581fe039dfc7a4b937f40be32ee10f265155de095c0751c8e54f7e1bbaeef928

Resubmissions

21/04/2026, 09:42

260421-lpv13se15z8

21/04/2026, 09:25

260421-ldyb3aey5x6

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
game.bat
Size 107B
Sample260421-lpv13se15z
SHA256 581fe039dfc7a4b937f40be32ee10f265155de095c0751c8e54f7e1bbaeef928
MD5 26e89923f832a7b47fe6af268012d899
SHA1 4c2996e250e9c816a7f2f8505b52b8c7cff61a88
SHA512 d67002be4760afe99e94930444b3865622a2993dcd494d9d9f97809c2b201cf9003e80fcfd561ac8d1c6d2b1fe7adadda000702956c12556d91117f58212d99d
TLSH
T176B0126F25C1A40F020106C69E2D60983101DB8385640A0479128AE774C0C74C19CCC4
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	MSAGENT.EXE
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	tv_enua.exe

Executes dropped EXE 5 IoCs

pid	Process
5500	MSAGENT.EXE
3480	tv_enua.exe
3324	AgentSvr.exe
1420	BonziBDY_4.EXE
5316	AgentSvr.exe

Loads dropped DLL 32 IoCs

pid	Process
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
440	BonziBuddy432.exe
5500	MSAGENT.EXE
3140	regsvr32.exe
6092	regsvr32.exe
2044	regsvr32.exe
5440	regsvr32.exe
5200	regsvr32.exe
3732	regsvr32.exe
3056	regsvr32.exe
3480	tv_enua.exe
976	regsvr32.exe
976	regsvr32.exe
2872	regsvr32.exe
1420	BonziBDY_4.EXE
1420	BonziBDY_4.EXE
1420	BonziBDY_4.EXE
1420	BonziBDY_4.EXE
1420	BonziBDY_4.EXE
1420	BonziBDY_4.EXE
5316	AgentSvr.exe
5316	AgentSvr.exe
5316	AgentSvr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	tv_enua.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	cmd.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
106	whatismyipaddress.com
87	whatismyipaddress.com
104	whatismyipaddress.com
105	whatismyipaddress.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SETAB5.tmp	tv_enua.exe
File created	C:\Windows\SysWOW64\SETAB5.tmp	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\msvcp50.dll	tv_enua.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\BonziBuddy432\emsmtp.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page13.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page14.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page16.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page12.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page2.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page12.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Apps.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\ODKOB32.DLL	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\menu.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\Thumbs.db	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\Thumbs.db	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp001.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\P001.nbd-SR	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BG\Bg1.bmp	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\AutoDirPatcher.vbs	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page16.jpg	BonziBuddy432.exe
File created	C:\Program Files (x86)\BonziBuddy432\Uninstall.ini	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\CHORD.WAV	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\J001.nbd-SR	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\msvbvm60.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page4.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY.vbw	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page10.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page5.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page2.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page4.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page1.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page10.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\ManualDirPatcher.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\book	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb001.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\favicon.ico	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\ManualShortcutsMaker.vbs	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\MSAGENTS\Peedy.acs	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb013.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb016.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page7.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp003.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb015.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page3.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp007.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page13.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page7.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb004.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCX	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\book	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page9.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\sp006.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\BonziBuddy.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\CheckRuntimes.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\uninstall.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page16.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page3.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page5.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb012.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page12.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb007.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb008.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb010.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCX	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Regicon.ocx	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\sites.nbd	BonziBuddy432.exe

Drops file in Windows directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msagent\AgentPsh.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET647.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET61C.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET62C.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentDPv.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentDp2.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentMPx.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET642.tmp	MSAGENT.EXE
File created	C:\Windows\INF\SET643.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgtCtl15.tlb	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET62D.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET62D.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET62E.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET62F.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET631.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\agtinst.inf	MSAGENT.EXE
File opened for modification	C:\Windows\help\SET645.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\intl\SET646.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET62C.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET62F.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET647.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\SETAA0.tmp	tv_enua.exe
File created	C:\Windows\lhsp\tv\SETAA0.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\tv\SETAA1.tmp	tv_enua.exe
File created	C:\Windows\lhsp\help\SETAB2.tmp	tv_enua.exe
File opened for modification	C:\Windows\fonts\SETAB3.tmp	tv_enua.exe
File created	C:\Windows\msagent\SET630.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\tv_enua.dll	tv_enua.exe
File opened for modification	C:\Windows\lhsp\tv\tvenuax.dll	tv_enua.exe
File opened for modification	C:\Windows\fonts\andmoipa.ttf	tv_enua.exe
File opened for modification	C:\Windows\INF\SETAB4.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentCtl.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET62E.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentSR.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET644.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\intl\Agt0409.dll	MSAGENT.EXE
File created	C:\Windows\fonts\SETAB3.tmp	tv_enua.exe
File created	C:\Windows\INF\SETAB4.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\chars\Peedy.acs	BonziBuddy432.exe
File opened for modification	C:\Windows\msagent\SET644.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\intl\SET646.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\tv\SETAA1.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\help\SETAB2.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentSvr.exe	MSAGENT.EXE
File opened for modification	C:\Windows\INF\SET643.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\mslwvtts.dll	MSAGENT.EXE
File created	C:\Windows\help\SET645.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\help\Agt0409.hlp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\help\tv_enua.hlp	tv_enua.exe
File opened for modification	C:\Windows\INF\tv_enua.inf	tv_enua.exe
File opened for modification	C:\Windows\msagent\chars\Bonzi.acs	BonziBuddy432.exe
File opened for modification	C:\Windows\msagent\SET61C.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET630.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentAnm.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET631.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET642.tmp	MSAGENT.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBDY_4.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_enua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBuddy432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAGENT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B976287-3692-11D0-9B8A-0000C0F04C96}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8671A8B-E5DD-11CD-836C-0000C0C14E92}\1.0\0\win32	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDA1CA02-8B5D-11D0-9BC0-0000C0F04C96}\ProxyStubClsid32	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE8EF600-2F82-11D1-ACAC-00C04FD97575}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D4D-2CDD-11D3-9DD0-D3CD4078982A}\Control	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55DD814E-A1B7-4808-9625-4F75A3FAD8A7}\ProxyStubClsid32	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSRibbon.3	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FE2-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\Version = "3.0"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FE5-1BF9-11D2-BAE8-00104B9E0792}\TypeLib	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB52CF7B-3917-11CE-80FB-0000C0C14E92}\InprocServer32\ = "C:\\PROGRA~2\\BONZIB~1\\SSCALA32.OCX"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A45DB4E-BD0D-11D2-8D14-00104B9E072A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD301-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinEvent	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53FA8D46-2CDD-11D3-9DD0-D3CD4078982A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RegistryControl.RegiCon\Clsid	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62FCAC31-2581-11D2-BAF1-00104B9E0792}\ = "DSSOption"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3CD19360-7454-11CE-9430-0000C0C14E92}\ = "SSDateCombo Property Page"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE8-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B8F2846E-CE36-11D0-AC83-00C04FD97575}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinEvent.1\ = "SkinEvent Class"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{322982E0-0855-11D3-9DCF-DDFB3AB09E18}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BD33B25E-E99D-40C3-B5C5-7F5C3F130777}\TypeLib\ = "{29D9184E-BF09-4F13-B356-22841635C733}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDA1CA00-8B5D-11D0-9BC0-0000C0F04C96}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider\CurVer	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24830770-5D94-11CE-9412-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{643F1353-1D07-11CE-9E52-0000C0554C0A}\1.0\0\win32\ = "C:\\Program Files (x86)\\BonziBuddy432\\SSCALB32.OCX"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "2.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FDF-1BF9-11D2-BAE8-00104B9E0792}\InprocServer32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A45DB4B-BD0D-11D2-8D14-00104B9E072A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BD9-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C89-7B81-11D0-AC5F-00C04FD97575}\ = "IAgentAudioOutputProperties"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4E0988E-24BE-4570-B4D8-982F1386E0C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BonziBDY_4.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8671A88-E5DD-11CD-836C-0000C0C14E92}\InprocServer32\ = "C:\\PROGRA~2\\BONZIB~1\\SSCALA32.OCX"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{643F1351-1D07-11CE-9E52-0000C0554C0A}\TypeLib\Version = "1.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F55ED2E0-6E13-11CE-918C-0000C0554C0A}\ = "IX"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A45DB49-BD0D-11D2-8D14-00104B9E072A}	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B1BE804-567F-11D1-B652-0060976C699F}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FD2-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A45DB4F-BD0D-11D2-8D14-00104B9E072A}\Implemented Categories	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62FCAC31-2581-11D2-BAF1-00104B9E0792}\TypeLib	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E20FD10-1BEB-11CE-80FB-0000C0C14E92}\ = "ISSSelectedDays"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C85-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4043742-AC8D-4F86-88E9-F3FD3369DD8C}	BonziBDY_4.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F581B2D6-E4C3-40BF-8A1E-F68CDFD8FEEC}\ = "_clsRegistration"	BonziBDY_4.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D44-2CDD-11D3-9DD0-D3CD4078982A}\ = "SkinSource Class"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE11629C-36DF-11D3-9DD0-89D6DBBBA800}\Insertable	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1533A365-F76F-4518-8A56-4CD34547F8AB}\TypeLib	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628}\ = "IListSubItem"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4043742-AC8D-4F86-88E9-F3FD3369DD8C}\ProxyStubClsid32	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DB2224E-D2FA-4B2E-8402-085EA7CC826B}	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\TypeLib	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\ = "ISlider"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B1BE807-567F-11D1-B652-0060976C699F}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28E4193C-F276-4568-BCDC-DD15D88FADCC}\TypeLib\ = "{F4900F5D-055F-11D4-8F9B-00104BA312D6}"	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D47-2CDD-11D3-9DD0-D3CD4078982A}\Version	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Program Files (x86)\\BonziBuddy432\\MSCOMCTL.OCX"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl.2\CLSID	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Program Files (x86)\\BonziBuddy432\\MSCOMCTL.OCX"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368C5B10-6A0F-11CE-9425-0000C0C14E92}\MiscStatus\1	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4ABF875-8100-11D0-AC63-00C04FD97575}\TypeLib	regsvr32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Bonzi.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	firefox.exe
Token: SeDebugPrivilege	2380	firefox.exe
Token: SeDebugPrivilege	2416	firefox.exe
Token: SeDebugPrivilege	2416	firefox.exe
Token: SeDebugPrivilege	5620	firefox.exe
Token: SeDebugPrivilege	5620	firefox.exe
Token: SeDebugPrivilege	5620	firefox.exe
Token: 33	5316	AgentSvr.exe
Token: SeIncBasePriorityPrivilege	5316	AgentSvr.exe
Token: 33	4832	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4832	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2380	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
5620	firefox.exe
5620	firefox.exe
5620	firefox.exe
5620	firefox.exe
5620	firefox.exe
5620	firefox.exe
5620	firefox.exe
5620	firefox.exe
5316	AgentSvr.exe
5316	AgentSvr.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5316	AgentSvr.exe
5316	AgentSvr.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2380	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
2416	firefox.exe
5620	firefox.exe
5620	firefox.exe
5620	firefox.exe
5620	firefox.exe
1420	BonziBDY_4.EXE
1420	BonziBDY_4.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2380	1512	firefox.exe	83
PID 1512 wrote to memory of 2380	1512	firefox.exe	83
PID 2380 wrote to memory of 744	2380	firefox.exe	84
PID 2380 wrote to memory of 744	2380	firefox.exe	84
PID 2380 wrote to memory of 744	2380	firefox.exe	84
PID 2380 wrote to memory of 3928	2380	firefox.exe	85
PID 2380 wrote to memory of 3928	2380	firefox.exe	85
PID 2380 wrote to memory of 3928	2380	firefox.exe	85
PID 2380 wrote to memory of 3928	2380	firefox.exe	85
PID 2380 wrote to memory of 3464	2380	firefox.exe	86
PID 2380 wrote to memory of 3464	2380	firefox.exe	86
PID 2380 wrote to memory of 3464	2380	firefox.exe	86
PID 2380 wrote to memory of 3464	2380	firefox.exe	86
PID 2380 wrote to memory of 4480	2380	firefox.exe	87
PID 2380 wrote to memory of 4480	2380	firefox.exe	87
PID 2380 wrote to memory of 4480	2380	firefox.exe	87
PID 2380 wrote to memory of 1204	2380	firefox.exe	88
PID 2380 wrote to memory of 1204	2380	firefox.exe	88
PID 2380 wrote to memory of 1204	2380	firefox.exe	88
PID 2380 wrote to memory of 1204	2380	firefox.exe	88
PID 2380 wrote to memory of 4556	2380	firefox.exe	89
PID 2380 wrote to memory of 4556	2380	firefox.exe	89
PID 2380 wrote to memory of 4556	2380	firefox.exe	89
PID 2380 wrote to memory of 4556	2380	firefox.exe	89
PID 2380 wrote to memory of 4172	2380	firefox.exe	90
PID 2380 wrote to memory of 4172	2380	firefox.exe	90
PID 2380 wrote to memory of 4172	2380	firefox.exe	90
PID 2380 wrote to memory of 4172	2380	firefox.exe	90
PID 2380 wrote to memory of 1764	2380	firefox.exe	91
PID 2380 wrote to memory of 1764	2380	firefox.exe	91
PID 2380 wrote to memory of 1764	2380	firefox.exe	91
PID 2380 wrote to memory of 1764	2380	firefox.exe	91
PID 2380 wrote to memory of 2952	2380	firefox.exe	92
PID 2380 wrote to memory of 2952	2380	firefox.exe	92
PID 2380 wrote to memory of 2952	2380	firefox.exe	92
PID 2380 wrote to memory of 2952	2380	firefox.exe	92
PID 3772 wrote to memory of 2416	3772	firefox.exe	94
PID 3772 wrote to memory of 2416	3772	firefox.exe	94
PID 2416 wrote to memory of 1500	2416	firefox.exe	95
PID 2416 wrote to memory of 1500	2416	firefox.exe	95
PID 2416 wrote to memory of 1500	2416	firefox.exe	95
PID 2416 wrote to memory of 2712	2416	firefox.exe	96
PID 2416 wrote to memory of 2712	2416	firefox.exe	96
PID 2416 wrote to memory of 2712	2416	firefox.exe	96
PID 2416 wrote to memory of 2712	2416	firefox.exe	96
PID 2416 wrote to memory of 4632	2416	firefox.exe	97
PID 2416 wrote to memory of 4632	2416	firefox.exe	97
PID 2416 wrote to memory of 4632	2416	firefox.exe	97
PID 2416 wrote to memory of 4632	2416	firefox.exe	97
PID 2416 wrote to memory of 1564	2416	firefox.exe	98
PID 2416 wrote to memory of 1564	2416	firefox.exe	98
PID 2416 wrote to memory of 1564	2416	firefox.exe	98
PID 2416 wrote to memory of 3648	2416	firefox.exe	99
PID 2416 wrote to memory of 3648	2416	firefox.exe	99
PID 2416 wrote to memory of 3648	2416	firefox.exe	99
PID 2416 wrote to memory of 3648	2416	firefox.exe	99
PID 2416 wrote to memory of 4376	2416	firefox.exe	100
PID 2416 wrote to memory of 4376	2416	firefox.exe	100
PID 2416 wrote to memory of 4376	2416	firefox.exe	100
PID 2416 wrote to memory of 4376	2416	firefox.exe	100
PID 2416 wrote to memory of 3604	2416	firefox.exe	101
PID 2416 wrote to memory of 3604	2416	firefox.exe	101
PID 2416 wrote to memory of 3604	2416	firefox.exe	101
PID 2416 wrote to memory of 3604	2416	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\game.bat"
1⤵
- Enumerates connected drives
PID:2352

