591df06198887b32932fc190aff597389629e08e2242f44cd3a9d30389bd4727

Analysis

user interaction
yes
max time kernel
343s
max time network
338s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wallpaper15.jpg
Size 134KB
Sample260420-tvfgkscs71
SHA256 591df06198887b32932fc190aff597389629e08e2242f44cd3a9d30389bd4727
MD5 9055e74cff4c7fc47e68f6e36ab54c0b
SHA1 7ad46cbd6b3e212d38d7823a74cc6bc242b47f2f
SHA512 9065853f638643ffc4a9f2b1b9c93320ae09e847ded3f2047175d580d2ffb24c449d36edd87e8e888e46325bdc8416f35aaff876089a176874f3809e694b0c2e
SSDEEP 3072:7LdAian78x6q4EHNNQWLnSbyHGpyTpLFlWT:/dqYN4EtNQESbaNLLg
TLSH
T1A6D312493D1CD9C8FD0396F40F4B465CFE284EEE98B912DB09A563B090992F69D0F639
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1736	hoic2.1.exe
5016	hoic2.1.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	189	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=9ef57f866d7af65c	5

Program crash 1 IoCs

pid	pid_target	Process	procid_target
748	1736	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hoic2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hoic2.1.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\HOIC.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	mspaint.exe
4328	mspaint.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeDebugPrivilege	5024	firefox.exe
Token: SeRestorePrivilege	4996	7zG.exe
Token: 35	4996	7zG.exe
Token: SeSecurityPrivilege	4996	7zG.exe
Token: SeSecurityPrivilege	4996	7zG.exe
Token: SeDebugPrivilege	5024	firefox.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
4996	7zG.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
4328	mspaint.exe
4328	mspaint.exe
4328	mspaint.exe
4328	mspaint.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe
5024	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 5024	3324	firefox.exe	103
PID 3324 wrote to memory of 5024	3324	firefox.exe	103
PID 5024 wrote to memory of 5528	5024	firefox.exe	104
PID 5024 wrote to memory of 5528	5024	firefox.exe	104
PID 5024 wrote to memory of 5528	5024	firefox.exe	104
PID 5024 wrote to memory of 544	5024	firefox.exe	105
PID 5024 wrote to memory of 544	5024	firefox.exe	105
PID 5024 wrote to memory of 544	5024	firefox.exe	105
PID 5024 wrote to memory of 544	5024	firefox.exe	105
PID 5024 wrote to memory of 3300	5024	firefox.exe	106
PID 5024 wrote to memory of 3300	5024	firefox.exe	106
PID 5024 wrote to memory of 3300	5024	firefox.exe	106
PID 5024 wrote to memory of 3300	5024	firefox.exe	106
PID 5024 wrote to memory of 3260	5024	firefox.exe	107
PID 5024 wrote to memory of 3260	5024	firefox.exe	107
PID 5024 wrote to memory of 3260	5024	firefox.exe	107
PID 5024 wrote to memory of 2256	5024	firefox.exe	109
PID 5024 wrote to memory of 2256	5024	firefox.exe	109
PID 5024 wrote to memory of 2256	5024	firefox.exe	109
PID 5024 wrote to memory of 2256	5024	firefox.exe	109
PID 5024 wrote to memory of 4892	5024	firefox.exe	110
PID 5024 wrote to memory of 4892	5024	firefox.exe	110
PID 5024 wrote to memory of 4892	5024	firefox.exe	110
PID 5024 wrote to memory of 4892	5024	firefox.exe	110
PID 5024 wrote to memory of 1116	5024	firefox.exe	111
PID 5024 wrote to memory of 1116	5024	firefox.exe	111
PID 5024 wrote to memory of 1116	5024	firefox.exe	111
PID 5024 wrote to memory of 1116	5024	firefox.exe	111
PID 5024 wrote to memory of 5368	5024	firefox.exe	112
PID 5024 wrote to memory of 5368	5024	firefox.exe	112
PID 5024 wrote to memory of 5368	5024	firefox.exe	112
PID 5024 wrote to memory of 5368	5024	firefox.exe	112
PID 5024 wrote to memory of 4000	5024	firefox.exe	113
PID 5024 wrote to memory of 4000	5024	firefox.exe	113
PID 5024 wrote to memory of 4000	5024	firefox.exe	113
PID 5024 wrote to memory of 4000	5024	firefox.exe	113
PID 5024 wrote to memory of 4564	5024	firefox.exe	114
PID 5024 wrote to memory of 4564	5024	firefox.exe	114
PID 5024 wrote to memory of 4564	5024	firefox.exe	114
PID 5024 wrote to memory of 4564	5024	firefox.exe	114
PID 5024 wrote to memory of 2744	5024	firefox.exe	118
PID 5024 wrote to memory of 2744	5024	firefox.exe	118
PID 5024 wrote to memory of 2744	5024	firefox.exe	118
PID 5024 wrote to memory of 2744	5024	firefox.exe	118
PID 5024 wrote to memory of 4768	5024	firefox.exe	119
PID 5024 wrote to memory of 4768	5024	firefox.exe	119
PID 5024 wrote to memory of 4768	5024	firefox.exe	119
PID 5024 wrote to memory of 4768	5024	firefox.exe	119
PID 5024 wrote to memory of 4360	5024	firefox.exe	120
PID 5024 wrote to memory of 4360	5024	firefox.exe	120
PID 5024 wrote to memory of 4360	5024	firefox.exe	120
PID 5024 wrote to memory of 4360	5024	firefox.exe	120
PID 5024 wrote to memory of 5604	5024	firefox.exe	121
PID 5024 wrote to memory of 5604	5024	firefox.exe	121
PID 5024 wrote to memory of 5604	5024	firefox.exe	121
PID 5024 wrote to memory of 5604	5024	firefox.exe	121
PID 5024 wrote to memory of 2564	5024	firefox.exe	123
PID 5024 wrote to memory of 2564	5024	firefox.exe	123
PID 5024 wrote to memory of 2564	5024	firefox.exe	123
PID 5024 wrote to memory of 2564	5024	firefox.exe	123
PID 5024 wrote to memory of 372	5024	firefox.exe	124
PID 5024 wrote to memory of 372	5024	firefox.exe	124
PID 5024 wrote to memory of 372	5024	firefox.exe	124
PID 5024 wrote to memory of 372	5024	firefox.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\wallpaper15.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {6a6e474b-0873-4aa2-8d3c-305d1a49662c} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2388 -initialChannelId {473916eb-e1a5-4155-a6b8-7c2322c8216d} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3680 -prefsLen 27276 -prefMapHandle 3684 -prefMapSize 270279 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3696 -initialChannelId {c71567da-d9e3-43fe-94a9-c512b7c487cc} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3848 -prefsLen 27276 -prefMapHandle 3852 -prefMapSize 270279 -ipcHandle 3956 -initialChannelId {22d84568-b2a5-477f-8081-61a8da1ea3bb} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2912 -prefsLen 34775 -prefMapHandle 2988 -prefMapSize 270279 -jsInitHandle 2928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2872 -initialChannelId {b559c3de-8721-4fec-a07f-fe1b5aaa0c3c} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4828 -prefsLen 35012 -prefMapHandle 4832 -prefMapSize 270279 -ipcHandle 4896 -initialChannelId {fa89fb4f-510c-452c-8723-fac600ed7d9a} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5112 -prefsLen 32900 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {a6ec6169-25eb-4b97-b7b0-2e0394d2e551} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 32900 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5356 -initialChannelId {f5a552e8-5b25-4c28-be62-b7341a0d430c} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {e8d1b879-c991-4c20-a4d2-930318d3bf23} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6212 -prefsLen 33071 -prefMapHandle 6216 -prefMapSize 270279 -jsInitHandle 6220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6228 -initialChannelId {d054f5ac-e3b3-4202-b61e-b87ccfd32346} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6464 -prefsLen 33071 -prefMapHandle 2748 -prefMapSize 270279 -jsInitHandle 6208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6452 -initialChannelId {47965851-7b7b-4a6b-8b09-0035e8e8299a} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6708 -prefsLen 36758 -prefMapHandle 6256 -prefMapSize 270279 -jsInitHandle 6640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6208 -initialChannelId {ca542676-d05c-4518-a9b0-c18224cf6f80} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6824 -prefsLen 36758 -prefMapHandle 6828 -prefMapSize 270279 -jsInitHandle 6832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6772 -initialChannelId {39af9b6c-b18f-46dc-9ba1-0dff8a4bcaed} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6664 -prefsLen 36758 -prefMapHandle 7192 -prefMapSize 270279 -jsInitHandle 7208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {e705458a-09b5-4579-8db9-e3fced53f6c5} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 36758 -prefMapHandle 6452 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {8dc66c84-0ab9-4dcf-8135-cbe35fc39a61} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7248 -prefsLen 36758 -prefMapHandle 7324 -prefMapSize 270279 -jsInitHandle 7328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6416 -initialChannelId {d759867a-8bbf-4003-8a63-6830a64db2ce} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2652 -prefsLen 36758 -prefMapHandle 4704 -prefMapSize 270279 -jsInitHandle 2620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7724 -initialChannelId {081e9628-11ca-40ea-8492-be2014e28e64} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:1216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3020 -prefsLen 36758 -prefMapHandle 3016 -prefMapSize 270279 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7884 -initialChannelId {66b84202-b2aa-4142-a78b-08daed496064} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2660 -prefsLen 36758 -prefMapHandle 6960 -prefMapSize 270279 -jsInitHandle 6788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4704 -initialChannelId {7a058337-085a-4855-a720-0eb1d8a61347} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8120 -prefsLen 36758 -prefMapHandle 6992 -prefMapSize 270279 -jsInitHandle 6912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8144 -initialChannelId {c8c3bf10-2363-475f-bf17-d9463d38afd9} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7696 -prefsLen 36798 -prefMapHandle 7680 -prefMapSize 270279 -jsInitHandle 6972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7708 -initialChannelId {4135a239-5b70-4e67-94cf-36445827679d} -parentPid 5024 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5024" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:1444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1176

