xworm | e6277877b5970a79b5f7e90ee9fd3dd2e93fa3e85223f58d1c15602d62de6385

Analysis

user interaction
yes
max time kernel
49s
max time network
57s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 30KB
Sample261107-t8984set5n
SHA256 e6277877b5970a79b5f7e90ee9fd3dd2e93fa3e85223f58d1c15602d62de6385
MD5 825b09708797fc88fc4961326e3075e7
SHA1 1c868274da7f9691d064c7a72a3da6e297ac6350
SHA512 0464b7e63d275ffd543c847ffb2ae08dc74c41792ed09807022d29f1e6c51418d9e5152419a6f753bfaf1f4e2aa38dc84963cc15de79f23f1777e8beaa52cb43
SSDEEP 768:BJCIMRhP3VMYAoRN9M2uBFE9RDbOqhAbi:/Cv/f9M24FE9RfOquu
TLSH
T1C9E24B487BE5432BD6FE2FF229B6910202759507D923EF5E4CD885AB6F67B8143003E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

FeloPateer881-63375.portmap.host:63375

Mutex

3jz9pAY4YBCzZrsA

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1836-0-0x0000000000590000-0x000000000059E000-memory.dmp	family_xworm

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	XClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XClient.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	XClient.exe
Token: SeDebugPrivilege	4332	firefox.exe
Token: SeDebugPrivilege	4332	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe
4332	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 4332	3324	firefox.exe	90
PID 3324 wrote to memory of 4332	3324	firefox.exe	90
PID 4332 wrote to memory of 552	4332	firefox.exe	91
PID 4332 wrote to memory of 552	4332	firefox.exe	91
PID 4332 wrote to memory of 552	4332	firefox.exe	91
PID 4332 wrote to memory of 1640	4332	firefox.exe	93
PID 4332 wrote to memory of 1640	4332	firefox.exe	93
PID 4332 wrote to memory of 1640	4332	firefox.exe	93
PID 4332 wrote to memory of 1640	4332	firefox.exe	93
PID 4332 wrote to memory of 744	4332	firefox.exe	95
PID 4332 wrote to memory of 744	4332	firefox.exe	95
PID 4332 wrote to memory of 744	4332	firefox.exe	95
PID 4332 wrote to memory of 744	4332	firefox.exe	95
PID 4332 wrote to memory of 444	4332	firefox.exe	96
PID 4332 wrote to memory of 444	4332	firefox.exe	96
PID 4332 wrote to memory of 444	4332	firefox.exe	96
PID 4332 wrote to memory of 3236	4332	firefox.exe	97
PID 4332 wrote to memory of 3236	4332	firefox.exe	97
PID 4332 wrote to memory of 3236	4332	firefox.exe	97
PID 4332 wrote to memory of 3236	4332	firefox.exe	97
PID 4332 wrote to memory of 5476	4332	firefox.exe	98
PID 4332 wrote to memory of 5476	4332	firefox.exe	98
PID 4332 wrote to memory of 5476	4332	firefox.exe	98
PID 4332 wrote to memory of 5476	4332	firefox.exe	98
PID 4332 wrote to memory of 5488	4332	firefox.exe	99
PID 4332 wrote to memory of 5488	4332	firefox.exe	99
PID 4332 wrote to memory of 5488	4332	firefox.exe	99
PID 4332 wrote to memory of 5488	4332	firefox.exe	99
PID 4332 wrote to memory of 5496	4332	firefox.exe	100
PID 4332 wrote to memory of 5496	4332	firefox.exe	100
PID 4332 wrote to memory of 5496	4332	firefox.exe	100
PID 4332 wrote to memory of 5496	4332	firefox.exe	100
PID 4332 wrote to memory of 5564	4332	firefox.exe	101
PID 4332 wrote to memory of 5564	4332	firefox.exe	101
PID 4332 wrote to memory of 5564	4332	firefox.exe	101
PID 4332 wrote to memory of 5564	4332	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {8bcdca40-117d-4c2e-a5a2-46dfe61020af} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27136 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {1e4b4367-24dd-4f7a-b34a-a2842f5f1203} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27277 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {b36e618f-03a6-499e-844b-1742b7d6c314} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27277 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 4048 -initialChannelId {2daaf026-61d0-4f4b-adea-069063d38730} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4464 -prefsLen 34776 -prefMapHandle 4468 -prefMapSize 270279 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4476 -initialChannelId {9e073455-49bc-42d1-a22d-8f7bb730ff43} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3356 -prefsLen 35013 -prefMapHandle 1640 -prefMapSize 270279 -ipcHandle 2684 -initialChannelId {617259f0-9d06-45ab-9474-ae34aa66242f} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32900 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {b0a37d1f-5026-4a74-b522-43b92c71a82f} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32900 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {3ca0ca5b-9b90-4286-806d-fccef519b644} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2828 -prefsLen 32952 -prefMapHandle 2832 -prefMapSize 270279 -jsInitHandle 2836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {9b75e1ae-d79f-4517-807b-a0f2b21bb8eb} -parentPid 4332 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4332" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\activity-stream.contile.json
Size 4KB
SHA256 379583d58af6532e41a16d3211e22f14c38cdcde05a2448b59845a98a5640570
MD5 1114da363fec54b670e4ea062fa31e52
SHA1 2ecd443adccd80504caa07673c1cea412cf33bc2
SHA512 7906d10254d1a6cc85ec8ff33ae6a91777261410540cc3579c09ce1e380e5838adf30e2c1d77f65862b3a471cc2eaafc692ddd591684bfea4ca53c04e6e2bb00
SSDEEP 96:T+B2MmCmH+msDDt7pT+mR/wEnG46myHnAJlz:i4MmCe+lt7ImR/fGdHAJF
TLSH
T165910A6F986448161771B9F46C4F2ADCF01374098AF08EEC72696C70D5FE7EAD0DA988
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 3a7ec4c8b0889c9c9cf967ba04747de65b58310be357d47523b1fe5d8d3964ea
MD5 f4c2a04d02b978c757187330773b2390
SHA1 3fcca5b5f65c2f3ba31b540a9f2a103d251bb224
SHA512 29be7c2314b91d46f11be02a2883b020de4f4c37bea31e772fd3c6cd70d83ec15e85747cd14899f97b0987cb92e624403406aaf7b3f89d6b65a100ad02f5d0ca
SSDEEP 768:gyfhyZbRbkWLxJJZiVSd51ERLOvXHOgz2G+GOy7AcDOOrS:7fwZt7LxJvMS/i1UOC2XGOGA5
TLSH
T1D47308A3E6E8B1BB1FD137D71C0B795B66D30195E3490ACCECE9C91C81CD694033A6A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 b247065afd086c0d3a9f07a64a8cc6dd56378873c7024aae32deaaaca66a3441
MD5 b5a19a47312fbdfe7573e026c62f997d
SHA1 78312c18c978ecac65ea462588b0c6aec35aa55b
SHA512 8717af187210b529f9f9875eea4914cf4a017adefdd05199723c68fb79a12e8f6cb3e72e875cc3441a1c3ce2308fb3dffa3c6c67b9e8a305d1794ae2600c57c3
SSDEEP 768:gyGbF4Q86Kptenb9tcbhBuLdSrWIk8U9MA7LD7mu5hKS9d/vXPPFizOL/U:7q1zi+b9tKhBuZqqtV1BPPFEOLc
TLSH
T1C873E963E6E8B1BB1BA037CF2C0B799B52D20265E34601C8FCEED51C90D9754627A5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6181

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\cache2\doomed\6181
Size 256KB
SHA256 07c9979824cd57e0b58e9a2dd9e6da6c0c4309a1cfd8b2782b329a51f26011bc
MD5 7a9455d01e04c648f05e1bf4cfb50b38
SHA1 698b1b18c16bf9ed7789495a120d80d2538dc151
SHA512 b2e2a7845a68075c07a5eba5135075a633b1c23f01831f4dcc1077161e66be8e709772e64bd2d2fe529e5b86755ede5db1a18dd46a2df6835fa6c9bb5a7ac06d
SSDEEP 1536:YYCYPsxYQtR5KjSPr1FpvkcIx73WaH5to3z2n60PHn/BFXIuLRK8Ct92ZFZWkM15:YYYFKcKCADn60//BF4uK2Zj3O
TLSH
T1E844F7F3D6AC70FB07518BDC6C0D72CF62AF4239DB5208DAF8688158D3C9A65107679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

991

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\cache2\doomed\991
Size 52B
SHA256 d02a0782540e129dd7f8c68c6433cc39418762e883c14cc681b83806408df982
MD5 b7068eec2745eac75b684189fd1011fe
SHA1 58d329171f50014ca480e2a894572118b2b23866
SHA512 e9c75f6f9187cab7d597bd0876b31cc1b90f86551170a46bc474c9cb18f14b39921ce3b5188c2ec414489f282bbd2ca077b3966c6744daed755c4f590bbf908a
TLSH
T14C90020542A1C941DA168075891088B40D113D186981062234F51B5904158D30905018
MD5 SHA1 SHA512 TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 9c8f8b984014a9dae2a787b90018d800eaadda7fc1c9556e747ee5b0d9ca4705
MD5 b4992bb83c1cd3a0d5e4aa3ce855fc6d
SHA1 d08cb203d49deb2f53d6284aaa3bc0171b906603
SHA512 94714dd7735ddfca3ba8b84320449d6a5351b8902170838372e15d9c7ba3e73e9627c0ee831b44187d9eebde833a6ab8ddf7f59e4399beab0824f7026005f440
SSDEEP 384:HXwIiO024YpWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAHoh:36ZYpWTToXJWTTogB7S/AmVAf+hRMkoh
TLSH
T150728E7D9F413CBC276780E8C8B983558D1CB2A7DFB5C02D159C3D09CA88A5670F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92E512BE69F9FAFB22E666B7D74AD9387F13E218

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\cache2\entries\92E512BE69F9FAFB22E666B7D74AD9387F13E218
Size 16KB
SHA256 5857357528e78c06acd5edd145f05e76da67ca224c220c85db30a620469b2008
MD5 a8f99dbd5a2b34175ea64e88699e1f88
SHA1 98c93457cec06315ec80f61894326df96eca27e9
SHA512 745a6475ee87b6e745ef028067c6d0d612906001936b9c28576b8c399071bbf3ae8b5de09ad327659c5619d07795e40f55d9daf175294b33e39cc05c19d23f97
SSDEEP 384:HlZciO024YPWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAuk6kT:FZdZYPWTToXJWTTogB7S/AmVAf+hRM9k
TLSH
T1B8728D3D8F013C7C1A57D0E8C8BA83598D18B6ABDFF5C06D128C3D098A98A5671F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 bb343aad66656933dad432244a067e2549cc8b841ea0e3579dece6bc962864b2
MD5 fc5e33da758f92b8e0efea1e509b80b1
SHA1 1d74c11642244a6b0433ee0f5a9bab552c42b1e4
SHA512 1bb3e5727c52ba3dab20f4c9875259bebaf4bb54c8a99cfc5176835e370f2cead57028c79f914b08ee5aa4bcbb0b3b915d8f26c3919b3194e2fe474097be94c1
SSDEEP 1536:jTrliYQ3vi0nUyuzdZUBpAevwehxTyVnWlUcjWCsTFzhsFti0zjpqKWC9gBs5vR8:j3lEUyuz4pAQwWUWOC/pNOCmHc+cZq
TLSH
T148A3AEF6DBA2CD3C58FFD42CABC2853EF8262444B3A73019C923675461C6B786779648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrqpkrys.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 1ad89855eb12664be966d0dfd6f46232c393a4d34836e8f64a101e5d2fb9aef3
MD5 30d158d19a8771a2a72e51ea7c5a8b43
SHA1 74f4dc3cfec7b4684650dd737e8dfc7a41d7bf87
SHA512 cd0b12097740ca63ddbcb172edc965c1bac539733e9841f39145257f353379da6a9ffd52c258511321e8dfa478fca11943aa23c0ac01684133e441362654e9b0
SSDEEP 1536:XTrliYQ3vi0nUyuzrgkLn64xO2PehxuyVnWlUcjWCsTFzhsFti0zjpqKWC9gBs5Z:X3lEUyuzn24xfP5UWOC/pNOCmHc+cZ5
TLSH
T121B3AFF6DBA2C93C58FFD42C6BC2853EF8362444B3A7301AC823675461C6B686779748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fbc5bc1-d770-4774-9712-8a3e3ffb69f1.zip

Path C:\Users\Admin\AppData\Local\Temp\9fbc5bc1-d770-4774-9712-8a3e3ffb69f1.zip
Size 3.7MB
SHA256 3b6408d2e299b077fd0eb0e0b8ca75733aac53327ef12e8fa55d2c05cce13317
MD5 30bb6858aed125eda954d4a2a6e4c7e1
SHA1 e683b2e1cfc12d025281078eb54b3bd279d332f7
SHA512 268662be812805db68595a9b9d79169dff1cfef33eabe91eeb5d9887cbd078dc404186d8fac65c0667eaf96db86049147f7aa595ce47c5d94e9374a1f528dda6
SSDEEP 49152:dN02GkTyHBOewplW8NKYHLYqh1B/yzevX1KrdeMeBexOkG02SHFIC89R0Sugbs0q:dq2GSWvaYq/dssMeBeOksSROzbs0VM
TLSH
T12B06F175DE5C3609CBCF83BA850D3FC2984C4FAE8064A96B7A6B99F15CA31E61F44C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\addonStartup.json.lz4
Size 4KB
SHA256 384fb88b773b42496b2c638363d9b3aca7f5aa91a137073a655fe62284c439b1
MD5 2a5f08de6098bdc975adc626a567751a
SHA1 401c79ac44c619d44f5f0780045d100ab0248e1a
SHA512 e11c11260577506a858061356a5041fbcef6e9a7fc8d58a1da66f2e357aa2824e6a83ad7e5ca6458b9cd581ddda4e18c6a4a862926ec3ba5d58fe0ac6981b60e
SSDEEP 96:NOJJj4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:Nd52xxhD8rGvm6ApwnHUuhN
TLSH
T167A17D7AD581EFB1FE32C04248D97FB2EAA6AB7414A9C8D0F1AB71294C74E735701340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\addonStartup.json.lz4
Size 4KB
SHA256 0caa4ceab735f390e18bd0bff41bb13a1756b2fd16a687d654de79253d6cdd43
MD5 5e15fde1cd4a98a622444324522f3311
SHA1 5036c038d08dbce47ef18db4ffaf6900673682b5
SHA512 b726ba85f85f162ab0512895a8c0cf8ba0d42b3f6384bf87f62244d4dfeafd282adf40198defe80f27adef7c4884539786ba2f8592eceb4d275f2dd081850627
SSDEEP 96:dU55sWNNd2xWNhD4fMgGvmHQ0FVO1u+8TXqYjE2IXR1:dW2xohD4rGvmHA8Ti2a1
TLSH
T113918DB5D949FFA5FE37C08698D97F31D2DA5A7420AD9431F06BB2054CA0BE26786300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\broadcast-listeners.json
Size 209B
SHA256 63221253f5c30efa214c2cd2adcf51a9c9f9a2c05f119b00a51c9579825c2c24
MD5 97c3738563a9448365a735f5f29ed3d5
SHA1 15a81433236ca6e6ecc4e1c8d0fdb8523b265c57
SHA512 ed98f42d5d02ab53a9e50f80b312bed4b5d05d053bec582cf9d619ef91251e86cf4f4d1123c645500fc1dc4673b49a8b7badd3f3a39f565ac643ca4fd0157ae6
TLSH
T159D0220E14177C7F4B486229F00827800B9A10093270A03DC3AEA0540A2AAFC4008190
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\db\data.safe.bin
Size 33KB
SHA256 acff7fa6fa96c9a4a49139d5fe5810083843894cba124f1ad5ac73fe060cebc4
MD5 8782956bc4921efda1d061891d810729
SHA1 6cda9fdbb568193888e8c5af0f4e7e7a5312e4d3
SHA512 9e19e39eee0d857d51106da936fda402e450f783e7ce78fe751d6dd880e2c233986d62f49ee75b1cda18387c5f8b4ac5c10f77c140ad04dc04c8f2edddc21fad
SSDEEP 768:JpP6RFWb/Y5kqnGcmhuFfkKDBtah0s5u1pPbUbRb4b1bObrbBbSbjP3t9tXri:KWb/Y51fkaP3t9tXri
TLSH
T160F2FF44EB1E953FD46812BBDCA507002F78F88959492FA73A5C64286C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 dcb08a8c40632734b48c80386601dc31963d4a3496211c81a692053bd4bbcf58
MD5 46bc634e70327a277dfd10a4384f63b9
SHA1 1305bce0fb50906717ace1dea4320c1a8d65a3b0
SHA512 2f56b4833e0cf35c6ae480fb85713c577d1458757babef90149d3c29f5c63226a279208a796e090c0b6a16362c36418e92ec23984ac06fc08c8a37b07adb89d6
SSDEEP 384:Tbob9Wyj5Md66Joz1zgC1jqWbCiS4bOfnGcmhuUkQpHmKDEVcJbCbJ3:nR8pPQWbbgnGcmhulbKDEVcJbCb1
TLSH
T16DC2FE84F72A953FD41552BBDCA507001F79B88A58592F9B3A4D606C2C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3dc3e29debedb0460a23ef34d051801e8964720ce273f8230474f98e9766bc9e
MD5 1865303fad57da2491146c9f602b0a03
SHA1 a377a6e82df63eaebf7fc6afabda7c0dffb596e8
SHA512 ad1759cdec2683547905f767c29e7fe25d8b285fa027aa3097df98f05007019246fe599732946aad5b1a4777d5dc0067c703f26238eb7d05bffe15ec623cc90d
SSDEEP 192:uJFk1d66Joz1zgCl6mc0dXRPOv5zboBbb5WyjWhYE:CMd66Joz1zgC1jIboBb9Wyjy
TLSH
T16ED12FA4E628863BC404027FCDA51B410F79389BD88E3F1939DC614C2D5B6DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 8a7d3f7862920a9c3de92d31128977ad6e3c292f0478cd0cf179abbd5b645217
MD5 e995a5969b509763698a4febd153f3a4
SHA1 cf816961de6a38304fc12f0cefef80a19dd9d8c6
SHA512 e6dddfe9c1a1788ce0217482e64f6b0a0f281a5f1e824e0f6d94974681b948fddbe127ab13887cb53aa31da5bc850de8dcde677c04bafc2d3f7fd85056dfc1bd
SSDEEP 192:nJFk1d66Joz1zgCl6mc0dqRPOv5zboAPZb5WyjWhY:JMd66Joz1zgC1j/boCZ9Wyj
TLSH
T121E110A4E628863BC41402BBCDA61B410F79389AD88E3F1939DC705C2D576DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 c9f8072dde0b87e79c8e186cb3f9afdd535a246603fb1eb986026fbf43bf02d3
MD5 5a752aadecbe4c2dbe5e9c6b2effc5a1
SHA1 b55d47d6e2accf5bcfa3e4e291640834bcfcbab1
SHA512 479287c662b9575167991e59fc1aca970bf5460ce8cc2fcdb8b3c5dc1a82db2633d1ed284a717fe5b420554def84dc8520a698ef8859ff3c13e7c7150c8776b1
TLSH
T1FF61DD58F229563FE044413ACC961F812F347456A8AF7F2A39ACA04D1E4B3CD768D07D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\events\events
Size 1KB
SHA256 97c77b86179ef1200ef23ee87b3e9f002c94efd7031e2d5461a79d014763da40
MD5 b4a4ff35a872744815272e500f9e9e5e
SHA1 2aa1cb3c6472be4cb019a787dc5eb2a6969e74c6
SHA512 5295e89090c4159c5f2d3c28ff6b66455ed611bd4a49b55bd5e53606d309c8c703a6219420a3b93e08b5251368c92998f45896eb46f6171b59c0b8a182b6446f
TLSH
T16A216A6C39FC4D3A99CBEA9C744012CE57558A0A04871C578D23FE8DCDE1AD932AA43D
MD5 SHA1 SHA512 TLSH

Submit Download

35c1f63c-becd-409d-8fed-42f4692075bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\pending_pings\35c1f63c-becd-409d-8fed-42f4692075bd
Size 2KB
SHA256 e82430c1707163d1be1fa89e139792dde3d67fa91716958a901c513471f40b52
MD5 88e4177d41e5f4556c7a574155845f2e
SHA1 d89f243c9482011805ee2d3d76c12b2739a1e9d2
SHA512 46664e22edd0ce74c6acf7a7c07f01d8ad34b4a1f6116092953acd52a88dcc976a342069b0d6c2e0c9e8853dbbd4f47a5ad28d553d3d0934c3a7434b6754f2b9
TLSH
T16B418618B5B88C374C97F59DC591338E53A04D1300D22C837D91DF0CCDA2A9D236A51B
MD5 SHA1 SHA512 TLSH

Submit Download

5f558437-bd7a-4477-bfa5-71685f4dbf41

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\pending_pings\5f558437-bd7a-4477-bfa5-71685f4dbf41
Size 235B
SHA256 68e87b2cef8261ad9c3d809ebdba18648027807dcf4420b180b467dd349e8d5f
MD5 f3cb08a27f3580c8a8e4733aae6e188f
SHA1 45de078f2952757341e2bab14f5695899d06dd26
SHA512 9fcc59aba7c419c786557e39d51b3bb5447adcb28d323c86dcc6d23195bd0b2b7c8bb0fdbcb9fd42f38c598cefda5828ecdbfbef527f96feb4e5d7a3c8d92349
TLSH
T1A4D097D0149C6B9E88100F02F0B028D270444C332C686820E9905134EABCDC9822192A
MD5 SHA1 SHA512 TLSH

Submit Download

6bb04733-41af-449f-b03c-0ba1e481ea0b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\pending_pings\6bb04733-41af-449f-b03c-0ba1e481ea0b
Size 15KB
SHA256 868e8211720cf70916427d3d2e36597338a645cf8685c5888495098edd6fc3d4
MD5 6cab6c92dc5abe828acc1886f0a98b3d
SHA1 7e6f41ba27311fc028ff62d4b1b2d95f01d749d9
SHA512 51e3bb9bac32b2370642426a1cb7122ec788246e2d2b412f7a8bac9c39c6472d4a1e2de717e8cba3c3fc4c51b5d7b05d5db5d9f40dd61fe2a7605ca6d52c5aad
SSDEEP 192:bPj9Ix6xWE9yWwBKJrAFPkzDCZdCqeIm+u9mnkC4oSZxgpSzGRyweNq1LmUrB1uA:yUjCMDCaq7m9YzSZx8SKRyl7Ur6F+
TLSH
T14B72DC562420497E8651E3A994FCBFC3E2F528CF4C418FCA9BE4BD0869DF06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6deef252-08c5-4029-a60d-c5ae4502cee4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\pending_pings\6deef252-08c5-4029-a60d-c5ae4502cee4
Size 883B
SHA256 cbe6fcd5c1eb0e9bc6c513c3310c57ef722c6bfde8b11c75607314e6e0a0189d
MD5 45f30196ae7bc599c9e47a64644ec1a4
SHA1 5c163b8112969f586474232649f7b0eb7bc0d24f
SHA512 e90892319df148b5a557194c89c2e7536170962d9dfb65aeaccff98d64de879b342df97ca2ec258ea8470e60b715d5bcbf83984b22d27a8e8a91c4723687cf0d
TLSH
T117112340A774B4B3DC28829FCAA5374297E83463C0CA94147DB49E184D7EE1DD3A620B
MD5 SHA1 SHA512 TLSH

Submit Download

94ea6a27-c74f-4f87-a11f-32236d47039e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\pending_pings\94ea6a27-c74f-4f87-a11f-32236d47039e
Size 235B
SHA256 72df764bfe624445dd6928d755af643375a8b3ebd56750c38b0679ddea9ddc11
MD5 84645f96a578a481c1e6ec9652c678d3
SHA1 42e222a8a4900b2d57f79de1a8b8b0f1096f0e9c
SHA512 48b350316a78195b6a84425dff385f72a7c17c515a5c2f89b844ce7c83b05189450e7ea51b6aa00eb49a03fbd2f74354bc2686e14bb9cb7e4b1c070c52f223cd
TLSH
T167D097843898276D08140F06F4F029C67099CC335470A8209DA00038C9FE9C8026181A
MD5 SHA1 SHA512 TLSH

Submit Download

ee7443a6-dd23-404c-9fdb-3d132a840eec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\datareporting\glean\pending_pings\ee7443a6-dd23-404c-9fdb-3d132a840eec
Size 886B
SHA256 a9dd64d6a9e3b9a51068de7d7e47b72a3d8ef0b9b948573bceabb663bf7ce839
MD5 4c30cfca541d90303514a75c8b1b9eee
SHA1 dc0f014530896516ffd2647cb6c2dee22a47b0dc
SHA512 79122531a8f8293865cf551252c3453fbe9c7305c47ac55464e02860e704d1cfea4f031cf6e6129f9eb501a175b20d774487e37624f9375db3b2c03e7f89287a
TLSH
T16A1123808764B4B3CD28D3DB9AE1778387E43063C0C658047DA46B1C0DBED2DA39320B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\extensions.json
Size 14KB
SHA256 fd2c18b856525495cc3cd006cfb13b03bbd68cf7ea0a08f0bebcb7d8c5db2dd5
MD5 5554a8a55ba702b517a53c7927510690
SHA1 cb7a25c50ae818eb5a61129876de8e376e2e5ca8
SHA512 e771b36d6afbfbb91155f124026cda29872075fa4c7b3d8da970018914a135aa6739c37e431bf3349668c434cee67c6db87f6416ec5b6ecb30e123e88e5b0e45
SSDEEP 384:qkI4viUmldv88dhWs94z896orL4HJL4PLL4HkL4HML4HC:NI4KRf1XV486g4B4/4e4m4i
TLSH
T14A62421545149EB8298FA78BAA367E02C37D473B60445C78F4DD8FC842FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\prefs.js
Size 6KB
SHA256 87b658df449c04db5a48ee10f4f3632cde6b2e1ba6ef81329f8597822c9870b6
MD5 61489ac436ca8ace222ff2867e90adea
SHA1 a21feb2d00ae11359f5616fcaf6cd9a719091ac9
SHA512 4a6d77dc21ac27b8c9bfcf4b54db0c793b4178e5a9a9817e43d2e1711adfde1d4bf3cba50425e94d32e7a7ecc292abb3834dc62bebb860f0d65a2fe3c8173557
SSDEEP 96:xH9UTUXqGqofiFt1zSySSlNdv9jlndHxBw88P8L4cnaS1O:HqRofiFt7SSfxBw88ac
TLSH
T1F9E11E789048CF6F74B676ACAC6888315AB2023BBBBF68C750B554C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\prefs.js
Size 6KB
SHA256 f089367ce9933067b772142b5f6aef4f376957a77dc807ce9971b25557c4c69b
MD5 0d89595375471c930f85e834b7c6de72
SHA1 75aa45bea17423e43e890d018227b3c1e07367ad
SHA512 e1a317f92f776b58caaf0a84bfcb6889984b6fa6db751301ec1e1322d58bdac41ecc76f7da59414963d194e2d9be76cb34e1e41c97cb3f440dc8ed2a07ed823e
SSDEEP 96:xH9UTUXqGqofiaEObzSxfSSlNdv9jbkndHxBw88P8L4cnaS1O:HqRofiaEXfSSOxBw88ac
TLSH
T1F3E12F78A4088F7F74B2766CAC6888315AB2013BBBBF68C750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\prefs.js
Size 7KB
SHA256 16adf02df1928575e52e5d81cdea60da9751251eafc712ca5d86f8c499d92e9f
MD5 e0376deffd777b8be119f40b728a47bb
SHA1 280d39d9680ebb4d2a1a03759850c140da080a8e
SHA512 d44a4ea1154607ebedad1bb852a773e97da446fd8cfb0af780552aa38e2719e5078bd5b994d4bbb6115a732a719f9cd3bdfed7ede7df72e6f5afc4f0df6f7cac
SSDEEP 96:xH9LWXSGe7TUXqGqofHaEObzSxfSSlNdv9jbkndHwBw88+c8L4cnab1O:H3RofHaEXfSSOwBw88Fc
TLSH
T1F0F12038A008CB7F75B2766CAC2449715AB2023BBBBF68D750B954C8055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\prefs.js
Size 12KB
SHA256 b22a432d44fecec44c520a50c8fd903d6762acc9fc5cfab1a9bfb586943f3174
MD5 3fd20bd4fd6e5e4f4ba3729c9397f2fe
SHA1 d0f1a0a6006bf1790a579b8ef9f02755a8c9bd39
SHA512 dd6c315cc3bc1fcf7b537978d4fee940336a3881bdcf296d40b1424d7403aad7c0c71a758757a2b4f652113aec276dd1b441ada1cb111951277874514610a5c5
SSDEEP 96:xH6LWXSGe7TUXqGqofHaEObzSxfSSlNdv9jbkndpwoDRb6HSOBw88Bhuwogf6/Lt:w3RofHaEXfSSKLRpOBw88Tkgf6/Lyc
TLSH
T1D442BD3860458B3F25B3367DAC2549B01A6101277BBFBCE685F9A8C6445CF2441F6AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\prefs.js
Size 6KB
SHA256 9dd2fc8e540fdf700a4cad93559195b816baf8a7bc466a89e0344220b3060c0b
MD5 90be63ad491286716923de5fb84e892b
SHA1 62b5e0ae363e0285eb34b15b8a7eac3cff28b5e7
SHA512 9677fa9894c90f7c8cc4deda4624fa33441f166d6f3b1aab055ea1a313f4876b433cac8370ddafb9172b5e52c148b6342239dc53256d4b0a4fa43b997d4d3696
SSDEEP 96:xH9UTUXqGqofiaE1zSxfSSlNdv9jbkndHxBw88P8L4cnaS1O:HqRofiaEIfSSOxBw88ac
TLSH
T193E12E78A0088F7F74B276ACAC6888315AB2013BBBBF68C750B554C4451CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\prefs.js
Size 6KB
SHA256 931bf828d1c31af5e18d5923d0d5623c7afc16c5a7e0cedbb669e45624c377d4
MD5 f5cc28805e824a62c26f44d6c2d6e6e3
SHA1 cdd6e78dfcec113d80d84fd0175804f6eac985cb
SHA512 bcdfac0e5fb5e439c9d3917b1b2292524707f548eac92d430d93e4835b9cefa34a621cd35f0f3fc8d0ce7544d3d94886675aac286e4fd2b7dcbc1bcf865a3437
SSDEEP 96:xH9UTUXqGqofiFt1zSxfSSlNdv9jlndHxBw88P8L4cnaS1O:HqRofiFtIfSSfxBw88ac
TLSH
T1A4E11D78A0488B6F74B676ACAC6888315AB2013BBBBF68C750B554C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 155d892cccc549371ce498b40b2cf4ed7b3f939bcb948d59261407c00f885175
MD5 82d1043d7a752a5eea32ad0edcd27eb2
SHA1 774017f3b0b0e3bc521a50bef9fbcbac7e76d9e9
SHA512 7733b52887b49d6477475f886ae7f3c1a286698084f8f8b3fe8438a252d202f50656005da08c25829000a154b8628dcd7b014ec1ba579a7b9553d2176831b2ee
TLSH
T17621B7CABE2E18B37565904560D25FF4C2D998228738B5F0D54E910209CC99AB29A38A
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrqpkrys.default-release\settings\data.safe.tmp
Size 152B
SHA256 e8bcd0dad2bb8f4814e473d7b142b3993a08e6efb2707070c969afa8dba0909b
MD5 22c22b6e7eb153f3aade0bf268765d95
SHA1 a3a216db17f37387d3977b6c79179c6df53cb7cc
SHA512 4dff5c255b72ce0b8423101a8f177bd7efea13f3a1bb51d8b99a9b2953c3b40d17df424ef7643c374c35c2dbc5f23c4d5bb1f9f8a935f0b20f49032dc88e6f8c
TLSH
T130C02B3B020E20F3F85074F802140721034040004A30BADA008F327C4E90041FCC50B8
MD5 SHA1 SHA512 TLSH

Submit Download