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {d06a9f24-6f11-4518-9f1f-21c737ebf99c} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {8f51a75c-03c0-453f-add8-e2f180059b34} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 27274 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {f5b7d597-47b2-4887-8e26-4da2c6b6f79e} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3904 -prefsLen 27274 -prefMapHandle 3908 -prefMapSize 270279 -ipcHandle 3924 -initialChannelId {e7d75634-c5d4-48c2-a68c-df265e2ed25d} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3068 -prefsLen 34773 -prefMapHandle 2688 -prefMapSize 270279 -jsInitHandle 2864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4496 -initialChannelId {b62be576-9426-44c7-8103-d6e857a70968} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4816 -prefsLen 34876 -prefMapHandle 4824 -prefMapSize 270279 -ipcHandle 4832 -initialChannelId {460494a6-5245-4905-a46a-096f6002cefc} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4476 -prefsLen 32952 -prefMapHandle 4480 -prefMapSize 270279 -jsInitHandle 4484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5376 -initialChannelId {503b5a9a-8016-4748-b128-b47f6d244d31} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32952 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {c3f00ba9-846f-4504-ac11-e8be5b923fc4} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {b060c1b8-271c-43a6-a9e0-2c60de4a6006} -parentPid 2380 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2380" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27057 -prefMapHandle 1964 -prefMapSize 270326 -ipcHandle 2076 -initialChannelId {bc15d773-77f3-4df8-9d6b-1ad5db1ebb28} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27093 -prefMapHandle 2492 -prefMapSize 270326 -ipcHandle 2500 -initialChannelId {01de9dc9-05a6-4d4f-a59c-1adc87b03877} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704 -prefsLen 27234 -prefMapHandle 3708 -prefMapSize 270326 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3720 -initialChannelId {a5ab59bf-b5b3-467a-858b-0e880f7fec18} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3872 -prefsLen 27234 -prefMapHandle 3876 -prefMapSize 270326 -ipcHandle 3964 -initialChannelId {fa457ef0-74e9-4597-9f44-4fb2dd9c25b8} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4572 -prefsLen 34844 -prefMapHandle 4576 -prefMapSize 270326 -jsInitHandle 4580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4588 -initialChannelId {ebc6d51c-b0f1-4dd2-a9bc-36353a85ba27} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3140 -prefsLen 34893 -prefMapHandle 3008 -prefMapSize 270326 -ipcHandle 3224 -initialChannelId {551a7277-bd60-49ce-83df-b9445e62e664} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2928 -prefsLen 32818 -prefMapHandle 5640 -prefMapSize 270326 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {0ed4b0a2-b77e-476c-8f71-578f94fb096b} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32818 -prefMapHandle 5852 -prefMapSize 270326 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {b00201de-df17-44aa-bfcb-d3d8d9fd3237} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6056 -prefsLen 32818 -prefMapHandle 6060 -prefMapSize 270326 -jsInitHandle 6064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6072 -initialChannelId {a0f6a717-fda0-4363-87e7-41a517fc0997} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4516 -prefsLen 32858 -prefMapHandle 4520 -prefMapSize 270326 -jsInitHandle 4384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4376 -initialChannelId {75e9a4cb-65f9-4da8-9629-259d82667591} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6664 -prefsLen 34319 -prefMapHandle 6668 -prefMapSize 270326 -jsInitHandle 6672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6680 -initialChannelId {74033fa2-25f4-403c-94f5-4a311e490332} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5992 -prefsLen 36595 -prefMapHandle 5996 -prefMapSize 270326 -jsInitHandle 5896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {333bad65-daa7-43c7-b8dc-02cf4027404a} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 36595 -prefMapHandle 5692 -prefMapSize 270326 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5684 -initialChannelId {9e0feb65-a360-4ec9-8ee0-3bf323e5da0e} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7052 -prefsLen 36595 -prefMapHandle 3252 -prefMapSize 270326 -jsInitHandle 7076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7064 -initialChannelId {e3ab5acb-61d6-409d-baa2-e62289dc8bd6} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:2724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7180 -prefsLen 36595 -prefMapHandle 7184 -prefMapSize 270326 -jsInitHandle 7080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1536 -initialChannelId {976d235f-5c19-4211-a4f7-a9a343eddb1e} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:1044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8008 -prefsLen 36595 -prefMapHandle 8012 -prefMapSize 270326 -jsInitHandle 8016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8024 -initialChannelId {f4417d4d-28aa-4e11-a3c2-40b1d54a2cd8} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:2732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8024 -prefsLen 36595 -prefMapHandle 8016 -prefMapSize 270326 -jsInitHandle 8260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8012 -initialChannelId {414c8b86-43cf-447c-aa6b-cdb82cddf603} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7364 -prefsLen 36595 -prefMapHandle 7360 -prefMapSize 270326 -jsInitHandle 2900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8296 -initialChannelId {509da195-53d1-4152-aa35-77d3557ed953} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6636 -prefsLen 36595 -prefMapHandle 8248 -prefMapSize 270326 -jsInitHandle 6940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8328 -initialChannelId {0d26d92c-cfdf-4e73-9339-28e64d12af0e} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8340 -prefsLen 36595 -prefMapHandle 8344 -prefMapSize 270326 -jsInitHandle 8348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8356 -initialChannelId {d1a7d7dc-af67-46df-893e-1875707b8548} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8376 -prefsLen 36595 -prefMapHandle 8380 -prefMapSize 270326 -jsInitHandle 8384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8392 -initialChannelId {282d4632-3cc2-48ec-a4d5-a69e029c91ba} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:1604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9108 -prefsLen 36595 -prefMapHandle 9104 -prefMapSize 270326 -jsInitHandle 9100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8312 -initialChannelId {6cee10d3-b96c-4db7-ad52-66ebb703f742} -parentPid 2416 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2416" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5600
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 31069 -prefMapHandle 1952 -prefMapSize 270978 -ipcHandle 2036 -initialChannelId {2902b8e3-dbf7-4881-b7dd-284a829378c6} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2280 -prefsLen 31069 -prefMapHandle 2284 -prefMapSize 270978 -ipcHandle 2288 -initialChannelId {abe8a13b-bb23-4271-a025-30fe09114f88} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3648 -prefsLen 31677 -prefMapHandle 3652 -prefMapSize 270978 -jsInitHandle 3656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3664 -initialChannelId {441f72bc-2ff7-4a46-b52e-6c92a8860e70} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3844 -prefsLen 31677 -prefMapHandle 3848 -prefMapSize 270978 -ipcHandle 3856 -initialChannelId {67e37963-e381-4db5-a1e1-51508415002e} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4356 -prefsLen 39233 -prefMapHandle 4360 -prefMapSize 270978 -jsInitHandle 4364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4372 -initialChannelId {260d5349-4e01-4d5c-8011-2b284c503638} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5168 -prefsLen 39287 -prefMapHandle 5172 -prefMapSize 270978 -ipcHandle 5180 -initialChannelId {20feb620-a568-4f73-b26d-bcd1aba77d88} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5316 -prefsLen 36222 -prefMapHandle 2924 -prefMapSize 270978 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2836 -initialChannelId {010345c5-26a7-4bd5-b40b-3d585695d80d} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5772 -prefsLen 36222 -prefMapHandle 5776 -prefMapSize 270978 -jsInitHandle 5780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {f6339e7b-5e01-4c80-99b3-ee9a1ba5e44e} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5980 -prefsLen 36222 -prefMapHandle 5984 -prefMapSize 270978 -jsInitHandle 5988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5996 -initialChannelId {33d540b7-fd98-4dbe-8a97-bc05aee48c15} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2836 -prefsLen 36262 -prefMapHandle 2748 -prefMapSize 270978 -jsInitHandle 5312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {7803087b-2d30-4b32-8ca5-c030378bc4bc} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6476 -prefsLen 39379 -prefMapHandle 6480 -prefMapSize 270978 -ipcHandle 6432 -initialChannelId {c4c9f52f-4f0a-498f-8887-dfd32732ce2e} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6668 -prefsLen 36262 -prefMapHandle 6672 -prefMapSize 270978 -jsInitHandle 6676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6680 -initialChannelId {63a405b9-3d9a-4282-8f65-0e6b1d29e4c2} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5452 -prefsLen 36262 -prefMapHandle 6580 -prefMapSize 270978 -jsInitHandle 2844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2476 -initialChannelId {fb73f6d3-ef8c-4925-a208-2e504ca89ea1} -parentPid 5620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2216

C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5220
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE
    MSAGENT.EXE
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5500
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3140
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:6092
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2044
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5440
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5200
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3732
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3056
  - - C:\Windows\msagent\AgentSvr.exe
      "C:\Windows\msagent\AgentSvr.exe" /regserver
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3324
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:2456
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe
    tv_enua.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3480
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:976
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2872
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:2524

C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Windows\msagent\AgentSvr.exe
C:\Windows\msagent\AgentSvr.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ActiveSkin.ocx

Path C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx
Size 336KB
SHA256 2c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
MD5 3d225d8435666c14addf17c14806c355
SHA1 262a951a98dd9429558ed35f423babe1a6cce094
SHA512 391df24c6427b4011e7d61b644953810e392525743914413c2e8cf5fce4a593a831cfab489fbb9517b6c0e7ef0483efb8aeaad0a18543f0da49fa3125ec971e1
SSDEEP 3072:TVKIgW9TkeIu2Yewxx3aGwz3OzT6pe3EhV665fi5sMfkjjyO0DtQo1fPqdXqvbFv:pKIkYPOpeUhV/oCMmjYtRne2LQ
TLSH
T1B1748E12F7C3C47AC15716314817BB7EA7B9E6028925928B236C3E4E2F72BC0695935F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BonziBDY_2.EXE

Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE
Size 796KB
SHA256 1e2994763a7674a0f1ec117dae562b05b614937ff61c83b316b135afab02d45a
MD5 8a30bd00d45a659e6e393915e5aef701
SHA1 b00c31de44328dd71a70f0c8e123b56934edc755
SHA512 daf92e61e75382e1da0e2aba9466a9e4d9703a129a147f0b3c71755f491c68f89ad67cfb4dd013580063d664b69c8673fb52c02d34b86d947e9f16072b7090fb
SSDEEP 24576:u1bv4xVGCPscduI4G7wO7GAlKawj90/J0H90fNYJmbZOrzw9HSiXVhgJO6akuqTH:uvakuugaEN
TLSH
T11E05D613F3A9E00DE47396B16A74926E59267C3645F8D91FB2801F193071AD3A8F1F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BonziBDY_35.EXE

Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE
Size 2.5MB
SHA256 88c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
MD5 73feeab1c303db39cbe35672ae049911
SHA1 c14ce70e1b3530811a8c363d246eb43fc77b656c
SHA512 73f37dee83664ce31522f732bf819ed157865a2a551a656a7a65d487c359a16c82bd74acff2b7a728bb5f52d53f4cfbea5bef36118128b0d416fa835053f7153
SSDEEP 24576:KAS+cA9B93P0k/ubqLss6/BAgGz+nDbZ65EeLpCeet7hNSw/yinPo1rCmUGCx9xH:pSQclDbZ65zpCeet7hNSw/yinPo1tm
TLSH
T10EC53B13FE44E00EE57285F07874926B5A28BD3524B4DA0B73907E59A1F27E3EDA071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BonziBDY_4.EXE

Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
Size 3.2MB
SHA256 5678fd744faddb30a87568ae309066ef88102a274fff62f10e4963350da373bc
MD5 93f3ed21ad49fd54f249d0d536981a88
SHA1 ffca7f3846e538be9c6da1e871724dd935755542
SHA512 7923556c6d6feb4ff4253e853bae3675184eab9b8ce4d4e07f356c8624317801ee807ad5340690196a975824ea3ed500ce6a80c7670f19785139be594fa5e70f
SSDEEP 98304:F5xCKlYAaIn76cR9kyb6aHZ1m8nA2L7K9O:FbCKlYAaIn76cR9kyb6aHZ1m8nA2L7K0
TLSH
T1C7F51903B610A40DE1F285F27CA4D1EEB5193D7419B8A60772917F1BA1B97E3ACA431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BonziCheckers.ocx

Path C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocx
Size 152KB
SHA256 9028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
MD5 66551c972574f86087032467aa6febb4
SHA1 5ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9
SHA512 35c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089
SSDEEP 1536:HtfBDnpy/MOuoHvCXDYd05gNsHzmDwUhUjm66UGi+axKQMArl4qwt4h0wcRv:dBLp4UoPC/zIwFsSp4pt4h0wov
TLSH
T143E30913B3A1820EC4955E74264BA3F8502D3E330660916F9797FA6C1EB5ED39E3472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

page17.jpg

Path C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg
Size 50KB
SHA256 473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82
MD5 e8f52918072e96bb5f4c573dbb76d74f
SHA1 ba0a89ed469de5e36bd4576591ee94db2c7f8909
SHA512 d57dd0a9686696487d268ef2be2ec2d3b97baedf797a63676da5a8a4165cda89540ec2d3b9e595397cbf53e69dcce76f7249f5eeff041947146ca7bf4099819f
SSDEEP 768:jvSrbEi7f+t2R5Q9mEvXtdTsnHNGlTMmUWmuuh91+CGCso/gnLNeW3iRBrwyW3J9:jcctGaXvPlAmU9uuh+CsM8iR5w7Z9
TLSH
T1C133F1965D094F816DE107CAD0FF1E11F7201EF7E7F96268117A14488A3F5B848EAAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

page18.jpg

Path C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpg
Size 45KB
SHA256 03f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b
MD5 108fd5475c19f16c28068f67fc80f305
SHA1 4e1980ba338133a6fadd5fda4ffe6d4e8a039033
SHA512 98c8743b5af89ec0072b70de8a0babfb5aff19bafa780d6ce99c83721b65a80ec310a4fe9db29a4bb50c2454c34de62c029a83b70d0a9df9b180159ea6cad83a
SSDEEP 768:3XqTLeimOlN/0wKIvbSN/TtQ0EmMhifv/n73LHZC9tuVLc17s/SruIftS6fEydPQ:+eimOcwT2hLMhifvHZDg7CIVS3Gex
TLSH
T13023F163B7709727A1BE9917E0E3A25EE5F67EFB64037B29B3B97D18075000150E098D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSCOMCTL.OCX

Path C:\Program Files (x86)\BonziBuddy432\MSCOMCTL.OCX
Size 1.0MB
SHA256 3b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
MD5 12c2755d14b2e51a4bb5cbdfc22ecb11
SHA1 33f0f5962dbe0e518fe101fa985158d760f01df1
SHA512 4c9b16fb4d787145f6d65a34e1c4d5c6eb07bff4c313a35f5efa9dce5a840c1da77338c92346b1ad68eeb59ef37ef18a9d6078673c3543656961e656466699cf
SSDEEP 24576:2EIDiOd04txdEa1C42Xp1C33wQjrDRjE4FSpUBqutFPJq6:2vtxdEas42ijRprBzR7
TLSH
T1B9352A1277E58022D0FB2670197B27B59BB67EA16C39E54F1B50360E2D32E82DE35327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSINET.OCX

Path C:\Program Files (x86)\BonziBuddy432\MSINET.OCX
Size 112KB
SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
MD5 7bec181a21753498b6bd001c42a42722
SHA1 3249f233657dc66632c0539c47895bfcee5770cc
SHA512 d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
SSDEEP 3072:i4QYXpLZaH+kCp1RCaSCF/6UMiySQYPfrj:i4rBfL1RCaSC0ej
TLSH
T1E3B33802B7E2417FF7A627346AF65BA95EF77D153C26984F9300328D5A32B40DA24327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWINSCK.OCX

Path C:\Program Files (x86)\BonziBuddy432\MSWINSCK.OCX
Size 105KB
SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
MD5 9484c04258830aa3c2f2a70eb041414c
SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
TLSH
T1A8B35C02B3E58171E5F22B300A361B61AFBEBD25AD31864BC354765D1E31B95EE3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Regicon.ocx

Path C:\Program Files (x86)\BonziBuddy432\Regicon.ocx
Size 76KB
SHA256 07e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
MD5 32ff40a65ab92beb59102b5eaa083907
SHA1 af2824feb55fb10ec14ebd604809a0d424d49442
SHA512 2cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43
SSDEEP 1536:5rPNWKPzHUIZurPA28AxaVgEbk2NRi6cVbAYAS9jbbx2+cW8vYvYBgbN:5LNWKPzUI8B+Iz758vCgYN
TLSH
T17973C602B3D7812FE69D0BB8097796AD08647D921FB0D1AF2791FA8C1A36D859D3071F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckRuntimes.bat

Path C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat
Size 279B
SHA256 8ae1ed38bc650db8b14291e1b7298ee7580b31e15f8a6a84f78f048a542742ff
MD5 4877f2ce2833f1356ae3b534fce1b5e3
SHA1 7365c9ef5997324b73b1ff0ea67375a328a9646a
SHA512 dd43ede5c3f95543bcc8086ec8209a27aadf1b61543c8ee1bb3eab9bc35b92c464e4132b228b12b244fb9625a45f5d4689a45761c4c5263aa919564664860c5e
TLSH
T108D0C26BB7A0050E8A852EA54C802743503230098E1EBB821C7251A5D12340BF334F7B
MD5 SHA1 SHA512 TLSH

Submit Download

SSCALA32.OCX

Path C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCX
Size 472KB
SHA256 8e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
MD5 ce9216b52ded7e6fc63a50584b55a9b3
SHA1 27bb8882b228725e2a3793b4b4da3e154d6bb2ea
SHA512 444946e5fc3ea33dd4a09b4cbf2d41f52d584eb5b620f5e144de9a79186e2c9d322d6076ed28b6f0f6d0df9ef4f7303e3901ff552ed086b70b6815abdfc23af7
SSDEEP 6144:H1v56AP7u/5b6HMpJVAtdP3IfZETrOn4jgO7jUvyDl2rwV2iM6QVS4AmuRkXc7k3:VvZ8YGZEeKUYlm827aREc7k3
TLSH
T1AEA47D13B8C0C56BCDB60630CE4F67B5F6FA96204E321E436354C7BC6B72F62961562A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSCALB32.OCX

Path C:\Program Files (x86)\BonziBuddy432\SSCALB32.OCX
Size 320KB
SHA256 5db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
MD5 97ffaf46f04982c4bdb8464397ba2a23
SHA1 f32e89d9651fd6e3af4844fd7616a7f263dc5510
SHA512 8c43872396f5dceb4ba153622665e21a9b52a087987eab523b1041031e294687012d7bf88a3da7998172010eae5f4cc577099980ecd6b75751e35cfc549de002
SSDEEP 6144:ZD3OD+b26Wcix8swZOsfi8h72gYYXWQ+8MIdQpE:ZDeqb2Px8swss68h72gFWyum
TLSH
T1EF643A01F1415D27EDA70BB1486EE799B6683E211F2064D7A3C8ED7C1FB25F2AA1170B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\BonziBuddy432\Uninstall.exe
Size 65KB
SHA256 2288f4f42373affffbaa63ce2fda9bb071fd7f14dbcd04f52d3af3a219b03485
MD5 068ace391e3c5399b26cb9edfa9af12f
SHA1 568482d214acf16e2f5522662b7b813679dcd4c7
SHA512 0ba89fcdbb418ea6742eeb698f655206ed3b84c41ca53d49c06d30baed13ac4dfdb4662b53c05a28db0a2335aa4bc588635b3b205cfc36d8a55edfc720ac4b03
SSDEEP 1536:y7YLOVDssf9ZMeQotjKgUT2UdpQyz27vWwp/cZg:l6Vv9ZMe4TbQTP/qg
TLSH
T195638E01F581D432D1251AFD6C2EF319DE3935112D3A20D3BFAE2A4EDFA9287191C1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssa3d30.ocx

Path C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx
Size 320KB
SHA256 7a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
MD5 48c35ed0a09855b29d43f11485f8423b
SHA1 46716282cc5e0f66cb96057e165fa4d8d60fbae2
SHA512 779938ec9b0f33f4cbd5f1617bea7925c1b6d794e311737605e12cd7efa5a14bbc48bee85208651cf442b84133be26c4cc8a425d0a3b5b6ad2dc27227f524a99
SSDEEP 6144:OEIHG7QYXSCz6QEPbLhB8Fp5qycE5lVdBqxuu3:9Im77XSTPbLhWp5vUf
TLSH
T101646C03B3C289B3C8970E31491B3FB9AB799D006D36A25B67657B0D2D72791DE0532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sstabs2.ocx

Path C:\Program Files (x86)\BonziBuddy432\sstabs2.ocx
Size 288KB
SHA256 596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
MD5 7303efb737685169328287a7e9449ab7
SHA1 47bfe724a9f71d40b5e56811ec2c688c944f3ce7
SHA512 e0d9cb9833725e0cdc7720e9d00859d93fc51a26470f01a0c08c10fa940ed23df360e093861cf85055b8a588bb2cac872d1be69844a6c754ac8ed5bfaf63eb03
SSDEEP 6144:/sd14Jpad8qAuQGIBTOuCXMMpyU6XAcg0nTq:tS8qABGIBTJEMpIp
TLSH
T169549F43B3E1C4F3C2A31230592B57A99BB9B9106D34974BA390DF5C3D72647EA19327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\activity-stream.contile.json.tmp
Size 4KB
SHA256 81d599d480ce1a74f69db68d0d536df2c833037d8565b9cd413a14d975df54bc
MD5 3904555028e7e2d056a63da3b8972efe
SHA1 1ee0e3b46732080021552eddd9d08ab6d751cdd5
SHA512 4901bdbba7103d7e69f226fdbbce6063f5b600c58edffc151c7f43d365f1cd3e092ef35463128f8eadcdf04881646431ed249ece603df5d87e4dfdd2595bec0e
SSDEEP 48:YdpUM/95eDXm64L7QJzXVWvxdP985eDXkpSqhMwhj+OmQRpVKYr5eDXy6qhKchO/:KZ/ZtHQRVAxd8If6RHKY4csc/6DwGll
TLSH
T18DA1D8EBCD30D4871332ABE16C8F375CE247E196D9DB8D89B7D88C1996C924B11DDA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\activity-stream.discovery_stream.json.tmp
Size 74KB
SHA256 55bdf89c1580e5f0259d332491a98112a614f17abef61d7543638c5a7de16eb9
MD5 92ebded5cfec438bf038b4a9091420d4
SHA1 560ecfe04e387bbaaecc6292ac324844fdcf0447
SHA512 1bdb1221d35609c02eafb15cb98f5d73697192235cfa3c35f14ecdb5b0d9e1bfca5ec4dd43febb02f1345c308f593dcaaa6f688305235033d444589f1567403c
SSDEEP 768:dym8rLkoyccuCgLZJ2Cmhhx12hBEC3c8WAK2bXDj0TAIjDfVxREcqKmoW4YwXTaN:MDfZ403dK2DEdDfbRM4YwXT+d
TLSH
T1067308A3A2A8F2FB1B503BCB2C0B795B52EA0155E78405C9FCE9C91C81D9794523E5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

386D22EAB36C3C5C3713F931E60D7F8CA78D773F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\386D22EAB36C3C5C3713F931E60D7F8CA78D773F
Size 48KB
SHA256 9a36a916a2aca9ad30d3c9076e2b573ee006dda831cfc920c8a32695496b9a19
MD5 386e7f01fefe8c1215421e2b19904e83
SHA1 0b3c726dee8f307fb742db932472ba251c8ea42a
SHA512 fd7298ecebfebe4947c9ef62151c36287207834c640687f58f886e5cbe54d3bebe3723181ada0826b3d199302fcc98cba5d1bec465de029d9f56f35a13e8fdc0
SSDEEP 1536:VcI/iEEEtXdFJj+0GPwHbP+w5rjkJhw2NmSmY:VZ/2wLt+0GY72wx8hV
TLSH
T19C23023B5F24A7058822B7B03650FBC97D183B13CFED64BA83189B5A0D98BF5245B1D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4C9CCE09D4194BE1CA2D6F987A20AA41D0FFBBC3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\4C9CCE09D4194BE1CA2D6F987A20AA41D0FFBBC3
Size 97KB
SHA256 591901b81a5c31c2ba0f6fd59d93991354ab060d2f572607b2eeba769139e360
MD5 01b6f9cf770d526a2a3656de876ddafb
SHA1 a2f66ddb70780afe514d8f34ff1c1cd79bee0261
SHA512 07b4112d29b9b3683a1bb193caf40da601627bea138cddc11b63fc1752e60cf601db47624166c44b55da7f15c8efa4943bc312c47c4fd8a0b92db8b24d1de299
SSDEEP 1536:KVuvjYdrnBau4VsVYtHNi+dD/nb2rYVek4IoUe:KVurYBBVVQoRIoUe
TLSH
T193A34B675AD91A77079373C82C0F7C5B0FAB0583EFE8C6A5A5CDD90880D3CA8527E661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

665111AFA20CF496E037D65EF43F44AAAA3137A2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\665111AFA20CF496E037D65EF43F44AAAA3137A2
Size 9KB
SHA256 17a59603052f39bbdc616442b1c5994fbf625eaf852202af8d5d0af195479815
MD5 01cdbae980cf694ab08d5a0238c05f85
SHA1 3884fd4d5a4c546b841342ff8e4325c02d6ea44a
SHA512 a5e13d1143fe16ffb264bd9dc6cdf75981c4108d1aa6f90bd3106879f1277c8a0489a11c33d6a3f9bd88aebaba53fbba0312bdaf7fed8f0600594e207fad4fda
SSDEEP 192:V/y8ysK1cURPAewE+q8sPU9PsALkhbgHpPueig7AaX6b4qx1e0lpBNDIIjuqkkBs:Vya9E+AxAbJ2ePsac4j0lpDIIjux
TLSH
T195226EB85F0520794E92886A9D9FA3804D58B2139F81DBAC4D643904CCC66F8F7F55C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 13KB
SHA256 8334b4b3cc754ad62c2c86a8d2d31e756fd362490f06aa5c7f04942c98aa7ed3
MD5 201bf967b1d1310e39eb80508e43f436
SHA1 c65bb0d430247d00af4d31f2bac3ba7bd6e0b705
SHA512 a977af2fb6ea105b64686a79207ec00d15ab48b4ad383638525c44a4f3132c613989723ada8ae31583fb11d71538fdcb9a0afe9457baee1cfacb160bf94143d5
SSDEEP 192:poDtHQRadOyROnc/wwIfE+q8sPU9PsALkhbgHpPueig7AaX6b4qx1e0lpBNDIIbP:popBCcuE+AxAbJ2ePsac4j0lpDIIbww
TLSH
T16B528DF7CF30A09B072299F2AC9E77C98D09A1579ED6CADD5AC43C04C08979AE5F90C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8235B0B3F773D91E1B0EB40B4E440ADA1A5F497F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\8235B0B3F773D91E1B0EB40B4E440ADA1A5F497F
Size 1.1MB
SHA256 f41782d6264878679b8701bce89ec6a4bf7e0e8cfdf4d8a5c9f1be34be44dd47
MD5 79bd7b3790cb1d6d16edc478f63069fb
SHA1 159e39f1253080bd89c5ef2dc186ff50f15b996e
SHA512 0bdec984232401a9d515db98959da205959d3d5a0388e736260e6365b911c5820ef0028db92c4f14560f91c7416a65656e687208a466db2c71ee09b63d42ad2b
SSDEEP 24576:bqMtW6oMpLEKirAgK7lrwOhMqaFPHTa0pLG18Hq8Tu5IABHD7L/KYQ5S4emeBhfL:htW6oMpLEKirAR7lrwOhMqaFPHTa0pLg
TLSH
T12435D726EE425E53C82103B240FB53323B34D0856B96F32B2ECF7566BC5A7751D662AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

885BCF67404497769CCE858938629A2E889F5819

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\885BCF67404497769CCE858938629A2E889F5819
Size 6.8MB
SHA256 dd6e4885ba5ff30244341e29ed9cf616a354eed40aee0d54362972fb13479d21
MD5 5a52b64b7c3fa89de2b1eb6632dd1331
SHA1 80c7c4f2a12cf04542b2ed90de0e52c8abbdefec
SHA512 02de9f57a18ec80def34e9cb12b29c0c278a40999bbe8a5f40ef61a41f8aa2066a032ea8ea1b722659fce84ea3baeb1c5bbbb8901d376b7a16da0da3b48703aa
SSDEEP 49152:0VwMBKW5qjHNiEt18P1vPzsZj96/4b5qxvaFl2r5w0I7IPDkS+p7AatHtWxRPg+7:YtBKW5yBvhtr1LOZ
TLSH
T1D1660916EF525E23C43003B641FB63723B39D0856B97E32B2E8F7552BC6A3650DA526C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98FDC406B52DFF91AF48652B4ABB147FEB91B60D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\98FDC406B52DFF91AF48652B4ABB147FEB91B60D
Size 13KB
SHA256 ee4c1f2f20f034b949580ade206f8fe273506edc10e6a4d5e80e05e19a74edb7
MD5 ec618d24e55426dbebd57de5f0688f33
SHA1 ca3edc148955039503df5ef2aab051f9b772f01e
SHA512 114716394c542acf744556d0f90272dfe33d921d1629d1a076a0a3e86aa74b03943ebbad0bcc23c096b669eceb9b70b3b47c9c491918ffb3b5820fe0c0a783ee
SSDEEP 384:HSvhbciO024YcFuhw+5EL1pPsac4j0lpDII+E5FV1:yphZYcFuK+5EB9sac4ID8LS
TLSH
T1A6528E7EAF0138BE1A27D194DDA95618CE04D6BBEED2D06605443C05CA80779B8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BB95D0607349D05725D5FE01D4FB300E319072AD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\BB95D0607349D05725D5FE01D4FB300E319072AD
Size 9KB
SHA256 0cb40712afefa4052eeaf0c6d41d1a41bf0f7c1f0802e0760f8b94545d1700a9
MD5 75394b8dc8581eafc93ad0f50e906dd5
SHA1 98fe96293fefd39ca0465ad529c1474ed6294679
SHA512 5f6b9c9aaf05ce1d93aa66c6315c950d3de7c9d234274c4adb045cb80e358c5019e17821cc22de472edc019d233ea53081ccf49684bc049a3088f520385626a7
SSDEEP 192:euVoDZ4FbF9eYa9EWusY1/LQWEPfcPrJro15j75ywpskCskkcdP5kkcdPg:P6DZAR9eYa9EHDEclrIVy8efPEPg
TLSH
T140226CB59F00581E2EF2E1939DEC451A1C51E723DFC6E2EF1508210D96C4BA9F9F91C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CAF3CEFC478E9E75F2BEE9ECD1DC10FA6EAD399F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\CAF3CEFC478E9E75F2BEE9ECD1DC10FA6EAD399F
Size 64KB
SHA256 dea5930fc275cd8b65e1e6431af39adf4e5d433e62d27981624003916381a642
MD5 3ecaa2c3d73d93d41aa21c3bd30fd6b7
SHA1 3619a09e287810f994f0f810402797a76bbb0d95
SHA512 a1a90435e8d586ca92e53bed35a5a34f141a2e448ca9f6ed6b9446e3cc3dd9baaa3be682c52fc6e3d7e8a2ebce7064bb82c661e95949f4419e2aa39fd9579926
SSDEEP 1536:sIHQHlbl+6cPxnqyfXmSbmuPhnqyfXmSb5gZoy:sIwHlbgxDhPgZoy
TLSH
T1B4534CA9BA83B0B6C17271B9407F141DF6BF2C11D908594CE20582D46FB0A9951BFFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 ec4512033136722f3c2d4c10efe85d67d3be6371e84d108e8f61efe89260ed0e
MD5 ffbf8a8312b082d0a5d7cb9a6cc8efb9
SHA1 1aea13203c4ef189edc215a3da7ca00b56b5ae23
SHA512 73cbc9b6e967416180e65dae7c866551c6c14c400fd84af3820c0890adb484e1d6e381c7bed9689b31c3831b695f4ef9fe93837af669894e906bf2e02a38069c
SSDEEP 384:HbaFrLiO024YwFuhw+5EL1pPsac4j0lpDII+/4te:7aAZYwFuK+5EB9sac4ID8Lp
TLSH
T1F5528E7EAF0138BA1B67D1D4D8E95204CD08E6BBEEE2D16605143844C7847BCB8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 dd05a2acff0f6c245dbc2f4a17effbe1da665c251eeea395d6232d0d36ff5b2b
MD5 9724e452a01f150c2938d1ea1909db38
SHA1 f08334f165ce2e454d4a029c16ee9840e1d13715
SHA512 a65fd7d598779573a3103fbda2b953601c159b68a077ab1aff3cdd3d15122e73c81c845c83692815a88e993dda502929dd585adf9c77bb22d4ba2e2019accdca
SSDEEP 384:HbaFrLiO024YjFuhw+5EL1pPsac4j0lpDII+/4te:7aAZYjFuK+5EB9sac4ID8Lp
TLSH
T184528E7EAF0138BA1B6BD194D9E95214CD04E6BBEEE2D06605143844C7847BCB8F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 243KB
SHA256 43e3a2af44dd1b30e9be7caacc7df95f6611302674e560272e8c9cb7343dc4a3
MD5 e0d613a1a2217e3746712239a394ce4f
SHA1 a780455e1bebc7cc7a0ee50da6918f191bf12182
SHA512 5a8499384bbedfa9af1e0fffd317262f60b2edb24dda56f5575287e90293be1110593125281cd446e728bab2ed7ebe6853691e7e94c851dae44c405896e5542d
SSDEEP 1536:jbYCYPsTTeYESPrf/wvkcIM55wupDzjDgAnU1NxVzMquMFJ6rV81t0SkM1SCumR9:HTeYfcf55wupDzPgABqR1
TLSH
T1B334F6F3D6AC70FB171286DC6C1D72CF62AF4239DB5208DAFC688148D3C9A65107A799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0F48A0632B6C451791F4257697E861961F06A6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F
Size 181KB
SHA256 e4ae708f5521e6b67d8f73be5d2a3e62ca3c70193d6a81f6f5a65f71926c8de6
MD5 2ca4c75ecdcdfbe240241da10d88f00f
SHA1 cfc8f5a077ac83ad655ab17afbf2f1a649fd54e9
SHA512 f25ec80c3d4c2e24903e311534902cc8150920f73ba9929458d36060ec1f1e0dfa69e4c8190093a6f3f3863f3bc284a224d116d20e13e4123063a2966384d53c
SSDEEP 1536:ObYCYFscSPrfAjvkcIM55wupDzjDgAnU1NxVzMquMFJ6YV81t0SkM1SCumRYVVk1:Mcf55wupDzPgABnR1
TLSH
T10904F7BBD56C71FB075256EC2C1E7ACF526E83BACB5208DBF4548408928CB6110777EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DE5F6CB1BD71958EB146CDD974763A3115937269

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\DE5F6CB1BD71958EB146CDD974763A3115937269
Size 10KB
SHA256 85a69d75dd661706469f7e8550f8bc548f09cef76a4d0a3ee949c539e4db8b6c
MD5 aacc8cdb82103ea13b1e203223510bfc
SHA1 5c49f4d2fd8a355610db60c94009b0ef7cf509a6
SHA512 b467cd992ce0c9375ff47bd6e2e4474f44cd7b8a47baa0f1c74f7b9d69969387ea8444ddcb509c807babd36b905b721739ee46733c4bb2ff6ac5cf0d41d259d7
SSDEEP 192:3uY8zDZ4FbF9eYa9EWusY1/LQWEPfcPrJro15j75ywpskC22nhdykk92nhdykka:3uYMDZAR9eYa9EHDEclrIVy8e22nLa2T
TLSH
T18E226CB6AF10581D2EF1E2535DED46291CA0F723DDD2E1AF160C260996C4668F8FD6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E473D920361435DF4BBBF194E406FE372015579A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\E473D920361435DF4BBBF194E406FE372015579A
Size 9KB
SHA256 7e47d8e6eb472c2171268b076607bb21c1a3debe775144c08a7957db3c1ce389
MD5 3be536da8fb4a797fa8f081018fb767c
SHA1 acf1076de9978da22a799b744bf86f50b101c6b5
SHA512 1e34079b4e578aeb2b69efb016ca3cf5f07fbd4eadbf9feebc05c71a11da13872c27651567ba2debda023a6999fe142427fdaf3180474ad63cc1053a5ad55ca6
SSDEEP 192:ttwmDZ4FbF9eYa9EWusY1/LQWEPfcPrJro15j75ywpskCTwdssvXKkYdso:btDZAR9eYa9EHDEclrIVy8eTos+XUso
TLSH
T12E227D769F502C1D3EF2E1574DED46551D61EB13EED2E2EE150C210982C07A9F8EE5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6DB2CC802065A948266A380F89F5EB80BB1A349

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cache2\entries\F6DB2CC802065A948266A380F89F5EB80BB1A349
Size 9KB
SHA256 31e451dc8525ff03ba86d66bdc1ff004ae2a9a58a22b54272a7f161aae08df44
MD5 eb919aaddf8465195b8f0b11267fa0ce
SHA1 ce673b1755dd8010291a29070ae8c37ebc0fef2d
SHA512 97b9fb047e2cdc7c00411a3453cb492aa81b2c48e20ac6dbadc416f2c07f0e66b104233670ad723e99b53ca5244125657e2bf592a290426b0c2d9adc272b0fa4
SSDEEP 192:RCMDZ4FbF9eYa9EWusY1/LQWEPfcPrJro15j75ywpskCpkkidPjkkidPJ:RTDZAR9eYa9EHDEclrIVy8eGPsPJ
TLSH
T142227CB1AF40185E1EF1F2934CEC411A1C55E723EED2A2EE25082109DAC5BA9F8FD5D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-child.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\scriptCache-child.bin
Size 471KB
SHA256 067c497c7ca834470e8ad826a0bfb7a786697d6eafc1141167e441b74a0e9009
MD5 9d9af615d1064548fd54820894429dbd
SHA1 6c297e3ba9c82e20979acb2375198e6457e262fa
SHA512 ec08f7760f920697eea95e2abd71d3ac634983b3f59fffcda08b35cb720e55c581c34410a0f68150d4c5db93c95165b3bde0a6de9803c830c5a13a49149b0235
SSDEEP 3072:DiO5Ho9UbaekRHeUwCbZ7jktcvFiTTBdtTapBCACi0uvjmHSTXHqZoNV4QWSW2SE:DFCUbu1hjktpJn2pmYXHqm4vSW2psu
TLSH
T1A4A47111EFA64E23C418037A44FB53313A31E14517EAE3276F8F7629BC673A91D8A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache-child.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\scriptCache-child.bin
Size 540KB
SHA256 f17fde2940ebfe6090a8648344f9f846d9408862d4f312dea4d6ed1a35860f9d
MD5 f4e03d4b328f2721e0082249fb911792
SHA1 7953a6470358a5d047d81c8b0a5005906d0b8259
SHA512 f37d0e93725e2ea308d3b834a6b0d80f721f97ff1a684420bc5bbb80fe96bebbaff83ef5eefe58b724e92db46ced6f6c204f317fa731888d56cfdf0d1b5d0145
SSDEEP 6144:8FCUbu1hjktpJn2pmYXHqjOepETvSW2psu:I7ubotPnpvmh4b
TLSH
T11DC46111EFA64E23C418037A44F753313A31E1451BEAE3276F8F7629BC673A91D8A95C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\scriptCache.bin
Size 9.8MB
SHA256 591c0b3a00285241e7dc97ebabdd3be08c63f1902019e617b1b5997c85184e10
MD5 f2f63c13514261aa01438cd51d41b074
SHA1 0b6b26ed5e0e11325950f89a0ea12bd9b17d7a82
SHA512 427d9ee4fb963749cd294050a3c97dc44bc5a72008d159eed79a15f99a7c6a7b32c5039968fac7c92aec4058918b5aa6fa2ee7caedfa908cf083fa036b23eb0e
SSDEEP 49152:SkVvxHNHh95v2DzwH6f8vbG38zYPHpJFVFwZ7dhCXRQe/BUbSQD:bv1q/wafh5PnRASRQt
TLSH
T193A69315EF664E23C468027A48FB53313A30E08547EAF3276F8F7129BC6B7691D8995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scriptCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\scriptCache.bin
Size 10.1MB
SHA256 5e994e902ac8a551f42160931f00894b371fcb459bb1ecbf43edbe316dc4799e
MD5 f124fee67395c8d5a3f67ff9a7b7eb2c
SHA1 ef147c0d4ff77c121f49f310bb0795aac8096c99
SHA512 28c750a658141622492c23a0c6396d7c9dadcb42af32a974bd42defbd99482a84c047e10cfa7c95b707d858afaa5d4d7394b6258915eca1c5e5b3290bfde3ed4
SSDEEP 49152:NNkVvxWNHhFDzwH6f8a5v8by38zYPHpJFVFwjdhCXfJDj/3UbSm:NsvIF/waf95PnRmSRs
TLSH
T1D5B68215EF664E23C468027A48FB53313A30E08547EAF3276F8F7129BC6B7691D8995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\startupCache.8.little
Size 3.4MB
SHA256 b2960cd86d4b9b118a8172a4649f06c5372ea32bac37482e08e7a69c6adcfd83
MD5 00023d7abbee35efdde1d812fe0ef219
SHA1 99747b0fd465901e9a8ee1fe2f2406583d569c72
SHA512 ff9c78eab7539ceba6ea763f69296a0d0c4e0b6395a8f98e5cdb2435f0b8531dad436496ff91206931d3f7c55c9dc26241968049f8862288339dd825b509a585
SSDEEP 49152:JM+IsaRGhKGSZRaKWgiDsBRk1nBpSMk4slPyHITWVVk:WRI6Ha74S1nyvyoTWVVk
TLSH
T19EF5F167B3594697C4241D1AE87A0A3937A3414207E2769ADF38537FBAC318C07C6F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startupCache.8.little

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\startupCache.8.little
Size 8.3MB
SHA256 940302ea7d13c365684483ebae86540c895a338bdba60b9b93addf0ed1d5f779
MD5 d7cee810f6e52f9e5d446ad8fc2b5934
SHA1 f2ffaaa2eb9101daab25627c7a10f7a35c89978d
SHA512 e815cb6b20098b8793460ef81f7c7497390d96e7a0604adb7a876d8aef7236ac0f75d3d1d4f297c4a648d51b4fc2110e48f2f07fa1ad723f0f8e47972f0c76c5
SSDEEP 98304:wr36LfOheeNdEeqN3DVznGiYlwO1NTngVVIKF/HSOR:wQfPke35qicwONDYFR
TLSH
T1299602B7B3590697C425191AE87A0A393763414203E166AACF78533FFEC724C1BC6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urlCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\urlCache.bin
Size 3KB
SHA256 8f37a754d3adb526d6945b050ba0111613c676e6704bc89d52c39d57f9a7a467
MD5 248e79163721a0154911bd632a309717
SHA1 dd85b6ac1c9497f429715ab5dfa7df8ad73f69d3
SHA512 3d830f78ea2ad3d068524f0c59be271254356fd57df57d7193b610a25db2d82f9fc7f2b19871ebd09de8d0e1e169fa223243ab48fedf0b7380c5a0288872d77a
TLSH
T1F161D492E43F203B7D62A8FB6D95C175B42009CED1CD20DDBA9663D4209E7DC034EB1A
MD5 SHA1 SHA512 TLSH

Submit Download

urlCache.bin

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\urlCache.bin
Size 3KB
SHA256 4f715a993c974b1ba3f9dd88eb51012b85ee4a72aef2fea37777a7509f52cf51
MD5 da2e0f1a02690f23a5348fe72495ab70
SHA1 cd45fbe5e3032a1e493fc4205af57231fd90e474
SHA512 d9b6846b4dd9f91918e41c217f3ebbcd28ece9a34e43719b1db33a8a6372b3212de6c61556fdfda6241aad0bef4b63fde16d2af6d657456aa09512d8a86d17cc
TLSH
T12561B392E43F603B7C62A8FB6D95C171B42149CED1CD20EDBA9663D4209E7DC034EB1A
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 fc719d844ea11b34fe32851cfc485162c7b98a1dd9cce57cbe78f31360d1fde3
MD5 e78e2cee7a93c0d7bea294f2c36440eb
SHA1 38220408c71d0ac43aea69034c41bcba5362b5c3
SHA512 6dc5b6e32d02a7476e4faf83b97338c073cba03c7aa1294f36baf9ff5ad58c82a8fce66aceccfca37599ac90da869a678074301d028736b281f67ce6f97bdab6
SSDEEP 3072:P3lrXjei2A++aeqJSRIKsta6itxcIkujn9VAHrLRgGJvY:trv2c005mHitxcNaT
TLSH
T180B3AFF6DBA38D2D64FFD42DAAC2C83EFD262414B397240AC923275091C6BB47675748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\8bpv94fp.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 c310ada4467042e3e238ed084d3a6d9e9285bbb8eab66e530a10b3312f9f211e
MD5 5430e32926921fab8145033095af2e53
SHA1 e9a9a1650651e133bed4bdb3995daa0056eff52a
SHA512 e786364ec6648b1d831e5049d65098a73df46bd09cfa33ffe064f7f16e41a51f7f400e5b2b072965f162a21ad1cdf084974400f87792cd3a37c22922b186ed0b
SSDEEP 3072:j3lrXjeiMljuecdTgIKsta6itxcIkujn9VAHrLRgGJv0:prvMB2dWmHitxcNaB
TLSH
T1E4A39EF6DBA38D2D64FFD42D6BC2883EFD262404B397240AC9236750A1C5BB87675748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0001.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp
Size 8.0MB
SHA256 803f930cdd94198bdd2e9a51aa962cc864748067373f11b2e9215404bd662cee
MD5 8e15b605349e149d4385675afff04ebf
SHA1 f346a886dd4cb0fbbd2dff1a43d9dfde7fce348b
SHA512 8bf957ef72465fe103dbf83411df9082433eead022f0beccab59c9e406bbd1e4edb701fd0bc91f195312943ad1890fee34b4e734578298bb60bb81ed6fa9a46d
SSDEEP 196608:V0O2jYJ3lwVjDq+mROCHWGZAXzbwEbW7Zksdphk:xlJ1NAG2DbCtksd0
TLSH
T1BD8633862E0EDD7DC9F86F5AC56AF9B7942042531CA73EEC226146162731EDBD230F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0002.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp
Size 8.0MB
SHA256 e1c89d9348aea185b0b0e80263c9e0bf14aa462294a5d13009363140a88df3ff
MD5 596cb5d019dec2c57cda897287895614
SHA1 6b12ea8427fdbee9a510160ff77d5e9d6fa99dfa
SHA512 8f5fc432fd2fc75e2f84d4c7d21c23dd1f78475214c761418cf13b0e043ba1e0fc28df52afd9149332a2134fe5d54abc7e8676916100e10f374ef6cdecff7a20
SSDEEP 196608:jU6VHTUkm3iwFb+BB5ch1SamqIz/Z+nxnfOUvKDb:jUwHgkm3PFb+dcjSam/AxOSu
TLSH
T1068633F7E545E1C68AD5691A07C25BB531B2AAEE63700AD4A1F0BD03872789B077FCC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0003.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmp
Size 8.0MB
SHA256 5eec15c6ed08995e4aaffa9beeeaf3d1d3a3d19f7f4890a63ddc5845930016cc
MD5 7c8328586cdff4481b7f3d14659150ae
SHA1 b55ffa83c7d4323a08ea5fabf5e1c93666fead5c
SHA512 aa4220217d3af263352f8b7d34bd8f27d3e2c219c673889bc759a019e3e77a313b0713fd7b88700d57913e2564d097e15ffc47e5cf8f4899ba0de75d215f661d
SSDEEP 196608:j+c9TBb1iOMVP6i/MBrvqFua+2f384Hr5cadt1oDbmEmAn:ycrmCVriFL8i2XHn
TLSH
T12E863333008FD4BE61A5B6ABF9AA6856914A3105075A7CDBC33A18EDD0E3D3C4CDC5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0004.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmp
Size 8.0MB
SHA256 fee4d861c7302f378e7ce58f4e2ead1f2143168b7ca50205952e032c451d68f2
MD5 4f398982d0c53a7b4d12ae83d5955cce
SHA1 09dc6b6b6290a3352bd39f16f2df3b03fb8a85dc
SHA512 73d9f7c22cf2502654e9cd6cd5d749e85ea41ce49fd022378df1e9d07e36ae2dde81f0b9fc25210a9860032ecda64320ec0aaf431bcd6cefba286328efcfb913
SSDEEP 196608:+Bfk4zng863A0M5cgvWQDyZHg7Kg3uP9Sgh1Hip5c82qNV:+Bs4Lg8qRM2iWIyNiN34SghNip59H
TLSH
T1968633281E1A0F244EDBF31BA2CAC522CB9DDBC81D554556B663AA40CDF8B124F1D7CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0005.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmp
Size 8.0MB
SHA256 026893ba15b76f01e12f3ef540686db8f52761dcaf0f91dcdc732c10e8f6da0e
MD5 94e0d650dcf3be9ab9ea5f8554bdcb9d
SHA1 21e38207f5dee33152e3a61e64b88d3c5066bf49
SHA512 039ccf6979831f692ea3b5e3c5df532f16c5cf395731864345c28938003139a167689a4e1acef1f444db1fe7fd3023680d877f132e17bf9d7b275cfc5f673ac3
SSDEEP 196608:1gqa1/Oczng863A0M5cgvWQDyGwW6/esxhK2AIvXBK:OBFLg8qRM2iWIyGtzs/Im8
TLSH
T14E8633A689195B40D4FDE27352D78505E29ECBC42973907EE2D73A02DABCF814E1F68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0006.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0006.tmp
Size 1.8MB
SHA256 7fb63fca12ef039ad446482e3ce38abe79bdf8fc6987763fe337e63a1e29b30b
MD5 b3b7f6b0fb38fc4aa08f0559e42305a2
SHA1 a66542f84ece3b2481c43cd4c08484dc32688eaf
SHA512 0f4156f90e34a4c26e1314fc0c43367ad61d64c8d286e25629d56823d7466f413956962e2075756a4334914d47d69e20bb9b5a5b50c46eca4ef8173c27824e6c
SSDEEP 49152:8QJpj9To8B6CJ0BSZ45XkK3qVj4jFGeANjf:39To8YC2cKIj4jFHq
TLSH
T1D7853301D36931278AA2C517671D520CB52AE3CCBEAFA3BEDF4CD9B3F5A09610707526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADVPACK.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
Size 73KB
SHA256 7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
MD5 81e5c8596a7e4e98117f5c5143293020
SHA1 45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081
SHA512 05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6
SSDEEP 1536:3TlRSuxQYyqUB9XzWqxGHVcIIX5ZDBZGscEvWlExtJl966CX6q0uE:FfUB9XamGHpw5ZDXXPOixtJz3CX6qQ
TLSH
T1F573F79267F54062E2F35BB469B9163943F9BC312D36D25EDB001A1E38B1AD7DA38703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGENTANM.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL
Size 40KB
SHA256 905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
MD5 48c00a7493b28139cbf197ccc8d1f9ed
SHA1 a25243b06d4bb83f66b7cd738e79fccf9a02b33b
SHA512 c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830
SSDEEP 768:8yIMbiY3hC8mrfiPjEx2GWwe6ZZWkqOkM+:7QWjExz1uVOkM+
TLSH
T110032B13F7DD41A7E4B3A9398EA2676BDBF1ED250429490B6B6408893EB4C119F3C707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGENTCTL.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL
Size 160KB
SHA256 d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
MD5 237e13b95ab37d0141cf0bc585b8db94
SHA1 102c6164c21de1f3e0b7d487dd5dc4c5249e0994
SHA512 9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb
SSDEEP 3072:ZkIjP7Esjt0wltvOAwGpkoeSgnNr5W/13OG6eyAJ9LEJ0rS6fqra/G8:ZkMH9vOmp6QyErS6fqrg
TLSH
T1ECF36D02BBEEE1B1CF8914396D2527AE6F5AB5540C1158034B389B7D2F73FE1983B126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGENTDP2.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL
Size 60KB
SHA256 c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
MD5 a334bbf5f5a19b3bdb5b7f1703363981
SHA1 6cb50b15c0e7d9401364c0fafeef65774f5d1a2c
SHA512 1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46
SSDEEP 768:ORFZebZ2LnrjclwaWxMT6TrShny3RFgfdZBXbDjvb4go8RX:gykrAmxMOXShne2fFPZogX
TLSH
T152537C42BBF7E0B4C3C11230A9620B6AFEBEED2549715C42A7E4195B3F31D42953A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGENTDPV.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL
Size 64KB
SHA256 394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
MD5 7c5aefb11e797129c9e90f279fbdf71b
SHA1 cb9d9cbfbebb5aed6810a4e424a295c27520576e
SHA512 df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a
SSDEEP 768:qgZW9S++qbJyUehRzfpvzsZttvN8B9ZyOkBePJnqvWpYhY6LbBXbJkwTBqr+X:VOSNqbJyNRzfO3ykEqmtUbksBqe
TLSH
T113535B237FA7817AE2D561318926CBEBFBF9EA11E4299443877008991B31F44A77D213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGENTMPX.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL
Size 60KB
SHA256 6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
MD5 4fbbaac42cf2ecb83543f262973d07c0
SHA1 ab1b302d7cce10443dfc14a2eba528a0431e1718
SHA512 4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e
SSDEEP 1536:zPnTgec5MGWnBiRMFSDJN1+WPflnDPA6Vb19UiTo6:jnkCR0w2O6Vb1ro6
TLSH
T1F2534B2373D2D272E2F241B58E65671EB79CFE1188B0C7468B14198A7B76E41CF36227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGENTPSH.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL
Size 36KB
SHA256 8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
MD5 b4ac608ebf5a8fdefa2d635e83b7c0e8
SHA1 d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9
SHA512 2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4
SSDEEP 384:XQtgoKUX4QGdcOOmuHZfCAC7+TMkXwDUuSHuDU2XwxLD54WFbvWpSy:XrgGFOmuHZfCfawg7HuDUuwh5
TLSH
T112F25C2237C319A6E1F1123898351720B6FEED2589B9E687475101AEAD30DC5DDFB327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGENTSR.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL
Size 60KB
SHA256 e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
MD5 9fafb9d0591f2be4c2a846f63d82d301
SHA1 1df97aa4f3722b6695eac457e207a76a6b7457be
SHA512 ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a
SSDEEP 768:8Z5p1A/W6Xj3jz/yzDd5/VsnZxOn3U7fbtjHBf+0UlRV1fXXlgZEYnospk2MqD:8M/nXjzz/yXNcOkTN/UzV9X1gCOowT
TLSH
T1E6535B7273D1917AE7D20674CB925B35F7FADB11912688828BA40D5E3B32E418B3E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGENTSVR.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE
Size 268KB
SHA256 e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
MD5 5c91bf20fe3594b81052d131db798575
SHA1 eab3a7a678528b5b2c60d65b61e475f1b2f45baa
SHA512 face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6
SSDEEP 6144:JGoqPGtL+sGpYq1Cn5bPypDhmaVnJPoE6iN:J/sGV4Yq1w5bPQhmKnJjj
TLSH
T13C445C2377C18476D2A611308D8B2767BBF6DE1019359D435BD47B1E2EF2BC26B3A224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGT0409.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL
Size 28KB
SHA256 6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
MD5 0cbf0f4c9e54d12d34cd1a772ba799e1
SHA1 40e55eb54394d17d2d11ca0089b84e97c19634a7
SHA512 bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5
SSDEEP 384:zKLWayVWzvtm1N89n/ahnb9feoJsoYoJgrHoM:ho16N89n/ahnb9fTJJFu0M
TLSH
T1C2D2A85063F9861AF9FB3F7469B806605E3ABCA6ED79CA1C1240515E5A71F80CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGT0409.HLP

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP
Size 8KB
SHA256 e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
MD5 466d35e6a22924dd846a043bc7dd94b8
SHA1 35e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10
SHA512 23b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247
SSDEEP 96:lLD5gpakOhsBlFY5fGHxFHPvUtFXed2Gv/hWuIJzK:lLFhmg5AHPvUtFXbU8A
TLSH
T11A0284297D55CA6FE1A80631CC96FAFC3524BE489E04C303B049773D38B3208AB8607E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGT20.INF

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF
Size 2KB
SHA256 49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
MD5 e4a499b9e1fe33991dbcfb4e926c8821
SHA1 951d4750b05ea6a63951a7667566467d01cb2d42
SHA512 a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a
TLSH
T16D41574A4803DF3937656F64B746DBEF6D5837E808312D63741B74A9D12D40543A84AF
MD5 SHA1 SHA512 TLSH

Submit Download

AGTCTL15.TLB

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB
Size 28KB
SHA256 3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
MD5 f1656b80eaae5e5201dcbfbcd3523691
SHA1 6f93d71c210eb59416e31f12e4cc6a0da48de85b
SHA512 e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003
SSDEEP 384:fWPa0WPeUDTtdstZXmTSIgmiNSJR/bkuX+7kmU:98Y+ZWTSIgmiNC/b
TLSH
T18FD2EA52BB81CAB3C41D02355C1F47A65F60AD982F43B62B378CB76D6EB33C47A40A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGTINST.INF

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF
Size 7KB
SHA256 bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
MD5 b127d9187c6dbb1b948053c7c9a6811f
SHA1 b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9
SHA512 88e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476
SSDEEP 192:/kqbxJ5xRJqo4yOv/89dCqg2h/o84F7QroCEC7HB5o:TxA5etmlC7HBe
TLSH
T1E8F151A880268E26BDE43F5129074DCA7B285B9628169F4534DFB150473F6C8C39A1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSLWVTTS.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL
Size 52KB
SHA256 ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
MD5 316999655fef30c52c3854751c663996
SHA1 a7862202c3b075bdeb91c5e04fe5ff71907dae59
SHA512 5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44
SSDEEP 768:WIdDR7WGEjHZLTa97JHin0xrkQdya/vhaxRfI60AjO6WLnLD:WI77WjHVaN4Erkoya/vsfI6PjO6WT
TLSH
T1B4337C2336E359B6F0F221B08EE28B68FBF6AE6145744583478048D62D30D999E75B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Msvcirt.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll
Size 76KB
SHA256 647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
MD5 e7cd26405293ee866fefdd715fc8b5e5
SHA1 6326412d0ea86add8355c76f09dfc5e7942f9c11
SHA512 1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999
SSDEEP 1536:4Nx5jQM0/rmlYjYYwnlF6QXHhAk/tFeH3hNfcub:k5Y/rc/zXBAk/t0H3hNfcub
TLSH
T160730923A9C75138E285D7350D1257273EFFB1BA8706AF4392E9E439061972B4C336A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Msvcp50.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll
Size 552KB
SHA256 91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
MD5 497fd4a8f5c4fcdaaac1f761a92a366a
SHA1 81617006e93f8a171b2c47581c1d67fac463dc93
SHA512 73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25
SSDEEP 12288:7l3kpKgpWFynTJ2VKBrCT8KJyyj61Jz7q3OocHkCq9:uKgpWFynTN9CIK01d7q3OocHkCq9
TLSH
T1D6C44B12734B41F2D64463F0668A53399B34ECA90711F7E3E2DBED562F272D4A233A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W95INF16.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL
Size 2KB
SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
MD5 7210d5407a2d2f52e851604666403024
SHA1 242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9
SHA512 1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68
TLSH
T12041A3630638E8C6C01C03328A57CBC631B4D310538F4F0B0A69A57B3A92BCD877912A
MD5 SHA1 SHA512 TLSH

Submit Download

W95INF32.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL
Size 4KB
SHA256 e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
MD5 4be7661c89897eaa9b28dae290c3922f
SHA1 4c9d25195093fea7c139167f0c5a40e13f3000f2
SHA512 2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f
SSDEEP 48:6Z3Mi+h0U47yaE6akf1WbvgFfSBZW3IezfXNFk5WgF:VEyaVaVv+aPWJXNyWg
TLSH
T1D591F10363F42677E1E70B3005571B2AF17EF970D7759ACB0D9400262C3A9C16E71BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

andmoipa.ttf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf
Size 29KB
SHA256 38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
MD5 c3e8aeabd1b692a9a6c5246f8dcaa7c9
SHA1 4567ea5044a3cef9cb803210a70866d83535ed31
SHA512 f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e
SSDEEP 768:xr+oVrM3Xz9CFnht6/zce4lA7DB8kmhI7oGH4w4EjKflHjbjC:xr+oVrMnz9CFht6/zce42RzmhI7oGYw9
TLSH
T178D24B4BF2A6CE4FF2D1E534DD246A3203F1F9BDCB3B457EBE881194E4924285814B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_enua.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll
Size 1.2MB
SHA256 e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
MD5 ed98e67fa8cc190aad0757cd620e6b77
SHA1 0317b10cdb8ac080ba2919e2c04058f1b6f2f94d
SHA512 ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0
SSDEEP 24576:vPwLKE+aAeUqG7AFbbynL1AgIy6cOi3gy3YuvtTNl:gLKCW0yL1AvuZZvt
TLSH
T1BA45BF2360CA185CD918127855673B728D3CF9929B5EF8D5FF08ACE2587F2237662783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_enua.hlp

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp
Size 11KB
SHA256 382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
MD5 80d09149ca264c93e7d810aac6411d1d
SHA1 96e8ddc1d257097991f9cc9aaf38c77add3d6118
SHA512 8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9
SSDEEP 192:j2yDmtRZ4W9iBq7zlILADoq+1g7rZZBc:jVKtRmkIsDoq+y
TLSH
T17542528637950B33C2570233928EEFE873619D9D2D9353A23488B71C2DB6F2957661EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_enua.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf
Size 2KB
SHA256 85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
MD5 0a250bb34cfa851e3dd1804251c93f25
SHA1 c10e47a593c37dbb7226f65ad490ff65d9c73a34
SHA512 8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795
TLSH
T1C25176A58D1255A6BA7D3701D80A05CB3F9865F632204924B897B1C458E37CFB2FE0FB
MD5 SHA1 SHA512 TLSH

Submit Download

tvenuax.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll
Size 40KB
SHA256 c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
MD5 1587bf2e99abeeae856f33bf98d3512e
SHA1 aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9
SHA512 43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a
SSDEEP 384:OWygeD+eKczRKfZsjdeGcOzOf33iX9aeF+xpzy1B9ta7kxAG9BoWWgiJ9VQ:OWo7RKfZsjdeGjFXf+HyVhaGEgiK
TLSH
T16E033B1237D680F6E3DF12309F505B6DE7FBFF2456E4800A0F6205C63A72646DA3A24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lol5.txt

Path C:\Users\Admin\AppData\Local\Temp\lol5.txt
Size 5B
SHA256 35273244c142afc4a9d816979b2e2f636a758ac8aed27aad149d202c68f2e236
MD5 32112bed1914cfe3799600f962750b1d
SHA1 8b8900e08db199b99a2051b861c312b57f41b632
SHA512 fce870e910813444edd051fb6f0d0347edb9a31ea4a02dce66b0940ca00a4f55809b2fd6edd64ef1b6ec6c80d85cce3529fca05ff476373bb85a7f85f3f11a89
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 10KB
SHA256 ba664fb9ee54dba6034e4c663a195a1bd91dcf9e38492efad5d622df5f0f56aa
MD5 a065e52b22c6d87598c1bc90291787a5
SHA1 d0720e272a551353ca9e416b3ec977fef095544b
SHA512 e689d8b46b2caac1e473f89be9995f606760451e074d8a3064f864291f7c094bd2d0d5bb3ec81066f09789a7fa0b4e27d2ee4641358ab1cb39ab8a8b54590264
SSDEEP 24:vBuhMZINc91MkC9BPYP9xoh5M5q9F55A5FyXLb9FeyjP9VviyNN9lKy:lWZ1YKhAI56UX1xxBTNl
TLSH
T10F22A4E37B76B472F0928FB0405D718CCC7307695DACA294CB5490F706E2AD9917EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 21KB
SHA256 3dc52d78663e4139782652b1bdec1f37c96f7167367e842970c0a117990dec1c
MD5 7c39b48b7865fd498d4892c2623dc7dc
SHA1 be8368bedc31badd1f52896098845840c07dab79
SHA512 8c516b379e926c0f34b52af2e3bcd275d033882e3198a40cffef9b457e2451ff47d13eb41a80cd2f781be781a4629fbd77b572d3c18b5919894da18c3ba449ee
SSDEEP 96:xWZ1YwAI56UX1xxBTNlkEXM/p4Nlk4w4qg9mxGqeFgS94NU++:eLQ9m
TLSH
T111A2B2E33B75A462F0528FB0449D718CCC7307699CACA294CA5490F70AE5BE4D57EFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 35KB
SHA256 7b7cacf3c06efb1fc54e6985c5815efb8176ee897744451865bbf623045ef7af
MD5 227edebc1a9ab17eeb2dd29a5401f704
SHA1 0a6d908a1329b9466a7da3f6fcdb27b8b12587e2
SHA512 e331c6f2939f09c58763949612b8d95a83d678e432b0d4a1f2426521f76ae1d8ba6853e76f81e9f2b4f34a1ea9e53199c7f3f53e0ef50961d11cd5440d92334d
SSDEEP 96:cxuyYwAI56UX1xxBTNlkEXM/p4Nlk4w4qg9mxGqeFgS94NU++Y4QzeeB+C5R+XxV:2LQ9mTt/
TLSH
T1A5F295E32F75A412F0564FB040AD75CCDC33025A9C9896948A58D0BB0EE57E5E63AF9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 40KB
SHA256 103b3e0cf21e6c30e18b8ade611fcd068be5b87dca84662f263cbc58e2609848
MD5 1609a028464b29355c5239e877073f3c
SHA1 d40dbe123844d8a9e7568c22e68be5b3104db173
SHA512 dd2116be21cd4bfa810f84dc06d32f7da42934a40e29a1f661731db759b36496b721112ec8133443571785a687caff722dc0762abb580eb1c6e0b645a8c67dcf
SSDEEP 96:cxuyvPAI56UX1xxBTNlkEXM/p4Nlk4w4qg9mxGqeFgS94NU++Y4QzeeB+C5R+XxN:CLQ9mTt/T+YWXZ
TLSH
T11C03A6E72B75B412F0565FB040AD75CCDC73025A9C9896988A28C0BB0EE57E4E63EF5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 71KB
SHA256 c2184ee2b373433f1b70280cd3a419a2efac29096411148d0d5d0fc510253f85
MD5 bbbb3152a957157c5bf3ef79d2e870e8
SHA1 f48ce5ee34ef369a2064d4b0c8eba18a9bbddb9d
SHA512 016552ef7470ce0c2ccbd8ef6c8ac169da5fee41386abbd95acf2bdeaab290d9b6a0262cacbb18a9af93ea1df87f61d768d0634ed03f4ee43b1a7c1f6bfede24
SSDEEP 96:cxuyvPJI56VisaBmmIK6xM/pm2K144eKmxMneFgrN4NUfL4QzfSQa5geQq6z4CNH:kQ8c+YZXZyc2r77VTZ8vV38qQbt5n2k
TLSH
T11C6386E71B75B411F0566FB0409D78CD9823015A9C989A948B28C0AF1FF13F4EA7AF9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 71KB
SHA256 cc0dc82ab2f7690c484a4a9583c539815421b95fa3df0cdc786e2d277a19369f
MD5 644d09d5b04ef81e7ab9a85bf092d22e
SHA1 aee09270441bdb6cc04e48ecd665515e79f22f82
SHA512 aa9e3c41df7a21ae98fe92935f0f149d42e8dbc976c77834b61a1a017b0cba1b7dc8ad78bb86b7d38a8bbd41eb8755dcf14692b9727e51ac6940059fb3731c5b
SSDEEP 96:cRCI56iPB5XTispFK6xM/pm2K144eKmxMneFgrN4NUfL4QzfSQa5geQq6z4CNf2Y:AQ8c+YZXZyc2r77VTZ8vV38qQbt5n2k
TLSH
T1526386E71B75B411F0566FB040AD78CD9823015A9C985A948B28C0AF1FF13F0EA7AF9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 80KB
SHA256 55e174a52b13298d940d1b65f44d483c6a80a6a67d3948aa4641b9dfdf0e2e88
MD5 6ac0566d4e333c9b87101ebed58d32d9
SHA1 a87d66fcdc875ced7668ec5c5879b054bcc27b60
SHA512 61e4ce3e08884b6aad5dce4a278b111796b7ed2337283eba025c60cd8aa795b2c14e812e80bd297dcd8a22f003185f0903ac07545acac82958b053c6ccced891
SSDEEP 192:4Q8c+YZXZyc2r77VTZ8vV38qQbt5n2kIosfIgA:4QJ+YZXZyc25TZ8vV38q6KosfIg
TLSH
T11E83A7E71B75B412F0566FB040AD39CD9823015A9C9896948B28C0AB0FF17F4E67AF9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\AlternateServices.bin
Size 3KB
SHA256 7d8a298a4b12ed2069d5dc7738c3350edc8e3a879b47d7273097ffc5d9f6c0fe
MD5 46d7b686e467b423418dab8166d52021
SHA1 9b3152a527523c00203aa195b71767a65eb9c00f
SHA512 e411923c1ce1aa79318690487a47e1c6a6f1f1f8704aa732b14b6593c63108878fde388f6343c9df4eee7edceeb29eb03f89751535a98df37f68781e6ce8e6eb
TLSH
T10E814CB752730431F4148AB8B81B60098D2757C99BF5648917B0A0721EE2D9DE1EC090
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\SiteSecurityServiceState.bin
Size 3KB
SHA256 d7c92c0e1b88f2e8f12dd832765abaeae690eb30497f4987e3f0838bf56f4c6a
MD5 9855e55ffa47b1f96c6f80a1da79cbdd
SHA1 5afbcb707a5550600e3223c8b44fbab88e2de524
SHA512 02d8ed5c57923ab510f529db5ee1ab64a23bb127a79a5bdde6ba2f078704ac786cdd80a13ab9e48a5ae9cdb7e64427c281e3c9817e614ef24a3203b4f994bdae
TLSH
T1656122B2DC8DEC73F0C9CEB0A0BCB1443C3A17698012F194AD1801D23084FA9246E7B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\SiteSecurityServiceState.bin
Size 1KB
SHA256 0a3cbb846acd2325ca71e9cf31eb6a591ed9f0665e4ab0a4f5b8f2d2e4869743
MD5 ba2303fde01dedf54eddaa83dec097b6
SHA1 99d4748c3dd7d9f4a51dce5de1ba923c1a931330
SHA512 adc3d42d7f113d2c3f6c845720e11d8088ff357c769b7cac5ea1988ecd3481ab95713c5ffd2a5ec3633c348b6dbc4471b33f66c69cef43a30f7aa5a03ccc6542
TLSH
T1DA211271CCDECD67F58946B578BD50503C6E679A2172F2B83D9C42A07084EDC25DD590
MD5 SHA1 SHA512 TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\addonStartup.json.lz4
Size 4KB
SHA256 b6e144ee360ea39c052f34fd3d7e7347a6fab52bca9da8f01588df71c2416cb0
MD5 f18bc03ed42490f5992c48d883ac2bb7
SHA1 fc025f30e2df192a42e842db08694c41a737d004
SHA512 f92ec82f6810c965c971834374d2a6711cae0da93f37516c793195d5f0fd5af21859f402640deede4cd98c97c47835b9866499f198f0ace39baa1a369d796b58
SSDEEP 96:Nyj4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRwK:Nn52xxhD8rGvm6ApwnHU+f
TLSH
T11DA16C76D146EFA1FE22C44248E93FB2FA9AAB3814A9C4D0F1AF71254D34A731705380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bounce-tracking-protection.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\bounce-tracking-protection.sqlite
Size 96KB
SHA256 83e2a5c9d65ed4f819fd9bd6a52715e7d92eb7665d12e9f6dc431496c2b758f6
MD5 87b094ee8bf6b3236413e045af531f39
SHA1 35b84680882ae729f75eaaaf14047adaf5f6746f
SHA512 0c47f8a39b1342ee8be869ae5e146cf2693fc118f9ae9588a03f08a26a756e2c1453c860d42060f505fc19bd47512d7becf73bf2680e233f1e7c3c10f6d88a4b
SSDEEP 12:DBl/WhnB8/ykS2lcBDMGEJKM+vcBDMvYkMBAlO:DLsB8akrEDE+vED8YfAlO
TLSH
T18CA3C68F0E702680EDC420B0D7828EEEAA1EC32DCB13279202A000B29D0206019220B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cert9.db
Size 224KB
SHA256 fd92e85935e5e9b03cf1160343c9d1ad889fea37954acb6df9fa7c854c024d48
MD5 893d7602ca78911dcbb0b456742af49e
SHA1 2859b7feb77b77854268e862355c61839215bc83
SHA512 70d49e4544d52ed63e4ff5685b0dbb22c6ff8ddf82ab47faeeec7a2a7ba490f9a467243987272b1c7656fdcdf5e3543d5f584ac37f1fa08f3615d01c286cf02a
SSDEEP 192:zOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vg/HaRPNnKoP70a+:K1zkVmvQhyn+Zoz67lcPVPQN
TLSH
T1B12411C3F820745ADF8A6D31B662DCF23D7627414385A422CE289D3F1D64A1F67A68DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

content-prefs.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\content-prefs.sqlite
Size 256KB
SHA256 fff6c2239e0d2ccc2dfe16bece3f51fe2831ce8baaa337827bbde444207a727b
MD5 d3941a15a96fb3023cf1587a47b586b2
SHA1 94996d072eea6af88a1d96b8ef900a1fe3ea56ca
SHA512 d627318f49a185b6ad4dbd76c9eb5aef82c360ab76fed195641fbd258e045e1f04c0d6359827a9c31c677414bc656e183770c0d1b829821388db8bfd2608f364
SSDEEP 24:DLCKvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DmWwae+QtMImelekKDa5
TLSH
T1234426174AA17408C0B014B1D4636F22AF3D405B8933E7B23ABC143A4F886AAFC791E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\cookies.sqlite
Size 512KB
SHA256 103a4e28ed22077b3397a954912a99f38d48f595a23a077f4592d35b7b1637da
MD5 84b43bb8bc8bb30b6370312fec3e1315
SHA1 1e69b5fc17633c6ec87a4d95cc5ff6abba745c5b
SHA512 ec6ecd19b5cb0ae1b09e309a42cca21bd768ad1792e1ebb890f52c44350c670d86a5663b5bffd6b0275ee6eef38f1536808e6f50ee3d1e83f8962033621702d4
SSDEEP 192:8Sa3b1Z/SA8JWx+2a85/wXtEoIBzY+CWvG7W+PZTqe0Ih:8l3GA8JWx+2a81wXtEouzY+tvGTZT8M
TLSH
T16DB485F26F78E718CDC674F8B4507848B41D44DBC689C9921BAD502B2EF15A2BF109EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.bin
Size 29KB
SHA256 84cd5338f35ef79683aba829b7496541dadc6f7ae21cb5f86fbcf2c9ce5adbc9
MD5 d578dcace62d71efc6202504d2f753bd
SHA1 6994e28ea2193b7bc351e0eb48c1651f2e05169e
SHA512 4c41a85ae67d1a86e1dd2983d6dfe97019718cf42120709cdb826bee7dd76d46a63279415dd2d95826b086cdf2abd1ee257f84b95209c3bf0e6451d4d69cc1fa
SSDEEP 768:pm7n1e29gGcmhunKP89KapabubsbWb7lHC:8n1e2A1M
TLSH
T116D20F84F72A913FD41552BBDCA507002F79B889981D2FA73A5C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 3342b98c3a15ff7125119bd2fdb50b120bd8444301ce5404ef4319caa82ae2c2
MD5 10588a44163c883eba79a2f91af930d7
SHA1 b5106c50f87f52d32819c7aa0aa6fc380eec4e4c
SHA512 a75867e0ff919d9b2d5660c05bb3f58215dace2e139a371437510a7dc309b461b8d594c12a4960b63757f772a09a2478dd8c2cbc3b1ecae83a690026f5c8c33f
SSDEEP 768:5mwVHn1e29gGcmhunKP89KapabubsbWb7:jn1e2A1
TLSH
T1A6D20E84F72A913FD41552BBDCA507002F79B889981D2FA73A5C64686C872DC3A9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 84b23d03f987bbe95f456023035649922cd95ff58249cffb445c1b06e89bb155
MD5 01992593e4f9981fd9139e7e942c6658
SHA1 9115e5132b180539e0dc0dfba6a2d8e9070243ce
SHA512 771a29f363c97833c9e5e113bdaafa11e9cd62405ee047a6d82436ddd24f17fbe15b84eed84a730c3e10f00ca19c6137fa11a973ae42b1ea710170f04970efd2
SSDEEP 192:ZOv5zboHeaDxyjvSY1/66Joz0dzgCl6mc0dz:2bo+aDxyj9/66JozQzgC1jd
TLSH
T1CAE11EA4E638863BC004437BCDA61B410F35388ADC8E3F29759C64582C572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 112KB
SHA256 10750dbad9589d83b6d54b7f36650732d23a81abe8344fc4c300a1617ebfe4de
MD5 933e72e8cdac4fee70bf1738603a69e6
SHA1 46e3c7418877c6362eb156afcc81c2eadb1d4632
SHA512 89dc62b3af3f7e867fc8ff8be1e2d080076c76e25f2ffa816c40b06553e185991481826536a919b0f6bf5a27ed98c5a1ad32c8109c97e84207e187360408c698
SSDEEP 3072:PhW5piAXcgwt7oiAaagXUKaNsvXM094f45:Ph0piAXcgwt7zAaaUUKaNsvXM094f45
TLSH
T17CB3C1C4DB27407BEC1485BFB4D5573C2635F4214A599B0B3AAC04762DCB3BF2D0AA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 586b232c0f10035d06a475c8effcf895309563836a61ef08bf58763e64b48e02
MD5 e79cea18dbd5ee5337f0e9980383ce42
SHA1 0fd2c6d1f215f3f65783a9382ee588afadeefc0d
SHA512 83bdff73138553f692258e76346f0cc3b6f0488aa749888ab699f76c9042cc7ceb9c348a31c85c4726b15072b8d5e41a7f432b5e4c13faedcf1293e56e1b0440
SSDEEP 192:ZOv5zboMZDxyjvwh1d66Joz0dzgCl6mc0d:2boMZDxyjod66JozQzgC1j
TLSH
T127E11DA4E638863FC404437BCDA61B400F39399ADC4E3F29759C64182C576DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dbdb39d578f82bb48b6dce1e37a62124fadf7f5fece43bdd829c0dcce792e351
MD5 26520a2ac36c71868c97ba32e851c6e3
SHA1 1474199f27256917e367b813c2409f979c7f42c5
SHA512 fe9529396c20b5437bce3adcf4add526d7e899b50c772b8431f5e6985d3e7212d14fbb40e4503df7459d26a718fe6c636a1c8ed70407e0985649d8db2dd4201b
SSDEEP 192:ZOv5zboHMZDxyjvwh1d66Joz0dzgCl6mc0d:2bosZDxyjod66JozQzgC1j
TLSH
T135E11DA4E638863BC404437BCDA61B400F39398ADC4E3F29759C64192C572DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 72KB
SHA256 fec3a151651edf6c35ae48e91d4b5673f4180fcee093e5e8ecad77e641a3fdbc
MD5 d13809431f3c6b93e4e80b73f2188434
SHA1 c31e69491442eef0143e4feeeb06b02c60c8a16a
SHA512 02684b7833ff51d9ad967c45e9899dfc0e201f2ab0dcc897a4c28222c92830e9ebb3670de78eae8b5775d06bf62f065b18d26add8c90155901c84a48bdc9cf8e
SSDEEP 1536:u6/6FNC6O4pTII75Ga942l+bGZGK/3tPr2FIu8o/1/:uS6FTucVlyGZj/9PcIS5
TLSH
T173730144EB1A953BD92803BA9CD21B103F78F8895A1A2B67371C54787D873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 72KB
SHA256 a1349c730c574fad71d2ec564ac7ff116b024b6891039ceb7a75906af5accf83
MD5 aca63e775b7f54f40e7648381261203f
SHA1 4e0e6074cf0cea3be727f4f108a90a5a7ed128b2
SHA512 d3366026f94a53919e9e26ff5528ae9a877e8f9577a47c155262a0eec977a9f13006ddd0c7b638f042ff370b9b5df1b25d9553eb1af9d6423f7eddaa92ca579e
SSDEEP 1536:56/6FNC6O4pTII75Ga942l+bGZGK/3tPr2FIu8o/1n:5S6FTucVlyGZj/9PcISp
TLSH
T1F4730144EB1A953BD92803BA9CD21B103F78F8895A1A2B67371C54787D873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d7ad0cc3a0b0cd2fb1f066d3bf1fd7bfef41739bc418d807b3a29bedd58c54f0
MD5 0b51b450a0ec83a0a1e44b5b3a790cb2
SHA1 2e0e167926a794cb1507007462ffd24d9a9dae32
SHA512 9d2824d62880207409a00758f66a909cb6428e574119279ba421db51d7e877075cf3e39c561255046822c09205df18e941d31d1bae4c99cb96a127478dc57f52
SSDEEP 192:ZOv5zboHeaDxyjvSv91/66Joz0dzgCl6mc0d:2bo+aDxyjG/66JozQzgC1j
TLSH
T1CDE11EA4E638863BC004437BDDA61B410F35398AD84E3F29759C64192D572EE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 68f66e727fd38aad0e8b6ac6c5f4bac79bfe567016d7bea21fa09a1f4d025b06
MD5 b40a5d8402b41f835a180423e9025354
SHA1 2b730e724b12d830b097a8163cdc4e17cb9ad75b
SHA512 6ea8c0473c4a64d607c4029e7ce2147b338284a0ecbb4352af3895e8701e07b7ce2210acc33df77fb11798a1b7f5750c8f1a40599319b437ddc6ca3cc3e3741d
SSDEEP 96:YF/QF68F6NF6kF6g/dd66Joz0dzgClKtmc0d/UbSdF95/7bkW6QXjrcPyUR6rWZ:41d66Joz0dzgCl6mc0d2Ov5zbooCyjC
TLSH
T142B1DB28F229463FC448423ACCA21B401E36384AE85E3F1A36EC744D3D572DDBA8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 08ca1876ac71af369618aaffb9788ecd46319577db7b2c2716c174aef07019d1
MD5 695d2ee61291c0acf1459330276b639c
SHA1 4a855aabf666db0e8dc1927f4cf106d042e04976
SHA512 4a1cb12f14f86df49e1393d2064d65ca7fcc031a2c3ba703983f06f72427d2f6e4c195a5cd8246b5f5ed9bc080ba19ac9a93bf16b862dd215cacfbcdd27369de
SSDEEP 768:Ue/m7n1e29gGcmhunKP89KapabubsbWb7:yn1e2A1
TLSH
T142C21F84F72A913FD41552BEDCE107002F79B88998192F973A5C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 f4f16ec3d5133195751a9051717fd14efc9dd9d477dc8ec51e24791638c502b1
MD5 ec1091b22cc96cf012a21bd9c68ab6c9
SHA1 2b8a8490b20b4663a80797881884d4a014e97b14
SHA512 fc571d8eac6fa006d2c4d5f76246a43e3e004c22a78da6d20fc994f71fd02ffc5ca091a50f55194b3ae054c712d3b5374af79f61d5a6ea3a2137b473dda34a13
SSDEEP 768:Ue/m7n1e29gGcmhunKP89KapabubsbWb72:yn1e2A12
TLSH
T13BC21F84F76A913FD41552BEDCE107002F79B88A98192F973A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 17a1a9d44e04f51ec4c200ec39bd02e1ae26bbccb3cd61fae272155549a488d3
MD5 371460ffbee521e95c5c0a4350e1e082
SHA1 8d2121623d86f3c1d163737de6c84eaa5a9ed7da
SHA512 983bb58d7ab98963641bf37abbf22576b481d16aa5d798c398a59233c6cda064d98e90b96a7c3bd945328b454f019fe4c330e7b1565c899d5c4a902187762807
SSDEEP 192:qOv5zboHQDxyjvw71d66Joz0dzgCl6mc0dz:JbowDxyjwd66JozQzgC1jd
TLSH
T17BE11EA4E638863BC404437BCDA21B400F39398ADC4E3F29759C64192C5B2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 55ee5ed5c110702bc5596fb5f53fd3619359c177192cbadae2e18abfa0d23295
MD5 7b512d71a881c416d42c2b3e4b0c5cc3
SHA1 c8e6e617af4f2bc7b951c3e2d0d681b482af1651
SHA512 e742b03f9cdb62c149058c8b96a70caae0e019d6c76957254e67e184d4feeb1a054054e0f0bb12a214cd8036dec6afc38d687caf66ac15b855ff40f0bee31859
SSDEEP 768:5m3bHn1e29gGcmhunKP89KapabubsbWb7:+n1e2A1
TLSH
T100D20E84F76A913FD41552BBDCA507002F79B889981D2FA73A4C64686C872DC3A9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 ec1e18fe051938656dd98f45656cbf2ec81f510cc10879ac95980bc71d675025
MD5 6c0e27fc62840e12bca119aeaaba5d86
SHA1 d0f2b2f74c1b64f97569151a2b71cb06231f2e05
SHA512 027e9539c8e6b83760292c869f9efab6e65ffa1f0109a402e1a869139741b2a0ea0de03edaaf9120477dc1a49203ab51e5fd971d3da846f47610deb9dce60e37
SSDEEP 768:gmRn1e29gGcmhunKP89KapabubsbWb7lVJ:pn1e2A1x
TLSH
T134D20E84F72A913FD41552BBDCE507002F79B889981D2FA73A5C64686C872DC3A9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6d1344c38bbcf6f45a1f54fa892ab249ea362b0509fe2a9237e6b17bdf0287a6
MD5 e5282d55be8fdb81e9a477c8831f7fac
SHA1 b3cab984eec1571d8ef3f38997cdfad6a57e8859
SHA512 0e23dc1e2902dc232c63ad85d34b2c562c49d7fc210e6bad3d9f7e44ca51396f07d9d881aba9b42a8871d502227d2028d588032cb5d83cb8243fe2d40b72e5c2
TLSH
T1F721375C39A84D6AA88AE69C7451028E53958E0B48C71C434E42DF8DCDE5ED932AA47D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\events\events
Size 5KB
SHA256 ce39e4dae552d3f653b42a0aeb84e569e773d2caa71ebf30c07f4c92ad27ba0f
MD5 ab7da0297c0d60d76ffda34de9ecdf30
SHA1 4db024783336d21f318aef70351fa90d6e1fdb81
SHA512 d4c602bf788d7edf6af99019407af1acb733a728aae9ff7f300948f19598eae41c42ef88e11422565bb626221760f30ff6b951fe97f1dada8d10ae803cf1ba5a
SSDEEP 96:BGmiSi3LMEiK44yN77F44XQdM7ed8aeEZxxwNiiu:BGmiSita77FSM7Y5eE7xwNm
TLSH
T1AFB1132D35A90C7F6AEBD28DB842078D829D4A02C9C71D474DC7CE49CCA9E59325A578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5c71da1a8bf498b7544f6d24242e9733042da167519a2a86ffac4504758cb4f1
MD5 4beb195180ec572c1b3883e959cb086a
SHA1 c5df9242308a104af283ab7e64cb02f0999d99b3
SHA512 b9eaf8b94f7ccf8cee7e4487484822fc211bb65008cceca58928ed666481d312473c79f90c7119a15a5a96be85f11852d5c7e19457882b1d4bba25a9380d52fd
TLSH
T14031BD5C35B94D1AED9BE398798A028D47814A4A8CCA2E434E11CF4CCDD8FD972AB07C
MD5 SHA1 SHA512 TLSH

Submit Download

0114cc5f-5c79-4488-8ab8-d20379cbf0c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\0114cc5f-5c79-4488-8ab8-d20379cbf0c6
Size 973B
SHA256 df0cb16a861f5d5f6cce5bf9c23f913c5a59085f289b25f87fd9f3d81461621b
MD5 44613a36203bafe7aefc98c3b63d5812
SHA1 a94d25c49c54d0eadde3198b39344e80edc7d2d3
SHA512 2f4e89b8c1ae17f9c82d62be250585909f69baf77cf4b981f3c20016f48d52bbdec9e8adbb9a0d1b12128014772ade81dbf18f7246d609bb7c9def819a6a5eaa
TLSH
T10111B1818574F9F2CC78C38E96A537135AF03533C4CA09187EE15E1409EA91E9797717
MD5 SHA1 SHA512 TLSH

Submit Download

10170468-bfa0-4e9a-a959-b4ab516f7db3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\10170468-bfa0-4e9a-a959-b4ab516f7db3
Size 235B
SHA256 3f12ed852c66260c3f2de89397116b9b068ec813d4b77fca420ab1ad4e96db2e
MD5 29b0ed69fb67e66a8150c4f36c3b7d5e
SHA1 536cd2d6b688110b7be6ee6b0acfd415433d9c01
SHA512 ded20aac9992d10d89e08308017836b929bd7298b1bd3dab216c2fb646acf35cce8ac73e9b042973627849bcb11331e43a9632db04c32f0a60c5bc2984ba9d26
TLSH
T1E5D09790289863DD08006F02B4B038D230894C3B18629C30EAA021B8BAFCEC8825182B
MD5 SHA1 SHA512 TLSH

Submit Download

14b6d87a-bfc6-42f1-8eb5-22a94b5a34bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\14b6d87a-bfc6-42f1-8eb5-22a94b5a34bd
Size 883B
SHA256 e4a337ff163e7e78c806eb21bbd63c6a1262ff6a20fa1975a112ad82665273b6
MD5 60658abba09df9bd93bc05f8ecf59a52
SHA1 d451b130843d8eacd7c05c1a9acda526e5783591
SHA512 d8e1b8399cd62738a5c61daf34713007dd836ed9cefc2e8d0fa816bcf59b74dbbb24aee42b87c2d2287a65eb6e9dcc1de72a65b59a47f89fb90eb92ea6508067
TLSH
T17111C081D670B9B2CC28C39F869537228BE47127C0CE49143EA19A180D7A91EA396757
MD5 SHA1 SHA512 TLSH

Submit Download

2d882157-15d6-49b0-84c1-dfc16c527899

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\2d882157-15d6-49b0-84c1-dfc16c527899
Size 2KB
SHA256 161bf5f60dc5af3efcf3cb998b57bc4ce3aa6df649c0f80118cd4727bc698bee
MD5 a01c02789dae4e305bb6951f0a0c5966
SHA1 6a343332b51ff6d43a1e98ae32c6e6e2972a0e0e
SHA512 397d92b3155e3764e5601d48d4683719ccac436a5ec4381e3ed5bf3fdce802dbbbe6d4bf1bfc115bf022cf96b563a53c6fbd9a792d75812d8e3fbc73d810650c
TLSH
T17A51515C35748C76DC9BE35C869B234D07A08A4688CA2D435E51CF088DEAB5AB3AB177
MD5 SHA1 SHA512 TLSH

Submit Download

3ed5624e-5a2e-453b-8b63-f899ca12d7e8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\3ed5624e-5a2e-453b-8b63-f899ca12d7e8
Size 235B
SHA256 4161ed98e0c78f683be06b83c4645ae3f30adc1ebbae3b45f472ea6652dba45f
MD5 d88c458b208a36cdfc49408236b9ef53
SHA1 3634402681fa25383f73962aaa7db8602f178d98
SHA512 8b9875017afa9a8d112f7014668ea2eb42f3ce65fa25fd5c3faba0f9673baa4b94d81f42ab7014cca5e74b4392123081377166c3933f25d6a697f4849e17c922
TLSH
T176D097C53898272D0D014F07F0A03AC630868C335460A860DA504078A9FCED541A1826
MD5 SHA1 SHA512 TLSH

Submit Download

4447590d-0752-4c95-b789-b793872e18fe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\4447590d-0752-4c95-b789-b793872e18fe
Size 235B
SHA256 d052c56166e51a49846b7ac600ba2df69a3e0746b00393e25ca591c5dcf34912
MD5 5e87e9384a6187edbec57de767f1c3c4
SHA1 c0cbe1e764a9f7161d57de5c173dab9e2f80d7c7
SHA512 2c55ab6029fb1c188c5a42b1f673373278b4c6277ba29920cffb5b726e5590457f51cddde0f6c3f0acf1a07c33c8cf38d4e3a299ed98150e8fc134e561a7278e
TLSH
T14ED097E124A8331C18040F03B0E069C230898C3350B8A8B0CE50C4B89AF9ACA4123827
MD5 SHA1 SHA512 TLSH

Submit Download

46049160-37f3-4778-be63-248485929678

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\46049160-37f3-4778-be63-248485929678
Size 16KB
SHA256 82b7d8ed7bdfab800ca9a3b5a34d6cf7525e3d3a0cb449fa2fd0c8188e5c97bb
MD5 1f7b2d4fcc96620b72b29b83917619d8
SHA1 cb6900631c1fcf56a93e0297e717968262c24c16
SHA512 ed7c4102159b8526c366295eb7053035b9836ef876ba232f22a7be076cf75778f6d8daf5c81558332c1479af981ee09d7dc8b1a29034d2c4bfd83d7502793e4b
SSDEEP 192:12uHlaBNDDGTRCJsMZEAFoozEXTpw7yG1J1IEaYBLai2utR0Lbzx/qmf7/JA7nBu:cVsp2QpYIihtR0LblimjMn8bF
TLSH
T15F72B956582055BE8691E36895F87FC3E6F538CF4C018FCA4BE0BE486DEE06D112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6145f600-efb6-4742-bd02-57048e1f1248

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\6145f600-efb6-4742-bd02-57048e1f1248
Size 886B
SHA256 4a43fc6ee7599fd7550e107997e4e7e403fef740855c4ea087c4f3ed557a2562
MD5 d2f0a3e963d097182f5a9cc850b364d5
SHA1 e7449de7dbf6a22ea7f39d2d43e93359cb9398b9
SHA512 367ae5b0b0eb61f519c47aca55b8891dde8cf1010c167ba6f6e1aee4c2e82b421bb6e7e9bb8935d5e3c2ce2b892865fc8e33dfce6bd618234a2c2e932c334426
TLSH
T18E11E3818A70B9F28C28D39B85E177124FF47423C0CA0D187DA1DF144DBB51EA757617
MD5 SHA1 SHA512 TLSH

Submit Download

69de518f-935f-4469-8a92-c452bdf4b4f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\69de518f-935f-4469-8a92-c452bdf4b4f7
Size 2KB
SHA256 7b3b3032d9c7939fa7d0569a1da5cdd7609cdd1f610d14c5829c6410cb6605cb
MD5 0ca52a5423b9e15a476c93d3c8d8e305
SHA1 26715d23d3ad4a3ad5659830ec5fe38681656f19
SHA512 bbd417040aee6740e0f5cd2ad195a13d648ab638d068bb0b62d5e66bebf30ae2612c9a9b5a6060e3b82cee9da083742ab84e86d08cd4985c92d66751ecfeb1ce
TLSH
T1E041239C76784C7B9CDAF25D9091378E57B09A0700C61C832E92CF0C8D9A6DE736B42B
MD5 SHA1 SHA512 TLSH

Submit Download

6ada6fcc-adf4-4416-b177-5e1a7dbbd6c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\6ada6fcc-adf4-4416-b177-5e1a7dbbd6c6
Size 897B
SHA256 816853c9f069779468f2a4d18ff4a54185ee7193bad7bd7bb10186afb954e6b8
MD5 7a1d89c70bff09d34a852b5d078936c6
SHA1 485a29b560a63ff96a863cd1fb8fa122282b26ec
SHA512 7a3a15858628d3eca3def7e8ca30ae71245a32a6c144baeee51eb79a90aef982ea404ae9cda7697dc0daf853338ef4d5b69c05d43a8a2ac1037476065d9e93fe
TLSH
T1A91100818670B9F28C38D38F86E17B124BB07023C0CB4D247EA19F140DAB92FA397217
MD5 SHA1 SHA512 TLSH

Submit Download

75e76a40-d751-4292-b256-521e051bc0f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\75e76a40-d751-4292-b256-521e051bc0f0
Size 2KB
SHA256 66143f214251caf1c4766dca79de5c7b9545153d43eecc9d2b26e5c0db0e6873
MD5 b8e5cfc5e08b363532b4a5e500df6cf0
SHA1 b8013f5be89f1faac04fc25636dc900d8e6cd54f
SHA512 776b5d8dd6b0646365a8575f291c9560e8b1ad27b554abf8da67e06a5991186b8c4af7a3f0f7c9dbdcd026c05f3c35f786fcc76ad62f688a7bd4b943de59a5ad
TLSH
T11D51CD1E6951EC7CEBFB906C6683DBDFAB4A528321C5AF57A970CF2CCCD82051017296
MD5 SHA1 SHA512 TLSH

Submit Download

aa9a0681-74c1-416a-8dd2-3f130234199f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\aa9a0681-74c1-416a-8dd2-3f130234199f
Size 281B
SHA256 e1c6aa3e00c02d92542ea7a6767d68eb0c4d05ba11f5dca06678e570df87c511
MD5 3e6dc7128633347ea2e8408c54c84bf8
SHA1 cbb416e502c2ce4812022deded0d7f0756688533
SHA512 b2c424c84338229931d7ba29d436a9a44d1f3d20cceaf8d1e14937bf6e6673691235f43a5e13ed6878a2154299c87b5aa6b77d3d1bcf11074cfe12e2dffd9ed6
TLSH
T15CD0EB81688C332D4C640F4BB0A028E232650C3310F01814A8AA04A4D5FD9DD4060C66
MD5 SHA1 SHA512 TLSH

Submit Download

eb8c0451-0bf0-4a93-9dbf-275d6386dad8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\datareporting\glean\pending_pings\eb8c0451-0bf0-4a93-9dbf-275d6386dad8
Size 8KB
SHA256 67e7835a9c05fe0788cd06435a7c6b9107e10f29b1566057bfae8fdeced7ffe1
MD5 9790440e109bce9b40807f511afb8ad4
SHA1 a0f9b907725ab0d6d7532eb54d3b465f99b81d70
SHA512 a30db6735690bb6315c2c2931d0a01378083be9c34e302aea93005e7a801cdb18908ff93972dfe93f85385d592792040f60157fc3473504ea5dfe39b8a21ca00
SSDEEP 96:dlNbuKd0hWDVec/LSirGoFtqu4YpE7n4BYwdd77dbBnbjwhTA7mHLhc9lyQZ+7:dfH0huTSiDZE7nMd7J5bjwW7mHLhkE7
TLSH
T176124F1D35B90C7F6DEBD69D9483039D83EC4742C8C61D830DDACE098CAAE5A329E5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_to_categories.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\domain_to_categories.sqlite
Size 96KB
SHA256 0581cdbedeca93191ffbfd49f28cefb44c64a3f8d7d9c1fd00f8fb58f8a29d20
MD5 8bbd85487e190bb30558e4a6e44a8dbc
SHA1 110892881aff9d27e99ad894dceb3a0fec6a3663
SHA512 28619dcb45a5ee7bdfc292f827141e7ce800469e80b2cfc032f16e185624e2462bdca51b0fa2fdef793ee0a417be32695c1e66e849424222de6c62271cbf9c7c
SSDEEP 12:DBl/jH/bUSoQym5H9L9ftirhP81MONd4/F0LA6Gr:DLLbv5XvtQhP8W5/b
TLSH
T110A32B1F0B5CBC40D4C356F16D8319067634D50B8913BFF13B9D84104F066481C35AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\extensions.json
Size 16KB
SHA256 57ba91c6da0fb88679120f8175f55bd86043bc4a25d5612e23cfcb34ed662326
MD5 eb60d67da611a787302fc53f672facce
SHA1 050c7d358a8291162a85d860f6d7e0c327ce0bd5
SHA512 f70ad414ab1514f101d55ee3b7df1b55852a3e97738ae79135c9e385892f80ea05694b4c81520869ff38ee44d6c68d0885e1d6110f372380925ab397d7ace1f0
SSDEEP 384:tkI4vgUmldvJ8dhWu94zi96osL4HUL4PwIL4HTxL4HaL4HVm4hN:OI4YRfqXD4q6J4u4IK4zp4I4043
TLSH
T19872331545049EB8294F979BAA367E02C37D473B60845C78F4DD8FC802FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

formhistory.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\formhistory.sqlite
Size 256KB
SHA256 479a11b34ffccce96b2949924ee1319785547cce240662c131f1ff459b889717
MD5 502a42abe8eea3848813b3474394c6a8
SHA1 e3227dcc2fbe92c08940838be5892e3e1324d12e
SHA512 6a32840d8d8aee72a9341dff8aeb08573483f1576e320bbb81aeb5ecd84e919a36d7f2915a41acf90a9494964e546d9cfbfa56ea951352ebcf25947b05d411fd
SSDEEP 24:DLd8VxExBWrkier5NzW6LlmProNpNmVIpPuVM7rBmxF/EzgvA:Dh8HMArt0pmcNptpGVM7rBw/v
TLSH
T1E644874F59142432C9D78AB7FDD21F534AAD0056C6632B947EFC101D4FB1A09DE58EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

permissions.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\permissions.sqlite
Size 96KB
SHA256 684f2e9b5e48a23d649ca382be346cba45e5675adf3da5c57ea7a4dec85e909e
MD5 5c2ffb6c5b1217bad1baed95f071905f
SHA1 708bfb6b8500ee0dd69fae9784be6abe312d2f0a
SHA512 ab2078ba51161ae9b7fc7c2e679c29de3344bd9136ac8cc84918d0a3a70884aa02bf881d3e7c1baf470f3b21315b39f9fedb13afeb7b069fbb6ed83a907f400c
SSDEEP 12:DBl/yPpbWla0mwPxRymgObsCVR45wcYR4fmnsCVR4C4KuOkjh3CE8qaZFDl:DLyPpb5sh7Owd4+1j/kjh3Cf7
TLSH
T153A3F1979CA8AAF2D68944773D8264CCA03F44884C1BF2D51D81002F8E039A5DF01AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\places.sqlite
Size 5.0MB
SHA256 b49dbdad57ce75b1436e71541e9e5ff805ebc740255ff937e579d46d41c415ac
MD5 29ca566ea67c63e814767ce6d1a7a9cb
SHA1 0e8f67ae31be9f79775a730e10a0e75c9c949858
SHA512 7eaf87b47e615ff1bb06a77a5998c31c33fc5c7d90ec3fec41bf6ca1f059669d9190486e579e047cb9a8787c66b133e6a269d22468d8b3f4aa171d45a785edf7
SSDEEP 384:M8r54w0VW3xWahqrHfixqTcxd5KO5u+jC3PhoV79o9Cmy:rqVW3oI0VGWcKTy
TLSH
T14B36C89BBA101012D9D6D232ADE32B4D283F755A8926B6C33994153D4EF0B62790CCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 6KB
SHA256 5fb6531083db25f50c39f827aec5d239ebf5e2dd63d3c0666ff9122653a7ab33
MD5 b15325bc0f1ac29c7e73a4be91257eed
SHA1 6816027c37cdee5a2550c3d8069dabca8ef1a15d
SHA512 bcd5ab818375a26f52da9122dae491a32b560683bd425d9f8be867a973d19e38b195354078abb0b6d42ad21e5bf2f25c5beef87f20fac5a0f8b026c5d1b58996
SSDEEP 96:xHAUTUHqGqXfUOd1zS/IsSSlcdv9j+nSH3MkN/Bw88H8L4cnEVVV5:qaRXfUOdSNSSE3MkRBw88Xt
TLSH
T112E131789008CB6F74B677ACAC688C316AB2013BB7BF68D710B54484055CF3486F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 12KB
SHA256 78aef8fe8b9ed3dce6fbe74249b17e5996d11381eae60e7e9666f890d60cfb76
MD5 2e5509193a9340fe88c961ee0b89316b
SHA1 79568dfcde22aad26b64665eeb10f0f363e1fad9
SHA512 288caed295d894954fc60b07ce5b8889ac7ff040aa1975751df961444867dc536ccbc1c08f5dad9d2ee58d2049c987dbc0d5b25debb003d3c8cdf8bda569628e
SSDEEP 192:qLRXf0OdFdSSjLRAMk0KJmBw88dgLiHjIH:8LRAM9KiwOqG
TLSH
T1C2429C3851448B2F70F2367DAC264EB419610137FABFBCD646F984814D6CF2481E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 7KB
SHA256 bc56cac35a1d3c524a308f43d419947ed9a2f898e4adf2d76fd18cfb04a4c010
MD5 b9bc20efa96e84139c5d8069bfad51ca
SHA1 9dde8e108c3601ed764f30c106bac67e7af3185b
SHA512 297e16a9a186fce3734bc6b101f27351163593d768768657f0542ec84b7b359961d42e0b90d3a53541334e923adeaa20b7dca238aa82a8e982a7c93cda7708a6
SSDEEP 96:xHAUTUHqGqXfUOdNbzSmIISSlcdv9jSqnSH3MkN/Bw88H8L4cnEVVREGS:qaRXfUOdLhSSlt3MkRBw88X+
TLSH
T1C9E1217890188B6F74B677AC6C688C315AB2013BBBBF68D750B544C4055CF3486F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs-1.js
Size 8KB
SHA256 6ca4b51a72457aff41965b024fa3ef5af513c7262d26e337857de7047c09625e
MD5 bcacca9e1b700d49a4c876d40e832db7
SHA1 86ec21153f22a4a82f71abe6f1ab250280b2f680
SHA512 97c29fd47b0df39f95736d6f5245febf3f7e2c325b39e1f27c7a234b876267b13b59ce70c91766733b822ba681054ba8798f35acfa4aeeac1a1d411302a96272
SSDEEP 96:xHAtTUHqGqXf0OdNbzSmIISSlcdv9jSqnSWRizMkN+wBw88Okza8L4cnEVVREGS:qLRXf0OdLhSSlsRAMk0wBw88Xzk+
TLSH
T13D02FF789004CB6F74B2366CAC298D705A72013BBBBF6CD751F94485092CF3441EA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 12KB
SHA256 b6c585c297fdde6a4682586d54040cfd38d5631a98cd0747b421e81e9506e466
MD5 f1c7818c06e22b984bb1a06807819131
SHA1 2ef19f0a4b01f428451c61fba769038091089d07
SHA512 4604f305e8b90beeab3b3c4d07f7398764e20b582a2b1531f6b1bdba52d95d489fbcae0a2ca55f06a8c6b42a9940db919d826af60b2630d8f7222cb0bf3983d1
SSDEEP 192:qLRXf0OdghSSlHLRAMk0KJmBw88dgLiHjIH:8mRAM9KiwOqG
TLSH
T14D429D3850448B6F74F2367DAC264EB419610137FABFBCD646F984814D6CF2481E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 12KB
SHA256 12ce6288483691a33732c9e78721405c55edff63fa6148ab475d43d35be11cc1
MD5 dada73c6e7be153cb0bb8a438bcd0802
SHA1 b21dabeb0627d494c783ab90c5ce587834fda325
SHA512 e00b4b460785f44fe3b9b86e1f261f688dbfcad2be6d6f2cad05e7e8fd1287de5b29fcb4f9d490a278f0e8d11e2f0fab7b260c87eed700c6d83b72001caa6a85
SSDEEP 192:qrCRXf0OdFdSSjLRAMk0KJmBw88dgLiHjI3:rLRAM9KiwOqy
TLSH
T15D428C3851448B2F74F2367DAC264EB419610137FABFBCD646F984814D6CF2481E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 11KB
SHA256 8f696158f86a51db005f0ae602d0b6b8b8c571fa29fc69ac4bd52bd5e0bf49b0
MD5 b680102f228f6f45732d3930e72a868e
SHA1 e1314f6646a6dcd29976a2ad0580330a9c2b0875
SHA512 a10616327cb670a410518d919487eb9b3b0d73f2afe229bc0db2df08a6c45c73c57d4733687dd9dc81b745635429667392bc5962e2684cbbe2c6a2fc620c5a91
SSDEEP 192:qLRXf0OdghSSlHLRAMk0KJmBw8OdgLiHjIH:8mRAM9KiwkqG
TLSH
T1F7429D3851448B2F74F2367DAC264EB419610137FABFBCD646F984810D6CF2481E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 6KB
SHA256 7e854b6e632ef678e94698edefc967509289e57dd8364d95ebd61b578e50f548
MD5 89a922be2c766fa10aace02e4a3e065f
SHA1 3e21a2d34dcdfaa1bbbffbb9066632ceaedecb8d
SHA512 e53e3297b8989969aacdc10ca11ee9600d53243c214e7f4c4f26f23ad1a79603261cbf93332a94d22356b47d476e7d5e4eb236cd40ba9a86025e88796f510ee0
SSDEEP 96:xHAUTUHqGqXfUOdObzS/IsSSlcdv9j+nSH3MkN/Bw8OH8L4cnEVVREGS:qaRXfUOdVNSSE3MkRBw8OX+
TLSH
T1D2E121789018CB6F74B677ACAC6888316AB2013BBBBF68D750B544C4055CF3846F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 12KB
SHA256 c5798061721e956333c274b90ea3c8daca863111b33ea677fcdfa0859fc40ad8
MD5 066347f50fec5a3ac44f61c4ac5ec2ce
SHA1 9850820d7a588f0eb8f08586b8ad2516254e1aba
SHA512 ad352030270b16d61f027b1191f804efa1d8141f65c067aee0400b38f2093d54eb259e41328b66abb0781351225ac21e0ff58359a18a6ca69c0e7899e3bfc5cd
SSDEEP 192:qLRXf0OdodSSjLRAMk0KJmBw88dgLiHjIH:8URAM9KiwOqG
TLSH
T1DD429C3851448B2F70F2367DAC264EB419610137FABFBCD646F984814D6CF2481E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\prefs.js
Size 7KB
SHA256 82ca155973ca88cf714de30e936dae4fa8cbd658989a4fcc1f7e8ecc4de52fc5
MD5 e744752c93594e4d0882be8fb4d6f0c1
SHA1 d31ce5e3cae11076c153c6e2c61a8ed8814f6611
SHA512 7af07ccd3eff58999ff49823cad2cfd54b3abd35cd6ee42b0af1cf16a9fb5c2026b30c1deb85a837a89fc45aba7db0050612d60c542486cf1a7acc6265d7c430
SSDEEP 96:xHAUTUHqGqXfUOdObzSmIISSlcdv9jSqnSH3MkN/Bw88H8L4cnEVVREGS:qaRXfUOd4hSSlt3MkRBw88X+
TLSH
T10BE1107890188B6F74B677ACAC6888315AB2013BBBBF68D750B54484055CF3486F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\protections.sqlite
Size 64KB
SHA256 f47973dd13805200a469d534a0ec50e224f0c12ae77d93a0e5bcc267af19c145
MD5 63b6f9d979a2cd96d93c105805cafcfc
SHA1 5fc70ce8799617202d1b2a350f6d596b65d48e54
SHA512 ca475720928bd40abab686efb8b890fdccef59c292b26263d41bfd9dfe8f35d21405820e10505fa7cff49eea5ae57ffdbd6ca73d5cf6e1cfe67f5994d2823b90
SSDEEP 6:ltBl/l4/WN1dR4BEJYqWvLue3FMOrMZ0l:DBl/WunddfJiFxMZO
TLSH
T1BF53225E47387021C0891372ABD323923F3CD2FA93232E836A100C358C0A023B822AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore-backups\recovery.baklz4
Size 16KB
SHA256 1f0f585a5aae2ef7df8025ee0a02c9fbc2c3692a5c499838c735624a683a749e
MD5 4487817b9f45f59da8291e1975dc0e40
SHA1 267fb77a4678fe693115982199b167bf24d6b7b6
SHA512 fca2d2f9f81a999a9e9d6ff133aff02791dceb5ad89dad1318668db016ea2d9bea147b94f3012654a21c6cfa6259955521a346aefcdd130dcb25b35905ab6e5d
SSDEEP 384:V0yd65cewpSRTs4DCUA6691yE+jSPfnrOisXx8JCq4s8TC:I5lMSRXDVY1ejafnCNACrO
TLSH
T1B172BF33C22B3CA5076E70544AB42C4E25C92D43C6BBDF09D9113A763976BCE9F4E298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore.jsonlz4
Size 15KB
SHA256 2059558764a344b20d34b2b9b1dd28ea107c3d80f3885332a52bb268e1a15377
MD5 dba2b7f9d59d6a74809f6c75352f6fd4
SHA1 df2ae20164ebe03b601968eac3058afa2df8455e
SHA512 f8d81784ef32a79e08a4becce14d707a1c1173e90ad1b393d0a5af2384f561073f01c92e09e19700b5ca3fe4145e32f4b0d42f2a113b348903aba87e95d38c86
SSDEEP 384:p148VQrcewX8EWFkD0dyCRrMoM68ObS+pzD8dm:zslFEukKyqxwdQ
TLSH
T19F72CF67D216ADCAD67466BC06D41D1AB3EB6CC2C4E98A1A4C3433B610F6EDA1FC5220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 1a8f6288273c3b5426af0db1e2d1da543cf72e5d4cf2345d9dfecd0c1ffe098f
MD5 a488e9d37b9dc7bc248e3e0bb1784e64
SHA1 a835e331905b842ebb568b6ef013268254f1c2ee
SHA512 84a3e33a8a4f79cb1462addb8011bc971acadb345f839b694edfbbf3fdd539e195985a687b1e82a9a9b498c76e6aacb193350da04721b051f19178864dc9e8f6
TLSH
T12B21F992887F1DF27E558255E48D8BF3D3483432C4F628B0406C8E8B14EF06A778E229
MD5 SHA1 SHA512 TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage.sqlite
Size 4KB
SHA256 137f1669fe04adf728d4764f4c0a377a26578eba4c0240a7580d3d4e973312fd
MD5 b6dbac50959113f8377d69e76dcef777
SHA1 adeeadd040e8e2c46277226b36d2d50d96f4ec18
SHA512 f03c8cd2f64c40db2bd771fcbadbcae3e2c02b5d006af34dca333e3f450b9ede0a9a79781348a363b9652362192da6fe4ccdedddad8d7e3a1215a26cf5366262
TLSH
T17B81A0DF0F18B500C0A1AAB1A0E03DC59D2B125F4A4B82C21D6440FA9AF25F19F169FD
MD5 SHA1 SHA512 TLSH

Submit Download

storage.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage.sqlite
Size 4KB
SHA256 1db39598ae2ee67e7a598723a6ec07a3b74ab17ef166a2614785c74c43d1c5c3
MD5 701bd81ab9bb9fb95ec393a557d20be7
SHA1 7f6d6f5a146ac2e0c5f5424da7d7199ca8b6662d
SHA512 4f6b7a82f3361c2f452f0093fb0286acfa898528a2933f501bfe627993899cc77e136c435a0cebd95457c72c604b030b46dc07fb7b2b937d67ce3dd46179fc5d
TLSH
T1CF815C8D1F247A00C0B057B1E5E00EE35E3E111E4B5B95C72EA011FACAF35966B164BD
MD5 SHA1 SHA512 TLSH

Submit Download

{eefb54a6-f56e-4eda-82cc-3372a4174131}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\cache\morgue\49\{eefb54a6-f56e-4eda-82cc-3372a4174131}.final
Size 404B
SHA256 ba3629c199956f51e9256ed5da1375954a0197263210e8f39a4e002329b71af0
MD5 85051cf42305694e9081822a85c9db9d
SHA1 9a0d7f1155462e0d8ffdf08d3d82057b538726e4
SHA512 3f9214d83f9c947d8f52e0ce2905f67192e15774a1f79a03729b2c32e955a31d2375c4213277e2623cf1f3f5922dece3733a89981e1eaccdbca1a9c89ae3c848
TLSH
T131E0F11BF3E974DC100D5B80BC6E7602ED4034FD83E840D9C5D01D33B364EA25242B98
MD5 SHA1 SHA512 TLSH

Submit Download

2171031483YattIedMb.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cgoogle.com%29\idb\2171031483YattIedMb.sqlite
Size 48KB
SHA256 47e4821a465a55b2659c56c43f4b7204734c112e6544274f80331e101818bcb1
MD5 2b4f7a4bbe970372d43ae2b246320686
SHA1 8da1176d2da575d93e4a97239b385abae6613dff
SHA512 060f5e0d0b5cf3a762cfcaca47f960f4a8452384d569524fdc019068910ba0ba2351d865d3d2a6f6c5016de5d5099b606dbc18435373aa96643f60b8af0f90dd
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE4B:Oa16S6CKnqlizbxV+2xVeU7X2B04B
TLSH
T1A8238F8E3F07F911C53AF0B178A48C51BC5E321E07222AD569D0D9E4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1657114595AmcateirvtiSty.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Size 48KB
SHA256 24c7af7095152a9b9ae8586c681bd1b2bcdb82c99e32ec0d2c2c4fb1a09381ed
MD5 c4f292f35543591afacbd4cb18d60c76
SHA1 0955bc0c53c3ddca0f4443541796a37419876e22
SHA512 8eea57ed4b889b69ba7997000eb3cc5a1eef5968c96d11d22d550580b4af2148fe7e5eea838fbd0dcfca015e89f60d8ea3b2722e35d57792510e6468b69e816b
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0mKc1w:Oa16S6CdFAWT1
TLSH
T1D623808E3F07B511C53AF0B178A08D51BC5E321E072226D669D0DAE4C8F215AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.6MB
SHA256 1be0534a2ca9936ea7b020aaccea6505a0921bf464e423db2952d99429f45c37
MD5 91c86dbb93d8b0f4a00a4a7b648b4cdf
SHA1 844c5ad6858d5438996bc0435600d75d21da64f3
SHA512 dfe5a5664eaef885dedc33aca41d886fe5547f36b34a3af5d1680a365ec2b8a39cb86647e3599d6af444d52a4b1b44331b6b5be3c971a80143b64f85d254f973
SSDEEP 24576:DgIayvhYoRQ+pPS71CAEh1VRYCJ/cqWlKkhXjiGmv:DpmKQ+dS7sAENRYC5EYkkn
TLSH
T110062AF860D1A243F3424073B64593EB21EFD00C6027DE0447A956E9A479CEF9E56BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.8MB
SHA256 17decfacec5e4282d6c172d2981baf74c955873eabedf099f18c913dca38220e
MD5 6227e910b219fcbc941fe6c8fbea8740
SHA1 fdfa5e55bcf87a3fabe67423b4d4bbdd59ce1571
SHA512 25b4a99a4078d1cdfca2b9e2d3f0e9d753da6b6ca5042d80cc83850b991781a5c0e56c53d73852e828b87350cc29a7ed84c079638273d34eb995078976f6990d
SSDEEP 49152:nk4k7RVaAIoW8zN6wl2M9jlxCocwuAv1/qw1OH8AheWpBug/TkSclvBMD1lZhD7O:nDAWVD7qw7F0a0N0WV
TLSH
T1F7565CE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.1MB
SHA256 5b8071f12c5f36495795a25140ba90bedd46f0402f0a3dd4575472985a7034b0
MD5 758ea844be51793cac9dfb050c28e4e2
SHA1 5c54d16c611f64c39c36ef859da8798e0f2e82f4
SHA512 d569a49fc9518b289c9f63df0dc09c617ac86898b265095b5205053bdcf700005494ab34a66c255abc7275d98b346c7bf136a0bb3bdd516242436456a598c805
SSDEEP 24576:JgIeyvp5og6+NPS71C1Eh17RYCeKMxWVhw4cH:JpHj6+5S7s1ETRYCfMEVFS
TLSH
T15DE52AF82092B357F3418033A64593EB21AFD00C6467DE044BA956F995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.1MB
SHA256 4b197103f37834000143e4d43465a93c1db749b3e33d47b4217e5dbed990a26f
MD5 df6ffc78eb5d8af106c5cd9c92390e1e
SHA1 33335a006433dfb8d68dc16ac6c56f0e677434d3
SHA512 3727877133b1e5e0db846594f4cf109d2885939641db08bc525a1542864f200909c36fe202eba380bad1cd0d8b2d87fb1c0704a101bbd956db26822ed46b5b8f
SSDEEP 24576:HgIayvhYoRQ+NPS71CSEh17RYCeKAxWVhwxXx:HpmKQ+5S7sSETRYCfAEVkB
TLSH
T148E52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\xulstore.json
Size 167B
SHA256 c9fd45df3105425adfc1726580f9ab27794c1916a7a746053c8f5c9425607c7c
MD5 911f0530c489cf5efd8dca7dbcb617f0
SHA1 766ad780ef25ee710ebdce7fcc2f74d2cbc47ece
SHA512 b428434f370f212a5a1019814afecee269b9e48bb993498df665588d3b419e6eb8c885c3f52fe46bf066b34262a61e8f7ef2ed94db4bd4c6135292f99f97a455
TLSH
T179C08CB0217F98097E178BEB02CD2A983D388A54A1C016A7A9E698B0188430FDD18399
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8bpv94fp.default-release\xulstore.json
Size 138B
SHA256 241d2632375974555d90f2cca717a4d69881807165d6cdfe116d9235a5d80ef5
MD5 02c8c0fb29759badba9a0fe9071d456b
SHA1 a7c9e00ad73e0219549bfd36bd33d0bb30041879
SHA512 3a6333342bdcb7e2b5d60b5a1e8720bb64a2dd0b61c7ba407032594056f23fed103f3e76bcecafff10272e0d12e8e289cc6fd8b16f36df201cce09d67a218745
TLSH
T127C02BB0215FD8087F178FEF028D2A943D24455081C01163B9C214B0004030F4D1C348
MD5 SHA1 SHA512 TLSH

Submit Download

Bonzi.dB-IDrLw.zip.part

Path C:\Users\Admin\Downloads\Bonzi.dB-IDrLw.zip.part
Size 49.8MB
SHA256 755bd7f1fc6e93c3a69a1125dd74735895bdbac9b7cabad0506195a066bdde42
MD5 65259c11e1ff8d040f9ec58524a47f02
SHA1 2d5a24f7cadd10140dd6d3dd0dc6d0f02c2d40fd
SHA512 37096eeb1ab0e11466c084a9ce78057e250f856b919cb9ef3920dad29b2bb2292daabbee15c64dc7bc2a48dd930a52a2fb9294943da2c1c3692863cec2bae03d
SSDEEP 1572864:JrXJmVPHHpgbw+ojykM3VO+4hG1peXyKRL2U:J1m5npwwRvgO3ipVAl
TLSH
T160B733778A0E926985F4F32786D6841A909553C91AB32CFEF3B16981C371FD70F39688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bonzi.acs

Path C:\Windows\msagent\chars\Bonzi.acs
Size 5.0MB
SHA256 f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
MD5 1fd2907e2c74c9a908e2af5f948006b5
SHA1 a390e9133bfd0d55ffda07d4714af538b6d50d3d
SHA512 8eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171
SSDEEP 98304:KdAMaWetTel1Q9ypfl1ydxUa751yGEFbnHEpAbY+/ERW3lc6u7/jtzVJdcbJ:KdAMaWetTeAkLIdx751qFTkub//73lcM
TLSH
T1FE361252FB82A840C420D6372D6AE9E17626FF945F53570E2F1B7E3C2672175E62B203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Peedy.acs

Path C:\Windows\msagent\chars\Peedy.acs
Size 4.0MB
SHA256 b8112187525051bfade06cb678390d52c79555c960202cc5bbf5901fbc0853c5
MD5 49654a47fadfd39414ddc654da7e3879
SHA1 9248c10cef8b54a1d8665dfc6067253b507b73ad
SHA512 fa9cab60fadd13118bf8cb2005d186eb8fa43707cb983267a314116129371d1400b95d03fbf14dfdaba8266950a90224192e40555d910cf8a3afa4aaf4a8a32f
SSDEEP 98304:3RgeCo7/u08ypDpzduZcdZOZQDyMvgk302Dm2yqJK9:hgnf0ppbZOZ0y6309
TLSH
T16316122069C0B840DD9496375F6DE1E47620BF8CACA7AB463A4F7EB9143246FD47BD20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-2843-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/440-2844-0x0000000000B00000-0x0000000000C4D000-memory.dmp

Download

memory/440-3832-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/440-3833-0x0000000000B00000-0x0000000000C4D000-memory.dmp

Download

memory/976-3814-0x0000000001650000-0x000000000179D000-memory.dmp

Download

memory/2044-3680-0x0000000002510000-0x000000000265D000-memory.dmp

Download

memory/2456-3689-0x0000000002B60000-0x0000000002CAD000-memory.dmp

Download

memory/2524-3818-0x0000000002A10000-0x0000000002B5D000-memory.dmp

Download

memory/2872-3815-0x00000000027E0000-0x000000000292D000-memory.dmp

Download

memory/3056-3684-0x0000000001440000-0x000000000158D000-memory.dmp

Download

memory/3140-3678-0x00000000027F0000-0x000000000293D000-memory.dmp

Download

memory/3324-3686-0x0000000002150000-0x000000000229D000-memory.dmp

Download

memory/3480-3831-0x00000000047B0000-0x00000000048FD000-memory.dmp

Download

memory/3732-3683-0x0000000002380000-0x00000000024CD000-memory.dmp

Download

memory/5200-3682-0x0000000000DB0000-0x0000000000EFD000-memory.dmp

Download

memory/5440-3681-0x0000000002C90000-0x0000000002DDD000-memory.dmp

Download

memory/5500-3710-0x0000000002530000-0x000000000267D000-memory.dmp

Download

memory/6092-3679-0x00000000028F0000-0x0000000002A3D000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads