3a63fa9bb0090238ce6e53ea5d28a1213de51
SHA512 851aa2fb4fbca3cfe4ffd8234f4f4869a96ce2717ee8b8c1d9e5b9369e01334ff0d7325061d9c7a953357ac993caeb33bfe1f170c337c07dc8b3b10a2af2c048
TLSH
T1FF51DD0D39BA4C7A699BF79CB84A028D57958B07D4872D834DD2DF0CCC87A99329F42D
MD5 SHA1 SHA512 TLSH

Submit Download

2c856660-6871-4e40-8410-74de62af0cb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\2c856660-6871-4e40-8410-74de62af0cb6
Size 235B
SHA256 a098fb9352957c2325ae8cb8c1e727fa93ef2b7d12844bfcbb6bd12cd59e7bb8
MD5 ef71033df3ebd00dd9be3b5b4902a86e
SHA1 7ddc376022d8fc2e8f00c003c27bb961d9ba31b5
SHA512 ff4cd5c9c318d9a37bafdb532337c04cdc41952d31740afc32139fd940003e5b3f45d86fa3c8bc7942631af6affd3af63de972a2e53593a006f0418c1171c9e3
TLSH
T153D097812888232E19040F47B0E568CA30488C332464A820D99105BC9AFEDC8016383A
MD5 SHA1 SHA512 TLSH

Submit Download

54cd4fc4-8a24-4c97-b832-b2c80fcc0ec3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\54cd4fc4-8a24-4c97-b832-b2c80fcc0ec3
Size 8KB
SHA256 5cfdb09c30beabfff3c191351389f0222b1b533c21a10cb974f8479b4c242687
MD5 e83c39f8bfa41548c6e0eac55c04d3db
SHA1 b31499ad990bc69b343c562f9608f3ff35184ffb
SHA512 5573a35908da9aceb5fe03f99a7cfe584aa07ea9691271d1bbef929ab7705690d66f3fde03eac0fa73eb32a039658c8745a66ab334c20d68ee1f7a4526c7f953
SSDEEP 96:NIvRKNCUDV/D/KB69wy9r60vrgOwCq3/dMpauAQoi3mRVr43EBBTc1bMzeUcQbwW:NIvRY9SDESf9jXk77c072
TLSH
T1C20215FDDD0204433E26E56DF1A6BEAB005628314ADC87CD6BFC083A36E69B74653385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56cd2035-6ba1-4ee3-98fb-62dbface44c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\56cd2035-6ba1-4ee3-98fb-62dbface44c9
Size 871B
SHA256 b24b922610aabd01c87da3eb6ab61c94b7b5ce7206c9fa40491d9650efa63284
MD5 78bde0b323a7af753e0a061b38f6f34e
SHA1 437ed535f70cb2ef9594f89f3640c8767022fb29
SHA512 270f49f9d943826b3265ee43c0578549c59e78eee30f832db865e538abe5f30e5ba79a78612b34a24cab03fbc4028a989064a558896a7e9c95f6519a5c71cd3c
TLSH
T1B0110080A635B5F68C78C25B89A6774247A4312380CB45143CA56E084C7A51EE7A5607
MD5 SHA1 SHA512 TLSH

Submit Download

5736be96-20ee-4547-9275-d6d6c26f4221

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\5736be96-20ee-4547-9275-d6d6c26f4221
Size 235B
SHA256 e8b715610558989446661e46c86393c7be15bcf518c0163c48588c91ab5d014d
MD5 b8118f815563473438cbac3dbeddc7ed
SHA1 b308810b7a41dcd4dfbd05d1845dca8ceee7f860
SHA512 db36b0b37df4d7c454a8c709a8e3bbd01e6237f368609abf5e3a2ff546408a53763f93372cc5ad3d011daaee193eb04675ebec3f3ba92b5484ba37107d49e0a1
TLSH
T13BD097801898AB9D48144F0AB1E0AACA38848C3378A8AC60CA6081B8DAFDDC80221816
MD5 SHA1 SHA512 TLSH