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\HOIC\" -ad -an -ai#7zMap13165:70:7zEvent32098
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4996

C:\Users\Admin\Downloads\HOIC\hoic2.1.exe
"C:\Users\Admin\Downloads\HOIC\hoic2.1.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1648
  2⤵
  - Program crash
  PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1736 -ip 1736
1⤵
PID:4860

C:\Users\Admin\Downloads\HOIC\hoic2.1.exe
"C:\Users\Admin\Downloads\HOIC\hoic2.1.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\activity-stream.contile.json
Size 4KB
SHA256 2b4eae84cc17cc9caaf3baeb858640ad2fde95f29e5f19ade1e35c4e16f89ef8
MD5 a765681f8b874369fff4581a57ce609a
SHA1 ac6ef6640bc2402ad53db5fc3fc447593838379a
SHA512 94a67c9d1ce3fd2671a33009ad78ece281cbf3576d058b7ca3832aecf06187a3412474dbc062afc246e16b7260c98addf6824a45d392344d0ccc8f132dcf2220
SSDEEP 96:KqdHZRSBtD2gAKdGbNJve8DlwQv1Nao9zDVroI3Im+7R0H9l:Kqat6gLdIJvZlrXaoVDVro1iH9l
TLSH
T117A12CFF4859C94B47336BD03D5F17ACB00B738F85EA8499A749CC04E6D915641EE2C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9hv4mshu.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 f646e7db6b6f3dcfe089fe2d97ff7d41e5002eea35ae96887b7a77b52b30cbcb
MD5 32a1c37b7dd815a1289b7f7c7d7de116
SHA1 e150796b731e1feaf3397927cb8fa23fa5cb613b
SHA512 2cc01321d4bd3cd589e16f7ce6d034fbd48916c2a07d55ef6cbe0f42e9c7c7ba2dbdadba026286627bcf101d04a9a3b50ab2e867dcbf1d3a93f6d89a5c018cd5
SSDEEP 384:HbaFrLiO024YaFuhw+5EL1pPsac4j0lpDII+UEBEc:7aAZYaFuK+5EB9sac4ID8LH
TLSH
T1DB527D7EAF0138BA1A2BD1D4D9AE9204CE08D6BBEFE3D15605143C44C684779B4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 21KB
SHA256 c7357ddd0d26b5778ed9a4c303de9c1a548f2928f0a818985d13df148f1a5a5e
MD5 9cb7adeecd26e4cd9691ec787bf48925
SHA1 3c925aa354164c03027ca64fad3e35eab2619fad
SHA512 ea76e72e880b4c4a75a3252c1ffd9e4c786d8efb03bbe62c0928953df2b645c84bc244e57660f02e23849eab3998ccfd3270d977ff624b1d10ee9052ce1b19fe
SSDEEP 192:lC2CHC/TTCxgvC878xC2r3CgsF1CEye6ttrHT9xkhQCdtF7TCK9kl:UPi72CaO7BFkrzttrHTjkhVPF72v
TLSH
T115A242012BFB1655F2F39B313BF6A726AB77F9019B06652E8141528D0A337108D2AF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 21KB
SHA256 8a9b2f92dc5593533b2697972e05e3d86d14707505fbee35b4bc48742582ff84
MD5 0257f89708c523e33736be9390bc8875
SHA1 6eda3c6531d30e848fce9134e36a4bfc0890ab66
SHA512 ed3a0991f6bf5f93e6ef2e58b89970aee64a61ecbe43b08d6490dec9809fd97a77f608e95d097d8a2b2c568e043c959d0287bab14c1dd742024fc0cb4355a8b8
SSDEEP 192:/CECRC/TdCxg9C878fC2rxCgsFzCEye6ttrHT9xkhKCdtF7BCK9kl:qBI7cC8E9BFWrzttrHTjkhrPF74v
TLSH
T144A234012BF71655F2F38B313BF6A726AB77F9119B06A52E8141528D0A33710892AF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\AlternateServices.bin
Size 17KB
SHA256 738fe51a8c806b313559b0960cbebf6da6282ab0ebf94059c02f7e0b7d342495
MD5 2518a049a240e1fe86dd687adbff9e62
SHA1 e66114a2ab5fcff29c074a86cafc2e65e8f04b82
SHA512 fb1678d30e54061d296a69c7e4396f57816ea5a59107d6cac69e44285e0dfdacbbf5b8ca8bce0c891b5fab68736a3d214c335b6dd93bb31baa43ff01540d3c57
SSDEEP 24:M8uhMZQQ8raGs9x/G63GfViIBo9yWN9VxWAtue+lzp9Bp9t8e:MjaRtv3YV1o9yM/pwe4N
TLSH
T1F8827EF35B769572F0119FF5889872DC8C3602198898A0B8D721D89B07E6795F03FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\AlternateServices.bin
Size 17KB
SHA256 00881830a08d56b7ba6b92e2c5958b065ea0d6533f830aa09ee7216ab955ec3d
MD5 095bca5507dfb7f3690c4933a03ce31d
SHA1 1b45d5fba7d77be125a82a0a124fd813057a2ac1
SHA512 780c954771cb4268eb76260efa99f75156e520162c72909fd8ebafe35015e2bc81f42ca77bff64f5d10415c7941fab9cc0e855eaefc7db6882c79af122b54b17
SSDEEP 24:M8uhMZ5ZqbWGs9x/G63GDrNy7N8vs6SIRrIBLyWN9VxWAtue+lzp9Bp9t8e:MwGWRtv3UujxLyM/pwe4N
TLSH
T15F82AEF357B6D132F0519FB9449C729C8C3602198898A1B8DB21989B06F6395F13EB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\AlternateServices.bin
Size 10KB
SHA256 5fe1973b8c0c339915b0b8b4642088601191fab257f0e1d7f319bc9000d475a6
MD5 330ac05f505f4435e0d56559f3651257
SHA1 45606ddc5e823fe93fe98d4257c3e778a1123787
SHA512 aaf7589c0a479d1cf61f59e700ac1b2aa9aac8d349c78578fc5024eb130de10b28cb15a23dd0e4095b877b491c0844db0bef408befd4a8c9403e624a0737d53d
SSDEEP 48:MQ/m9TGvurSvudB+vuQI56tvurxIvut0vu:M2UT7r/dBDQI56c1tth
TLSH
T1562269F35BB5F472F052DFF0809D728C9C33036955A8A194C76488F706D1B9A913ABB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\AlternateServices.bin
Size 17KB
SHA256 1d29766095ae8c9edb26a0b515bda7fa07de6a618e530d1afb6744dfbe708355
MD5 ecb32656b7fd750610e26981512d671f
SHA1 21e3a168e0e0158a3102452c971b3225b7c08182
SHA512 dd60e906fe21e17ac24de5ba2418e82495c90db684c7bc5592b7d6ba9e1ec53e7c88345e92592e5906a9ee80207cf448507f7bea05a39a7ed244f99bbd780c6c
SSDEEP 96:MYOlVRp3BdqI56iX7/Pbtl3M/pQxZ04o:MfQ
TLSH
T12B8261F36B75E472F052CFF084AC719C9C33032558ACA194C75498A707E6B99E13EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\AlternateServices.bin
Size 17KB
SHA256 02f17feffca8e3ced2d235b020f45842df150d7377cc068d9b1662338cffcaef
MD5 60476df51d6c88511260707149d520b8
SHA1 552a314f9d8ee160466c85b7277521b8c6a03cd4
SHA512 585405e39ffbd46560701b56cac00f39c45169df4ce3e0723880f78b20b23e5a2e267b795bf2f424c657f66f2330de39e2d0bd3b3644c3dbb04414a1d4ac45aa
SSDEEP 24:M8uhMZ29Fh2yWN9VxWAtuP9Vf0+lz+f9BLt8:Mr72yM/pw1t04+b
TLSH
T17982A7F36B76D472F0518FF188AC719C9C3702199898A1A4D721D89707E2B99F13EF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0c7785eac9671d9d82bb874bc4273de11fb306d9aa315af05de15b60570266f7
MD5 111a8814dd7bbabd25735fcde29615bd
SHA1 f28488b80889ae4160c58f96d696c78f3056850f
SHA512 58647ce65a02fb59261a72ab9a7a7d7df5b4242be6f5f96015227136a3f8a62912f9234126a7502eeb7bdd415039aec4a196edb8cee303d95d7cac553229c21f
SSDEEP 192:P1d66JozGzgCl6mc0dS6mOv5zbowbHLfyjWoxI:dd66JozGzgC1jM6dbowbHLfyjWX
TLSH
T1FAD1FB64EA38463FC445423BCDA51F400E76799ADC8E7F1932AC740C2D5A2DE768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 41c1d8baf3b1c741f439abc058d670d88802f87b2f75f2f5836b30953fedc5ae
MD5 c0c716165fd09c4723f1d30991080812
SHA1 5f054be14f898316d6e82ebed4e1548339a46ca8
SHA512 a5b43b5ae7e20caab47c98911a76d768a75428b598bf9d9a0099003a1d9bf060a92f8404466e6455ee41ab2232d093fa4a6f75c181e038880402b2d6f8f8004b
SSDEEP 96:W6mSdF95/7bkW60rcEHLfyUR6Wix2WZMFmb2FYFaF/Fk/dd66JozGzgClKtmc0dz:W6mOv5zbowbHLfyjWcxB1d66JozGzgC/
TLSH
T140C1DB64FA39463FC845423BCDA51F400F76795A9C8E3F1932AC64082D5A2DE7A8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 fbd29d120214cce53c027394ebf92182afb7c20a41e1a16b527a12ecac2c8938
MD5 d3313639309d1bcbf584c1c15ba3a5a5
SHA1 61329703de087296602322bed6419ba91afa2272
SHA512 e0be8003151173e9cfc375fcf9d8fc009178df68558676c40f299b4c89211bc6f906f72bd97b033d8310533800a4333b86f92efae44ab42ecc01ffb3a1a5bc64
SSDEEP 768:dacbYNQE6y/bZlGcmhuwK1/CDQbK2bRG4SEE/:JbYGE6yc+HG
TLSH
T13AF21F44FB2E953FD81512BBDCA50B042F79B885581A2F5B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fb05b120dd9bf0fdfde9b921cc231533d570c23d6420881b0a108a8c45875287
MD5 aad784adf4d3e4147c0bdacf171a7de9
SHA1 2c34c0d6307611184ba6bfffb56f0b64a8b0e3ae
SHA512 5855f22e17dc77a1196b71b82334a492bbaf6051e96fa366c7504b289691c2e8827879b32a5fe272d98a7e17e7ad70fb2e26c80f6ccf0a8b6cbbe986f2686fe6
SSDEEP 192:61d66JozGzgCl6mc0dF6mOv5zboGZHLfyjWojI:kd66JozGzgC1jn6dboGZHLfyjW7
TLSH
T1E3E121A4EA28467FC404427BDDA61F400F36389A9C8E3F19369D740C2D576DD768E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 137KB
SHA256 173011ea8d6306ff407802b1e02875f65144bb58a0427c284e9d50bd7eadf66f
MD5 03ace37ffea059292c3c6fc1b22ec0cb
SHA1 2c2800d2080196ae63b7a56a18bbcd0afaa5cd8b
SHA512 cb4675cbc6c54bdfa6b4167899dbd74acce784da9869eaf7d6386e7d125e1e2b13a1b692812af7221d9cf178c72718afbb9cebebda61be83d4f5efb0e2218f33
SSDEEP 3072:Pmt5fjQ1k1SC/6QJerpGQjpKXcsKaCv5fv606fVa:PmHfjQ1kkC/6QJerpGQjpKXcsKaCv5fb
TLSH
T14ED3CFC4DB16407BEC1485BFB495273C2735F4644A599B0B3AAC00762DCB3BF2D0AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\db\data.safe.tmp
Size 87KB
SHA256 a98bcdb7cd755b7ca564782d74be8a09f1d36e7a99528a2e176ceedac675d301
MD5 80263d1f0e02839f231bebe94aa96432
SHA1 204370726e0b1530b35c66ca2937d83a344a5650
SHA512 398fb21e6e015aa96058f0264c734c12b829ccf9ef58b178e56e9414f3ce2fd3a89cacf96d527941b9fa2a3c388f6d092984501723eed7d24ca83ddbe82e8ac3
SSDEEP 1536:Cmbp5zLwKYPdX4+Dy71bd8CYOf0//78tvn+KsjnjtgpKt/2KTtKWV:Cmt5fjQ1k1SC/6QJerpGQjpK2
TLSH
T1B593FE44EB1A953BD96803BA9CD21B103F78F4895B1B2B67271C64783D873DC2D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ec3330a558fc84f9d7b216fe260e57a06b0b71fc35878cfd1836d96875c30d74
MD5 42a7ea8cd4376626af469ca1afae57d9
SHA1 0e8c6633f1704ff2294892deabcb028cf39a32b4
SHA512 cc6d835caab1000cf162edb7bab79894cc275159ad2c9cb869727e5d9b68564467e64ad3e7f6e3f8ec0fc8438e8c6ec2810c0238d2431578e292507bfea9cfc7
TLSH
T1F5216D6C3AB84D6A78DBF2DC78C1128E53554E0744C72C430E13DE8CDE95ED9326A478
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\events\events
Size 5KB
SHA256 f76e9c6b281774dcef22c72da89ba97e7a6e5f4bdd3e2ee03a2d59aea797f8f9
MD5 5eb3f78c385998a1338edcdb374c842d
SHA1 08be0f13f669d13cac521432b1493e3be8e823dd
SHA512 b6b7737bed2339e98f5ac4600098853ed0df654619cf390a4959c2913dd6d1d8cd4ee699138d788e5af0fa518439b5b67a3ecab0439c92b10bd615950f125130
SSDEEP 96:oLA85dZl+uYsCaKw/44FxlGdWGdvsEOMLeQxV2+:UgmCWgv1xLeE2+
TLSH
T1CEB1002D76A91C7E79DBE3D8BC81038D42C84702D4C72C874DDBDE48CD6AA9A325E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

219f15eb-264e-4b1d-8491-c0f41dc65f14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\219f15eb-264e-4b1d-8491-c0f41dc65f14
Size 2KB
SHA256 74396262e0a5f252aa8460d3f3c772c81b2b74fda3fe5905ef17ce0a145f01b2
MD5 6d90cb3670a1a69b83b5699749bb999c
SHA1 bb2cdf74035473a5401df7da9136bd024c1a0b18
SHA512 fb8a281b2883e8bd89b718e0863d97c3f96d52b9172b692687de49e7815bbde83ed2491cfc9f024df2a9620a9b9021953563b251f66a933b16a2e356356eff7f
TLSH
T12C41531C35784C7A8C9AF15DE4823B8E47A08A0300C618536F51CE0CCC966ED736A62B
MD5 SHA1 SHA512 TLSH

Submit Download

44bb92ed-99a8-445f-a3f3-9f1d807c70cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\44bb92ed-99a8-445f-a3f3-9f1d807c70cb
Size 235B
SHA256 d3cf4b40bb56524020b21846b77f8903e83d2b34d9e19eaefab24c330430650b
MD5 577cd8af492516c66c78afbab1508ebc
SHA1 d2d57a58e5c96ac07de95c4dd58400d9968ec616
SHA512 46f32a49c025080df0a3130e0ebc9755a5895bbe1c863824960960a4fca84fea4e9cec8d943d140e8e76bcfc29e3b7fe4e77c19d6baba193ea2ddcebac1e4a20
TLSH
T1A5D0978064A83B6E48180F07B0E03DEA30468C3B94A49820DAA04138F9BEDDD4221807
MD5 SHA1 SHA512 TLSH

Submit Download

5b5a2368-4503-41c4-a87e-369b8a67d375

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\5b5a2368-4503-41c4-a87e-369b8a67d375
Size 886B
SHA256 22f1bde2937014b056d84b5b4d8c6f2e51bb63d12d61757b29138677ff3c8ed5
MD5 c9226245462b62700afdaf1993aa78b7
SHA1 9427c7802e9392b5d6aa6e3fd74cef9474dcd6a4
SHA512 1e206a247b6dbb6b7c3e5e14b1885a84374b493072df5fb680dc3aacdbbb74b6f7d472631ebd227cb97f4cef70c5e38926c0abb75fa21515acf3d7c3002a87de
TLSH
T1CE1100818A7579F28C68D25795D077428BE4752380CA0D087F605A085EAB51A93AB707
MD5 SHA1 SHA512 TLSH

Submit Download

a3413020-dc6d-4566-9679-2bb663dad9c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\a3413020-dc6d-4566-9679-2bb663dad9c0
Size 16KB
SHA256 c3dcbb1cebf460b33d23a31ee2a3349bf5a3aeead52670965a421c7e2dd135c0
MD5 ffab8a9ab5c44b000afdb9ebf8c91fb8
SHA1 3c9cb5766fe479db2c0a8e44829e7cc6df8dfa28
SHA512 3fc1c7e57ca4ebe965970e62681291454ae203462de3aadeb8512d1fc7bd3305027c6b1dd217ea93da680f4f9c336ca687361140c8f4ac08a74d4121225afc68
SSDEEP 192:HHIK72Q3uKb1MHwK1Ntj1RgpXNKz/bLD80/BeC11LzPf/1XpnXVxArHWJMpXAiHQ:nIK6Q3uILMRgpXNK7bH80/DLDSWJn
TLSH
T15972C956182044BA8251E3A9D5ECBFC3E5F62CCF4C419FC99BE4BD086DDE06E112758B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a485e788-76fb-454b-b67a-76a3abe1c4cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\a485e788-76fb-454b-b67a-76a3abe1c4cb
Size 883B
SHA256 81151dd00857361762cbc51dffcf2cecdef6268b3f858ed180c87bd172b0ccdc
MD5 b2c12b9ce7099c9d0b3edd339b59c754
SHA1 c4c7307b09af0fdc9f0ff92b0e50ef9e58a726e4
SHA512 bceb8ac3e863dfdc6e9ca3703e85966eb38d71d5d1702f73d1e7ad9fd4399e6a9035d59dbb6373088f7eecc7f800403d60d2ea536dc53b86f0232ffea947dd32
TLSH
T1CA112381873479B2CD68E25BC8913B068BF5762384C744043FA15A084D7EE1AD36A70B
MD5 SHA1 SHA512 TLSH

Submit Download

c1bdc481-1c28-4ac2-9782-44abf03faa9e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\datareporting\glean\pending_pings\c1bdc481-1c28-4ac2-9782-44abf03faa9e
Size 235B
SHA256 0a20df6d17d2b5ed9fc61669424ac96958c025fe56aa00c97d36f27b7f85669d
MD5 7815e913574f9fc918358ea943b5511c
SHA1 af15c4113229c3c7b07455c72304c5cccc2d738e
SHA512 3c3473ab9a657a0d217bcd54bc8f2f669674fffe3724430c6a138a4caa450c0e6eb37c63b5cea4f41023cd9dfeace022b1d284a255d0e1ddc689bddafb4618a0
TLSH
T1D4D0978028D82B5D88248F02B0A0ADC6358C8C3320B0E890BEA156B4D9F9ED6416191A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\extensions.json
Size 16KB
SHA256 4289be6df1ac3837e11b42596afad7c85f266dd6a73f4b29a9a71529855e261e
MD5 b33e1ad96b53d02cb31b0624ee01ff4b
SHA1 dab8eba8b46c17627cb99c0f7ba5a072ed2a9a49
SHA512 b579a6abe60a23b69773a745c2c408a6cdff3b8da294fbc3e3c2d6fe8e27fd969c64150ae2480e6f133fa8526decf32dce17b52da41607cffe4cdeb0c32e2f5f
SSDEEP 384:AkI4v0UmldvN8dhWZ94zq96ojAL4HyDL4PeL4HofL4HYL4H93K4hp:nI4cRf+XA4q6h4a4s4ID4a4da47
TLSH
T19572411545049EB8294FA78BAA36BD01C37D473B60845C78F4DD8FC842FA5B902FBA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\places.sqlite
Size 5.0MB
SHA256 211ec047101728ba3b4e7328b0a4327b2dce032ccf058d767850086bfded6f3e
MD5 b5c55c061bbf3163090a7a08a41d4db9
SHA1 8f6520931d09ef47a764e0d1f1fa77cdf1698bff
SHA512 77deb11634274984e98c76d026ad7951878ff3ae226a08db93ec28a546dc0ece8fc2c018cee9b91b89d649812eddd2ae2e5d09d748baf5f4f51e50bb8da00d87
SSDEEP 384:M8r54w0VW3xWgBh1/8/ogLNyufeAdq5Ooh:rqVW3ogSs
TLSH
T14B36B75BAA294053D9EA9176ECE37B08183F71168A7772913D94152C0EF0712BA6CCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs-1.js
Size 12KB
SHA256 d7828515804d57122ade98de1a00e23214e6a1fe50215e725220c53883c73f09
MD5 ed0c3eaed308acd28e1aa0ad7652b4f2
SHA1 aaabaa58e7ca978e96f9c31134f4735601a042a4
SHA512 f70e1a9da5e0f281f59047da03bae717d9909666bf5e5eb9b52e9ae70aee1f73350d472f8ef9a9e7e6b851bc306af52b7766ecd704548baec04c8c76def19012
SSDEEP 192:2jCR8fnseGSSGgLRmclpmBw8OOTq/Y3nmI:IJ4RNCw2jWI
TLSH
T1E142DE3D5244DB3F75B272BDAC2949A419A20127B7BFBDD606F988C1081CF2441E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 7ed60b576334e06d04a9bde122d249450054686ce2ec95023bc327c0906da0f7
MD5 a54c19c1853af01be3f95acce35e062d
SHA1 c0ff5be3cdce3eccc34ef60577c05c9730e647cc
SHA512 be11c09f6c98eea937c33d134b65778f6f9fc158696528d2cf5830230e89672d31351cf19b9d58300945b31dd9eabbcaeb47c11207401c83cfaec61e646e308a
SSDEEP 96:xH89UTUfqGq8fCqVKjfnjz1zSpT+SSl8pdv9jOnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVYvoT+SSGz6OBw885y3H
TLSH
T1BCE11E7895088B7F64B677ACAC688C315AB2413B7BBF68D750B95484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 cf663863a8054e82b70e692ae6a6b3c0f5908277a87acc71b01725ae5b77257f
MD5 4f353f955b44037b7e70b4cd2ac2ab6c
SHA1 b3d1e877aa4fec4ee3ce245da3bab36ce39a045c
SHA512 d353b4a0e4fb4665031c51f6a8cc30e61e71ba68e18010d3cd86b2087f789c70888b08aa47a75f67f6a681cb95641235f24649e666f4154202f56bb9a08ff7bc
SSDEEP 96:xH89UTUfqGq8fCqVsekzSpSSl8pdv9jBnFIH6OBw88n8L4cnoV81FHuGS:2CR8fCqVsenSSGc6OBw885y3I
TLSH
T1C2E11F785508CB7F74B677ACAC6888715AB2013BBBBF68D350B95484051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 7KB
SHA256 1013a811c39c01be59066eccc0c2979c2a56adcc419cd74ab0d73714797cbe30
MD5 91c4ce1c7eff6bdf3e3032a671568a50
SHA1 c683ce4c33256670c1b939d6d36ab5973947b5b3
SHA512 2272d1b34e296a22b80ad55780db49420c7a21b8f7d357f0d9812a7d7fc6f1f3a71dd12750a5678370a35828898bffc40cd85c6233c75e0fd78043ae23d9ac5d
SSDEEP 96:xH89UTUfqGq8fCqVseNbzSpSSl8pdv9jBnFIH6OBw88n8L4cnoV81FHuGS:2CR8fCqVseYSSGc6OBw885y3I
TLSH
T1AFE11F7855088B7F68B676ACAC6888715AB2013BBBBF68D350B544C4051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 7KB
SHA256 9e6b4a273596b8a2a4baafd43660fdd98d7b88ef7a0b1802e19c8aaea74436a6
MD5 256510d0d470b9e5041b239b0df8856e
SHA1 96a65e99ddd4a32984323fc4dba9f99f43602dbc
SHA512 cd2aa2e19ca02a9b1c0c5c861863928d4e7a77cc7ec918abdd46c2b2d197954121fb2f9d7960cfab70ecc3a4ef219f43a1f023a1bc08e179cc517884cbae4aa1
SSDEEP 96:xH891TUfqGq8fnseNbzSpSSl8pdv9jBnFIH6bBw88WW8L4cnoVcFHuGS:2DR8fnseYSSGc6bBw88WqmI
TLSH
T190F10F795104CB7F74B276ACAC6848745AB2013BB7BF68D311BA84C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 12KB
SHA256 be821e074b3979e284ca0782292029148d6a9841619f9ddc57baf63e5e256586
MD5 73b8fe2b6a6c4a8656f1e3654e441fbe
SHA1 a3f739a339c1ebefd95114049e793db5d0d1bbc9
SHA512 e395d4d859aa2544c2edf3f1770b4c052fe33cacf1beab24a22b24b1a0962bb3db71d1763bab0570ae4d0da8c706cdf2e0260d3bc9bf750e1a1b2764f1b612af
SSDEEP 192:2DR8fnsejSSGgLRmclpmBw88OTq/Y3nmI:3e4RNCwcjWI
TLSH
T1B642CE3D5240DA3F75B272BDAC2949A419A20127B7BFBDD606F988C1081CF2441E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 6KB
SHA256 05d589c7564c81cf7462db158392fbc0d122634cc82da2014fea43c3d51ff30f
MD5 1e2233b86b25ff042fd5b9f0ea47c8b1
SHA1 98f976ffc55dcc7be1a6b211bbacfb70c7215044
SHA512 6e0b91f0e2084987044d207c178708162375cd8543c9004d1d96ba3e9220658143c2bc37330a4764f5abc59d9323f98bdd0b8455ec72627b6c3d70741a5d6cba
SSDEEP 96:xH89UTUfqGq8fCqVse1zSpSSl8pdv9jBnFIH6OBw88n8L4cnoV81FHn:2CR8fCqVse0SSGc6OBw885y3H
TLSH
T119E11F785508CB7F74B677ACAC6888715AB2013BB7BF68D350B94484051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\prefs.js
Size 12KB
SHA256 cd5f1f45019639203f2f9e743eb7bec34c887baa484f496b66ccf5eef34b2fac
MD5 1fea98df5186e4858197ac4038a2f81f
SHA1 2de3f9b5770cfb949e16fd4d4d0efff17c57a044
SHA512 ed98feb5575d7d3bd9b9f1ed130e5fe2c00156e4e798c146858ecd8d7ab63c438c04488fc29ba140e886188ed12847f847b3485ede7643f82716b8ab12f243a7
SSDEEP 192:2jCR8fnsejSSGgLRmclpmBw88OTq/Y3nmI:Ie4RNCwcjWI
TLSH
T14642CE3D5240DB3F75B272BDAC2949A419A20127B7BFBDD606F988C1081CF2441E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
MD5 c8dc58eff0c029d381a67f5dca34a913
SHA1 3576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA512 b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
TLSH
T1F8D02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.baklz4
Size 258KB
SHA256 34517527f75523c4ca1f4b353c167e2a7e7aecbba9e04cd36300a79b10338893
MD5 4f00af086ad400a7bf24754aeb51bfe4
SHA1 5cfaf93b08be4b8def516e9d3f8bb79bd5ec6910
SHA512 e14407d5b05ffb5bb1945eb715773bfb5479295b2200f0648105a204b662a8fe6e98ba0eb45831d9d8d57aac85618e426de632d184a136789d68f8a0fc012a2d
SSDEEP 6144:mTPbawcdh5mBgHlqbQ3TP5BbuLgEKHgkTKiN3hm0:alcDIgHZDPjaLglJe90
TLSH
T1DF4423F758CC1CF84B5550A148A3EE1E0BE45F1440E458C8CA9BB9EA92F7706DB9F98C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.baklz4
Size 253KB
SHA256 9e65a8a52957d8d8dfbdfb84b200210a5cc7cff590c34bf7ff4c7b7ef7fd806f
MD5 4b608e4296eb596dea4c3140a0f88ded
SHA1 e1a75aca25483ab9a1c44994b17820e6025bce63
SHA512 8df4ff694dde914421f0aa462f7d35233af198dd043a38c9ee3245c5c6dacb53793c3d335e922e944ef940fa8be441915177e3062c0404e03c9ff6fb5ba72276
SSDEEP 6144:kPSbawcdh5mBgHlqbQ3TP5BbuLgEKHgkTKiN3hm7:plcDIgHZDPjaLglJe97
TLSH
T13F4423F758DC1CB80B5590A148A3ED1E0BE85E5540E458C8CB5B79EBA2F7702EB8F94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 5a37a74da76e5d37660265a971cc182e592d89dda496fbb01e0cebb1f81fc767
MD5 58acb0cc04a11875e6e9b2d0ce3610f6
SHA1 bf9ddec9e03a094c91f95159cb82f13ef06e13d8
SHA512 995bd0e30d68f0e76a00ddfae5a9d8a5aec8adccd7edb22b26a2bd8fbb14850ca949c4350165059d0a8adaab6175410a078d223d611e08a3ac5ebd9843bb5eb8
TLSH
T150210AD3353F4DE37A15E326C0181FF9E6962C628CE808B0DEBD060600CA1AE731A62C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 e01a6959209b7844b76614badf15606cbe1176fac0ea88c6f558db8c1c9abf60
MD5 e024d74ee8b381c68a73f7e575fccc18
SHA1 6ccbbc99a8ace878b1c6e2d0270fc939bb6c938f
SHA512 3849a3db03fda43d899e20f459ca4ca8a7afbdf3589e481d270bddd54e761f254d6f47dfb08eb5f19d7ca718d086e83409b6c8e2d00eca2060e855dcc7c4307d
SSDEEP 192:p4qB9e/rGlBb2cGq8ir8pyQC7Mrm51TxWp2JQ44QR2NF7v:p4IcAiq8nwMwTWpJmYF7v
TLSH
T1A312B0939635DC1E7B895AFCC4EA1DEC4DC6198152F42058EC3F9E30565DA41193C343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 f306f325ea0bc8cfe3f71faf66131f10309c3b2dad64031ad1fa9ea0603d17e5
MD5 1c5c3497294a8773809ff1c4433a51c5
SHA1 e73c3fae97041d710f70942e50993162c81c13ab
SHA512 9634440e777fc96493a8a532ad223edcd58c4cda936550296715e4a45e5f31d653682b9f72226e75701708df8c11ea1e54818f808df537b4c7324dcd94e0f939
TLSH
T1D8310AA3227BCDF6B106D34DD4213BBD8A84382204E488E4E67CBA42146E193322F21C
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 d33d275efa539292b78f3a9e31995153d98e155f2e102f22f7213fb13c01992c
MD5 e465b12607e4b2142bf5fda368c7856a
SHA1 807cf944994f1fa122b0c54ce4be5930e8c45388
SHA512 d9ac37ec6da353e6c673f4219a5e0c6bb83f126219287b473268845acf2ba3150b53cfd620400273be09271342b3a7b22f63fe4d94228347c648d3a461aa6d5d
SSDEEP 192:w4qB9e/rGlBb2Zc0AjrXhy/Yn7s4s71TxWp2JQ4ZzjGoNjWEfDi0v/4/7exS3kMm:w4IcAW9Ap8esrTWp6rj3fDpgTZ3kv
TLSH
T1B552C0A36A31FC1FA9B6EFA404EF1F9C08C11A91A4E5A11DBD368F3156AD645212428A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.9MB
SHA256 ace4f8f31580cce6d5be9e0174d035893c18f231102d8f0cb603f1299aa68e20
MD5 56671d9c0e8c90bc5a213742d355e5e7
SHA1 57e874515a71da54d7b2f587f2df7b4ed3026840
SHA512 eb32805271f7a8ebe9628a1a28c09343bcdb23688073701aabce7b332d8eb06fff2020f9bc74009949bc18a00df59eae7f7a5a949e0bd02f582f04df9ae02aa1
SSDEEP 49152:GSkARVaAIoW8zN6wlRdXxlxFLrBkv9iKkwhLmOufkYKAuYzSvNvFBvLY0jgMTtUC:d8zootSw65XJ6hxs
TLSH
T183565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9hv4mshu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 5e9d517eb69a72526aad9bd532a8c10dd4e64357b3701719ee755e0a062112fa
MD5 682354b6358c306fb20a382eab1f25e3
SHA1 d88d0f70ff5fbf8c362f8652a00cf13493266032
SHA512 774e079c1116e7958060dc5afa0efb325679cb1e8ed752a54da0eade1aa47e002d326e034b3e2baafb7528b0c0e6b38e22c28b5888d95475580e9f1bc2577d5e
SSDEEP 24576:1YS3+tIdSWaRTz6N/rZbr20eOV97pmifHMg2vJ:1JB3aF6BZbr2zOV9lmifsg2v
TLSH
T129F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HOIC.ytpZdDNV.zip.part

Path C:\Users\Admin\Downloads\HOIC.ytpZdDNV.zip.part
Size 3.9MB
SHA256 a5a02ad7b7621178129aebd9fc37d4f5a86ed066911b69caff92d9f9bed9679c
MD5 de22dfa7ae6c49b88c99434e236afce1
SHA1 64207790f9a0505dba4cd54c734b6c612c5e2ae8
SHA512 78c3eb3a41893c814011afe7ca7a5d0e633b3767c1636367b1bec1d07cd76079550f37a75af4d5f8bafa8712c337be35b1b81da642c0ca7e0c494b1b68ae5534
SSDEEP 98304:rUUIqk9jjYF2kjqs+FTraImMruI8T7cyWnaib9ipi5scIyzFhoo+lO:rUekmFjqLWZMyI8TnCaipiWxpFhoo1
TLSH
T1CA16337B8AE0A6707786FCB14C8D88506FA6377D131D11E9B8EB98DD47A7C972F22104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GenericBoost.hoic

Path C:\Users\Admin\Downloads\HOIC\GenericBoost.hoic
Size 3KB
SHA256 106dea17ed39daba428aa600cc7b4872b2debc5f472f75cfa55b4fbcc5386210
MD5 117dcd32592d6785a55c9ceac79bd557
SHA1 e8ceef37e1bc10de0774ca2db139ed9576eec77c
SHA512 927d051557dea7165a679af99c1a57437d9e638e135f7afe1875c5117bb983fb85a454c342f7d30acb327eb6957501d84632724a4fded85a345a55f83d38cec8
TLSH
T16F61405BAC3904246221CA573242163E848741378D5E24E1B1F1EC9EFD21EEBE0BDDD9
MD5 SHA1 SHA512 TLSH

Submit Download

HOIC DOCUMENTATION FOR HACKERS.txt

Path C:\Users\Admin\Downloads\HOIC\HOIC DOCUMENTATION FOR HACKERS.txt
Size 1KB
SHA256 e9e799dd3b6e52d83260a8950a7b0c224023b7c0073330e8085f95d62bf2fe70
MD5 94db567d62065b3a59660d25c394f11c
SHA1 83ec81f5b779ed8f3b2316cba6579077f70b2b12
SHA512 0769c4e115f16cc61c9595e4de8ae2a5d171bd4d02a7ea80bd26ac5527995e92315fff08a7069a9f135c7755f8c1328b8fdbe22cba93af15e8539827b7d59f85
TLSH
T10B214430064931B208622889D49769F4A62DE0680732F1D4B8EC49EF7586CFC8679F9D
MD5 SHA1 SHA512 TLSH

Submit Download

INSTRUCTIONS.txt

Path C:\Users\Admin\Downloads\HOIC\INSTRUCTIONS.txt
Size 1KB
SHA256 566b4448f74bd2a684d38879d6c8de0560b4ad53b928bbce43bb3099a22a89f2
MD5 afd3421eec4fa790261e2ec22537f42e
SHA1 61fb55f68021727110784b92d0ba67b50839a971
SHA512 c7b7eb412364604248311f39932d1875dade90405bf7fd0e1676c33d64b1ba4b6be55d6d0f54ee10ff2e0471a3123884b02092a76eae721ea6bb22ef11f71b39
TLSH
T1D53150CB138512F602AA057A254EA9C6D753919E963BC138B410944927AAE7083F77E7
MD5 SHA1 SHA512 TLSH

Submit Download

button.png

Path C:\Users\Admin\Downloads\HOIC\buttons2\buttons\button.png
Size 3KB
SHA256 f094c46aab2663470c88bf883e8b641941de70ff4d198c56a568d0ef74eef94f
MD5 3e759a1fdc0a9cb94239284af36ae651
SHA1 9010b65d7f07945dbb888960772f694d70a5b43d
SHA512 f46adc0a844128973ed82b149b1f9b5e3785a17955eb053af761d664e7bb7921152309b6e72ed50a224b0906f54627ee647b0365e61ed2dd48f39dfc54393bce
TLSH
T1F0718D8F5AA0F04F6CAD3A230EDD2141E365203CEA172A34A9D328ED4896E0177A91B4
MD5 SHA1 SHA512 TLSH

Submit Download

hoic.rdp.rbp

Path C:\Users\Admin\Downloads\HOIC\hoic.rdp.rbp
Size 221KB
SHA256 65e6d3eae51574a42bfaa6e2c43ac0f40eb81ed1993b18cf844f41754313cf4a
MD5 31b7a7409b8db4e3a51851e1259fcac4
SHA1 e0c79e9d05ba933962110dc092e761b2a720dc39
SHA512 056a515c1b813bdcebaf411f61685836211c5d8511b409444b1eb1329bb64cb86257d2349561e0104b152b921fe584515914164a617a1c552e144a6775e058be
SSDEEP 6144:Flll5qFyFGYbed8huwrgAw1Aw9Zwc6w84wEGweGw9TwHSw4oqWKRcJ+IpiwCJwli:FlllFBL
TLSH
T1752420864D66EDF55CD80210A3B92AC035E0FA5169203608B0BDF37AE36FDD17B9D3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hoic2.1.7z

Path C:\Users\Admin\Downloads\HOIC\hoic2.1.7z
Size 1.4MB
SHA256 36d3c55f764de174762d0023b7b529e98bfd28a1cb3ad92e286a649956cc09b7
MD5 958534eaf2c52868c1c7a69ed3379377
SHA1 82ceab916f1fbfe43e418a08e85e87ef7b879438
SHA512 7ec3653290e41120be55b9d49e1855b6e9925137c3ffc8737d1dfaef136edfac689ef3bc0f70ffb09726fbe0010ba40150c1bf08e23576207b041896338e7507
SSDEEP 24576:yNaVlSebTHUbWsI1NazQa8ff/0ftsvLswLUFnj8nPdP/onho9Wq3dMlqSrvMFGNH:SJ0HUyRa8l/NzswYJj8neaZ3dMlqSrvD
TLSH
T12365337B8CF677316713CDBE7928EDF16B266EA9335E059E784F988405184FA1863308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hoic2.1.exe

Path C:\Users\Admin\Downloads\HOIC\hoic2.1.exe
Size 8.5MB
SHA256 3c9806f8e132917ef85512505fadaca733e5523c271dd2e2a6925ddb9c3d0df0
MD5 451c94a23536dcbba422d7612b34b6ff
SHA1 0b419c8b9f60cb9cb8957a6dbccb393b5d072e43
SHA512 b777963ab9d21efa29528e6a126e616088205aff9e1b63453c731966dccf5f15cf30f17a933d40c98347a2d057b5f2cb40e40847f41476f0f212b28ce12e94de
SSDEEP 49152:XKgsEyTPOoMjJWPDYtoAoB81BE7nNeHhkD9d5VGokmPh2U69mNGkpETUPSGvVuWs:TsEaQWrYtlKheZmq9ANP61tmf
TLSH
T13296A3151E81EC9AD29D0B78E5A5C6BCA5A18C305F1359A3DEF3BDDBB074C443B2A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user-agent-test.hoic

Path C:\Users\Admin\Downloads\HOIC\user-agent-test.hoic
Size 47B
SHA256 d7a3e0b28155cd41be9cea0e6ea74463de3d7a358b902835abd51c5671dbe953
MD5 bc3480db06614b5e56376559d4138c8e
SHA1 39b3bf286b288cb900514a141d05bb979108bf1a
SHA512 a5c2177db02e5da2d25850b4bebc65576640f94ff307aa01d0695facd91b51c832b922ef4ed5f49f26e7c56227632b6e586501fa00e09155ace60cd2ec4d9f4a
MD5 SHA1 SHA512

Submit Download

visa_stress.hoic

Path C:\Users\Admin\Downloads\HOIC\visa_stress.hoic
Size 711B
SHA256 6ed9a8fc4de9e3c8f1f932b679d363ccf106bdfa7b29d8f227b110d3eca9f1b0
MD5 4715a3d5e2323168c4afeb3637fc127b
SHA1 98404fd10847455af094b0af5caef3b704a431bd
SHA512 d489389b9d91c6560ab98c0035ac5424859faaa402d0e414161f8ae9479cb967049a64c13c3c50dc199a996559135b364c5b57d60939bfd1a6783e6059288607
TLSH
T1CC01FE43228839AF9433354698E190B60604082156C04A90BCB0ECDF6DE3FECEAC3DCD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1736-1425-0x0000000002FB0000-0x0000000002FD0000-memory.dmp

Download

memory/1736-1417-0x0000000000D40000-0x0000000000D50000-memory.dmp

Download

memory/1736-1413-0x0000000010000000-0x00000000100C8000-memory.dmp

Download

memory/1736-1448-0x0000000000BF0000-0x0000000000C86000-memory.dmp

Download

memory/5016-1509-0x0000000000770000-0x0000000000806000-memory.dmp

Download

memory/5016-1477-0x0000000002E10000-0x0000000002E20000-memory.dmp

Download

memory/5016-1566-0x0000000000770000-0x0000000000806000-memory.dmp

Download

memory/5016-1485-0x0000000002E60000-0x0000000002E80000-memory.dmp

Download