e3725de563711290aef52dd9ae84d814a8e38abd6c29c2105ea96869ba16f194

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_cdcb2a965c4953b526f910c99c6b8dea_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Size 392KB
Sample261107-2yskbasv5p
SHA256 e3725de563711290aef52dd9ae84d814a8e38abd6c29c2105ea96869ba16f194
MD5 cdcb2a965c4953b526f910c99c6b8dea
SHA1 7cabd6d66cd828a830aa52be61073824ce1e60bc
SHA512 48019af1ec1a1376c524aac8e29a86f4a11103bc3f4a59143aa7b31abe9cc3195ae9ba9612c5245e95c15108fab4bbd74bfdde8f5dbcedc6f6352be1e1e52d07
SSDEEP 6144:Fwd++jQ2/y8MUnT2jiN1Z9m0E9ofJp25PveXDsBRHJeqdR:FwP3y8MU42Tm0E9of6ZWzwHJeo
TLSH
T1D484AF55F3D500FAE16BC17889424516FA72BC164B60A6DF37A42E9A3F23BD09E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	firefox.exe
Token: SeDebugPrivilege	1568	firefox.exe
Token: SeDebugPrivilege	1568	firefox.exe
Token: SeDebugPrivilege	1568	firefox.exe
Token: SeDebugPrivilege	1568	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1568	firefox.exe
1568	firefox.exe
1568	firefox.exe
1568	firefox.exe
1568	firefox.exe
1568	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1568	firefox.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4372	3448	2026-11-06_cdcb2a965c4953b526f910c99c6b8dea_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe	89
PID 4372 wrote to memory of 1568	4372	firefox.exe	90
PID 4372 wrote to memory of 1568	4372	firefox.exe	90
PID 1568 wrote to memory of 636	1568	firefox.exe	91
PID 1568 wrote to memory of 636	1568	firefox.exe	91
PID 1568 wrote to memory of 636	1568	firefox.exe	91
PID 1568 wrote to memory of 4172	1568	firefox.exe	92
PID 1568 wrote to memory of 4172	1568	firefox.exe	92
PID 1568 wrote to memory of 4172	1568	firefox.exe	92
PID 1568 wrote to memory of 4172	1568	firefox.exe	92
PID 1568 wrote to memory of 3964	1568	firefox.exe	93
PID 1568 wrote to memory of 3964	1568	firefox.exe	93
PID 1568 wrote to memory of 3964	1568	firefox.exe	93
PID 1568 wrote to memory of 3964	1568	firefox.exe	93
PID 1568 wrote to memory of 2712	1568	firefox.exe	94
PID 1568 wrote to memory of 2712	1568	firefox.exe	94
PID 1568 wrote to memory of 2712	1568	firefox.exe	94
PID 1568 wrote to memory of 3172	1568	firefox.exe	95
PID 1568 wrote to memory of 3172	1568	firefox.exe	95
PID 1568 wrote to memory of 3172	1568	firefox.exe	95
PID 1568 wrote to memory of 3172	1568	firefox.exe	95
PID 1568 wrote to memory of 2184	1568	firefox.exe	96
PID 1568 wrote to memory of 2184	1568	firefox.exe	96
PID 1568 wrote to memory of 2184	1568	firefox.exe	96
PID 1568 wrote to memory of 2184	1568	firefox.exe	96
PID 1568 wrote to memory of 5128	1568	firefox.exe	97
PID 1568 wrote to memory of 5128	1568	firefox.exe	97
PID 1568 wrote to memory of 5128	1568	firefox.exe	97
PID 1568 wrote to memory of 5128	1568	firefox.exe	97
PID 1568 wrote to memory of 4696	1568	firefox.exe	98
PID 1568 wrote to memory of 4696	1568	firefox.exe	98
PID 1568 wrote to memory of 4696	1568	firefox.exe	98
PID 1568 wrote to memory of 4696	1568	firefox.exe	98
PID 1568 wrote to memory of 2684	1568	firefox.exe	99
PID 1568 wrote to memory of 2684	1568	firefox.exe	99
PID 1568 wrote to memory of 2684	1568	firefox.exe	99
PID 1568 wrote to memory of 2684	1568	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-06_cdcb2a965c4953b526f910c99c6b8dea_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_cdcb2a965c4953b526f910c99c6b8dea_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27097 -prefMapHandle 1928 -prefMapSize 270279 -ipcHandle 1996 -initialChannelId {a25e76ca-1b75-431d-a081-4cc699f97a40} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2384 -prefsLen 27133 -prefMapHandle 2388 -prefMapSize 270279 -ipcHandle 2396 -initialChannelId {283fd084-f8d2-403a-b68a-70b4c0e53586} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27323 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {87c7bb16-7c01-49b0-8e85-a623ef0b1efe} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27323 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4148 -initialChannelId {3902ba71-0aa6-4d10-8a42-e61d82003baf} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2780 -prefsLen 34822 -prefMapHandle 2792 -prefMapSize 270279 -jsInitHandle 3180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2712 -initialChannelId {13b4d23a-3cbb-4458-ab93-2db77a5128a4} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3172
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 35010 -prefMapHandle 5080 -prefMapSize 270279 -ipcHandle 5072 -initialChannelId {3ff7ac4a-dfc5-4de4-b1ed-e2d12826b206} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2184
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 32952 -prefMapHandle 2828 -prefMapSize 270279 -jsInitHandle 5028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2872 -initialChannelId {a3004684-0ba7-4e5a-b42b-136abfa3d822} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 32952 -prefMapHandle 1056 -prefMapSize 270279 -jsInitHandle 932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1616 -initialChannelId {b4f5e190-cf1f-4694-b983-a1921acad288} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5804 -prefsLen 32952 -prefMapHandle 5808 -prefMapSize 270279 -jsInitHandle 5812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5820 -initialChannelId {59f3f834-6da3-4d3d-8584-6d104df59989} -parentPid 1568 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1568" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.contile.json
Size 4KB
SHA256 f5c105bc566fbfa9eae03f5bf419949411f5aad5c9a5dfd6c423dac231827f58
MD5 a77f58246878402adfd0bcd8fdc980dc
SHA1 5d53edd890a1043cacb01c116d9b030952540fbe
SHA512 c831b6a4e29cb49d01e5debfcf0bc578b9b3eadd95290792f57c9fb85e48b42b9219cc53b262405336daf337e3fc484837ab70cdc0f03996552e4383981e3166
SSDEEP 96:TWGM+mQnnml9ivvT+mRBNn4KYAn4+L6D4xlz:PM+JnneivymRBN/JLw4xF
TLSH
T14C91C79B89784C571F31BAE16C063688F1477003D9E09FA8F15A9C71C96C7AF80CF659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 80a0e1ced2ea97d9c95cf6de388b1733b6ce665d81dd903400e58dac5715c153
MD5 32132681887b55d3089015010809a1f9
SHA1 76f64b9d30878c95f34b802f07b2d6ed4e682c7c
SHA512 79ad4129d2650a0b80b84edf315291e977938ee94ca1f278771133901479df06692a27cd8dd428e915f955a31506476f4b10e7482c0dd3da65bd3864c6ccfb7c
SSDEEP 768:3yWpzVUGfz1JyEi+WYOpn23ikvsTt51TOOr6TNw+G/5pR4KEOSjK3aEt+7b5:iYR5aYu23xETPcRG/5pmkaXF
TLSH
T1B8730BE3A6E9B1FB0BA037C72C0F795BA2E20185E78506C9EC9DC91C81DC654137A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1215

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\doomed\1215
Size 52B
SHA256 0698f51aa40fa1b539f9b189666dc659f8a16913a2a78069e575d5a1b962e94d
MD5 e29d89644c58ff96915cba9620be5e21
SHA1 6fdf86fffdf7884ed2d6d537f5495996a5fd4df0
SHA512 fd00d64469e2d3edce21bf020a17fa176a9f88c206a464241eb69069fd3653dbf66631576210ac961be12e23d47c9f97a300c132b0cf74483eb15be4e1927792
TLSH
T1C790021A56B19605D0158131891488B826103D50458016A774B20B9F18111D34402130
MD5 SHA1 SHA512 TLSH

Submit Download

6684

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\doomed\6684
Size 256KB
SHA256 0bc04709ee0c700fce5af90c5329302fb7d271d8a0a417c9936a0a9c601ab792
MD5 e303732372e90897e0f65a829e44f649
SHA1 dc278784e92e278a8b176a81c2eee5ce7df471e2
SHA512 7030c07ece93cb964832d146aa9aff4644706388b921dd0ffe1302411fe5aae57fa43816def8a24312fbe655020d7ab8d1e3c992db7e124449b5a409a1a6b830
SSDEEP 1536:xYCYPsqdOuSPr7Q4QzvkcIJtOt3z0VMQRYsCmLrfm4kxKPrBNMOK8Ct92ZFZWkMJ:wOAjAcKOiRYsjLrfYxKPrBNA2Zj3o
TLSH
T12F44E6F7D6AC70FB07528ADC2C0D72CF72AF4179DB5208DAF8688148C3C9A65107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 f3780e62ea7f5a2d7787637bc92c1a3b08bcf7bd50ca9af463b93032fbf34c82
MD5 ef8bc93a4cec306692a5bf0069f73c10
SHA1 aeaa9d311b2e2e160d798a042d3cb3ed05c05ca0
SHA512 eef11f78c3102704222eb27e86ab95289840ee0ba8bd08ecf682c16a7cb702d5f6f7e88b64e943da6bab2e3a4c3578d55f84c01090938a65e916a4f797abcbf8
SSDEEP 384:HXwIiO024YuWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAHxq:36ZYuWTToXJWTTogB7S/AmVAf+hRMkxq
TLSH
T151728D7D9F413CAC276790E8C8B983558D1CB2A7DFB5C02D159C3E09CA98A5670F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 2c5826ae57b5958806a79a267c5547a80d1710044bccc9b16ac164733ea7918c
MD5 559c39ec6c5a86c2aca296e4a103621d
SHA1 0fc889786fe269cb0273450cffbe1ed98d159491
SHA512 48e483b373a468039f952d6388857f68ca1fa8789f5886846a60cea505b2c05eaef90262280deea0d13fde7e9f78e17e0c364efcf20a6110b5b53e1b0a13444c
SSDEEP 3072:X3lkX6aTsLz95GfqZlEfn+pSgnEl9NXgNd:FkDsLp8fElEf+pfEl910
TLSH
T15FB3BFF6DFA2CD3D69FFD41CAAC2883EFD662404B3A72009C923671461C6BB46675748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8z6dgki7.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 7fdca986e7e596aa54a213080bc17b434e8404ce6b6d5b3fe44672c6bc4fd5db
MD5 d2bc48f2a040d737843aaa0d90e6a3c5
SHA1 9f40edc8c4833d7e184a0b71db6026beefb88ffb
SHA512 6c541155c5a9295ac3073d2e588114102671220ca7618e2109f4e8cd528257468b02808443acebb51dc9982b5f8df612c5ccf56d97b837cb8b4ad50f343a4139
SSDEEP 1536:jTrliELf7DenX6aTpKmVcbDyIdC3TiuwXMkZ86AGWAJKxgxuA9lgDU186dK15F7p:j3lkX6aTr4vdGAMsn1Kxg9vg9NXgNU
TLSH
T1C9A3AFF6DFA2CD7D69FFD41DAAC2883EFD262404B3A72009C923671561C6BB42275748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZOZ7EHYA89YXJ6JXHGMA.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZOZ7EHYA89YXJ6JXHGMA.temp
Size 5KB
SHA256 535ff0e29fd3e1d4e63bd2caf195352096ff167bb0d9beac5f4ad93a0d0d41ce
MD5 daedb6f2574836409e7e38f7579bc25b
SHA1 eab039c6f17e40ca4ef4d608d1e88745eddeb918
SHA512 159e9f85313fa49a444ea3b06da9d734bfe28eb7a68fa2741e42ea30ae3087aa5ecace9a8523ec0ba52c779408e77e6580165cf74dcbf147b3ee37d0a5528acf
SSDEEP 48:ojLh+dxeerJ5Ugdw/E3zukLh+dxeerJ/6Bdw/ExuKLh+dxeerJ/adw/ETi:wkRN4EhkRN/3EhkRN/HE+
TLSH
T157B19B420FF70966F5F3563266317B43B373FD01161E46AEC18162A50A327A095AAFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\addonStartup.json.lz4
Size 4KB
SHA256 103bf68626181ec72373522ec0a7ca43cff8896e63f8cb71bbe7afcd90224eb4
MD5 430e18a41010e2d53371ae064b134a96
SHA1 a0718395b0dcb12faaf3582536307b95240e1ca9
SHA512 f6ae2e1917a5fcffe6e6af19c965fbe2f9e572c0f64688b748779bfd8b705f2636f184fde9be793b62d7919c8fb7ea1ce37d5d5f763dd44a301c4569a1335366
SSDEEP 96:NE/q4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NC152xxhD8rGvm6ApwnHUuhN
TLSH
T184A16C76D581EFA5FD32C0464CD93FB2EAA6AB3414A9C4D1F1ABB1194C74E735700340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 cbd4aee947ed6e61729dfb45ff23ec32a0e7e3de016179aa1abe8afc5c0b3572
MD5 57e203638ad091e791f317d67edd2bb3
SHA1 c77677ccd94a58b5e985a6198bb9669d9e7cf19c
SHA512 a313c3d7d477bba3cd37fc9bd776780a2e455739ba135c1bcf5a3a7860761cf25d03923749c15397145d133e5e5d452d17e3ee6962c8ccbfa214d7edcbffdd6b
SSDEEP 192:BOv5zbo7MZjlyjHMc1d66JoztdzgCl6mc0dz:ebo4ZjlyjNd66Joz/zgC1jd
TLSH
T1E2E1EE64EA28463FD414037BCCA21B404F39389B984E3F1975ED641C2D572DE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 916d044f87505d7524f7659453b46de74f92b2570cc3c9d28b048f5e891a87d4
MD5 d903730b398b168bd84586cc00df75d6
SHA1 42c238613c5454e746804bfc6362ee6f717819b6
SHA512 a0c628af96f6f9bc9a9bb6aad0ab24759d8e756b37c0899df6e0772756b2f0998ed5d49f063a3d92ae84e8f892129eaff43c061829961fea1f8bb65e86bb660e
SSDEEP 192:E1d66JoztdzgCl6mc0dTOv5zbo7UjlyjHM:Od66Joz/zgC1jaboojlyj
TLSH
T13FE1FE64EA28463FD424027BCCA21B404F39389B984E3F1975ED641C2D5B2DE769E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d669fc7b5044d5fcd796a376f79e924ac67155a26f434834851f0a3623dbfced
MD5 e762d5a0306965c81007a9c36fa8df29
SHA1 343effc9f3ffd01235ef42a42564df682c21b694
SHA512 8dbc920f7118b9523d8d71b4dc2fcd57dcfdc1e8b18731e98acb34b8d0aa182b2fc4ea22815e8d2fa66aaa98ad7eaee90757909b50df63e106a41c4521872664
TLSH
T1CA217C6C39B88D6AD9CFE69C7981028E63514F1B04471C874D22EF8DCD81EDD32AA43A
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\events\events
Size 2KB
SHA256 672bc5a7224b67d8a12f2b681f646b05cb05c31a49a023e4151c5da129267e16
MD5 806e193aeb33c13db14ffd85f5b26af6
SHA1 c7b43751dc2b109a7c5c11bc449843049447acba
SHA512 d836e83a10dd5e43db92bfd491d3bf9296d1ba4d92d3cc802dafe00e95c32863933f0aa7f593526aea4762f2b0024d0d4ca945482d043184ba705ef82b808b8a
TLSH
T15041B05C66B98C7AA88BE3DDF841018D57414B0694832DC74D93EE4CCC52E9D329F43D
MD5 SHA1 SHA512 TLSH

