d6082e95ec8563d8380f48bcad517dbe2e86e74d7f37fb13331b3dac693fec66

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/04/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oi.dll.txt
Size 47B
Sample260426-e3ta3sfw2l
SHA256 d6082e95ec8563d8380f48bcad517dbe2e86e74d7f37fb13331b3dac693fec66
MD5 1ca87e678a73d2f3ed7e4b5a2ed356d6
SHA1 9e375a02fea07a8193c36c348b43efbd4d74a1a2
SHA512 388480835f17fc7fd4e15aac3d0b1dc75c09531a8af78f721ae6827fda3ae74990c42f9a6b41966cfe5dacb4e5aa83a21de2fec3122483794579854ce302a10e
MD5 SHA1 SHA512

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBuddy432.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\bon4.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3720	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	firefox.exe
Token: SeDebugPrivilege	2788	firefox.exe
Token: SeDebugPrivilege	2788	firefox.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2788	firefox.exe
2788	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
2788	firefox.exe
212	BonziBuddy432.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2788	2208	firefox.exe	92
PID 2208 wrote to memory of 2788	2208	firefox.exe	92
PID 2788 wrote to memory of 4496	2788	firefox.exe	93
PID 2788 wrote to memory of 4496	2788	firefox.exe	93
PID 2788 wrote to memory of 4496	2788	firefox.exe	93
PID 2788 wrote to memory of 3200	2788	firefox.exe	94
PID 2788 wrote to memory of 3200	2788	firefox.exe	94
PID 2788 wrote to memory of 3200	2788	firefox.exe	94
PID 2788 wrote to memory of 3200	2788	firefox.exe	94
PID 2788 wrote to memory of 2252	2788	firefox.exe	95
PID 2788 wrote to memory of 2252	2788	firefox.exe	95
PID 2788 wrote to memory of 2252	2788	firefox.exe	95
PID 2788 wrote to memory of 2252	2788	firefox.exe	95
PID 2788 wrote to memory of 2088	2788	firefox.exe	96
PID 2788 wrote to memory of 2088	2788	firefox.exe	96
PID 2788 wrote to memory of 2088	2788	firefox.exe	96
PID 2788 wrote to memory of 4136	2788	firefox.exe	98
PID 2788 wrote to memory of 4136	2788	firefox.exe	98
PID 2788 wrote to memory of 4136	2788	firefox.exe	98
PID 2788 wrote to memory of 4136	2788	firefox.exe	98
PID 2788 wrote to memory of 3048	2788	firefox.exe	99
PID 2788 wrote to memory of 3048	2788	firefox.exe	99
PID 2788 wrote to memory of 3048	2788	firefox.exe	99
PID 2788 wrote to memory of 3048	2788	firefox.exe	99
PID 2788 wrote to memory of 3696	2788	firefox.exe	100
PID 2788 wrote to memory of 3696	2788	firefox.exe	100
PID 2788 wrote to memory of 3696	2788	firefox.exe	100
PID 2788 wrote to memory of 3696	2788	firefox.exe	100
PID 2788 wrote to memory of 5500	2788	firefox.exe	101
PID 2788 wrote to memory of 5500	2788	firefox.exe	101
PID 2788 wrote to memory of 5500	2788	firefox.exe	101
PID 2788 wrote to memory of 5500	2788	firefox.exe	101
PID 2788 wrote to memory of 5204	2788	firefox.exe	102
PID 2788 wrote to memory of 5204	2788	firefox.exe	102
PID 2788 wrote to memory of 5204	2788	firefox.exe	102
PID 2788 wrote to memory of 5204	2788	firefox.exe	102
PID 2788 wrote to memory of 1396	2788	firefox.exe	104
PID 2788 wrote to memory of 1396	2788	firefox.exe	104
PID 2788 wrote to memory of 1396	2788	firefox.exe	104
PID 2788 wrote to memory of 1396	2788	firefox.exe	104
PID 2788 wrote to memory of 2668	2788	firefox.exe	105
PID 2788 wrote to memory of 2668	2788	firefox.exe	105
PID 2788 wrote to memory of 2668	2788	firefox.exe	105
PID 2788 wrote to memory of 2668	2788	firefox.exe	105
PID 2788 wrote to memory of 2484	2788	firefox.exe	106
PID 2788 wrote to memory of 2484	2788	firefox.exe	106
PID 2788 wrote to memory of 2484	2788	firefox.exe	106
PID 2788 wrote to memory of 2484	2788	firefox.exe	106
PID 2788 wrote to memory of 2988	2788	firefox.exe	107
PID 2788 wrote to memory of 2988	2788	firefox.exe	107
PID 2788 wrote to memory of 2988	2788	firefox.exe	107
PID 2788 wrote to memory of 2988	2788	firefox.exe	107
PID 2788 wrote to memory of 3860	2788	firefox.exe	108
PID 2788 wrote to memory of 3860	2788	firefox.exe	108
PID 2788 wrote to memory of 3860	2788	firefox.exe	108
PID 2788 wrote to memory of 3860	2788	firefox.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\oi.dll.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3720

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27100 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {c79efb16-90a7-49c8-a6fc-fe35470ff2b4} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {b9f5152b-7ab0-4418-be7c-1bbb98b24a33} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 27277 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {c2c5c47e-0822-4b0f-9fd2-851c772bcc05} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27277 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4152 -initialChannelId {8a470bce-8194-481f-af3d-1916588e509e} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4452 -prefsLen 34776 -prefMapHandle 4456 -prefMapSize 270279 -jsInitHandle 4460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4428 -initialChannelId {b87ca52e-90f9-4349-ae72-eb9f586f4b84} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4896 -prefsLen 35013 -prefMapHandle 4900 -prefMapSize 270279 -ipcHandle 4908 -initialChannelId {da3db0dc-1dc9-4a44-a55b-b3f1235d5ce8} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32900 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {6efb1e40-ad64-4460-9e8e-a110fc673695} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {282e1286-f7a6-48ec-a4a1-529ea999504a} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {223483d1-bdaf-4506-84eb-2ec69fa51b03} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23152 -prefsLen 37503 -prefMapHandle 30968 -prefMapSize 270279 -jsInitHandle 30972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 18864 -initialChannelId {7e368abe-f25a-4ecc-8434-5efadfcd1cf0} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24408 -prefsLen 37545 -prefMapHandle 31108 -prefMapSize 270279 -jsInitHandle 31256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22568 -initialChannelId {a0f96927-415c-4c65-a942-7c75d1da4c60} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 30812 -prefsLen 37545 -prefMapHandle 30752 -prefMapSize 270279 -jsInitHandle 30808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 22776 -initialChannelId {dc9322cd-2663-432f-bf9b-46564310d75f} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 30484 -prefsLen 37545 -prefMapHandle 22244 -prefMapSize 270279 -jsInitHandle 22264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19136 -initialChannelId {b686a4b9-b1d0-45be-a14f-c8f1bbc0fb18} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 22748 -prefsLen 37545 -prefMapHandle 22752 -prefMapSize 270279 -jsInitHandle 30736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30688 -initialChannelId {ac857073-f080-440c-9ec1-0abcf047dcc9} -parentPid 2788 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2788" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3784

C:\Users\Admin\AppData\Local\Temp\db4a5e21-da42-4817-a570-668126de7158_bon4.zip.158\BonziBuddy432.exe
"C:\Users\Admin\AppData\Local\Temp\db4a5e21-da42-4817-a570-668126de7158_bon4.zip.158\BonziBuddy432.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3088

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\doomed\3088
Size 8KB
SHA256 6f76f72067a33867d67399adeeb9c61b0cea633744328b593b862818956e3230
MD5 d028d0b16bc2becfcec8771472e5573f
SHA1 9370e7735f3ec68baecaa754db10f8fbd616d74f
SHA512 ad9aff48222070ad9daaafa14d98b6c33ef1b13ee927d14c708a05dfa6fbc56397800118ce6117f229feb229830d3cc2494a6f986e4ecdd2a622c9e400e3c4d5
SSDEEP 192:LD5lfXGoPdj/qt6h85lfXGoPdj/qt6QA4KKfCPJMGna0AxkpQMWF:35VX1Pdjr85VX1Pdj6HKKaPOGnA0QF
TLSH
T1E8124C734E90B50C9B9242E1C54FB54B3D272EB396E9A4AF28083601C4F476AD9EF19D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2D826BD682ED46E2B50DA3AD49E455C6EEC72FD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\2D826BD682ED46E2B50DA3AD49E455C6EEC72FD6
Size 82KB
SHA256 0dd635a25fa51c1b6ed33cb7cffe6578860922055b85c3fa85ad9970247753e3
MD5 f768545bdac170fbb2557bf95dd55d9d
SHA1 2b6f1607f953d351f7321442511e3bf23d723872
SHA512 fa0612b9016628614b71cea595a0b257b4fb9682ec46f368022fb0f1179fcd82de5cac903e438b8f48473cb49001ddf9aec67e69209a369a51b9b3bd4fbfd879
SSDEEP 1536:9+BtIuGx2g9hqmCs7pV887zFOCWwS5Z9jBV/mGyFL9u8M+ABLPo2fd:KtVGllV8DCWH5zNA5M+MLPo2fd
TLSH
T16A8312B11FDCFC025F9AA0D2C40AD0993E7A7EEA50F6E81E15007D4285F46DDE56B06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5555110BACE184090709E65FDEF42D8CDCDF9B09

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\5555110BACE184090709E65FDEF42D8CDCDF9B09
Size 17KB
SHA256 62556d69637951f7b51dcbc1d211529fd528c14f41525b47a69c565c38dac12a
MD5 a573f241452ce476a74d10fc26ca35bd
SHA1 96dde53f58d76071b3819687e8d0d8383fa6d45e
SHA512 f4ee050458236dee9d6b9aa96dd2ebda54e3cdf76329df39846385b8a1c6180745ec82198cd891a0a9625aff2bdf3ae48c152dc841d3e5038da1e7404bb9f3bb
SSDEEP 384:ciffLdY0b8ptSmF0IeuYToABKXLw/CBKXLOHKKaPOGnAPsFs8:csBlo3SuNeHo4KXM/2KXiHNaZkUh
TLSH
T14282BF7BDF80302A4F9380D6E84F95669C211A23F6C76DDA3D113746C2EC2596DAF44D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6DED9FE7A50E8290358DC1D8C755B05692CB9E36

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\6DED9FE7A50E8290358DC1D8C755B05692CB9E36
Size 512KB
SHA256 720cf938348a54b53640573c40ef88e539ff48bb1e840c567073e45d595f0078
MD5 9cf253b738f620fd303080fb67698030
SHA1 eee9a487e4375eddb4452a17207942ab902dedb5
SHA512 4c9d073042cfe31cf9ae66193d46b351681ba4c3f677dea33e4475e216bec81f123030e566fa24f884490b4c72b929598d425b18560b4da4b61f83ef0d113063
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErZYS:OltBL+PLQFZBgBo2xAzpsrZYS
TLSH
T16DB423ACF72B3668D37A9C76C257C4F857A8DA2B45523CE80C8E014E6180AF136963D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7D688EABF59894BC13A12B6F68D9280D3C7B5D62

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\7D688EABF59894BC13A12B6F68D9280D3C7B5D62
Size 224KB
SHA256 9fde1ae15d830c1a2077d3e99051be1ffc6bd5e952359df64c46e0834fc0b896
MD5 0a6573acd6ca45e380ccaf4430ed9a1e
SHA1 2177a0c864385df88a7dd97adbe842db8a156cfa
SHA512 03af46893a01835c78a429589486d4c11ed444807a44caf62420f86569a57947ff0e14a2ffa85ebce354e69c7e0a3cb90d1702d95f8cb66d505b7e8c0fbe83b4
SSDEEP 6144:e1JPMu6f828oXRhKDml2WJ6k2Ra50Y93BsitKSBggV0nx:e1VMu6f87oXRhKDml2WJ6k2Ra50Y93B0
TLSH
T1A924F727EE515A53C82007F040EB27363F35E0416BA6F32F6ACE7226BD5A3791D615AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C06083D0E02F6E29EFCD0CEFB4578877D226E5F7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\C06083D0E02F6E29EFCD0CEFB4578877D226E5F7
Size 16KB
SHA256 8be179d31ee1fb90ec5d91fe8a9ef82be9493a327ceedf55786ef3e5055c483a
MD5 081c9c75d9f56d78d0ffc376ffe59fb9
SHA1 9621d1d8695970c5a80e5b94a02c59d22673ac77
SHA512 92825ef1532aa865883555f97f28a742c0ba7dba07ef8c9e9e9a16da3fc37287ea15c1ed18d84ef5a7f6a41ca25b6c3383072357abdb4fec0e05410f11bc37c3
SSDEEP 384:XlhuWvcqFa3dPWlUMokIx0xnLBKXLw/CBKXLOHKKaPOGnAPl4l8:DuWy3dOlpIqVKXM/2KXiHNaZkGW
TLSH
T14E72BF77DE90B0594783C2E8C94F91666C255773D7CBE5DC3C41224249AC0ABB9BB28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 eb51550965ecc4ac98a6bf696dd265e0cee8b3343b24c03c87b5117c866146cc
MD5 1e9b99aaee02d2cc80b51e3504e50273
SHA1 f0fee567b84d75ce9e92c2fbd935de361fbecceb
SHA512 e2c7350e51225d25d7c3fa2bb73d7b37245399dd438d5bfcc10ae0c5e9026144be6f1bdade3dbca877ff36b8734b91e68b12f8c466ca6102fbbc0a425ce98610
SSDEEP 384:HbaFrLiO024YNFuhw+5EL1pPsac4j0lpDII+hxmx9:7aAZYNFuK+5EB9sac4ID8L6
TLSH
T13F527E7D9F013CBA1A2BD194D8AE5218CE04D6BBDEE2D16605143C44CA847BCB8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFFDE4A2DB40446A305AC889B4998F8963630965

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\luq7t40t.default-release\cache2\entries\CFFDE4A2DB40446A305AC889B4998F8963630965
Size 155KB
SHA256 5a1e781edddf826d48d15db4e44622c787fb4ff9f07e9475c9ef02ff692f029a
MD5 05c1b3375809586c6cb34821c754a188
SHA1 5c3dc896dd8c3777b6af4d72a04cd87ca97bd2d9
SHA512 7830aad7d91a63aa28ffb3ed5ce5a1055309dc03f2369a18cce00323b32327c1de17f580eefc3949da26919c5719d3064b16679a5a4782a04c1638fd757c5057
SSDEEP 3072:Xfk7u75wPcwhnbI1ks7ar41Vm0BfOcyJnbIDks7ar41VmiBR5PoK:XnG5tEUd5Ed/
TLSH
T169F35ACFB2C1B3249EF2A1F2504F544A527A60489DD8289F7910F6F42E7458B606BF7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44327e50-1217-4cbf-95fe-c13097aa990a.zip

Path C:\Users\Admin\AppData\Local\Temp\44327e50-1217-4cbf-95fe-c13097aa990a.zip
Size 3.7MB
SHA256 41f88315ccb5feca6d1f0ca29ee131700bfe0f0a4a0cb4cc56912f7525275fab
MD5 3161f12ccf7dae28d5ba50957dcb38ab
SHA1 28750e8ab50cbeb7918f8b0e2c64df1d12a6f7f5
SHA512 f8a64ea32e684e0c7ca84f7faed743c74b31f194a8f8412cc41162c89e6c7a93dfbb90dc8041ce8e5dc101522c06ac68a4a57c12ad68baaa26072a9327b452d3
SSDEEP 98304:yLr0Cmjpv8wpUBBQBMEfINmTn7ylp5MAU:ewrtUQBMEfINmT7+MD
TLSH
T17E06E035DE9C1E08C98F83FA850C2FC29B4C4F668054A95B7E6A9571DFB31A21B47B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 18.9MB
SHA256 92ac4503d850d61341c2b89b0ca25ae45a875f85e7ab7018354cef9a0b37bba7
MD5 ca2e152cdecfec8997a5467b9c3ce569
SHA1 abfefa098053f20577c867069ee2fa02c768c907
SHA512 7b07d200b5a5dfa88e22cc293be9f9fe0f26e3b927ca0222958c08db650590907bba852083562577b49f58edae676594ba4a1d8163bf07f102311a77694c0c8e
SSDEEP 393216:YD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5o:rGD+l8VmuZ/S24/junfSFwUqYg4z
TLSH
T18B17E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\AlternateServices.bin
Size 10KB
SHA256 fd56b11121a275ad548a58446a74a979d49f4e4667e1aa45d1d4a6d98892ef27
MD5 6c4b7c9e08b87ae8491269e322cb6b93
SHA1 b467959118d461a04cbd40e7b546e222444f85eb
SHA512 7284aa33bba456fc4293fd8bc3b928ffe70eb3b2aba49eadb5320f1ef580cf675bb0f721fa85d005948a59b22305782ddacf5c2dc30557a8be2d2793cea04fbe
SSDEEP 24:iuhMZnN+lz+E391w7cr9BGi9x6s9VvOD5q9F55A5NA9lG:c4nEYMQoeBONI56NKY
TLSH
T19E2262F71B726462F0928FB0909D754C8C37172A59AD91C4C76090FB06C1A99D17FFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\AlternateServices.bin
Size 30KB
SHA256 39b1559c63bd5b14f55df18c54837b95761b30598542d57463459fe230ecbee3
MD5 009cedc5fea91775733d97c158812c1b
SHA1 d2b0e09b689f9e3061be296f4adb0a0e9dcf9223
SHA512 06d624a4a07ddb28da2676ed016d1dcd43bd5bfc484631b2893f75d9db7a7c40d000570e4d7212ddcba408b51a6ea7cd50efbac5e47f67f40dace6a09c09edc4
SSDEEP 96:c4YVUY3PXBJWI56yb/LHrM/pAg4LLcCDfBe8t1scy00zkjj7j8EfbEbEFOex2sms:2Q0xt/YgsS2zFZCYk
TLSH
T100D285F727B164A2F0A28FB4909D748DCD37072A59E892C5DA1494E603D16A4D13FFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
Size 43KB
SHA256 0e064907d5727a455298b7d7be0521c43ba674e4810f5d37a69204955098c842
MD5 dc778e95c6c1edfcc8ee87f4783ed9a8
SHA1 70ab7e0e3a8118360ecfe2b112ffb136fec29553
SHA512 53adaf9154377f59de6db4a890d17f8e9256768fa4c59c66b216b42ce2e3abb256582a325e7fce4924e7e477f495cb9fdbbcdc8b51be2a3c7abe7ae9a7f50099
SSDEEP 768:1UoPgiZPJ45ElpSayOS6Gcmhu19KsIEfM0X58yr9bBbRbwb7b9bYb3bJb1qzUiF+:V45ElpSayW9pqzUiFsHMo
TLSH