Submit Download

bbb488c5-285a-4533-a97f-87cdb1bd5902

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\bbb488c5-285a-4533-a97f-87cdb1bd5902
Size 2KB
SHA256 780fc553253c2ffd8f31afaf7b28a9c6628d2d70aae3fb4a52cd219352484697
MD5 c89c0e63128b52e1ed2fc7d71414b2dc
SHA1 93216a9458bb3dc87e1c046de07f87c94148b78c
SHA512 8da237d0044b3c4639cc5d8a79a1177f74f059fa787b9276e7f01c5e40a8516232bd8ce7994d597dce79b995704e40e820929405af4fc1cee0f526944ff9e19c
TLSH
T1CE41465C75F89D7A9CCAE59D84D2238E43A18E0340C62C536D52EF4CCC9679E736A42A
MD5 SHA1 SHA512 TLSH

Submit Download

d78c6c74-8fc6-4d0a-85cd-d6ffd41502ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\datareporting\glean\pending_pings\d78c6c74-8fc6-4d0a-85cd-d6ffd41502ef
Size 886B
SHA256 06a1b2603a5998e5fe43196d671385e5a0aa001a5207169d787cf2df145a452f
MD5 4ad3c1eaf7bc4dea285adf8e3bec66ce
SHA1 8e822753806e57477675ec6e616dfd139e40b8da
SHA512 7175c13d1fa501a650d60e1f913d5fb6f99de8199c859be4ff5366b115bc6e1c24921ad777b7b1224ad8434a6753ed4ee1a9e3ed9c6a18c91f350edf1da52143
TLSH
T183112790A521B9F28C64D2CB95E17742C7F03033C0CB4D147DA56F184CAB41EE7E6607
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\extension-preferences.json
Size 942B
SHA256 a56a46aa7451d640626f9adbce3ffb26ea6ab549f15af56fc2cd69f0bcfda67b
MD5 8913f98eab4828647224c9a64b706b3c
SHA1 f886a4456ee44a4e73ef32a2b138193f2fa41d37
SHA512 28869c106812bf053c732469b0f67da993e42a471c7b576e68d45fe66d2f067bab0a66c5334e88c6460e08a06285daa643f5f34771bd0d7361097307137e1630
TLSH
T16211F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\extensions.json
Size 14KB
SHA256 249172c21021abb82f894e1f021733564319f376c2f6fdae1669d5a834bcb797
MD5 9a6b68b1a6eea877beac646f859fed8a
SHA1 60b8db2fd8159ee1011b3ab2d69122710adacfc7
SHA512 d91979e69e07fbcf6406d4fd803a79bf9023c9f9e93b46923939ac4c8ff70edabbff32e643e7181eae5965423499755ed1b71f8ab87ed9ea504fe76c9b05baab
SSDEEP 384:/kI4vTUmldvRJ8dhWH94zt96ogL4HVL4PAL4HvL4HGL4H7:MI4rRfZCXy4f6V414a4T4M4b
TLSH
T1ED62431549149EB8294FA78AAA367E02C37D473B70445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\places.sqlite
Size 5.0MB
SHA256 bee7cb12d9dcb0d4b5ccfcd38aec32c76b957bb0a98e7cd7b2fc9a872ae4407a
MD5 6266d5a57bc6edbdb1ba6cc1f32baa61
SHA1 c2860235c79bfb10d66d637d7e15beb3d114f6cd
SHA512 9926bbc26e667abab5de0ac958ccf5705a89ba46ad7dd6d0538193b3c5005cb80e181394282bb5602cdc69587daf1fd692fbb0ba0c703ae52d4efdc37ebbfcd2
SSDEEP 192:M8rJQaXoMXp0VW9FxWOEjYOhY3cae1OLySzA9Aoqm:M8r54w0VW3xWCOhecaIo
TLSH
T11336505F3A241095C4EA9232A8F32F19183F71268A3777923DA4257D4DE0723B56DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 6KB
SHA256 ec3166bf8d261479e0a7600f3199a8054b39286bba6e1a87641b70ee5ec6c886
MD5 d54cf4ead242ae0ed056cd364983db72