Submit Download

3cfe85cd-3ed8-4f14-9c59-e2a09898b025

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\3cfe85cd-3ed8-4f14-9c59-e2a09898b025
Size 883B
SHA256 88130b6eba62a2eca12943b1c46928a4f7e5cf6337e9e4c70c4aef3eb4e8d3a1
MD5 60a44fcd1ac4620fc32c976b1cb8d821
SHA1 955dfeb259397cb003de258c3b2488521114f460
SHA512 67868c1f4a0b02aa3991568cb425cc9c0eabf510824df7341db8b7934bd502fa5d9a83a2c96022334a8ee3537e99c9bb53d95bab53505b6212002e324efad91d
TLSH
T11A11C0409634B9B2DC7C924FC961370297E47563C0CE95183DF69A180DBA65FA377247
MD5 SHA1 SHA512 TLSH

Submit Download

55876527-12d3-46b7-893b-7d8a45928f75

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\55876527-12d3-46b7-893b-7d8a45928f75
Size 16KB
SHA256 2eda3448cc78e785721d85b34f4328d905c6e32157d17cd49d84aba7815f345f
MD5 244187eda48be594b28a35b0bda7d034
SHA1 3194ed346cd9011d37b304e4f63dd97c2439bc67
SHA512 2c288248ba77d3504083001d984d1dff3f8fee2d613bb45059e5e4d0ae7848fa9b21d343cbbd5ef7bd32ba7a331060dd26eef4733b26afde2063edb0acac5279
SSDEEP 384:rgpT4FvR4dITgUSljgi6ROaHMY5kW05Ww7a:rDXHdS5Wwu
TLSH
T1F172CA16546045BA8591E3A9D4FC7FC3E6F638CB4C419FCA9BE4BD082DDE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90fbad41-e639-469a-8cb2-800d104c5856

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\90fbad41-e639-469a-8cb2-800d104c5856
Size 886B
SHA256 95c6cd4b77832dfab1d01d2efc51683a0533b60aab5819c798c71d614291af7b
MD5 f255e582c375985bf5e7c771fbca8830
SHA1 5b5da7dd730b3842b60cfbb7914ce37771222309
SHA512 5d86f31a33c734c48f2dc8c30633a43c0621e4d90131264b08c5dd1efc3dde613725091526a10096a697d4b29b34ecc3311517c26fc23f8c4b5516e280086e5c
TLSH
T15511004186347572DC38924F85A17702C7D47033C0CE59487EB59E080DFA66B7376607
MD5 SHA1 SHA512 TLSH

Submit Download

aa0761cc-9c0f-4e3c-932e-d7f3e9f4cb35

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\aa0761cc-9c0f-4e3c-932e-d7f3e9f4cb35
Size 235B
SHA256 b03a91a50afca678014f50ed44f667c1cd973d7383c690b108a525f09932a7ac
MD5 bec64c38050b55d5d9fde7adc743046e
SHA1 54b781e3c7844410ff102c74ad2b32b8415a2a7b
SHA512 daea5eda3c7e7de6121dfeaa96265552128026b16f0876ee266c865b160a2ad38e961ddf67264c33619ad4388df25921bf0cbc4148d270424523b62d01ecf34e
TLSH
T1E0D0978124A8376C48204F17F0E478C770888C3714F19C30EE53403889F8DD4025AC1A
MD5 SHA1 SHA512 TLSH

Submit Download

b9a810f5-b9dc-4f5d-895d-4717ccf39100

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\b9a810f5-b9dc-4f5d-895d-4717ccf39100
Size 235B
SHA256 ccea6f572627a822f31e8ffacea5ab7b132bbdf354ff459e6a6ab4b38ae640e3
MD5 56b5fbb72973d18936bcfe4bb10eba4f
SHA1 64f578c973cbd0fcfc18433c5920761274ecc9e1
SHA512 3337f323a8cd4a10ee78bb89e0261f976c587c9f733b4f5969a0a9fb3680d5dc6f68cab42b93c437688146eac445823932a02567a91881dbbfaf54e89e41bed8
TLSH
T139D09780A4B8636C08200F06B4A028C671A54C33146858108A619234DDF8ED843A190B
MD5 SHA1 SHA512 TLSH

Submit Download

f78ab103-beea-4884-8f1a-bd29f4530013

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\datareporting\glean\pending_pings\f78ab103-beea-4884-8f1a-bd29f4530013
Size 2KB
SHA256 a2b8e94c25867f21de10169428f708965826c32b81ea4657e3fa43cdb01f205c
MD5 b737b8a58be4885771d719564a9366b2
SHA1 7d173643585448908dd3d1c403b72576db55d67e
SHA512 2622691aed2f2fece0193df0016207ea1eda63210bae265c75caed4e5f8de4c3ec3af232400799cdcaa600e6effc5dfb122dae0cee13ff845e2ad32343a4afdb
TLSH
T12541542C35B94D379CBAE14C9452234EA3704E8348C628836E51EF4CCDE16A933BA427
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\extensions.json
Size 14KB
SHA256 96bea2ea2634f6bf32a8e57550b547a1baa9ad44884d7c0d508dddf4c03f40f4
MD5 7ab82db5997d0f709cf22ea94ec092e6
SHA1 d6376e1f448d57d0832c159e5ba15c7c7926a781
SHA512 73dc2ef1feab416f21bf62bdd141ea8ccb41529abf587edc1c9139d8ef0337e71e17112f55e65dd081527c7e9c08427f9ee7fbc209d042a863dbba392e654664
SSDEEP 384:4kI4voUmldv98dhWg94zj96oSL4HLL4PiL4HeL4HtL4HC:vI4gRfuXJ4V6X434Y4E4N4i
TLSH
T11162431545148EB8298FA78AAA367E01C37D473B70845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 4ead28095f94e7b91745c3533ac7c445425b3370c0efc3f6a3e1a2858725cb41
MD5 107fb11d4925d6270a40cf37df99f677
SHA1 437dde31fb545d82031b5690ac413bd955bc0779
SHA512 df73277c6255a41269553769bb3ae376fc0cd2660e8f07e97d9372c7b1eca0219f0ab46201561d34554d794fa3a2c4b4f2b4ef96383167213cab156b40ca474a
SSDEEP 96:xHSUTUNqGq3Jfb4e51zSaSSl4dv9jcnbHtXsdSBw88u8L4cnKM5I3J:EAR3Jfse53SSRtX6SBw88y
TLSH
T1E9E12E7894488B7F74B6776CAC688831AAB2013BBBBF28D740B55485015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 d4ecddb87d80a3040a05b886684ff054cab5c333a6602dc33c04b366e21e201d
MD5 6789e6fd233ee38d0861994f79234dff
SHA1 00fc2ad69d43ffd0ba89d9f06a26f915e80cd0a5
SHA512 d9808ecf68ae8459ba1b3a4f447c3358156f752cacb9f7e99169a035dbae9f28a3cade72f18ad2d172721d2a4a00c67395ca9257391009c01916b8f741437735
SSDEEP 96:xHSUTUNqGq3Jfb4RmObzS9SSl4dv9j9nbHtXsdSBw88u8L4cnKM5I3J:EAR3JfsRm7SSgtX6SBw88y
TLSH
T127E11D7894088F7F74B676ACAC688831AAB2013BBBBF68D750B554C5015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 7KB
SHA256 028e23c0d3c057f66afa108fca09eb7d653c2f180f2f569d40e4d37f042994a2
MD5 8254ee86937c25eae7bc22fb76223c84
SHA1 bc5b3988efac0e38c27d03ee1f388409e1efaa75
SHA512 b5247324c1f758000b5fe0bcdd1e328fc67983eda868f399ce1b420f279689e6050b62af72e6222ef7d7ba6f7ebdc8d1deb95cb342ac42a3453a750e4e20a600
SSDEEP 96:xHS9TUNqGq3JfkRmObzS9SSl4dv9j9nbWRmJXsdLBw88E+8L4cnKM5I3J:EtR3JfkRm7SS1RqX6LBw885
TLSH
T141F1FD789004CB7F74B6766CAC2849315AB2013BBBBF68D750BA94C5054CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\prefs.js
Size 6KB
SHA256 0dfff24639cd04e79052f43df9816f0d7e1f4a141d8ce9f54bf21d73ad7978f6
MD5 f037b1065e6267633391996d33e30086
SHA1 4443863b5a65a10b7f9661a86255fa0f62f5ae85
SHA512 3ca9f12040222a9489286374224d8eed89a1f5e0c70789a4e478878b17e3df9d1760f849746012411ee2e4cfa917838c4e6c944c6f208e9faeca549d9c16215b
SSDEEP 96:xHSUTUNqGq3Jfb4Rm1zS9SSl4dv9j9nbHtXsdSBw88u8L4cnKM5I3J:EAR3JfsRmISSgtX6SBw88y
TLSH
T181E12D7890088F7F74B677ACAC688831AAB2013BBBBF68D740B55485015CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 cde8d90920b684fe5ff8b8239ea0839226589c2fe33bf77ccfee7e0adb0c117a
MD5 e2c668f9b612ba7c2c6db54e8f37fc4a
SHA1 f093afa0b80f08e135b66a76449cc1b25e8f3c72
SHA512 e86d06fadb450150f17ea1539f3d0f7ba5bbadb9bcc7e7f687ccecbfa1e9f636a0db3fbd6b703510a60cc40f2e2a4369759ea87be5704202a35483b3034b29d1
TLSH
T12721A3A3986B0EF53A908215E1891FF2C26834318474E4F1917ECA0265DC41EBBC661C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 8713f1d50f4cd067452782e0c3a74188f727b707633b1425a956a23ebb412a36
MD5 1e213eeb39409ee98b02e0bcbd1881b3
SHA1 e244eac5a827c127ea0b9ef417174cd7791d71a5
SHA512 90ad142d332c8705654513c50de64608c65883c411c0ce70c36db8bdaf6fefe5e929135f1a4a6898c55819b327034cafec88b11cddce5735e0d475e1df753b41
TLSH
T12721E7C2BE6F1DF23288C14AD0D63FE8E660A0544128F8F0D85B960116C881636DDA0E
MD5 SHA1 SHA512 TLSH

Submit Download