hxxps://huangqing[.]net/s/file

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://huangqing.net/s/file
Sample261113-e328zsf17m

Score

7^/10

defense_evasion persistence privilege_escalation spyware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1480	setup.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Firefox\mclailsaupt.dat	setup.exe
File opened for modification	C:\Program Files (x86)\treaties\straernauegs.dat	setup.exe
File opened for modification	C:\Program Files\raindrops\schmaruirreerk.pdf	explorer.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\build-VN56LM5Q.zip:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5032	explorer.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeRestorePrivilege	3276	7zG.exe
Token: 35	3276	7zG.exe
Token: SeSecurityPrivilege	3276	7zG.exe
Token: SeSecurityPrivilege	3276	7zG.exe
Token: SeShutdownPrivilege	5032	explorer.exe
Token: SeCreatePagefilePrivilege	5032	explorer.exe
Token: SeShutdownPrivilege	5032	explorer.exe
Token: SeCreatePagefilePrivilege	5032	explorer.exe
Token: SeShutdownPrivilege	5032	explorer.exe
Token: SeCreatePagefilePrivilege	5032	explorer.exe
Token: SeShutdownPrivilege	5032	explorer.exe
Token: SeCreatePagefilePrivilege	5032	explorer.exe
Token: SeShutdownPrivilege	5032	explorer.exe
Token: SeCreatePagefilePrivilege	5032	explorer.exe
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
3276	7zG.exe
1480	setup.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
5032	explorer.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 4088	5592	firefox.exe	88
PID 5592 wrote to memory of 4088	5592	firefox.exe	88
PID 4088 wrote to memory of 5756	4088	firefox.exe	90
PID 4088 wrote to memory of 5756	4088	firefox.exe	90
PID 4088 wrote to memory of 5756	4088	firefox.exe	90
PID 4088 wrote to memory of 2432	4088	firefox.exe	91
PID 4088 wrote to memory of 2432	4088	firefox.exe	91
PID 4088 wrote to memory of 2432	4088	firefox.exe	91
PID 4088 wrote to memory of 2432	4088	firefox.exe	91
PID 4088 wrote to memory of 5516	4088	firefox.exe	92
PID 4088 wrote to memory of 5516	4088	firefox.exe	92
PID 4088 wrote to memory of 5516	4088	firefox.exe	92
PID 4088 wrote to memory of 5516	4088	firefox.exe	92
PID 4088 wrote to memory of 5936	4088	firefox.exe	93
PID 4088 wrote to memory of 5936	4088	firefox.exe	93
PID 4088 wrote to memory of 5936	4088	firefox.exe	93
PID 4088 wrote to memory of 3708	4088	firefox.exe	94
PID 4088 wrote to memory of 3708	4088	firefox.exe	94
PID 4088 wrote to memory of 3708	4088	firefox.exe	94
PID 4088 wrote to memory of 3708	4088	firefox.exe	94
PID 4088 wrote to memory of 2716	4088	firefox.exe	95
PID 4088 wrote to memory of 2716	4088	firefox.exe	95
PID 4088 wrote to memory of 2716	4088	firefox.exe	95
PID 4088 wrote to memory of 2716	4088	firefox.exe	95
PID 4088 wrote to memory of 2976	4088	firefox.exe	96
PID 4088 wrote to memory of 2976	4088	firefox.exe	96
PID 4088 wrote to memory of 2976	4088	firefox.exe	96
PID 4088 wrote to memory of 2976	4088	firefox.exe	96
PID 4088 wrote to memory of 5456	4088	firefox.exe	97
PID 4088 wrote to memory of 5456	4088	firefox.exe	97
PID 4088 wrote to memory of 5456	4088	firefox.exe	97
PID 4088 wrote to memory of 5456	4088	firefox.exe	97
PID 4088 wrote to memory of 5404	4088	firefox.exe	98
PID 4088 wrote to memory of 5404	4088	firefox.exe	98
PID 4088 wrote to memory of 5404	4088	firefox.exe	98
PID 4088 wrote to memory of 5404	4088	firefox.exe	98
PID 4088 wrote to memory of 2760	4088	firefox.exe	99
PID 4088 wrote to memory of 2760	4088	firefox.exe	99
PID 4088 wrote to memory of 2760	4088	firefox.exe	99
PID 4088 wrote to memory of 2760	4088	firefox.exe	99
PID 1480 wrote to memory of 5032	1480	setup.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:5032
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://huangqing.net/s/file"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://huangqing.net/s/file
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {e767d48a-21ae-4de0-bc9e-93f258401529} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27133 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2356 -initialChannelId {27002371-752b-41ea-94bd-513478201da8} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 25213 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {c0f0e648-cfd0-469f-850f-a044cbcdf4ab} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27323 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {1dd7907f-004e-43d0-be1c-3c91e0250470} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5936
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3064 -prefsLen 34822 -prefMapHandle 2648 -prefMapSize 270279 -jsInitHandle 2652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1588 -initialChannelId {33b40cfd-51cd-412a-b4c8-c6b2819b1a11} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5176 -prefsLen 35010 -prefMapHandle 5180 -prefMapSize 270279 -ipcHandle 5140 -initialChannelId {a464c10b-f0a1-4446-a88f-8cffbfec7ee8} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2832 -prefsLen 32952 -prefMapHandle 4888 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {e4cb873c-6385-4814-a41a-ff3ea4a0491a} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5460 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {e634fdd1-191f-45e3-97bb-4b46d93f5865} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {19ef40e0-802b-429b-b54a-d64220057e28} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4036 -prefsLen 32952 -prefMapHandle 4308 -prefMapSize 270279 -jsInitHandle 2736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3224 -initialChannelId {4a74fbac-4a25-4dff-bf3e-37b6c9f03e33} -parentPid 4088 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4088" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2760
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\build-VN56LM5Q\" -spe -an -ai#7zMap7318:90:7zEvent23174
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3276
- C:\Users\Admin\Downloads\build-VN56LM5Q\setup.exe
  "C:\Users\Admin\Downloads\build-VN56LM5Q\setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\activity-stream.contile.json
Size 4KB
SHA256 4d403a53631e28ba28b253399956d339a897918d3c19a3e5cc19b19be5ea3056
MD5 3786b075d77f2f7c45fa68bcd7bdee5d
SHA1 cf2c2b841d8474e3ab8b3f9aa27d2ea49628062e
SHA512 e8d6e6b304c4b16c8aff37a61eb75f7b7b826fdf3a3c4c4b9444782e363ff9250841dcb83010a8cabe07b1383417b6bee4443addb943de04114599c7a7c36963
SSDEEP 96:RMbvT+mRsQm4KYPDGD6DxmEnOkMaLLD/b9:qbymRsQGDwxpOMXrb9
TLSH
T191A1D9BF953455162F70E6E22C5B27ACF103701BD9E08DBCA1199C6545A8BBD80EB584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 7f322296de2548cf887439000272fc30216f941bb9836d9a57d8054b3cc5dc1c
MD5 110d023de6b6166c4d66fad6ba484562
SHA1 e484ef2502017366ddc049ec23ae598ac8cd3b06
SHA512 c3f485de07a255a87c09874a746230be98c69c745ec20bb2805a54d8c38e14d14a89c02a3c04cecf9dd20b8b58a618529162690adfa04afd2d1e6ac82717a1cb
SSDEEP 768:Eyuw7itwIe8VpMVFvXztsiA51mOMG0fJmGBaRveOOrl+GbqiF:fu86e8/MV5ts38OMG0XBaNGbbF
TLSH
T125731AA3A6E8B2BF1BA437C72C0FB96B66D20145E34506CDFCEDC91C81CD654423A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
Size 16KB
SHA256 736a7bd459beab224f0d2bcc2b660e2517cddb884ad080dd6d10188fb0a3f944
MD5 630a511f02f96282d0eb3c66d2ea4a4c
SHA1 7e4d5d4212bcd5eb4badba36bed3c45a31d070af
SHA512 84a1acfd6b30f14000da2b6295e65b0aa4bf02c47c66d66aaabff744f5cccb9a6b4084988b02a2fd55144292035c07bd843912c1188a21dc66c2a7ecddf71078
SSDEEP 384:HXwIiO024Y+WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAkNQ:36ZY+WTToXJWTTogB7S/AmVAf+hRMRNQ
TLSH
T1E5728E7D9F423CAD176790E4C8B983588D1CB2A7DFF6C06D15983E0DCA84A5A70F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 390fddfeadc4d2fd6f9953ccc24a87e710a0a18d0e094a2f06c31fb632d0b4a1
MD5 37711a3eb73d810a1a845b89657db398
SHA1 901336f86dbadaccb3c3646c174982f6feae51a9
SHA512 2215e1ca2500be0ea5bec3264ed08b8a0dc6ef210028126c24091874c13ad5478ef541e79cf45eef98e45fb32c7655a7fefbcbe5ec1f96e8ebd9a23221c7f640
SSDEEP 3072:j3lnKyT5RU1/PEiv42RwVy0vdGgoC7bhOL1a4:pnJI1j1Ay0M3S4
TLSH
T182A3B0F6DBE2C93D55FFD41CAA81C83EFD272400B3A72019C923635462C6FB4667A648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 c9b4c07f5d01c72e6806775bc6365933b3e9d1755742de8dbbb3f9a6301df2c2
MD5 867f4fecb464e1a1391e52b13b07e225
SHA1 2d242db623d1fc006a4ff9212d1d4dc30b8696bd
SHA512 68846f3c1532a851e0a6b02a033eb7ca3803ac3548195205c934a8ee6f718ebbcef446c117e6cbe56c3bf57a3e4b44dec6c382aefeea8ab62b7b0f316a148676
SSDEEP 3072:X3lnKyT5RUU8NvZxImnalwVy0vdGgoC7bhOL1aq:FnJIUf3Ay0M3Sq
TLSH
T1ECB3AFF6DBA2C93D59FFD41CAA81C83EFD272410B3A72019C923635462C7FB4667A644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\addonStartup.json.lz4
Size 4KB
SHA256 6a9b386ab8911a3f95c7926102327ef8b436bf931bcc380d3612464adf1dd0a4
MD5 604c3649714c4d82e3e808a43661782a
SHA1 3174886237fe0190e7da15f826b7d958891f5df3
SHA512 0df95d27f63606e2c7aca8be55c451ac63876878753a67b7adaaf1781f2ef2b2aceb9b40cb8eef2a83522d9e1a70caf7d06b4ef21d6df74038450e46ce7dfb70
SSDEEP 96:NGNy4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRwK:NA952xxhD8rGvm6ApwnHU+f
TLSH
T17BA16CB6D545EFA1FE31D04258D93FB2EAD69B741479C4D0F1AE71294924A735305340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\broadcast-listeners.json
Size 221B
SHA256 e72b8e652cc8f48ab49b68daf2cee32dd77b548b7daddb3ee101ac3d94303bce
MD5 9bad26d9589d853a1555899875781b99
SHA1 6d5bb3dfaf009e2077354cde989e40406167922d
SHA512 6c2ef128e1926449f3de1758682d5690495ec7af369fac9a30c0330d96a02239f5c844ba97aa7219a3924009528ee227e3f493ad2da01103fb550562959dd00f
TLSH
T136D0221E10133C7F4B5C6629F0042BC20B9A200D72B1A07DC3AF30981A2EFFC40095E0
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\db\data.safe.tmp
Size 54KB
SHA256 b8d041330c6ca606ab5e760508a3ebf8d7cf0d68fc8846cecfafaa45f53d3f9e
MD5 c7f2d20b393c89d524a4a4818de34ecd
SHA1 dff04d0aa6adc35af7d41ed3de4c97cce51d7e01
SHA512 31d41487eb1ebe226e1b135ec89d08ce737f380567acbb6dbb8da87acb1eb378b89dc32d1fa9a4da5419cd315e5b76fcf62c75629fca6f37e2222c0205ac8770
SSDEEP 1536:TTKV/LuLeLKI7DvtPc5xBvqFut/xvuTkaM6RC4PKK:TT4jOeOWtPOuFWVugJYCpK
TLSH
T1E1433444EB1A553FD46802BA9DE21B003F39F8899A0A2F67375C64786C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\db\data.safe.tmp
Size 54KB
SHA256 b82e63219a28c9d4df62f347f60f8c55a3be6b7396bb4b41540f95b8fc5d3b86
MD5 b9fa919c197aebdfc8e585147c15c3c4
SHA1 1b0e2ef09064f202b43ffb51dc9153b432eaa1c0
SHA512 9d49aeb075c16a5897f03cf3199b6516e6fe13095a73d5e7180445a351957df5615b6b9e714f132da1a5503fc35cdc63cae2a7a136f1895ec5e48f07aecee14c
SSDEEP 1536:oTKV/LuLeLKI7DvtPc5xBvqFut/xvuTkaM6RC4PKP:oT4jOeOWtPOuFWVugJYCpP
TLSH
T10F433444EB1A553FD46802BA9DE21B003F39F8899A0A2F67375C64786C873DC3D5E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 3591c4a280e2a7d02df96821e46b3e4a5aeb1142e4b08fc2ede0aa34b8105131
MD5 62a7dfdcd99d4868de77f535b3443652
SHA1 856b632717d7c92eccbdc60419ebf49f7e7fb7fc
SHA512 ba39125d32f5f2b13eb0d8b423696248c4976efeaf04a74ea5308261090109a18b55a0d1eab7bfe2d05345bcbf47fe9ce29727da1c3238da7d1592f48fdc86ef
SSDEEP 768:9NI1KWDPZGcm+uc/EiMKPs2ymmbbbSbOPFH:PWD9EFnP1
TLSH
T11FE20184FB2E953FD41512BBDCA51B042F79B88958192F973A4C64286C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 97a8081a2b7117d15d33309575fa42543e2ff6a189fadb28f22003bac77bb6b2
MD5 942064247af21f78ebea0fb6867b4790
SHA1 fec1fa95fffb414685240e8aa84ce173ebb9b635
SHA512 5a03d758bfe6a991542dda5e00063f4ceea52556ffcebcb11a742e9f8606d38cfda2866a58897126245d880a878afea6118382e25a215623f42b2aa292b84f91
SSDEEP 192:le1d66JoztdzgCl6mc0dbOv5zbo7JZ0ayj7Wl:id66Joz/zgC1j2bo1Z0ayjA
TLSH
T124E11064EA28463FC404127BCCB61F400F3A389A984E3F1975DDA01C2D576EE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8a899805ed225d3ba0f8b1896516d14e08479189a131d82647143a8850cbe196
MD5 66777436f68d8117661c3c49724c832c
SHA1 2569efcb1ff100e265efc5c426367d3f842a1545
SHA512 4ac3ce7958dfaecdf426e054aae33c6d3ecd07c3e98e7b6e60cb2fd19d09bf941725edb4a1ddb061c2d8e5e8f2bc999ad5cfcf66f6ab80671d3eae77ec846db7
TLSH
T18E216AAC7DB94D2A6CD7E6D87582028E53454E4A08C71E430D22EFCDCD856D971AA43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\events\events
Size 2KB
SHA256 eb13dc485e5314d10a2f335aec9eaafc3aace5b596a7a98a1816f2ee96ae0d73
MD5 322c25fa91b61e0b6d74cc94e2ec3524
SHA1 dc026017e96bf0c886ff1045339d456c62548d9e
SHA512 f0116a5138dae44e221053cd575fde806e72eeebfae4519802589d9f67722673d7192dfddd601ed7694b90e9e635b80ca6ab6cece92e5e7df9d4f0db1df94797
TLSH
T1DD41DC5C69BA4C3A78A7E7CCF901018D53454B1A94D31E830CD2EE8CCC46A9D72AF43D
MD5 SHA1 SHA512 TLSH

Submit Download

224cd425-d73e-4414-92f8-6715886f6b02

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\224cd425-d73e-4414-92f8-6715886f6b02
Size 2KB
SHA256 bf5e3e35f8db5b1bdde8a78c68ff5433d22042fb69b8eedd1238da3eefb7d67d
MD5 31080c2f1dfd3d46aa6e59acf36fb9b1
SHA1 13a6db317595623c9dab6aade9571b4952aa3dc8
SHA512 23daad677bba2cf5858772d889bbc1f0ab3108cb921ca00e814dff1837d001539d77b7f3b5b5abd180b6b7a7edfc4638401d6b34914ca4c9609c31069d722fa8
TLSH
T1CB41545C75788D778C8AE14E9041379E43A04E5340C61C87AE81EE0C8DD76DD637A42B
MD5 SHA1 SHA512 TLSH

Submit Download

285cc0bb-fdea-48f4-9806-4b18aee9f144

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\285cc0bb-fdea-48f4-9806-4b18aee9f144
Size 16KB
SHA256 55c8cd37b5c7a38efc19ee5b3df03995f16c0c1f10e0c86b5b27d438a2306db4
MD5 177534ad3488c5f2a95aad82215b3728
SHA1 3eff1b6bcbac03760d44bdb8138290826e07ee3e
SHA512 0249b11e98b9f5f521045e99997fb1f419524c0a531700962f6821f9d8c807883d254ab35e44113056fa89c3f13cac5343a7222df1d6196e3267cf4efeeba32a
SSDEEP 192:iTrd7a3n0Eyw2CmBHqObFb8nCBA+447T1E+FHWOnoKdySrDzip+O2oReMwvLI:NCs4BFHWyoKdySrDs+O2oRAvLI
TLSH
T11872C956182055BA8251E36894FCBFC3E6F62CCF4C418FCE9BE4BE0469DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63a11824-62c5-464f-be7e-cb4e7055e2cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\63a11824-62c5-464f-be7e-cb4e7055e2cf
Size 883B
SHA256 8518b836aae402cb38a199591363c50ff3f9a90ec9506c645a8bd375074b54a0
MD5 820be582fe84f671c0a865196beae1fe
SHA1 9207969d3324689c883fda35cffbb628cae6ddd8
SHA512 55bffc049dba67c5df181db2a83442776844e993e2860014e1c9ec368736bc2dff2d63d474a90127b19f5b252aa3b97edda21a6e1435996dd60689c0e6985d09
TLSH
T1CE1123409621B2B2CC3CE25BC5623B0257E4753380CA85443DE19E140EBFA6E936B60B
MD5 SHA1 SHA512 TLSH

Submit Download

80767f4e-0933-4762-afd3-4cc0b4d06e7a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\80767f4e-0933-4762-afd3-4cc0b4d06e7a
Size 886B
SHA256 225b36698f3140e067443f54c5b979f777555355bcecbc81ba141b37231355da
MD5 b84828b48fa089cff69c1e9424d8e392
SHA1 ce696a1c51753daf644dcc7a13567c58c3b61c1b
SHA512 d3cd305f80795f97e199f7537c8cdf0bdedbe0590d85af9447bd34a97703c085441eb16b3808c54f0a0d7353877abde2175d14dd472a35abf5a9ba2caf7f9e9f
TLSH
T1041104819A3471B2CC68A25B85B1774287D0343380CA4D5C7DE2DB180DBB55E93A7607
MD5 SHA1 SHA512 TLSH

Submit Download

a390dbc4-8118-4a57-852a-ae1c8f32fb4c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\a390dbc4-8118-4a57-852a-ae1c8f32fb4c
Size 235B
SHA256 cd4a44f17f277de0c4f0737745fab64416da0a8686ce6068e6b19cfc4a3fc05d
MD5 868c7d7b7b405da174a3d718922892fe
SHA1 a1e91f900d25e3abf4141e09438241404a71bcc9
SHA512 1ee04db3633cedafe0ea21dda78f89f837c3da5fcd9c9593e0949ccbc3a7f526ca5e286862a935d68d266a421270a701324c4f15d77502d1de0c732263cb296f
TLSH
T105D0A7C12498776D48140F07F0B569C771548C3715E55860D5B156B89AFD9C9415191A
MD5 SHA1 SHA512 TLSH

Submit Download

e0d98007-d965-455b-85d3-52809859ce09

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\e0d98007-d965-455b-85d3-52809859ce09
Size 235B
SHA256 5fe880774b535f6ebc500413dd417ea94490c4215b953d34dee188a18fb78571
MD5 7559a2769ab7276e702d9e74c0bbc0cc
SHA1 6ad9a6f672f2f6791c9eb277dea173699163c71d
SHA512 eef199ed2297688fd229c7bb301867eb1aae0e1e1681f4fa0368a25797b601326c4cd0774435d958d5baefe650574c1c3ae9497acb6d6aa16894398bf9de3f8f
TLSH
T1C1D097C018D8675C08248F42B8E06ACA30888C37246458109AD24A3489BAEC9A1EA96A
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\downloads.json
Size 639B
SHA256 f2501234c1d14cd9ab9bec5280fd3b8a51941005f83e55642fe62b242570458e
MD5 7725b3c2167e1d98a3f21cea5aea42d3
SHA1 cf2c07a5619c51dc28aa6087675940077b79874e
SHA512 689b9324aac0f1c1dbf4a2f2489b5ecc76aef5cf73ff8a9434717ca53bc3361ec21ba4556e8872a4d3e1988ddecdcc29a00db26d4ab62d736bc0b393a5c37b44
TLSH
T128F047F324035CA953550B90927EBB014D31B157CAC8847D584D592540F20776C3D8FF
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\extensions.json
Size 14KB
SHA256 6559380f55dd96196ed2b24533f2d1fb145099b86e16e4801ea85970b1ece6bc
MD5 2472da4337c469b9b2dbdf00fb8b5de5
SHA1 c7dbd467b1928ba4f8d4335c10b95592bb46d6ac
SHA512 9361ce233e96f21dc94ee9d0373926d61bef87fd71b9f3e7d0a9a4ec82a50aeda71256a69fcf1775376f2c5d776a6882da7d96cc0f2436be3454803c6ddca62d
SSDEEP 384:2kI4vaUmldvP8dhW194zP96oXvL4HjL4PcL4HPL4HPL4H7:ZI4CRfMX44x6M4v4+4z4z4b
TLSH
T1A562421545149EB8298FA78AAA367E01C37D473B70845C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs-1.js
Size 7KB
SHA256 0a00feca5f6093c238b74d16002cb4cb0d073990acdf1343c686be60eb981c6a
MD5 52e5ccb94066b4e81465d00df7a3e048
SHA1 9a167b209efa1580b1a5031b77425a563f499795
SHA512 c9e783730954cd5e1c0210a81dcebb51b211de952e96b73c87ddc00b26b3ab321a809c877c1a2cd93d28fd4dc7d56f74cc71cc3c2255c327bfdf8930f400b360
SSDEEP 96:xHNhTUuPqGqbfFU+ObzS/HSSlpdv9j3nJWRX63uFYbBw88c58L4cnqDx4:LTCRbfFU+9HSSwRXGbBw88Z
TLSH
T165F1FE389404DF7F74B637ACAC6489315AA2013B76BF68C750B954C9050CF3881F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs-1.js
Size 8KB
SHA256 95830ee4d548b1b0ed2a5a916f544f088be7ed1c811c7443243cb2dec81b9cbd
MD5 f4886e2c63c225cac683f8318d8fe534
SHA1 cd6c0dce017b23d37106b445b05d7e596ecfa7a9
SHA512 35d8231314fc3a0e951502d2364b4f3cc7097586d5d0068d16652478f229f55e4b5c55884ad76f404ffecaa72ed7cbdae770853a8996c618a40fce351d3fae96
SSDEEP 96:xHNhTUuPqGqCfFU+ObzS/HSSlpdv9j3nJWRX63uFYbBw88cUkG8L4cnqXx4:LTCRCfFU+9HSSwRXGbBw88Qj
TLSH
T1B602FE389404DF7F65B637ACAC6449715AB2013B7ABF68C750B954C9050CF3881FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 6KB
SHA256 2be4faae68b94c0c31c36b934c6dc21619900eb31862d5fb48f916963ffc2982
MD5 7c7a4abf290a61e821fea6bceee5c6a2
SHA1 e277d6af62e6257d6115f327ba6a8cc3aac72454
SHA512 d955fd2fb401158f742adff2f2f6bec81185c2ce89c81b334251d2e51b0524102fe7cf65db2a3981a613c2bd1103a89fb7fca32f6ff98e92f70b34e7916c4301
SSDEEP 96:xHNUTUrqGqbf6as1zSIJSSlpdv9jknJHDuFY1Bw88u8L4cnqDx4:LWRbf6asBJSSmR1Bw88f
TLSH
T143E120789048DB7F74B677AC6C6488316AB2013B77BF68C750BA5484055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 6KB
SHA256 cf3d484de414b818500c78b430662fd6e5209a8f883ffbcbd2752234e81a05ef
MD5 b88dd9097668e6ec9401cf3771a94844
SHA1 23080a97905dacc774001372978aff0fed624d52
SHA512 71c4c3e1c98b63dd10aeefdbea2a426ce2b7ba15a001a4b2297b4df3f73a7868c27da01b719221f11f42a5952aaa1c77564b3308cf8d865b789bd1cee7f5b40d
SSDEEP 96:xHNUTUuPqGqbf6U+1zS/HSSlpdv9j3nJHDuFY1Bw88u8L4cnqDx4:L+CRbf6U+uHSS5R1Bw88f
TLSH
T1BFE10D7894089F7F74B677ACAC6888316AB2013B77BF68C750BA5484055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 6KB
SHA256 4c5baaf0592829740e6574e5d45d7f4c9a8ba5a2bce921ad0f6f7cca9816fd35
MD5 7734640506f69569fe453a8205c0742b
SHA1 46d4255668f10120b1ec5c2f2a5b98c0e8267d5d
SHA512 dcf36172a59d20d004302f812da5ba539074e26815f051bcb262ab5ed42f48500bbdefd8c7dbe0332b8c2fd847c20da30ef939af9fafea218bab6fb8bcf684b0
SSDEEP 96:xHNUTUuPqGqbf6U+ObzS/HSSlpdv9j3nJHDuFY1Bw88u8L4cnqDx4:L+CRbf6U+9HSS5R1Bw88f
TLSH
T137E10E7895089F7F64B677ACAC6888316AB2013B77BF68C350B954C4055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
Size 6KB
SHA256 bb2c80115c3e4e99411e8a930741ea6fe76ee5acfdb383315c662cb978e538a9
MD5 15b1cad4e9f795ffb9ba4a4d2f39a00b
SHA1 445418a7c072edc54e735b95a5c851c54c910584
SHA512 d7cf5ff3d4216ad23ba09453a12375a315222134f53cd2e3481c0390b96ff26e78445b02ca25752531c062ba5f81509bc89d30e6a876154ec874cb938362e814
SSDEEP 96:xHNUTUrqGqbf6U+1zS/HSSlpdv9j3nJHDuFY1Bw88u8L4cnqDx4:LWRbf6U+uHSS5R1Bw88f
TLSH
T1FFE10E7894089F7F74B677ACAC6888316AB2013B77BF68C750BA5484055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 6838ef985c7c5bd1f47947655d39a643cae5ab272822e4676ee8825fd4668e28
MD5 1c3d65bb608fe4d60cf53ea80e42f0c6
SHA1 2cc636d9fedf936e321a5a6d646345882c1ad72e
SHA512 61b73e073a2a794f2af7702a94ee87b5872af03cbb7443fdfba2210164f8e4a0a1af2fb5632ffee44cd1634d98e32d9809f16b656ca07c54eef2127ab4fe366a
TLSH
T1F121EBD35A473EE2B7D1519D81850FF2C7A9303244FA98F0C18E4A82556E65DB25A11C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 4534dcda34c095dc400436848e8cfbba223a7a933bf0341d67d882fbe0abd92b
MD5 3233fa7995c618d6c02fd22887b5cdf4
SHA1 724d80a17554e4544fb0e20e156594ebc65b279d
SHA512 bb522f62c1e99de57554078bc37319fdf0a40f99d3acd66e438ccc489eaf6fe5cfa8dd9e3ddf56fa8fb2c87f3c57bc3531e9617968b320210d0173bf1072899d
TLSH
T17C21BB935E473EE3B7D1519CC1854FF2CB9D343248FA98F0C18E8A41656E65DB25911C
MD5 SHA1 SHA512 TLSH

Submit Download