T16013FE44EB1A953FD82812BBDCA217002F39F889595A2F67375C64786C872DC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
Size 43KB
SHA256 db37f520c4d9d219ec406abd2268ffb502ab8f1f78b711c62bc16d29396d44a3
MD5 22244c4c24e8a509a5b3cf83c2203038
SHA1 dcf8e48509ed8a52f4332821ce5f31987bd770b9
SHA512 9d805c45184029fc823129351e079e4df0a7720daa9e67192e7e9979033eee170d859d4103c9bc7f7162c51780f6a2c82971cf4c3d34d6e0bb620912d1ad9500
SSDEEP 768:FPWUoPgiU45ElpSayOS6Gcmhu19KsIEfM0X58yr9bBbRbwb7b9bYb3bJb1qzUiFL:x45ElpSayW9pqzUiFsHMx
TLSH
T18D13FE44EB1A953FD82812BBDCE217002F39F889595A2F67365C64786C872DC3D9E06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 848b71f2e85a5924b1462612f4baa8e64c054208b853e52c671e87190aad809b
MD5 e042039d6e6c526b0028f7c06f3b8b77
SHA1 3c6ade40098503bd56f91e73091324b89ac91a5f
SHA512 27fa796599a8aca88929fdcd4b39de8e393c894ecfb57a6fcd7756a4d7dc6180142fa3c03ec318b406641629665317b79fbe5f249f468cbb51567dccdda9c0ee
SSDEEP 192:cW1d66Joz1zgCl6mc0dkUvOv5zboyZmQCIyjfBwP:Dd66Joz1zgC1jGUAboyZm/Iyjf2
TLSH
T17AE11E64E628467FC448433BDDA21F810F3A389A984F7F29719D640C2C5B6DE3A8E07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b05b7eec7afa1a9ffaef8b40f8a9dad2f30cea34dccce7a55666394251029a88
MD5 f8570196ca8fd051a51ecf6f38c5c062
SHA1 72e1e436763fddf5178fe193fa90b438ec094dd0
SHA512 5e304afce6c57adab316490d6ac0b0e84666f387396ace58d5e58cdca8feaed3134568eb5455b6a93fdd71f66880a2ac21c5ab74cd12892037e93c8390a8ed5e
TLSH
T16521259C39B94D6EA98BF2987848028E53254E0654C72C834D42DFCCCCD5AD9726AA7D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\events\events
Size 5KB
SHA256 98ed88ba1b882fcbfbdd85753ed97fb94006be9923e48fcc6b6ff04f9d5c32fa
MD5 706b9c7e0623b1188a52d5505740cd01
SHA1 cee76e64028d9365cdbd5aad979a8dd68b38cdbc
SHA512 5fae6de96cd17cebfce49dc33eb0e72bd7e862d9937ad77131474ab0c278fa5714356d006c48a0d20c9ab8c8747c7b3175035ff687a6c5747ec0e147ff718d30
SSDEEP 48:Yp7XefoR6/v92lVdpsw5qZfNnKaqMhKj/PjpZpf3gvT8MaZ3aMXYT0Bi/PcDYHhq:H9NTwajhqnVrXQ0aHHoq6rX4h2
TLSH
T1FEB1004C61B90C7E6EDBE39DB846028D42A84B0294C71D874CDBDEC9CCCAA5D325F679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0870a257-5041-468f-a35f-d7e90d4593b9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\0870a257-5041-468f-a35f-d7e90d4593b9
Size 11KB
SHA256 acc4a9a7ec01cbc69189433e93681882f659b9f0c5fbe1c17359b38df01fea1d
MD5 31d233eec1fbfde5987f260b07d17e98
SHA1 54a1e13cd4f747cfa8a53fc99b09d46f170ea24d
SHA512 d07a17a2de5b6ee523f2e380020bed8250c521f13497b5858c081e302e5c0be56fea7576d605daed9493134bcae1179b2680b2bb8e4a500965fadc79e20cd817
SSDEEP 192:W3vCcTbUCiIAi2Z1ywToxPXJQSD9ex8xZi:eCcTbViIAi2ewToxPXJQSJex8ri
TLSH
T10932CBFEDD2241433A65F62DF1A8AEAB005A293149CCC79C6AFC4C3A32D2DB71617314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b340bae-f58f-4864-88bc-c353ed71ad58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\3b340bae-f58f-4864-88bc-c353ed71ad58
Size 886B
SHA256 74912a8143b7b64ae1adca74a5e9589d4cd18e206170b611a2e77342b9c2bae4
MD5 c34db64e45a1d4f0866e018a82cd3711
SHA1 f1edcff82d8556f43248faa3b4f7718e76155c72
SHA512 7148b0411fb6ac881f3c8bc2caa33789e0320d45c089a818f6e98e723b1e30aedf28dae995673f6a71e83aa007162d6a1b78cf93d2b70516948fdafc895bc82a
TLSH
T1EE1100408524B9F2CDA8D25BD9E27BC347E4B02780C748247EA04A184DBA61F67E7607
MD5 SHA1 SHA512 TLSH

Submit Download

4364ceb3-fdec-496f-a9c9-dc04705480f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\4364ceb3-fdec-496f-a9c9-dc04705480f9
Size 2KB
SHA256 6fdd995178c5106117dbf8c405190f462f48969dd80a64329a7e3c32693a6de8
MD5 ae95423f4f72d0f41b3390557b550d2d
SHA1 61780046e4df1ffe135ff77a672da1cd283009ad
SHA512 d637eae93862f182b1678e1e78ec35597a80e8522e0f53d0fa251ca10a5c76076d72ba817cd120bf29c774fd157a1c4b2b89301a259f978273cd9f78841081f0
TLSH
T1F651A5659120D8BEC97DA31ADC253BC38BF3540B408B194EAFE89F0A117F90E9399605
MD5 SHA1 SHA512 TLSH

Submit Download

719ad02b-1e50-45f3-a616-d337da08057c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\719ad02b-1e50-45f3-a616-d337da08057c
Size 235B
SHA256 e3437ce99392c31294643761b16ed60a7ca1c3ed89762d8d25094aafae2e16bc
MD5 4a60672577e5259b1655db7200eec6cb
SHA1 fbba290c32dc51d2ebb460bd5e8d1114bebd5c4d
SHA512 4d70dd8128add4918fca418fb42ad5e07250f315a407193c01f1004438387e0c2dd1978d4b3c071c06c85989abf814090aa1c2e6ee458d2494d9335a3b6e7209
TLSH
T188D097801498272C09284F07F0B02AD230888C332868681086A04B759ABCDC88172C16
MD5 SHA1 SHA512 TLSH

Submit Download

891149c2-057e-4c77-8089-bb15d5a33cc6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\891149c2-057e-4c77-8089-bb15d5a33cc6
Size 2KB
SHA256 f8b82ff2b62c8af41fe00911a3feef95f26e75abf835fb36ef9af405e7d20b28
MD5 63bf0f1df3d6ff8e0cb9cfc2bc08d00c
SHA1 a73158393dbac14fad1f30040165345960d5e739
SHA512 344a4bf21976f7c838af389cfae23310728abc3c0a72392fd05bdb39078ce618618850eba2e09c72ffd14903ba416384ff4813373fb4bf11224513388dc63019
TLSH
T13441665835749CBB8CDAF19D9482338E57748A5740C228936E41DF0CCD867DE33AB82B
MD5 SHA1 SHA512 TLSH

Submit Download

9f2f352b-55b2-4eb0-b7b8-38fd0faab9cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\9f2f352b-55b2-4eb0-b7b8-38fd0faab9cc
Size 883B
SHA256 38637058f72549038df3e5a16fe8fc1ad2a179619edddb02914c53a13bb9365e
MD5 42dbd34f77ecc6389f5f0be1b68c99ed
SHA1 91184734ef3fd3b3d59d64d28fcad96f6d242365
SHA512 efea4bae89ae2772506cc415d463208644c4221f04fcfaeb3fc185b22076c9329bb5801b12b16bb213a6b905879e47344f90125b3b36e18c261d2bde2c0ae2ba
TLSH
T19F1100809624B5F3CD78925BC9A23B834BE5B12780CB94647EF01E084D7A61E97AA217
MD5 SHA1 SHA512 TLSH

