hxxps://www[.]campforestgreen[.]com/

Resubmissions

02/11/2026, 17:43

261102-wat6caby3x8

02/11/2026, 17:39

261102-v8kh5avzaz8

02/11/2026, 17:31

261102-v37rgadz4r8

Analysis

user interaction
yes
max time kernel
112s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.campforestgreen.com/
Sample261102-wat6caby3x

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
80	2228	firefox.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	IncendiumInstaller.exe

Executes dropped EXE 1 IoCs

pid	Process
5460	IncendiumInstaller.exe

Loads dropped DLL 5 IoCs

pid	Process
5460	IncendiumInstaller.exe
5460	IncendiumInstaller.exe
5460	IncendiumInstaller.exe
5460	IncendiumInstaller.exe
5460	IncendiumInstaller.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\IncendiumInstaller.exe:Zone.Identifier	firefox.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\IncendiumInstaller.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5460	IncendiumInstaller.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	2228	firefox.exe
Token: SeDebugPrivilege	5460	IncendiumInstaller.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
5460	IncendiumInstaller.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe
5460	IncendiumInstaller.exe
2228	firefox.exe
2228	firefox.exe
2228	firefox.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2228	3480	firefox.exe	88
PID 3480 wrote to memory of 2228	3480	firefox.exe	88
PID 2228 wrote to memory of 4804	2228	firefox.exe	89
PID 2228 wrote to memory of 4804	2228	firefox.exe	89
PID 2228 wrote to memory of 4804	2228	firefox.exe	89
PID 2228 wrote to memory of 1424	2228	firefox.exe	90
PID 2228 wrote to memory of 1424	2228	firefox.exe	90
PID 2228 wrote to memory of 1424	2228	firefox.exe	90
PID 2228 wrote to memory of 1424	2228	firefox.exe	90
PID 2228 wrote to memory of 2952	2228	firefox.exe	91
PID 2228 wrote to memory of 2952	2228	firefox.exe	91
PID 2228 wrote to memory of 2952	2228	firefox.exe	91
PID 2228 wrote to memory of 2952	2228	firefox.exe	91
PID 2228 wrote to memory of 1944	2228	firefox.exe	92
PID 2228 wrote to memory of 1944	2228	firefox.exe	92
PID 2228 wrote to memory of 1944	2228	firefox.exe	92
PID 2228 wrote to memory of 392	2228	firefox.exe	93
PID 2228 wrote to memory of 392	2228	firefox.exe	93
PID 2228 wrote to memory of 392	2228	firefox.exe	93
PID 2228 wrote to memory of 392	2228	firefox.exe	93
PID 2228 wrote to memory of 5276	2228	firefox.exe	94
PID 2228 wrote to memory of 5276	2228	firefox.exe	94
PID 2228 wrote to memory of 5276	2228	firefox.exe	94
PID 2228 wrote to memory of 5276	2228	firefox.exe	94
PID 2228 wrote to memory of 5296	2228	firefox.exe	95
PID 2228 wrote to memory of 5296	2228	firefox.exe	95
PID 2228 wrote to memory of 5296	2228	firefox.exe	95
PID 2228 wrote to memory of 5296	2228	firefox.exe	95
PID 2228 wrote to memory of 5320	2228	firefox.exe	96
PID 2228 wrote to memory of 5320	2228	firefox.exe	96
PID 2228 wrote to memory of 5320	2228	firefox.exe	96
PID 2228 wrote to memory of 5320	2228	firefox.exe	96
PID 2228 wrote to memory of 5332	2228	firefox.exe	97
PID 2228 wrote to memory of 5332	2228	firefox.exe	97
PID 2228 wrote to memory of 5332	2228	firefox.exe	97
PID 2228 wrote to memory of 5332	2228	firefox.exe	97
PID 2228 wrote to memory of 5116	2228	firefox.exe	110
PID 2228 wrote to memory of 5116	2228	firefox.exe	110
PID 2228 wrote to memory of 5116	2228	firefox.exe	110
PID 2228 wrote to memory of 5116	2228	firefox.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.campforestgreen.com/"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.campforestgreen.com/
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27100 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {0031b350-aaf1-4807-ad10-984a2eed7333} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27136 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2516 -initialChannelId {eb88cc75-1bf5-47aa-9022-3242a1c6fe2f} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 25164 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {baa8ae4d-179f-4167-a29c-c56603111e6f} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27276 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4120 -initialChannelId {4a98ce9c-d24e-466e-958e-bdb677e44f51} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34775 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2808 -initialChannelId {8599c3da-e2a4-40c0-b52d-fbd9273066a6} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4984 -prefsLen 35012 -prefMapHandle 4988 -prefMapSize 270279 -ipcHandle 4996 -initialChannelId {de61fc4f-be35-45cb-9e70-f3c7ec27e1f4} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5204 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {3c805c7d-fb4e-43a0-8f27-f7b9a0cf6cfd} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5244 -prefsLen 32952 -prefMapHandle 2760 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {8bca6659-c80f-4e61-b0e8-ab1232174035} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5612 -initialChannelId {34053187-9ad8-4841-b58e-8c8a9e5b5276} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3976 -prefsLen 39944 -prefMapHandle 2720 -prefMapSize 270279 -jsInitHandle 3048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3184 -initialChannelId {b0f5c296-a72b-4ad7-9753-3519e6745b01} -parentPid 2228 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2228" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4756

C:\Users\Admin\Downloads\IncendiumInstaller.exe
"C:\Users\Admin\Downloads\IncendiumInstaller.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\activity-stream.contile.json
Size 4KB
SHA256 54bce7cd162946df5afdff4ae97b593656d9ea6c389c52b1fc55b3cc2c1bd277
MD5 2f2059799c8c0008475c5a0e941e2190
SHA1 f5146ead4b5deb3ef061e72d3e017c99fb1379df
SHA512 3dd99dfd2cce88787d55707adb76c75803c49f9177037f4499d601f199d78e3a61ea397e835958db2daeb292983923ec504639a7a70560da81b5788e959b9b0b
SSDEEP 96:Tg2KMS55mWuhe4UT+mRt+n4KY+cK+SK6Dw9lz:0jMI5dwe4FmRt+PmSKww9F
TLSH
T10091E95FE4744A931B31BAE12C4B3A9CF007B408F9F48F5971579C21C6EC7B991EAA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 421ab9ed560ef64b47f7ebf3b0087c8e981ce0268065019bc2a0f455fec91749
MD5 be03ee51cc7e9fa1e9283b46b73b0a3b
SHA1 3e69893db9362528cc5146a47c4269ccc95da74d
SHA512 9990eb05d94d048e631a381a66fc2aa951ef947dbaeb3d5151206a97ae676db37c1be0881ef532d7055e5e4ce2bb8ea2d8255e3e22928f9457ddb8d892bd18c3
SSDEEP 768:myrziQsD+GJn5kb51Bi+Gd121B29pVki3O0OOrKZW7ekF+GgS4LkPnMa41GPd:9rzc5Si12HIp+8OtZaR8GTIkkasEd
TLSH
T1687309A3A6E8B1FB0BD137C72C0FB95B62E10595E34606C8ECEDC91C81CD658523B5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 3a6bfc6406356ebe56ecad81a5ff3a8545b6c2a8c2d36895bd8bdd96e3c13b1f
MD5 33db4aed1b3f0fd6bc53bca72048f845
SHA1 3bfa4bf7068d0dde3cc0da3de2bfb5ee9185583a
SHA512 ce4207a013b58094b2401717634b0445b156258ed9d9f8758ec35ee054b2fd8fb501bfeb8b45c72983bce09c6a63238bfd0117d32a6d3162e96a004a1ce3c312
SSDEEP 384:HXwIiO024Y1WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAjJM:36ZY1WTToXJWTTogB7S/AmVAf+hRMyJM
TLSH
T104728E7D9F413CAC1767C0E8C8B983558D18B2A7DFB5C06D26983E0DCA88A5670F984F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 d7f3c092ca11fcecd675d3bb7b23302ceea61752328ac641971e24be9d5b7975
MD5 a9a3c17e604ca51ecc75968c2833cd0d
SHA1 bc2505e96890e9e7f21e1d49a27c3a5a2889bae1
SHA512 2a456ea5a93802b525197493117846f2894b00bb79358405d109ac01d8db648121df7ec75b20c84dc245cb1897570c1623697433aa7e29cb76c885ca59685e69
SSDEEP 3072:j3l2VgMzx/GuVSjDUDelPf22S/v7bgEcjbN:p2PxuHjDyelPOf/TpcjbN
TLSH
T191B3BFF6DBA28D7D64FFD01D6B92C83EFD222450B3A73009C963675452C6FB86275608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 e0b263592337ff088ef9521fc04b61e8bad1c096e3b445fcf387ee2230c9d494
MD5 54baedb0da4fb20adce1cfadb775b34a
SHA1 4432b15e4f672baf03ab53de80bdf1a73a11011c
SHA512 19b23818a756eddd38f2ffb4fde72851e74fb4b76d83cd4ef6e6646f06bd3afa5d87033d56602c923933f07b1bfccfdb48afbccb11e6cbd4ecbb0715fc572c2a
SSDEEP 3072:X3l2VgMz8VPxSHVSjDUDelPf22S/v7bgEcjbY:F2P8zSIjDyelPOf/TpcjbY
TLSH
T1B8B3AFF6DBA28D3D65FFD01D6B92C83EFD222450B3A73009C923375452C6FA86279608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\IncendiumInstaller\RmRDRcTdFHRG\SDL3.dll
Size 2.9MB
SHA256 fcaf8f9c511712a0886218168ab07c6b9faa77bc1e286135e26584804dae981a
MD5 58a7d3eeb0fe556643ebae6117e57512
SHA1 da1fd98a4f1b6ce44da320c9259ef8c80ee4d66c
SHA512 23a1512acdd133f7f5a70e008b6b5ddd24e5f2b61f8e8fa91c1c7942db781e6943b81d0f7615a427f0406fe0607edc4d1912b79111e3280f768e41298717ee77
SSDEEP 49152:cG3tMXoryJX4hXSEGeR02xCFSNRVjhpsTFxW7TvRUtrny6EiCTkLB0:6A3Njhpc9ukLB0
TLSH
T1C9E59E4EB7A7019CDD674079C28B620BE672B81817924BDB5BA447A53F33BF1127B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av_libglesv2.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\IncendiumInstaller\RmRDRcTdFHRG\av_libglesv2.dll
Size 5.2MB
SHA256 9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4
MD5 11a4a07f31e4a91fff678c019b7736af
SHA1 9912e11aa9c351be136474e0d0975e7964b1e124
SHA512 4197cd706c7abb4782f05ba73177a018299365060c6368305b030f21733f3209545bc7d8f61968c79b24088ced4acc4eda92044821fb8347c3370bc6925a4bf1
SSDEEP 49152:FJ2uagzq2YgAoS2tNydAOlzwn56aCqQ2iUAqC2rCnsZ1LT/Tq2XEoxEf6m8s47eF:9PTjAurCnsZ5T/lXEonmn56AL
TLSH
T104467C03F39690DEC409D2B9874B8622F776B88507257ADF229497242F77FD06B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\IncendiumInstaller\RmRDRcTdFHRG\libHarfBuzzSharp.dll
Size 1.7MB
SHA256 eb76238c9e8e41d44b5a5b18167c4c5b39ca5db4277af5dbe92d730f0fc14a7d
MD5 e0c86bbd88d6b8f5643c1ab1c050a4ee
SHA1 f6c72b1fd89d0f9e3d7825a0450ae0c0af092c5a
SHA512 023a1054d7516ebb99b46ca3f9a17b1ee00e55a46356586513fdd45c42bd6ccca16139a8e93e7a9bc533afa5abed121cb5fd40474bfb27bca22da3598ebef694
SSDEEP 49152:MG+tDvarn9O+3KVv/s0upzEpOqw8k25Pj4LneMdTaGVW:FS2be5Pp
TLSH
T1E3859E4AF2AA10E9D9BFC074C666950BE7A274050314DFEF65E08A95EF23EF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\IncendiumInstaller\RmRDRcTdFHRG\libSkiaSharp.dll
Size 9.0MB
SHA256 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
MD5 ef1fabce43fe32ca83260481253f5476
SHA1 ad988af9826e5aacc7b8e5ed6d220b229d70060e
SHA512 f73b56742e43b169177ff49f639c50f98a417f91175c70f7348bde1c7570c2838c181a59b628b003eb2618d75da920a449a724cccaec1dae8b9a80d5aac386f6
SSDEEP 98304:4GKXmtfLM9j2KAdTzwlrdyc8HgGTngmY6+o/:cXmlLMvGsIaGjb
TLSH
T19B964A03B66B64ACC04AC474834B99665E2038CB0B35BCEF52C5A1393FB9BF46F79615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.9MB
SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
MD5 322a050bc53af9aad7a659054354862d
SHA1 44dec61c400db851b57e4e2645fb253609db7d1d
SHA512 ae8624becb7619dd9602f416203c54096ae0e23c4c2574c8069e633f9682b0b9bf5bbb95e94fca6610b9581746d5ed648fd41c47d762b174bd5d632937df6689
SSDEEP 393216:vKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHA:wWCmz0dwJIkpqCs
TLSH
T16337E14AE35310E9E81ECDF4866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\addonStartup.json.lz4
Size 5KB
SHA256 c4a6e36f18384a5103ace435516b1369af7661d6b565cd832ea84d5ff8099c26
MD5 6535cb47d1e98e858ab6f455cc4418ca
SHA1 7515d89cf81ba87127d0567df8649f0aaf17a978
SHA512 07cbf1e26b0dcae908f6747807cafa7bd9b4b37a8a56fb1d6ee8a60372bb12578bc0f54efa2dda14f9ea8bfb2423117810bbfe0d1357206559c36f61efc2d87f
SSDEEP 96:lU55sWNNd2xWNhD4fMgGvmH6M++PHsyRdQHg4zB2k9N1bU8RXBYjjxyaY:lW2xohD4rGvmaM8yqVcMM8R6saY
TLSH
T188C18CB9DC88FE15BF76944EB8DABB32C6F91E3411D98821B4ADB3014D90AF11345390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\addonStartup.json.lz4
Size 5KB
SHA256 2d7c1402ae96643073702ef8497ec21686a85385161f859f1f68221e717b0139
MD5 4a8fd7964f9eb621719008ee94e42c25
SHA1 f5e1b1f0b54132ef52e4157b82682eb489ca1deb
SHA512 fe8c5f3311d9feb2c9123fe503cbe79d8774e31429719f2060b229fc610fcc89ef0c54e9533b2cd9fa10218fdd1be988a89aca3abcc7dfc6186c31bc6e741584
SSDEEP 96:HB4sHNw6M2xWGhD41MgGvmHqF+8PHsHR6QH7BzJIN1C9ZYvjYy2S3:452xxhD8rGvmKF2HT71JI+9Qp2S3
TLSH
T1DEC18E79EDC0EE60BF26A40228D5BFB2C6B5AF3415FAC890B19D73510DA4A7312013C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3ffe623c9bb637103b6503387200158c85fbf9a5fe86ce82693582a8b18abd2a
MD5 9a3a3eb2fa4d8c22de3641781a129ce1
SHA1 3490cf4070f7a347e65dbd2f5ddd60454cd691c5
SHA512 ab4bb04a6918425c997ec8bdd2abc3c830ad2fcf00064cbde38a325599323864a748be92f5e23ca5b0628461195443e55f399816c3057fb2f88a2df96fc64971
SSDEEP 192:P1d66JozGzgCl6mc0dZOv5zboPRbHlyjsMN:dd66JozGzgC1j4boZbHlyjv
TLSH
T1CEE11164E6284A3FC408037BDCA61F410F39389BD88E3F1975ADA5192C5B2DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 53KB
SHA256 6eeb6df68de0d7e7deb014b99a475a4fd1b3e728d6b3fbb748d702e9adf61209
MD5 592d41fcd0415e2139c1e491c7dee3ef
SHA1 5c6949b51b1e200bb6eea464856c4692651aea89
SHA512 1f99d58ecbbd9716c2ada442708ec576a61d5f50d24512aae3728fd9ab7602b688a81d4835a29f7aefaa826be879eaa7dfe5d6dc89f2b0e74a58978da326bb3d
SSDEEP 1536:U8/gvSPCtv24Nibr7/+2YnRG2ALmfhWhl:U84vSkRirLUg2nfor
TLSH
T1A6330144EB1A553FD82802BA9DD21B007F79F8898A0A2FA7371C55786C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 53KB
SHA256 d691cfc5ec598109b760eaf34b0fb9ed58d7c03f9fe0663f4aba0a804196f17b
MD5 e685aa720fdff0b889c8a644025258bf
SHA1 a3fcf7dac06e6f33ed54d8102abf517aad5c607c
SHA512 fd30b2408518abab76dc4b2d8b6f4f793ae57057ee8742ba1c9065a0d4696c21ade3f646f0c8208aee39ee810438d85d9e2d9db68b9eee2193f662be3fc19174
SSDEEP 1536:C8/gvSPCtv24Nibr7/+2YnRG2ALmfhWhF:C84vSkRirLUg2nfoz
TLSH
T11D330144EB1A553FD82802BA9DD21B007F79F8898A0A2FA7371C55786C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 11d73ac7462b254f194444228af611b20da584a360b72cd30defaadedf3f8834
MD5 15ebcd96060dab14b562a77e05dc2dda
SHA1 4e018897fdf6a98ac412a6952755048008407548
SHA512 ad9e6637aa0e244f2c23f2b9928615087461fe9e073b3d105803aa591d0aa1bbf7fa7b8bcea035ac281641fda1629a96d2dfc1f20f8214ef3a2b5d7d111eb348
TLSH
T10961BA98F228863FE444413ACC961F412F347452A8AF7F2A34ACA04D1E5B2CD768E07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7ad0fd379c85961be7d1fdef88372f9ae90668bf50cc20f2c61ea6dd53813cf4
MD5 935ef47e262768b3684013a3034d14fb
SHA1 cf70e35608a9d4a384d6ba3fc26fd8a9844df57e
SHA512 b262dc8dbf5fc144c089998bab5af308c9511e38480f841f5bd132dde4fa7276ca68597f553ab9d469550121b9024c778950c974b6195daeb09c5b1c00487503
SSDEEP 192:IOv5zboPRZHlyjsMV1d66JozGzgCl6mc0dz:zboZZHlyjld66JozGzgC1jd
TLSH
T168E10254E628463FC408027BDCA61F410F39389AD88E3F1975AD751D2C5B2DD768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c90e117ab162dae679fdc7d0a8014d6e3daef0fe593c0e148ce81df50b7a04c3
MD5 38d63fe7ae1c6dd1780b045520392a4e
SHA1 46fa4c564b97bfc867cb7262ef47a3c7f07e5d1f
SHA512 b9173a8c76c7b4400b99bacf1d9d534a668470289dc081539818860c07794991ae0be7c59f4a77dbf7ad589dd685cae911eb0ddf554d9c7426ebb3d6ebbe1a06
TLSH
T19A214F5C79F84D2A79C6FBACB445028E93954D0B04871D430D52DF8DCDC2AD932AE47D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\events\events
Size 2KB
SHA256 28bdbe2263c25eceaef78999866c1edb1153335db8caa4d73df2fb83d33097bb
MD5 56e68eaeb3d175c53702be5be196add9
SHA1 08b9fa633e3e39e03849292c2ce17cdf3e9860b2
SHA512 8f0cee16d70046c6eaf39ea3f921db6762024dc72f7dfcb0a2b0a1370e0dd2a0a6c11b9ec4e53f98baa645b8400eed31d7189837795aae89f5ac48e7e03fb66b
TLSH
T1FA41AA4C66E94C3A7887EBECF406068D97855A0744C32D831D83DE4CCC43AA9329F4BD
MD5 SHA1 SHA512 TLSH

Submit Download

07b48720-9767-45ce-b0a5-3e8ff82add44

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\07b48720-9767-45ce-b0a5-3e8ff82add44
Size 2KB
SHA256 46f2a28771de3133817ab262f30f3c6750c2246de052bee7622a94a4a9c938cc
MD5 a4239051df0542aa8944a624c3248aa5
SHA1 c68f0e5efee2bfd5903408dc95137d2700dfa0f4
SHA512 4406b99360e0c23ab18d8f205fca396b7bcb9f076a175342825651b5a2bc5cf4bfc1b8f95184245727d56769d3997927c2aad35d74349a89b4d2b37b73820a89
TLSH
T15841525C75F89C378CDEF14D9092274E43B44E4350C618936EA1EF0C8CA775923AB52B
MD5 SHA1 SHA512 TLSH

Submit Download

58be5955-5a42-4369-a219-9061b6504bfb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\58be5955-5a42-4369-a219-9061b6504bfb
Size 280B
SHA256 0036cf5ac6d921f79cf62141c07c82d60711e27d989e43dea5172d67a15bffd4
MD5 f67d2db4d502985da1297e6b558396d7
SHA1 3b623780c187a065650f97e1ed3310d441f0b9da
SHA512 c98b4a23783993ab3a7ed30c1db41d431d9e091bd0f82ac2e4aebf55f402210811f44eb98beabf48816e6415fbe68e47f2f319003ba7aa58f7cdb9e51a201b8c
TLSH
T162D0EBC4288823AD0C2C0F1BF0A069F730218C3390E16810969005649EFECCC4161D1A
MD5 SHA1 SHA512 TLSH

Submit Download

651009b3-0162-4152-9f51-cf263bdf9c48

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\651009b3-0162-4152-9f51-cf263bdf9c48
Size 931B
SHA256 4c6f2290e6d74733b76ec3077e0a31dd9bf36a0eea03068f39d9e27667144678
MD5 722c4ea49b2d0281eac3013ebaabbb8f
SHA1 e6c214aba5726f8255c56ee945fabfd2236c0f67
SHA512 5372133ef413310a468ade1511469a456d90654d7b6f68e0ca8a1f9c7921f793f1418cb9fc0f9a4f2e3b0f3d0a0b3a649bdc202a18bef2999cdd319d0323ecd3
TLSH
T1401110819B7078B2CD7CD28BA4F037538BF47463C0CA09243EA09B140CBB52DA356606
MD5 SHA1 SHA512 TLSH

Submit Download

adde7ded-6240-43ae-b4ed-969d157ebfa8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\adde7ded-6240-43ae-b4ed-969d157ebfa8
Size 235B
SHA256 f3fd488ed2b2f22fc6f18aae295ae23e226477e5de5bf8c996cf0b1825079beb
MD5 1149389c186190a94e599c7958a93fa4
SHA1 f3852a27beb9d6965586cc0f8c3031d45fc7ec73
SHA512 434b79ea88914df074ef82ba940ae6a74b4b0e2f735310865f577943b991a1690fb2f96225dcf72e5577cd5b12bd2755b7a8a4be9edc912d04cbc7877b930550
TLSH
T17FD0979024982B2D08040F03F0F06CC230854C3314B55860CA63053C99FDAC44361917
MD5 SHA1 SHA512 TLSH

Submit Download

bc84d0fd-cc2c-4065-b5aa-9d8f6c5f0eda

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\bc84d0fd-cc2c-4065-b5aa-9d8f6c5f0eda
Size 883B
SHA256 02dbf2aa6fa39a683683acd8db944f3b70e4d1ca7c249942ee85548ef5e940d8
MD5 d359e9b949945d4ea500f66481095bc4
SHA1 5e479e359c7a4d0859b903706c98b08772c75f5b
SHA512 c05dd650c538b60eed6f69b9f808b1951ed138bbaf796280a41aaa3ce129b0c1abbfb986a95f186c3bbf71cbce14b44be8c34f7e123690dfd03b210acb2fac20
TLSH
T14111C086A670B9B3CD6CD24BC4E53B0287E86423D0C995143EB15A140D7EA1D936664B
MD5 SHA1 SHA512 TLSH

Submit Download

dff1b964-a3ed-4574-8c5d-8117f76f555d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\dff1b964-a3ed-4574-8c5d-8117f76f555d
Size 15KB
SHA256 46632feef75dc502555da5a5dcf5d218a4f3e2e853da60d6913bd0725bf23e81
MD5 e1c351b3138ef3cb0d4e728f1ebfb1ab
SHA1 f1e1b3d825236131802ae978bb3d8a0cf498064d
SHA512 de249fc0924326994b31bc48ec18d0b8168ce5ab9898102f3a867337b056518c4ac045eaf7ef8462beb7de8833995e4a24e8fd0bade29c2ae1d8d692cb31da59
SSDEEP 192:s9GYTBu+ytl5/FEycurRiM17Kvz4j5NIP/v+DmEfB4Lq4pdyyzEQaAejr9LKKINV:s9BdytnFZjrRiM17KvqN0nKhtLE
TLSH
T15162D9566470497A8691E368D4F87FC7E2F618CF4C029FCA9BE4BE0859EE06D1127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\downloads.json
Size 803B
SHA256 3b1c9267354adb0569d7240f89b5c2b58fd966d6c9b4c48ee4629631dc265fb0
MD5 4bb91202a2e777ee075e41240c07e7dc
SHA1 b9f048b88128e8c9f97a3826f1359f9885c6b69f
SHA512 958b48305ad3a377ab1592c954a025f113f7b55bf6f511412f9e4cadab53fa34322b6f363f084547782141347e387a32dc5e3ac8e713c8bcfcaa7eae4d76831f
TLSH
T1380125B213668F7437881E67552C7F2F5C62701BC9C081752AEC5585916603E5D3CD77
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\extension-preferences.json
Size 942B
SHA256 cf91c5fcebee0d71d0d20ec46579b48dac36dac9f7282050c722a145290a6686
MD5 049e3f74f928fcd7fdc29233b7326c88
SHA1 a99947bcaf045b7bdea588d5c76c3407f1ebfcea
SHA512 362cce92211768838d31b556e22e7810357b52caebefacee6ba05228fcc4dccd813bc40a19bded3ac3a8bf886bb7310ea7fd46cce5f599de9891df53813558b6
TLSH
T14311F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\extensions.json
Size 14KB
SHA256 b03b35c68cdc22db5c819f8c505a972e8832d130bc0e034bb0bd71527cb697b3
MD5 a703452cf7b0d35730edf2668d284723
SHA1 fc4b2c23bee560c937481e88471c953b86c7a5c3
SHA512 aa9a306ac7b5033f1bffe9d6d9332a9d077a695985c46f20656530a603a367a9bba8c58c44a17797257bb80017dcf589dfdbd49876b1ef4fe845d67c30ea584c
SSDEEP 384:XkI4vMUmldvS8dhWA94zs96oxL4Hb9L4PdL4HXL4HoL4HC:0I4ERf3Xp486y454V474K4i
TLSH
T12262421545048EB8298FA79BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
Size 21.9MB
SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
MD5 5614c2225ece73a37e47894ff3c19aa3
SHA1 df3aadd22db3b5841fe488c985365269709b4b27
SHA512 8b8e55347a7a496cfe52222670781654ada20accf21f3e2dd88847e0a7a00cb083609a5f3907bcc1f927c1227de20373a744028466663c5389ad286a46fc3286
SSDEEP 393216:SKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHy:dWCmz0dwJIkpqCW
TLSH
T1CC37E14AE35350E9E81ECDF4826E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
Size 1KB
SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
MD5 a0dd5d559b24af4590e5cae3ac11a0fd
SHA1 04b83b414c36ab24fd27fe432a690de636bd2996
SHA512 2d69ea26916ed156f214c17d57c158cb680f1119849b8dd1f7315fd3fa6981c9d6ec2026b494d8e2e70e969205f063979287265a94e73704fe392884e8b4e4ac
TLSH
T1DE21E9DD697012242880793E5FEDF016FD3325C2AA3014FF456B65C2BCE376018C462E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs-1.js
Size 8KB
SHA256 4b06e9fb672f56ca1b693437e2419ae2e6832e6327541461dca1fd951c992757
MD5 9e58a9b325513119b7137e24eba8f99f
SHA1 23e6d70f9b14fff395c495217c33858c596dac33
SHA512 4ff50545054338c09e0c0bc49cab3cb9b0dd615b3a61f5eb518a3c88d664c106d1d9403aea98bdc07e5f11ea7f11f9acf4297ba73fb0a24031e5cdd4f4e4f2e4
SSDEEP 96:xH5JTU5PqGqFfvNsObzStSSlSdv9jkon2RWRWOPJYBw88ub8L4cnEVoR:XUCRFfvNsbSSB8RDPuBw88+G
TLSH
T10302EA789444DF6F74B637ACBC6889315AA2013BBBBF68C750B954C50108F3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs-1.js
Size 6KB
SHA256 2e5dbc786df84cf6de9099eaefe384d6e5c34bafe88cd1cde2b861f367a156ce
MD5 125953d11e605b38a0110789ea8576f4
SHA1 fb1f92969bab99c700efbcbf8714b6d531c31d4d
SHA512 a8225c466f3fe5332f1ff13db96f26b5e118c53e0046b22087a5d4de851f04110b36fb8229f21c5c5dbc56b07129c77f83bf1ab4b522c3691074de94caa8f5d4
SSDEEP 96:xH5UTU5PqGqFfdNsObzStSSlSdv9jkon2RHKpBw88n8L4cnEVoR:XJCRFfdNsbSSB9KpBw88ZG
TLSH
T1E8E11E7895488B6F74B6376CBC6888316AB2013B7BBF68D750B554C4015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs-1.js
Size 6KB
SHA256 88a2d8b4cf752f1f638fbc2f917688c2d9bde0776431ee7052f0cbdfb0549f96
MD5 99d0d067a80c4d02aa4a198b6803f0f3
SHA1 e9128e8af5ac5ab05f961da39881142e3a9a45bb
SHA512 1bc3fbed41b18ced47d1a5e3b5eac503c80bd6c528db396de789fbb276c7c9adb63f262fae5833403885a63e618b8074e2fce8c67dc9fa6c5335f89c613a548e
SSDEEP 96:xH5UTUGqGqFfdNs1zStSSlSdv9jkon2RHKpBw88n8L4cnEVoR:XBRFfdNsMSSB9KpBw88ZG
TLSH
T1C4E12F7894488B6F74B637ACBC6888315AB2013B7BBF68D750B554C4015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
Size 6KB
SHA256 8580ee26b13c3e885de9eb0b9d0320f4411221f5b18147a0dd4de23ad234779f
MD5 55a21db7ffee2df5ff64d66683e05506
SHA1 817897b8ad1bd3d810b5094cb4d7a105eba50938
SHA512 179bc04ab40b6a1e1ded13ebf1300d89924dafc38fa56d5f7f87eb314b25e28e27d598755720604ff32308c0dacecef33d1cf4e47a8bb2b16bdedae97d6f17cd
SSDEEP 96:xH5UTUGqGqFfd461zS3SSlSdv9jRn2RHKpBw88D8L4cnEVoR:XBRFfd46mSSR9KpBw88FG
TLSH
T1D7E11F7894488B7F74B6376CAC648831AAB2013B7BBF68D750B55485011CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
Size 6KB
SHA256 3d701a6107a3447bcee8d53a6d083b9b86ac48d0bc10e3fdf8d13f669dd1b3f1
MD5 014db749de240829a9b3f42b4a37708b
SHA1 6953159230e9e92fd3fa1eeeab6388a96a1251f2
SHA512 b055fddcdd938f2c904f8cd57371e08720a3176dff95b0b0bd7b6f326bd954466e72bc5b88ef9f502a01296639172ddbf9d5406ce16f6dfc24698105ca04843f
SSDEEP 96:xH5UTUGqGqFfd461zSSSSlSdv9jRn2RHKpBw88n8L4cnEVoR:XBRFfd46fSSR9KpBw88ZG
TLSH
T127E12F7894488F7F74B6376CAC688831AAB2013B7BBF68D750B55485011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
Size 6KB
SHA256 da86af65634ceb963bf95f27d20cb2335cdbd29d954d59571396745a0c19ed66
MD5 1d0894ae453e2eb24a41be0a1305a9e0
SHA1 692842f8c4bdefe6b0947ef336936a1965b7975b
SHA512 7507dcded1fa5d82f48a2a8199218afb876d0aacad2d47838732702fc0e796b884fe448d1dbc3fc608fc1b4f9808afa4451a5c4e46a82d756118542c86e3cd06
SSDEEP 96:xH5UTU5PqGqFfdNs1zStSSlSdv9jkon2RHKpBw88n8L4cnEVoR:XJCRFfdNsMSSB9KpBw88ZG
TLSH
T19FE11F7895488B6F74B637ACBC6888315AB2013B7BBF68D750B554C4015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
Size 7KB
SHA256 fb44ffb2d407f1e37da2eb20567c6c3c2b8455ad91af82654b069df6577e9b69
MD5 d784e69c4f907b1be1f4e16137ad7dec
SHA1 f30cc9c911d920a77796e8cfb715f15de42d8ce4
SHA512 8b4dc46b5d6b93f088969853e11360f14e165ba3b95d2c6d932caa20c3b2ec364c8d1bbdbadb8b9ed20533bcbc52f0a53b2fa5c67247605df4aa4ce8178adeaf
SSDEEP 96:xH5JTU5PqGqFfdNsObzStSSlSdv9jkon2RHKpBw88uc8L4cnEVoR:XUCRFfdNsbSSB9KpBw88lG
TLSH
T160F1EB7891488B6F74B637BCBC6848315A72013BBBBF68D650B954C4011CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\search.json.mozlz4
Size 327B
SHA256 a4c8d0344cbf6e230cecbc4d989de36ec075cd8eda7ae740242e1b05b5dd3fd4
MD5 240589068f063f8f706378168230e975
SHA1 9531374a22dea374d032f7484567fb1b201af87d
SHA512 6d04629da44769a64b8808d198f3b3ba6388a0cd5441269e35ca39e7595c4e9abd32618f76ff60b79df80732838ee2a67455e195a801a67334a592b6b6240da5
TLSH
T169E07D3E9C15A0B6C2AC0AC35F0F494A0F58583A9324AC8C90B49D91557FF9B5248E2B
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionstore-backups\recovery.jsonlz4
Size 21KB
SHA256 e943bc753c95bc2c2a69d7231eb24a27d5697d0b72aaba1586bdb23ca3c03790
MD5 ddbb7b794fcfe2ebd6eca45b17215251
SHA1 9f7db576f9a4fa7ca137434b85037cd3dde4ebc5
SHA512 3ae4afd21bd0541a9b22fb43342ca2a9ac0459b54c80a89bbf75fe4664ef0ae25fe6e1d6b20561e79733fb3efbb7a9c0474bd44f4f31ce279199a0defe44b4b0
SSDEEP 384:m+1TIYqrXOvwSiEXwionhJGi0IiceRN/ZksTBQV6beaA5kjZKKaAz2rjk67rH8Rl:HIYqreY1EXi6i0seRhrTBy6beaA5sng+
TLSH
T1F8A2E09DAA7258D8336D42218096DA246B6A4DEE0DD4E5FC333BB10708B66EDDDFD070
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionstore-backups\recovery.jsonlz4
Size 21KB
SHA256 ac77ad1d44421a3e1ca0369cd4a6ef89c8eed4483bec96fb984a13ab31041bc1
MD5 0b843318d0bfc20699cf20f093c3def8
SHA1 e870f2f38adca66e2a922776751c78ebdcc936c7
SHA512 ccf1ab1099cbdae0068ab928d7e71deab51ab7eb917e934e03e100a777d0106d7e294dac8744220ea18349a9c27b0a294137abc552e7d080b452f2b473f9c910
SSDEEP 384:m+3IYqrXOvwSiEXwionhJGi0IiceRN/ZksTBQV6beaA5kjZKKaAz2rjk67rH8RHy:xIYqreY1EXi6i0seRhrTBy6beaA5sngr
TLSH
T19AA2D05DAA7258D8336D42219096DA205B6A4DEE0DD4E5BC333AB10708B66ED9DFD070
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 1fb5a594cc6d1a32602e8bc9bbaf0cf284032cdd5b6d13565c2d31258ef3cbce
MD5 91ad8dd083a6bc3f5d8ae24b4a23d24c
SHA1 8e6c27ee70380f474998c345179ee808511cc77f
SHA512 1d2648cb8c8b54405497c0025aacf8e6d0a59db44c149c7bccb649fb0f1b0212fa7d2e2f0dee6a8c84c18ab10a6adbc56f093ded5e8252a83ab85c9167a5cbec
TLSH
T15921B4C96A6B69F43A1587E680094BE8C64834820AEC00E8CFEC6A0298D5558275BF5A
MD5 SHA1 SHA512 TLSH

Submit Download