18828a8613a89091612350b4c4024e46edce21c808fb43528c72718467921482

Analysis

user interaction
yes
max time kernel
125s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Farebné modely.pdf
Size 320KB
Sample261023-kywtasax71
SHA256 18828a8613a89091612350b4c4024e46edce21c808fb43528c72718467921482
MD5 3122029740f20d1203f869894c7db502
SHA1 7348fcdcfdac9039b8c1d65d3ffe1b3a9c6e207f
SHA512 591edba6d5be447038fd6d230dbe09e5551456adfd729f90159dd1f6c38142bf295398eb900c63f7cca818d7fbb88b345e2534572952efc7f76acf3e3a03ffd7
SSDEEP 6144:JKylkgI6gJnF3I9ge2W5Ijo0yGgoVDWzhrq4OVy2vTJIhuusEAmh99KB:8ylkV6gJm52zcZCkroVyctIMuj9A
TLSH
T1E564F10388148ACDD6748271FA576F6D260D7B52E4C67AF5342E4E9B2760F37C84A12F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery persistence spyware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\AlertaRansom = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_MrBeast Ransomware.zip\\66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe -alerta"	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
92	raw.githubusercontent.com
94	raw.githubusercontent.com
95	raw.githubusercontent.com
102	raw.githubusercontent.com

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 34 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MrBeast Ransomware.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	firefox.exe
Token: SeDebugPrivilege	4772	firefox.exe
Token: SeDebugPrivilege	4772	firefox.exe
Token: 33	1464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1464	AUDIODG.EXE
Token: SeDebugPrivilege	5264	66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
Token: SeDebugPrivilege	4772	firefox.exe
Token: SeDebugPrivilege	4772	firefox.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
3140	AcroRd32.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
3140	AcroRd32.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe
3140	AcroRd32.exe
4772	firefox.exe
4772	firefox.exe
4772	firefox.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4772	2568	firefox.exe	83
PID 2568 wrote to memory of 4772	2568	firefox.exe	83
PID 5716 wrote to memory of 404	5716	firefox.exe	85
PID 5716 wrote to memory of 404	5716	firefox.exe	85
PID 4772 wrote to memory of 5672	4772	firefox.exe	86
PID 4772 wrote to memory of 5672	4772	firefox.exe	86
PID 4772 wrote to memory of 5672	4772	firefox.exe	86
PID 4772 wrote to memory of 4260	4772	firefox.exe	87
PID 4772 wrote to memory of 4260	4772	firefox.exe	87
PID 4772 wrote to memory of 4260	4772	firefox.exe	87
PID 4772 wrote to memory of 4260	4772	firefox.exe	87
PID 4772 wrote to memory of 5500	4772	firefox.exe	88
PID 4772 wrote to memory of 5500	4772	firefox.exe	88
PID 4772 wrote to memory of 5500	4772	firefox.exe	88
PID 4772 wrote to memory of 5500	4772	firefox.exe	88
PID 4772 wrote to memory of 756	4772	firefox.exe	89
PID 4772 wrote to memory of 756	4772	firefox.exe	89
PID 4772 wrote to memory of 756	4772	firefox.exe	89
PID 3140 wrote to memory of 3384	3140	AcroRd32.exe	90
PID 4772 wrote to memory of 2556	4772	firefox.exe	91
PID 4772 wrote to memory of 2556	4772	firefox.exe	91
PID 4772 wrote to memory of 2556	4772	firefox.exe	91
PID 4772 wrote to memory of 2556	4772	firefox.exe	91
PID 4772 wrote to memory of 5036	4772	firefox.exe	92
PID 4772 wrote to memory of 5036	4772	firefox.exe	92
PID 4772 wrote to memory of 5036	4772	firefox.exe	92
PID 4772 wrote to memory of 5036	4772	firefox.exe	92
PID 3384 wrote to memory of 3980	3384	RdrCEF.exe	93
PID 3384 wrote to memory of 3980	3384	RdrCEF.exe	93
PID 3384 wrote to memory of 552	3384	RdrCEF.exe	94
PID 3384 wrote to memory of 1484	3384	RdrCEF.exe	95
PID 3384 wrote to memory of 5940	3384	RdrCEF.exe	96
PID 3384 wrote to memory of 5940	3384	RdrCEF.exe	96
PID 4772 wrote to memory of 3012	4772	firefox.exe	97
PID 4772 wrote to memory of 3012	4772	firefox.exe	97
PID 4772 wrote to memory of 3012	4772	firefox.exe	97
PID 4772 wrote to memory of 3012	4772	firefox.exe	97
PID 4772 wrote to memory of 660	4772	firefox.exe	98
PID 4772 wrote to memory of 660	4772	firefox.exe	98
PID 4772 wrote to memory of 660	4772	firefox.exe	98
PID 4772 wrote to memory of 660	4772	firefox.exe	98
PID 4772 wrote to memory of 1840	4772	firefox.exe	99
PID 4772 wrote to memory of 1840	4772	firefox.exe	99
PID 4772 wrote to memory of 1840	4772	firefox.exe	99
PID 4772 wrote to memory of 1840	4772	firefox.exe	99
PID 3384 wrote to memory of 1848	3384	RdrCEF.exe	100
PID 3384 wrote to memory of 4604	3384	RdrCEF.exe	101
PID 4772 wrote to memory of 5392	4772	firefox.exe	102
PID 4772 wrote to memory of 5392	4772	firefox.exe	102
PID 4772 wrote to memory of 5392	4772	firefox.exe	102
PID 4772 wrote to memory of 5392	4772	firefox.exe	102
PID 4772 wrote to memory of 1944	4772	firefox.exe	103
PID 4772 wrote to memory of 1944	4772	firefox.exe	103
PID 4772 wrote to memory of 1944	4772	firefox.exe	103
PID 4772 wrote to memory of 1944	4772	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Farebné modely.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4BECE79F8C68E2E4F34249584A665F7A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4BECE79F8C68E2E4F34249584A665F7A --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3980
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5011EF678525CC73F6FAA5FE6610BF44 --mojo-platform-channel-handle=1796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0124E03DBC200FE6BF87272D9E768F87 --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1484
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3814AD2B22B4B93E71BF6C5B58A21AC4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3814AD2B22B4B93E71BF6C5B58A21AC4 --renderer-client-id=5 --mojo-platform-channel-handle=1992 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=17B995F4603D3C6BF9320950B0D437AA --mojo-platform-channel-handle=2716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1848
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=968222595D5D2DCA77DD568286D716B2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 1948 -initialChannelId {3bb499af-54ce-49bd-8543-5e97a8ef19cc} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {7a6e4143-7237-4b8b-a3b7-ee1a050044f7} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -jsInitHandle 3960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {cc9c25a8-1264-4472-9d09-ca245b36eedc} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4108 -prefsLen 27274 -prefMapHandle 4112 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {403707dd-1b3d-4259-a767-bd9d3a196fc4} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2600 -prefsLen 34773 -prefMapHandle 2724 -prefMapSize 270279 -jsInitHandle 2556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2676 -initialChannelId {5c977d0d-dd73-412f-98f7-8559840234ad} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3432 -prefsLen 34929 -prefMapHandle 2620 -prefMapSize 270279 -ipcHandle 4936 -initialChannelId {fa51df71-5254-44f0-b55c-7a8e85c41552} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32952 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {364cac01-fbb2-4695-890f-df4649658663} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5680 -prefsLen 32952 -prefMapHandle 5684 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {91198667-0d8b-4e59-b6d2-0bcc8d031089} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5868 -prefsLen 32952 -prefMapHandle 5872 -prefMapSize 270279 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5884 -initialChannelId {d2b7f1bc-2f77-4f3a-86bf-67a1c78b1121} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3244 -prefsLen 33071 -prefMapHandle 6320 -prefMapSize 270279 -jsInitHandle 2892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {efd093f5-f9e7-43cd-b760-20494f6cdd9d} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4788 -prefsLen 36885 -prefMapHandle 6792 -prefMapSize 270279 -jsInitHandle 6808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {45713309-5590-41f3-8b88-c42d6dc95b2c} -parentPid 4772 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4772" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5548

C:\Users\Admin\AppData\Local\Temp\Temp1_MrBeast Ransomware.zip\66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MrBeast Ransomware.zip\66dba9788f974d7a9219137263e49cfe46a19ad51a895d220388f00b0e65a917.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5264

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 42f4bff2ba1e96b0b257700ae2ff96aca8121bebe2b32872a557a9c10e79cc80
MD5 e45487971ec354830988d9d9f9bdd791
SHA1 e21570ea476056ac7a4828d948ab65d359c5a45f
SHA512 b3f8d7183cb811122159b0f6831eb192f8cad10e58d46e66b0cd853f685d8876eec695c338f02bdb1169bca7ed558ebe019362401bc2e216d2f09c3bae225788
SSDEEP 384:yeYdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:L+eUZsLQCZsL3hUS4
TLSH
T14E53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\activity-stream.contile.json
Size 4KB
SHA256 294da61d128d0ef2d14190665f733d8d6b4ae6e72d65585bad300739e1304451
MD5 6631f18b48f10b78287cdf74df5b41d1
SHA1 69f06154cd89b958ebecf7f7feec9b3ffb1102eb
SHA512 ac771dcc75f4b0fff6531d428270e0fc9c3cee684c9f170edda45ef11d9a24f38b917f034fccec9f414cfe588307bd4655573703cfeeb8de83d60ba441ca341a
SSDEEP 96:TJqMAkn9mxiMcT+mRk18n+WFUNT9rYYwylz:UMF91MdmRM8+3NTVYyF
TLSH
T13691B54B957848621B31B2E42C0B7B6CF107700699F5EE9C716A5C6582AC7FEC0DA9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 78b0e20ce6ac73b7976d37135071aae8abad39172e9f5a0e0866d1439bdc84c1
MD5 93173cce4f43592da61cea2c637613e1
SHA1 140c02c74a28f386277272693bd33e45336264d1
SHA512 f5ea23e114f8c7435508f8f718cf3e33aaae727c11e704246bd17257b07109ac54aab5e61434ab2e7a4a6be3c55ef1cab46c59b8dbd3eafd87e3b98a3e699c06
SSDEEP 768:Dyy2204hOfBYF4lbOlJXgZKi151GJEqkOOrU2L+mLs7o+Gnd:+y5xUYGlbOPXAKQIJEqZmdcpGd
TLSH
T1FB73F9A3A6ADB1FB1F9037CB1C0F799762A10186E34506C8FCE9CD1C81CD795123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

24130

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\24130
Size 52B
SHA256 1f306fd180c908f60ae6f2c4b3046f0160decde246698b76c56e936cac0a99e4
MD5 0fcb39709fee905adfff27b27649a649
SHA1 3ce03dc1e62d61a5221cda526523bf30836d7578
SHA512 35df567c5909d1b259a2181c6f6961d1071abc093bf8e015ff4d1c19dca7588cf81eac9d6a679eb8e396bd55bea7245661a3b256bdb1b43441c57f387842d9d2
TLSH
T11090024442918958E02580310940C4B814553D0844D0421239D2076206114E21111369
MD5 SHA1 SHA512 TLSH

Submit Download

2446

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\2446
Size 7KB
SHA256 1cc549b18fdd260e776ee2993db87591efb3b0fa661ba1318c2d842bd4faf0ae
MD5 7c0520b74dbefff79d96f825a693b5a0
SHA1 b0fa2031bd92d6a1a4af6cb6f3aa24fc6cbb83ba
SHA512 0ba521500b30a607e586da09812c56d8aa297e5e3b906be06771704772bf47cea12e96180a7d4eb24a41f4a91c530f49c7b2bfac021057d491a1ce4a9e3e3353
SSDEEP 96:PH5toRgbxV3pkYctoRgbxV3SivjCfgp+fY3GEt/NGLxbt/NGLx6VGR:cRg7C0Rg7CWXp+fY3VfOxbfOx6UR
TLSH
T17CF15D3F9E0974050AD55AE2C04A2A4F6C51FA47ED86CADEE1883352DDC8270A75C1EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8365

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\doomed\8365
Size 256KB
SHA256 8057a7370a86b5760e9b75ecf905ba317d474b1e68ec8a05e09a3e89d7d5f3ba
MD5 aaaf07fed147174565ada13c70670790
SHA1 dd3144035c2bf986bfdbdf6a10201ef9d1230106
SHA512 8e330c42fc33140739f32d38856de00545df7668a99078ef1793e47f4e55449173b0edcc05ad0c674dfd245f14a0f9f124e4af729a7e51d2459a56abb2bb8069
SSDEEP 1536:jYCYPspwQ6yyGSPr0ycvkcIBevY//gY0HS5bjcHlS6SmIM1EiasVgev38sDuNcK6:x7Dy5cSeJObjezIMhVPvuJ2Zj3H
TLSH
T12E44F7F7D6AC70FB07528ADC2C1D72CF72AF413ADB5208DAF8688148D3C9A651076799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

733849FFDF119F55FC621850508A6E493C2FEC79

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\entries\733849FFDF119F55FC621850508A6E493C2FEC79
Size 353KB
SHA256 5704c297454ab78d9e829fb71709b44ca4052626f2d0e1c63191da2e92a5a9c3
MD5 ca064dd2e67ad9cdb0436ae81efe2a4a
SHA1 1963a3c0ea12be38fd7d6690bfbdb88f029006ca
SHA512 d0462662ebb69150853351670cf097b2d105c008c8126cd606bc6af0ab551adb997537722a7bf8326b43d4d207c338d4d3e2655946b751ce30e12e96e3ff6fc3
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRq7:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEY
TLSH
T1F974231B2E0DC93227834796903E391889059A1A4FCF66D11B6847E8853CAFBADF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 b037bfaafabfb79bb8bb585968ad1cf043756ef3c7f5981912f08caa9e1e52a8
MD5 371e2f62a338dcc26950dc43779703a6
SHA1 2082616d3608ff845278140b7b69e78cce58f307
SHA512 498f7c8f88f2afef223f80459f033c32e49ef8c1b8ea24f45df1ca3253f5ff8e66b308acec19aaa53917b5a487a52524e4634a516cc5b85585df68a4c4ff8bc2
SSDEEP 384:HGNQiO024YpWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA5:mDZYpWTToXJWTTogB7S/AmVAf+hRMo
TLSH
T167728E7D8F013CAD2B1780E9C8B583588D18B6E7DFF6C06D269C3D09C984A1671F944E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 d92a6abdedbf6b3fc1459382f93691e70c2edc7cc1f43194e736d96624f824b7
MD5 1b25ffa04593b2680621d761631abf7a
SHA1 e2bed45a817ec23409565ed4cb01a2388caceb5a
SHA512 ec324926987d32949b74be7e3a98795cfc47dfb4a21c80ba39cdde2be10478cac4b2af69b06de7dc87cc2a53dec2c9a678420acecdd2850a7062163d0b341f91
SSDEEP 1536:XTrliyg4rDqP48Aa8H1iE6sIouauLWlZaLHE70w/XRRP/hySS1h1DRr/5LQgMmkq:X3lY48IUs3uQQLy0qpybTh3C9rS/
TLSH
T19EB3AEF6CBA28D2D55FFD42D6AC3843EFD266440B3A73009C8237754A1C6B74B6B5648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zt90ztxy.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 e577c0fca337a60e21f3eb1e46d609e176d2b131c2c48e6962811914beccfa55
MD5 da6ebbd89f79d1d780499752830c3bac
SHA1 79c7dc061302a8099483ddfc68878af33fb0d802
SHA512 fb76befffc7c0151e9a89e4eba469e4a5a4b381764468a61f47224f8960a3626534d2b7bedd90d381773412967f192c4155851613a1b5ac4705cbf37aac1f9aa
SSDEEP 1536:jTrliyg4rDqP485rDZblt+Z3p3tjaLD37L/bBw6uhaiKS8h1DRr/5LQgMmkRAOyQ:j3lY48nbz+duL/3iaiaTh3C9rSC
TLSH
T19AB3AEF6CBA28D3D94FFD42D6AC3843EFD266440B3A73009C8637754A1C6BA467B5648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozilla-temp-41

Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41
Size 4.4MB
SHA256 4481aab361e03206ac4973496837bd9bd38b5c7af0f2ba93d950d4822d6fd6d1
MD5 b568077c5c74f620c9645f6c94d9dae6
SHA1 3851afa5638f19cbe5ca9ec1e4768c372800c768
SHA512 0921523f299cef82c61c0931e0628efb581180d7be5c4e9d91850f00115519261fdb8c0f77c49423a0455373159bac6cfee7d49c071f9bfcb0cde5352bfa9b53
SSDEEP 98304:uDN0gxIrlKgrZ/R6uqm1rLDTnZSyfRKjGhj885jR9P5clCol32UDNe:g5yKgrZ/0uqm1VRKjvWbhcrl3NNe
TLSH
T12E2633CB3CAC64967DEFE67333810E251030ADDD4829C376C964C8A7510A8A5FB97B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\AlternateServices.bin
Size 15KB
SHA256 886a7e2a6856e1f4433ec702c3ff5a876fc859fef0a07c76bb5b269fe4422dda
MD5 c04b2797c1bd8d986701b156bb30109b
SHA1 d39b740ec11e214fc5d920c204eb4d3839fafa4e
SHA512 d7520ee2aca5cca4635dd391ac922afc334277ad2d831e10a003ac0f91b75cdc02e5c5a70db3ceb6c87ec5e5af4a11590f72e08d5b29d345c213df9ff9942769
SSDEEP 96:DQZKyq4XR4AB3sI56Edtxh77wM/pFf4LOv:j1Q
TLSH
T1DE6284F36B716063F1929FB0806875CC9C33032B496D9184C62590E662D6BE690FFF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\AlternateServices.bin
Size 11KB
SHA256 6d1a965727a85d1a9a6ae0c96418eb1e6ab12e8d0cb907722dfcee461aa58781
MD5 624bf7ae59f6136adc6261418b617f94
SHA1 5f8c0992e8e087887564301c4c5945c62d068280
SHA512 ec324a093a9916e1e9e0b7f9df1908342fc7f2019201ede7e3d086d0af385a17719bc8d4464f1be368e2d396d3d14e466e8ac69f00334f7621a18577b0860bfb
SSDEEP 24:DuhMZp916Ru0f9BUOkd9x+W5+lz09Vv2b5q9F55A5R7M9FSI9l+:Ny7FxkXkW54WB2VI56R7+MCI
TLSH
T1A53286F36B72B063F0929FB08059B58C9C33072A196D9194C65590F653C2BEA91BFF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\addonStartup.json.lz4
Size 4KB
SHA256 5b0dd0b652ca81f08cd9ef5e2ce47c58c98de7ca8dcf996a93c5d5bc4e4a11ab
MD5 f2dd8f870a0d5f9b665325b316757a75
SHA1 2bb519a2785c1413398a1bfc45eccd75e21819f7
SHA512 1341368f43a0c8eaadd0cadb6bf5f9bfe94ef788e35beebeffe207266c5ebe4785a456ace4d0471d0567dc5e2e67d3eebbaea20635eb1d76f5ab18a1766b7274
SSDEEP 96:Nop4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NX52xxhD8rGvm6ApwnHUuhN
TLSH
T148A17D7AD141EFA1FE32C04348E53FB2EAA59B7410A9C4D4F1AEB1294C64E735705380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1091bff0488846ca3fe3336ad0095018e227f68c0a02fac99987c0bbf8731e79
MD5 74184fd73c93a4d08891055e59e52779
SHA1 56921472cda078c486a14eb015eb0b5d16565ee4
SHA512 122e7e79ff2e38d7ab90123e137311dd3c3ea24053803e80a1984ad6fce57cbc9bc83a1b42bebb8e1047e39af28049ae08ecbe3b123f2266a12dc3b57a3a1084
SSDEEP 192:POv5zbocvZyFyjw8ElIhL21d66Joz0dzgCl6mc0dz:gbocvZyFyjOIhLQd66JozQzgC1jd
TLSH
T1EEE120A4EA29867FC408427BDCA61B410F35399A9C4E3F19319C751C2C4B2EE769E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d366a3739c5dc60d94c7499c6454258ed3c7490db0b03b301144e589d446f31d
MD5 d4ee3660979979a02db8404d2ba1263d
SHA1 40ced701d057692ec19a362ddc9c524ba760a28c
SHA512 18f98c4972e0e9a022c4ebeccbc7e143f6e701bcd68d536f90a0a48d35a7567df1ba3e8c899024699f206fedf91801c7966d81d5177125012337f5a33fdd543d
SSDEEP 192:tlIhL21d66Joz0dzgCl6mc0diOv5zboHtvZyFyjw8w:PIhLQd66JozQzgC1jvboNvZyFyj2
TLSH
T1DDE131A4E629867FC408427BDCA61B410F35399ADC4E3F19359C711C2C4B2EE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 57d06d1857953386ea0824ad2e31e9297b2322b842b43d787d50a0fab44e0d0e
MD5 a6199fe391614d6b5d16334c95e35dd3
SHA1 a7d91059d69502f133868b5a938c81f3d7078c21
SHA512 b695c1684c027f5eac6198879ca9b3c225a0e2dc4360293d214d9e064555d87ba083d3d1b6cb0ef40b33283450959d7f6c81e44c47f0abf543a40f067bee7cc6
SSDEEP 192:KlIhL21d66Joz0dzgCl6mc0dVOv5zboHtDyFyjw8:aIhLQd66JozQzgC1joboNDyFyj
TLSH
T153E110A4E629867FC408427BDCA61B410F35399ADC4E3F19359C711C2C4B2EE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 24d55a4461fefdf353f95313fe0286cab39bf01ae4c19cf927486f72ca4f38a4
MD5 26be206d95ccc2470604ac8dbca9ad3f
SHA1 d591f8dca8eaa03f7b235288bd89a3ccfb27d6a6
SHA512 14298b7909ff841c3ff20478dc2d4eba845085bb263e30a254eff25d3914b1bf265b6ec2b524f6cf222191bcdff43ac999eb8a4940be04b08aeeedbf0f9defa1
SSDEEP 192:8lIhLR1d66Joz0dzgCl6mc0dVOv5zboHt49yFyjw8:wIhLPd66JozQzgC1joboNgyFyj
TLSH
T13CF130A4E629867FC408427BDCA61B410F35389AD84E3F19359C711C2C4B2EE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\events\events
Size 1KB
SHA256 71538f8786c57115e09a7315ecca7360701cea276b6bd0ab01f7c519819fd2b9
MD5 a8bed3bde4616e0474de3a8a39f9e647
SHA1 bbcaf680d015ecc2f27a6894940dd56f8eb9073c
SHA512 69ab716327ff79fc27199d1e7e698ccd0cc9ea3e65778e658a3061a61afc93a6862dc26aae69e8444e6ea70ab6a7c4e8699b1333e2ab6d407a01dbeafe5a1731
TLSH
T1F821794C3EB84D6AA8CBF69C744103CE53658E0B45871D830D22DF8CDDD2ADA32AA43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\events\events
Size 3KB
SHA256 ca02674c2d4668b9d9859a3eee4d84a61ed715c7762881584bf2ad224516a915
MD5 eb4291e9ab08c856bd39899f8bea7082
SHA1 6341f080e95ece5f58540d70b518c8c8b586e0e0
SHA512 fbedda17131114322275cc020ddac01087f8838d592f244700c66ecfafb47afdf2057d57d7828875f447344afcc9775834140ce44593bdce05459270d0399802
TLSH
T17371D01C69B90C7E69CBF79CB44143CD83A94A07848B2D834CE7CF49DC97A9A325E46D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\events\events
Size 4KB
SHA256 3ae9af78532632f1335492a15e64c701a082ddf982b5e2e1891285115bb2f9f9
MD5 edbd9d0115b204c37c4b9ffe6f16b3c7
SHA1 c20d31e7c8bf86094e7571a2ebbf474d054315e6
SHA512 0d610f318707b36411ec3056e475d6566a53fe252395faa708161f54f9be1544fd2c5dff53978aa6b5fb3ea8c3e94339ade6592c54ab5a34b45782e648ab3126
SSDEEP 48:YtNofYApDv+DMk0tKybsrwLcfi//I35wxdY91bMdc446wwmT1SG3byCxZ+flcCNd:EDuWELfIwy443wGQG+HL2rS4nYv
TLSH
T108A1DF1D6AB91CBE6DCBE698B40143CD43A84B07C58B1D874CEBCF49CC5769A325F429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34cec671-2bf3-42e3-a6c4-2239f0c27cc3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\34cec671-2bf3-42e3-a6c4-2239f0c27cc3
Size 886B
SHA256 0e1c6c5e2c4d0f6a5c2a0b9194d9667f81a5e673044faab70a262ffcf92a6a94
MD5 596313291d70ea38e5b158618bf1090a
SHA1 54dc2f51d42625671f56ec30ef31209f43bf0a0a
SHA512 76d8e9fb307da921cd10260cb31b7aa4da7efbdbf143ebd3ca6933ad305eadf519a27938ad902929da440ea17a1db145399436bca111795d1abfffe0b4248d70
TLSH
T12311DC919639F5B29C2CD68798D1B74346B43523C0CA0D183E64AB180CAE51FA3A720B
MD5 SHA1 SHA512 TLSH

Submit Download

550e670b-4dd0-4ef2-a418-e72ac6b03cfc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\550e670b-4dd0-4ef2-a418-e72ac6b03cfc
Size 883B
SHA256 1393b5680f017c3363234bdbcb9314584227cae8630fbd2388de73ea492ab355
MD5 c4dd4c7188b51348ea56b93ac30899a6
SHA1 ea23681471d9750970ceab6145a86159f5e3296d
SHA512 39a37323584eec4025efb07c4b36c5cd56e4f344d79fbae178141b335f6bf8f28c6b1f4cdb5fb779b2ba8e30a517b98f8fd49d2bf307076adbcd7933c89f2b25
TLSH
T1C311C481D73575F2DD28D24B8995774257F4752380CB58043D659A140CAD51FD3AB607
MD5 SHA1 SHA512 TLSH

Submit Download

7b9dbcbb-6b62-403d-921f-71966608d846

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\7b9dbcbb-6b62-403d-921f-71966608d846
Size 29KB
SHA256 2ac23d14b67b54a02628a176ae98a74f6ae9b46514af07ef932eeabb401c3b14
MD5 da315846c90e8c5d4977fb9fd43e9a47
SHA1 22f3833a0314b34f8dd4c7815d65b1538d4560fd
SHA512 9b582d629fc17b9c0076bc3bfacf32e8fc2aeabaf81b668d2bd8022fae24662ea9c056aa38f9de9314ea6eafed6ce6783512853b294b05ecc87f431d141290d7
SSDEEP 768:dc78INXidemX0EJ6OQ2uxv6LAS1Y5VDnhRWB0u5E1ETjB2S3MByl4Wt9rhSdRFS:ygIsiPxRnqB0uGtnWFkW
TLSH
T123D2FAFDCE1240473E65E51EF2EAAD6B2017193209CCC7DD6AFD483A26C697B1527328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b93afd5a-96b7-42c2-a69c-b1950f4658b7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\b93afd5a-96b7-42c2-a69c-b1950f4658b7
Size 2KB
SHA256 642b1a643671335501c98baab174edeef11ab6a67564834c91c703cffc29011f
MD5 b67c3f0eca2bf275158c8909df81365e
SHA1 2a17fd140ad423edc0a0a06bf5f83d7aab34cb28
SHA512 7ac476ab97cffaaf75fc49af623a5321fbeacff0b9d9e30abd0861058b59d13d9084abfdf4cb9b25e7510b926dd075478becf00344cdfa4c76b2069c22047713
TLSH
T1BF41216875BC5D769C8AF24D9491238E53204A0380862C876E45EF4CCDD67DA237B42B
MD5 SHA1 SHA512 TLSH

Submit Download

ba080e67-73bc-4acd-81a1-f20046b07525

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\ba080e67-73bc-4acd-81a1-f20046b07525
Size 235B
SHA256 1309e185752ada22af1a0d74929fc747b6f009456646a6363534eb4d0d0a6ccb
MD5 59eb91e587c884fe382dd2a37c4efcd4
SHA1 71dfc55b68ead074015f4aa13aac08c904d5ecb7
SHA512 633445d161a11a08bc141b70d42938d31f86a308a3a43adacff4d74ed11462d7cd982c31011e6ef619af48cab79e09b0af3f1cd106c99e5247c8a292eedff2ee
TLSH
T13FD097802888A7AC0C045F17F0A039C330968C3350659830C99205348AF8AC8023181B
MD5 SHA1 SHA512 TLSH

Submit Download

be39e428-eb06-411c-a771-9c88fb5884c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\be39e428-eb06-411c-a771-9c88fb5884c5
Size 235B
SHA256 f32a2732e41e941c30347d90938990b7296c6791ba11e9660ff26e2a14015792
MD5 e0704e7c883accda3ee0d75c13b0400c
SHA1 ba1e069ea1d7cb9439c5ba2fdc69d3d6ec393d8b
SHA512 8b2d6db814975a5fd32e36804d26263089da39e3bdae88722a5bf9cb10684f03f18e33114a4063a167c4e41283b56b0baafa5003276f08bdf53801e6439e31cd
TLSH
T18FD0978028A8B76D08040F27B0A02FC630888C3328B56C21CA6204B8DEBCAD50151807
MD5 SHA1 SHA512 TLSH

Submit Download

c696d096-d477-4c45-aa9a-08a2b7472532

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\datareporting\glean\pending_pings\c696d096-d477-4c45-aa9a-08a2b7472532
Size 16KB
SHA256 9a41fc6aec3695326af86a42403e8d1abba6e679b85b4eb1b96aa1bb71d41894
MD5 94548f6143af215d5c0c599d61983e44
SHA1 b919503bd96665c3951b27b97ed03e5301c137a3
SHA512 22923590ff6ac8e416857626d91f166a67479314a4d67401e992573429629a04753c3231cbf5656ca73829bbd62cf816d57da369a5fad6ca62058de3f89b68ed
SSDEEP 192:lyn4APl3lSRzxB0iMunb2UuK8j4b3aSccLhHcVyi1roS0OyycFaeroeNh4oDxvOv:lyvPl1SRlB0izntFzvRN/DxvOwAPH
TLSH
T12472D756282045BA8691E36894FCBFC3E6F52CCF4C418FCE9BE4BD0469DE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\extension-preferences.json
Size 942B
SHA256 00dc2290dbbdce30a85e06ded26d7ee786412fa45c1348a801bfe2c13b9c63d0
MD5 b9aeb15420f1636d61ab0f72e3852464
SHA1 34f4c6b664d0d5b663678c1552686723e8cd9cbd
SHA512 f5d138a42649ea001273d8f516dd0e5f91aae04ccedcaa1da9a27e3f5aed14859f02733629a52af8c98fee0b5dc70998b4c27821fb8a459349eef4b1dc15b14d
TLSH
T15411F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\extensions.json
Size 14KB
SHA256 d09ca0123f66c361cbe597b432ff7bbf7a1a5ff2d3f874d43103f676fbaeb523
MD5 b171d4f5593ac0a0de195f2a996541a2
SHA1 27190efeb3b71f2b0af5923ef412321279b005b5
SHA512 f2d490e87c5fe3be745c6e7fb074f55660c3c5d99ac11e3c55a61baa39a9eaf0508e06f51e4f96894c5d7bd5aa314d3e474d945d6411a02cb77a86e4683f14be
SSDEEP 384:gEkI4vAUmldvTC8dhW794zv96oAL4HwL4PbL4HrL4HuL4HC:gLI4oRfDXW4h6N4S4f4X404i
TLSH
T14962521545048EB8298FA79BAA367E01D37D473B70445C78F4DD8FC842FA5B902BB62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\places.sqlite
Size 5.0MB
SHA256 efaf720e9109be0c7ab52311f2a415eee5d6953a1a7535f240dc64c1f1b42ed7
MD5 2ea49ee9c2dc28686cd0caa77cd0ad48
SHA1 51a23c77417bcbade409525a852280b7af6a4a18
SHA512 4686b0060f2f379bd8610302f597d0e32a299c9309f335c539971f76c3fabe1bf6e3f217973eefb7a4e29a39d188c929f2b05100d32d9ef34fc3405819679403
SSDEEP 384:M8r54w0VW3xWd2RIXwDhQOaCT54MSoXk3:rqVW3omCsSoXk
TLSH
T12536A65B7A305152C4EAA231ECE35B08483F71168A7677933DA41A6D0DE0B63B91DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs-1.js
Size 8KB
SHA256 295aa74f4bf2712f905529f26aad01cea20a724b873d15781e09e6a63626726c
MD5 174bf0f00f95edc85b74772b9afe8105
SHA1 24a316e982c95fccb5522231936d4a4f43fdb0de
SHA512 d4fc9f97391e67d7613f96aa36253f7ba82dc5c90de1825cd25590aae01d7c9098a76aeb4cf1e38b01a88b7d299c0d09321e49e68ec5797a6bf4753cb3b3618c
SSDEEP 96:xHsdTUSqGqnfhxGaNbzSv1SSlcdv9jvnuWRTGt7NBw88nv4jws8L4cnGLEcGS:WIRnfhxGaS1SS4RCBBw88cw6j
TLSH
T15B020D389504CB7F64B677ACAC6489705AB2013BBABF6CC650B944D5054CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 12KB
SHA256 fa8781fd0e0fbbe340ff77879178d890718614d66c68a3e9042abb3c2d9741ce
MD5 31e8fd333bdcbef0f61a37333f155871
SHA1 66601fef4a34f57991c07427a45b5450d95d8e95
SHA512 a5abb0f7c7be5d26ddf16dcd5148082cdea299c0ccd07e0a94fd57a86da5f0e082e7f22856ae37b90098d47ef018057f872d61511131787084722db4508267ad
SSDEEP 192:WQCRnfhxGaS1SSrLRCDmfOBw886qg0tubrf:K6R2wDg3
TLSH
T1D142E03C96419B3F25B2327D6C215AB019A10137BA7FBCD345F889E2485DF2441E7AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 6KB
SHA256 46365e72a892e5c80330d9edd92efffaf69a8b5f6180866acbff5ec06c77b163
MD5 476e5915f05b61c1f62e50712bb9631d
SHA1 f5aa9f597ff6c2a42d010b832feaf3f919f02c7c
SHA512 7b729d3af4c5d6092f811d4463b40b114ce1dc3d14405d417ca653f376ecf939e7b912ecc30278b2fae5dc7881371c57679474a72d94ccde1ba58a23685526ea
SSDEEP 96:xHsUTUSqGqnfS+q1zSwSSlcdv9jDnuH6tZBw88H8L4cnGLEB:WFRnfS+qxSSFyZBw88bs
TLSH
T1F1E11F7894488FBF74B6776C6C6888715AB2013BB7BF28C750B55885054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 7KB
SHA256 efc7c7dd3866dd35db5d38fd013d4bc2360fb1da9d8d414d8638979453bc1d7f
MD5 78a287d43b52626b5ab1d42ec9566915
SHA1 8d3da6176e5907bd7beb33562f2143280ba14d84
SHA512 b22d32096dff71b238348bc95e70b51a023e09db7e9e3cddf55a3033658b34419f1063344a6d280b16aedcc227566fc703edfe65cb844dc487ce37c5fb6ba593
SSDEEP 96:xHsUTUSqGqnfSxGaObzSv1SSlcdv9jvnuH6tZBw88H8L4cnGLEcGS:WFRnfSxGaF1SSxyZBw88bj
TLSH
T1AFE11E7895088F7F64B677AC6C6888719AB2013BBBBF28C750B554C5054CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 7KB
SHA256 42c6fdc9382b0a7ab37d49c23a097f4e3a2625e5adce5983ddda762ac1a39952
MD5 3f00a68ecc6f89d3e843872e0c678a74
SHA1 8745ac440f3bfcee3cca10e0914393747d4983c9
SHA512 bcb58f8768e49b1bce0215f1578359735f4d3f043e03fbc37070c72648e177a943b447f9c76b93c74783d945abad7b7f92000dfaf79b36b22787c1c632ef7094
SSDEEP 96:xHsUTUSqGqnfSxGaNbzSv1SSlcdv9jvnuH6tZBw88H8L4cnGLEcGS:WFRnfSxGaS1SSxyZBw88bj
TLSH
T1B6E11F7895088F7F64B677AC6C6888715AB2013BBBBF28C750B554C5054CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\prefs.js
Size 6KB
SHA256 623074a0ffd7f377e62dd3b582ffd22a6002e96f4dcfc349384612317214ee3f
MD5 b89244ae167ac17433e459d4322345b6
SHA1 6f620d7cdd91e35f8a90fbe5bfc8366e8f8f80f3
SHA512 c95b60b32a31e929983f3267a4997dbdcb95eb23198f41225b17198c81d103fa63b8be8d39f91f3dc0ef387229a24a9ff2bbd4a0bee1806dface404341bb2790
SSDEEP 96:xHsUTUSqGqnfSxGa1zSv1SSlcdv9jDnuH6tZBw88H8L4cnGLEB:WFRnfSxGae1SSFyZBw88bs
TLSH
T133E11E7894088FBF74B677ACAC6889715AB2013BB7BF28C750B55485054CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 d010263487f5524c206e354f624928777ddf3e28f9042c21f956e319c3d6132d
MD5 da313ca9eefa52ada587e491d7f6dd38
SHA1 ff59af5c73aa78c44bec93794134914493909180
SHA512 ef55c5a683655ba28218ab86cc2dd71fa0f968791a9d2cd5397a05e3b202407e2b319002d4f34cd8bf4b5fd0df95577912d6e0d7e827c6e1ea77d6406263cf77
SSDEEP 192:ZBuQ09dGewFBlyekIpKknv2VztmbVXjor/yb+qE/TtHbR:ZIQ0nGn4ekIYkEtYyyb+dZHbR
TLSH
T15EF18F03F2627CDB856E7467C9CC7F0FA18296558B71A746990C8FB58C57A1C239933C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 a54fd09aef92959835803fca6fca61abf82f792698027d18c6235a7ac7c16e03
MD5 5fede095de1f76db76cac71f333a9c09
SHA1 29708565eb34ba7573b117adec096e6e5efc5a7a
SHA512 30665544800a750b422596202c753020f8148a3d936886f0740fcffad0d6181f3841689f65217ffb159472a6d7ddd8badd7c4cfd8d8d2d605940add248edfaf2
SSDEEP 192:iBuQ09dGewFBlyekIpKknv2VztmbZNnX8h3G9E/TtH3NW:iIQ0nGn4ekIYkEtOnMG6ZH3NW
TLSH
T101F19F03F12238CB856E707BD8CC7F0F91829A654B756746AA0C8FB5884B61C33A933C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 f5f5073f32af2186958c4361f962ad50ea99e924e724ed404ed9779e477a4d19
MD5 787cac973fd342389df4d9b146af7e88
SHA1 6a469a4915cbd14af7bc4747c58db724acac72e1
SHA512 5c05d2515e631cd9009117985538bb508a094973eb8ba9f7a357cf1d4b58bad9320056ec65a161e2b8666cfeb5ea3b94303bae2c96ad6f3d3df15eacd3ed2236
SSDEEP 96:xaYAC8EMJF7VbMZk0zf8W8Qge3ZwS20o5KJ959vM25:xa0RgF5MZkcuemj5KJz9EY
TLSH
T1AC816C72C82D3EDAE4B9B13B10E108E3DFB7805006F7F05566141122C06B68923E9679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 19e27ca4824346f4f8af07e4a05e49b3c5bb6e1492bc8a2da3759d7d0c61e337
MD5 97c7cd32a91851c6f9d93480b7d1d6f5
SHA1 6e2343e7aaa33fbfbf4ab6342d339ff981c6aa08
SHA512 bbcb9b63557040943fde97ce455688bef4929e0097ccb28943f8c3d1fcc6e0fea914b26c67f561cf756107931fa3229179ae8489d70b243f33a2ee45f27763a7
TLSH
T1BE211A333D37BEFE7706502295C43FB6454D307280E05880507C9B09E05A11F236AA0D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 562b22b31a28e1f4492d393674cfc838f4973b345daa4bd3cb3db3ea92b95d08
MD5 72df333cd37b1931f4e7dffe0175827f
SHA1 3afb02a0b14d18edaf4a283c109e58eb332fe14a
SHA512 1bf8a5c36dee08a410b554c15510690df4736102922c42ba8aeab706346d1249dfcd7e38d6af500b760ac383dec630ecb8cedfa49f32f4741dc39a858206863d
SSDEEP 192:uBuQ09dGewFBlyekIpKknv2VztkfXpKHgE/TtH7oz:uIQ0nGn4ekIYkEtOibZH7oz
TLSH
T1C7E19F03F1627CDB896E7427C4CC6F0F5182E6A69BA09346991C8EB5988760C239D33D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zt90ztxy.default-release\sessionstore.jsonlz4
Size 7KB
SHA256 f0244c688d2606d7319497079397e72de25d83ae11f108e7dae3191d8a5725fd
MD5 aeac80bc15f170728818e2cc8d74d82e
SHA1 f8e01181d5addec0086eb51992a50802163b80c6
SHA512 1a4f5bf9112bb4561de51b354ea85e0f741729c01c17e4d9db04fdbec1e345ee1943f8e889ed163e6c202de40e33bc8a5221e5ab86d713408682da910bfd5d2a
SSDEEP 192:oBuQ09dGewFBlyekIpKknv2VztmbynX8hUGvE/TtHL:oIQ0nGn4ekIYkEt7nxGcZHL
TLSH
T1C3F18F03F11338D7846D70AA99CC7F0F91429A654A7597869A0C8F79888765C3399338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download