SHA1 a601050972e29647fcd1f5f375ff6c10fa6c4e17
SHA512 f557ed3046761caf8954f7c6fe308a1bb76b29b7db4397e531460bbf7a09db2749fc4b7cf6e582d0901d5023c62f8d5d5c2f3f547b88aa213603843791c90eb3
SSDEEP 96:xHAmUTUJgqGq4fywj1zSfnSSlcdv9j1nIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fywjenSSRG/KF7Bw88mV
TLSH
T170E1307895088F7F78B677AC6C6888315AB2013BB7BF68D750B55485050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 6KB
SHA256 1fc3a568238595c5689e205b49971f97a1a6fcadf3c293c702fcef2887aa5b10
MD5 5bed27c67b26b4aff092adfb9f502cc5
SHA1 2300a2759f5d533096463cea3dae8d242920285f
SHA512 2e123c834112ce1e7fa5328ed01b1753a33776ead0fb8139614b5a8ef9a15175641deecc84e47685be307df6c4846e409b1e04bcc0787a6983fa99b2e66573c2
SSDEEP 96:xHAmUTUJgqGq4fyv91zSztSSlcdv9jXnIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fyv9qtSS7G/KF7Bw88mV
TLSH
T1CDE1107895088F7F64B677AC6C6888715AB2013B77BF28D750B954C5050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 7KB
SHA256 3c1155fe7d070bdb37efef24a550749daee07f6f871dcc25a1691ac339e5ac19
MD5 8b355b4a0ad27f2f06ffd1019f92ef33
SHA1 438bccd14cd905c647fc14d4093bfadbdd972824
SHA512 f62a57e2feb2a2b226a1a1b1e6c7f677230ed90c067bdcdbc39dca7d9a15356e2a957c2cdf990194efa7c0d028aa61a1769f620de89d5e8d10dc710b3ea7bfc5
SSDEEP 96:xHAmUTUJgqGq4fyv9ObzSztSSlcdv9jXnIHGAvzE3KF7Bw88ji8L4cnh1VlMGS:hRR4fyv9JtSS7G/KF7Bw88jhO
TLSH
T173E11F7894088F7F68B6776CAC6888715AB2013B77BF68D750B954C4054CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 12KB
SHA256 2d88710e4921e90ba9bb6673e3d686d9b32d40f6a442cb7731c198159fccfb81
MD5 3446a33636c127a0abf69f4267efa772
SHA1 4d7df823e00fd97b9a505f02b10598cbb7065e45
SHA512 a215038f7d38e48adc39ed6f2cc4f0ae0446a96b96b000c4edd0c9c1575c870cf5e76f887aa945822c08e2a62fe529ce5b7878f3615900693480085770ea42cc
SSDEEP 192:hcCR4fpv9JtSS9LR3/KFROBw88tWmCzovhhB:GrRkewUwZ
TLSH
T10142CDB960018B3F24FB727D6C2149B029A54167BABFBCD245F885D2094DF2481F7AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 12KB
SHA256 ab5c323873375f884a482a6995e5f5e47dda8dbb3f0b911f8ae6094665f99dee
MD5 c264d8fb5560cbdfb229e0d5b99234ca
SHA1 71440d47238497115a3318b68756ac35f453548c
SHA512 df2fcc5469d49ed7bb2ba6ea2802680f979870eff3269078c9ba464b91b89d5c623af850d3ea0d050367d4e5c50f6541eeb7b0e034a3e0e9621c9fcd34a70278
SSDEEP 192:qcCR4fpv9JtSS9LR3/KFtOBw882qmCzovHhB:xrRk6wfw3
TLSH
T15142DDB960018B3F24FB727D6C2149B029A54167BABFBCD245F885D2094DF2481F7AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 8KB
SHA256 c42191b56b1fa46af770c7d8cc15248e0fab338271a5207fe9f1be2ef9bdd71f
MD5 1660dd4fed7a93a8b58c2dcdc6c2bbd3
SHA1 40d7cdab12bfa3e3113059e1c6e027d1a9d3cd44
SHA512 80349b2f167415b2cb4e2cd7908b82f5e99d512a0b1a86a2cd0a809cfda505038040e66b970b23127ab93d965a9f5367caf9c4d4b4ca3c63d9c258216da7bc55
SSDEEP 96:xHAmRTUJgqGq4fpv9ObzSztSSlcdv9jXnIWR6N6AvzE3KFjBw886Vii8L4cnh1V8:hcR4fpv9JtSSyR3/KFjBw888ihO
TLSH
T1B8020E7860058B7F74BA776CAC6449705AB2013BB7BF68D750B984C5054CF3482FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\prefs.js
Size 6KB
SHA256 a2cf0379b24bef1169fb69e4b85d936a977215a6dc2036873c8373446af4ea61
MD5 b600b59d1ad12e9b8b690ccd5f780b1d
SHA1 df07ad92541bbb6df80afc74cc1acd0b707b9e81
SHA512 c35cc3e21bce64f15263a138479188cb2e90a451ae5b64dbe50872f88b49e70d8c1658e9e54d7540fa5574ce7a5079a1adbe0b8350b89b16ca38ee36d9a763b9
SSDEEP 96:xHAmUTUJgqGq4fywj1zSztSSlcdv9j1nIHGAvzE3KF7Bw88H8L4cnh1Vlx:hRR4fywjqtSSRG/KF7Bw88mV
TLSH
T10DE12F7895088F7F78B6776C6C6888315AB2013BB7BF68D650B95485050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
Size 892B
SHA256 aae5f9343176d773edee287f7390592bfa6ad40870889f525838b56a49fe2a4f
MD5 b5ff78774c3a663731ddc81a8dfdef3a
SHA1 ac0b4851de0867e15683cf99a93f542e2ee0db42
SHA512 cc71dbd5f85ea3a12edcb2370f84a7e5d5f242345e4c4bae3e19b7181be354572e1e02a9df219f0abb87ea99ff0fc50349eb76918a586962f215a6da6cd55c7b
TLSH
T106116782546955B79B58913EC544EFBF0BD6203799343040E35E7600065C60F31EEA8E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
Size 20KB
SHA256 9ab329102dd84777b0a18ec6216c16c2cd4d4187cd7cc167c5f7c6949a6798eb
MD5 9975827c6157736b938804265505407b
SHA1 44f57febd9d81e798b53a89131120e27748c21f0
SHA512 c30e9be0675675a5ad786808d772e17ae482520cccabb695737ab7e13b5113b2544518bcf893da5e7d88083e4781ed872c8080b53f6e872a3b846d0186959742
SSDEEP 384:DpD4r2OeiIm2k+GsbXL+8EdMLC9yJmMPffs5yCElxlSIJatN283JDv6zxpc/7g:DJHm2WsjLkMLnhfaEnEtwQg
TLSH
T176A2BE1124213737193DC7D19CF64B358FBB286E85254908954DB9F707EAB32AB022F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 3548cd3fb0e1c0da907ef25254da21c41a97a1646e45522bbfd16041715ff14b
MD5 2ce3be7ee6228296892d5d112cb08ebd
SHA1 d4c86c5f2559c6ae0798ef1c9c821a67626d35ed
SHA512 79eb47abe49b06d4cdd1f43e084a766d054982817473fe3ca71fd43102ab21389992b019d0baf3472c2d8932c0e4630343b85b94390a7aef8e9d05e61158c762
TLSH
T1A121B799BC0E74F63F5CD022D0856BBF0AD630A3963C044457CD8F001268D9B719EACA
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2bubq5l2.default-release\sessionstore.jsonlz4
Size 20KB
SHA256 64caab9126aef5ce7865e96f2d48e08f4c6017a6f5de097fe7b87e87dfcaeedb
MD5 48cea7cf2ca6519d4626ca48710b5eb0
SHA1 7dc5a26c9bce10fcb002307ea7d279af9713c624
SHA512 960d539294c5831e8d90d25c4c500c8c4389a4245455f9199a246c1e5f5c46bc71e6a53f4159441b0a559e8e074373ca2698710a2d82ed39a3b0072148589474
SSDEEP 384:xpv4r2OeiIm2k+GsbXL+8EdMLC9yJmMPffs5yCElxlSIJatN283JDv6zxpcMBo:xZHm2WsjLkMLnhfaEnEtwDo
TLSH
T181A2BF1124223737193DC7919CF64B358FFB28AE85254908954DB9F706EAF32EB022F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download