Submit Download

fb8ca7ff-5384-4b35-8687-5f1523374a0c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\datareporting\glean\pending_pings\fb8ca7ff-5384-4b35-8687-5f1523374a0c
Size 235B
SHA256 319cfa26a67e6d021a84cd276cd92714a42ad7a61bc4a45cde007a2d75456999
MD5 beb0d3e85c8526ecc1b457b528e6d39c
SHA1 8ef844b9595d3dac723f4ad25a901ed6b3c41bb9
SHA512 53ee274eb90e410934eae61efa44ffe648cd835dbd0b8197758a1bff898ef2137abb516e954c1380e96a3830da36f93d466396a018b01da856ca7522d7bcd480
TLSH
T1F9D0978024C8ABBC08080F03B0E0A9C2B1548C332468AC1186A04078AABDDC51222916
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\extensions.json
Size 16KB
SHA256 310bf50a57b35e5bac4e3da01295060abe3bcbfdf78d928f1161542a35b71974
MD5 2b9eb60d9f77de534da7d50e5fbeb079
SHA1 48e36b050a79cad31f7bb8f6ee8b5e8e9cfed78e
SHA512 ece1c5b2384e6c31218e3ea4c02d4ae7224436cbd4dadda679a3e5dbfc516163a1b9cb2a8f202e4e8a397a046b7848ea995933788e41797a2ea57974cc79b156
SSDEEP 384:ikI4vzUmldvW8dhW294zH96o1CL4He4L4PHL4HSL4HQWL4HO5C4h/:VI4bRfbX/4x6B4/4D4A4wc4f4R
TLSH
T1EC72521545048EB8298FA79BAA367E01C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-widevinecdm\4.10.2934.0\LICENSE.tmp
Size 499B
SHA256 55064d7d8fecdd90ba36cebaff34f05583c183b34686b17b40b974442fc07523
MD5 d8a9bfce875f2081d41dbb18dc618b14
SHA1 5bc4e44bd455d8838fc382b5a5525aff1a117e4b
SHA512 643b0befb7244283f08188fafb2e7f96cdf82353d06ca5c0b25ad0157eabe786809677c876faf3b12888a8c3ce38e97c8090505b06c514370a16c955db3fd8ee
TLSH
T14DF09E7EBA224772459603C7011540D47B1707FAF25422D1B358C1E4276E27982FF184
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs-1.js
Size 12KB
SHA256 f0d43cc4d8602896e6cf71123d000d66448fa433397ee4226a87901a5d734f73
MD5 b4d3d75f76287f9a26f18096c094d8be
SHA1 abab24e59134cf7b3a479aca520a825b3413c4ef
SHA512 8b782ad7e994436b11ad0698da3867434fc0e7c79d8efc524e35abf53e415f976b51af41a7fd49bbaf4a3702f54886f44e9ca6bd2f6192c209a4f9b28e4c166b
SSDEEP 192:2cR5fnWyVE8CrSSxTLRYTmBw88nKj6bvvqA:7bTqRYAwaeXf
TLSH
T18E52CA3855408B7F69F2367DBC2949A019A14527BBFFBCD701B984D1058CF2481EABEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs-1.js
Size 8KB
SHA256 c2b352463d0a4b20695b948d4456752729787972ed5283d56ee0afb7d6732664
MD5 ec42d4e7fe5eb7b572cbc549bf0d788a
SHA1 bdb23cee30eaaacceb347aa44b0c9fcd553fe027
SHA512 0fd6473786ded0b6f6ec953a681cf19748a43ba4e073a56ec98eff398232801ea101ecd0477ca430dba9081cdefaf1f6e5b156aada5bf837428ac7503f5e689a
SSDEEP 96:xHI1TUSVqGq5fnWyVE8CObzSCSSladv9jMMnAWRkZCBw88sZ8L4cnFs7GmGS:2cR5fnWyVE8CwSSxQRBBw88srqA
TLSH
T1E002ED385544CB6F69B236ACAC2988715AB2453BB6FF68C710B944C4054CF3481FABEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs-1.js
Size 13KB
SHA256 8d175b2d2b3f1f5bc2c775f9c40bda305e0a143dd4adb45981533b6827ba4837
MD5 adb70ba0125e38aea4808e69e1ee0a19
SHA1 b29515f6d3c0e147b725c86520aa1b346dcccae3
SHA512 ca72f9257ce71ef80338f33fa1e72e36fe47b170dfa80c1cb1101340b48b6af0824ee8911b34261d70edccf79a8465d35cf3add9b240ce8c7c1ae0d34354d9f9
SSDEEP 192:2cR5fnWyVE8CwUmSSxTLRYTmBw88nKj6bvvqA:7bTfRYAwaeXf
TLSH
T19A52CA3855408B7F69F2367DBC2949A019A14527BBFFBCD701B984D1058CF2481EABEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs-1.js
Size 13KB
SHA256 46f6cf9ef469b73185498e23bc36e5f5dbda04446975314178370296b92584e0
MD5 19ea7c5cf5e6fca12cb96068816b2fd7
SHA1 507171f2cee50e5900a7a1c9359c3b355c923d92
SHA512 d31c8ec46021e4d0da226d598e3cc402968fc6a0982f133b4d18a4abf9de275493af7c1eb212e65e11741bea95319e3037c318e97c3473ba946929e04c3f4b6b
SSDEEP 192:2cCR5fnWyVE8CwUmSSxTLRYTmBw8OnKj6bvvqA:gbTfRYAwseXf
TLSH
T16052BA3855408B7F69B2367DBC2949A019A14527BBFFBCD741F984D1048CF2481EABEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 6KB
SHA256 b50b43c3634936e0b4fff1ed43624b679152da7ea8bbc8dc9fe64b26049718ad
MD5 631eea40124d84db3cce7004e4d343e4
SHA1 fa25fa2988507558b4effd3f232889282e1cce95
SHA512 d8ddf4c0f1fe5006cff8dccc206f770356ca5be63f9947bcbe0d31d19f6516dac23bdb42f244a7bcad24a49be9d948df2efc724323e0428ccf01c1e2935b839a
SSDEEP 96:xHLUTUSVqGq5fxKjqnjV1zSwoSSladv9jlnAHVLBw88P8L4cnFs7GP:t9R5fxth9oSSPFBw88BqP
TLSH
T16CE110789408CB7F68B6776C6C6888316AB2413BB7BF68D710B944C4051CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 7KB
SHA256 7d6aefb0dacbcb5ca3e9e4a1448d202f50c13009e11616b62f6c164340f4aa88
MD5 40067dd1954f18ea81f2e0a6b20a9b36
SHA1 f92d94dfdbfd18a68a0c2d675c6699df2a0c79a4
SHA512 13e79116673261ae6ac5f3ee73d286af2a127a8d11395b76cfd1e517601b6f513d4d122d76da2d55af42cde1a1e157fffcadff316258d396a8761348d64709d5
SSDEEP 96:xHLUTUSVqGq5fxVE8CObzSCSSladv9jMMnAHVLBw88P8L4cnFs7GmGS:t9R5fxVE8CwSSxZFBw88BqA
TLSH
T1C7E1107894188F7F68B6776C6C6888316AB2413BBBBF68D710B544C4055CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\prefs.js
Size 6KB
SHA256 17c8b9a121756934e8544819d3ee02f2f57fb672b987687ec07e253aba80407b
MD5 9c1fad39673b635cd0cd56e858160f33
SHA1 bf486dd5dcb7fe39036aa4a897cbe2f60727e911
SHA512 43ce6746c554d5f6c9c477689dfeb01d2517614bdeada65c8ffc294bd082cc93f18eb9a4f7f78c5f4e429313cb58588fcfce816f505f2a1b831c100b4de4a0d6
SSDEEP 96:xHLUTUSVqGq5fxVE8C1zSCSSladv9jlnAHVLBw88P8L4cnFs7GP:t9R5fxVE8CHSSPFBw88BqP
TLSH
T172E12F789408CB7F68B6776CAC6888316AB2413BB7BF68D710B544C4055CF3481FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 a3a0985ac60c6e2e4d2349718e186e086539660cb1113fa5ededf686504cbed4
MD5 942f38780e4dfb973c549cdd2d43c7f2
SHA1 e7f709a7659d3fac3e386eff64a3161925393c9a
SHA512 26e22622ec737cbf0255c3c9c0c7b5481a082ed759c1b45f40cdf33b1215f4fb240022a4bc5825810c329a3f5f138566fb0adb9b4f5305a68d2bb510a32f1964
TLSH
T1AE21E742AD4B3CB227948089C4CB2FC8EBB970718178D5F0E8546A0105CC91E339DB5C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 e67b487fc19311f427b5432d11f697e6475740c0fe094f960af52a0671d3552e
MD5 8019c15f63247c324c102a7ec23279df
SHA1 2df43ca9a47b39dfa3ac44da298b0ef8b7bc1f4e
SHA512 71e10c5b8ac974c532ee1cdac6beb618821638db57912069917901dbf0c59b55c4b49583d7f7cabd746689882becb8ae0de50f12b1983fb2979f463583226ce3
SSDEEP 24576:ZCWk+tIYI0Lgrb63BDcYrVQpa9dfH9EQ8lQyjH:Zjv7LO6pcYrVEa9d/9EQ+Qyj
TLSH
T14BF52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 11.1MB
SHA256 29fadb60ea57d2d89f1cee171ea56aa40734aae311a6e96bd42f373347ab2add
MD5 3487e622eafe566d576e9008aa2ef103
SHA1 9f6bf471397d8885743c78cef6644e7651c50e8c
SHA512 f3e7f91671562c9f3c9495b809a340c238318c047e4e0858d2d0b252538dd2dc28200f49b893c0711b8663ffaf6b393e005ca6d2e2bd3e3f9efc1974cb925db7
SSDEEP 49152:HwlcqmWo2E8O5QT/UbVFcw8YAV5CyD428e1IrcB6y1u:QldpDO5QT/UbVFS028oIrcB
TLSH
T1DCC6185270A4DBA2EE0086B6F30F53DB353BC2CC24D6849419B8B95C596769BFE2F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vS9AYcY6.zip.part

Path C:\Users\Admin\Downloads\vS9AYcY6.zip.part
Size 49.8MB
SHA256 049d4326a7eed6461e8d17151b69509c806e495aedb3e72d9093651087c2315d
MD5 3ab34ec8ca3c5dcbf7b2641957ca1e01
SHA1 af64bfe777ec16feae43da72820907d273c21dce
SHA512 43833599a6f712f3c6a394e336f741bdcb53894a9a354d523ac5fe37f9791b995d52d468906c300ba26aedf4ec9f7e73b4803f6ff68a99b1a1c1d800ea14fd0a
SSDEEP 1572864:2f3tqlRW36fvWTAjiR2H7KQvkzAOh+Lf9lhrHIg:2PQsq2T2iM2pzDkXdt
TLSH
T140B733724E0FD1AA85F8F32B52C68419519553C90BB71CFEE3B229868375F974B2C788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3720-0-0x00000187DC730000-0x00000187DC80A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads