5e33d1bc76338bcec8cd570739af5b6cb37aaefa5bcad6537301d47580e70189

Analysis

user interaction
yes
max time kernel
212s
max time network
214s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bonboncraft.exe
Size 139.8MB
Sample260711-pb49dabw91
SHA256 5e33d1bc76338bcec8cd570739af5b6cb37aaefa5bcad6537301d47580e70189
MD5 e73be71f2ace8639ef817a1dca0e111d
SHA1 dad370bd847c1fbb0a3a7ea2322eccceb5f9f9c0
SHA512 304ce27dbb7ccfc2f05d742819b4e656ffff63e8bc1dc9dfd164a5594a5f483adcd96ebba2044b33c998b35fcf92159e00fa6b33b38d713c3465c6cc2385e26b
SSDEEP 786432:PBdSr/5RVvsZXCZMeQ6mtYptgPV1OINWtzUiV6xdUKit4XFe2vuxTLd3:PBdSL5jsZXoQzNWtzUiVynXFelTLd3
TLSH
T177689D0177F6A563D167917946AFA002BB31B0032734DAC7366C8364AF53FE46EBAB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1720	bonboncraft.exe
1720	bonboncraft.exe
1720	bonboncraft.exe
1720	bonboncraft.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com
3	discord.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4612	powershell.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe

Checks processor information in registry 2 TTPs 23 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
6092	taskkill.exe
4576	taskkill.exe
1796	taskkill.exe
5424	taskkill.exe
5920	taskkill.exe
2512	taskkill.exe
4528	taskkill.exe
1916	taskkill.exe
2240	taskkill.exe
2004	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{41C4DCA4-3318-4504-A0F5-43930A2071FB}	ShellHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\bonboncraft.rar:Zone.Identifier	firefox.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4612	powershell.exe
4612	powershell.exe
1720	bonboncraft.exe
1720	bonboncraft.exe
1720	bonboncraft.exe
1720	bonboncraft.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
808	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	5424	taskkill.exe
Token: SeDebugPrivilege	6092	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	4576	taskkill.exe
Token: SeDebugPrivilege	1720	bonboncraft.exe
Token: SeDebugPrivilege	1720	bonboncraft.exe
Token: SeDebugPrivilege	5920	taskkill.exe
Token: SeDebugPrivilege	2004	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeShutdownPrivilege	2488	ShellHost.exe
Token: SeCreatePagefilePrivilege	2488	ShellHost.exe
Token: SeShutdownPrivilege	2488	ShellHost.exe
Token: SeCreatePagefilePrivilege	2488	ShellHost.exe
Token: SeShutdownPrivilege	2488	ShellHost.exe
Token: SeCreatePagefilePrivilege	2488	ShellHost.exe
Token: SeDebugPrivilege	5776	firefox.exe
Token: SeDebugPrivilege	5776	firefox.exe
Token: SeDebugPrivilege	5776	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2488	ShellHost.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2488	ShellHost.exe
5948	ShellHost.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe
5776	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1360	1720	bonboncraft.exe	88
PID 1360 wrote to memory of 4612	1360	cmd.exe	89
PID 4612 wrote to memory of 1068	4612	powershell.exe	90
PID 1068 wrote to memory of 2468	1068	csc.exe	91
PID 1720 wrote to memory of 5764	1720	bonboncraft.exe	92
PID 5764 wrote to memory of 2236	5764	cmd.exe	93
PID 2236 wrote to memory of 2784	2236	net.exe	94
PID 1720 wrote to memory of 4400	1720	bonboncraft.exe	95
PID 1720 wrote to memory of 1912	1720	bonboncraft.exe	96
PID 1720 wrote to memory of 4768	1720	bonboncraft.exe	97
PID 1720 wrote to memory of 5092	1720	bonboncraft.exe	98
PID 1720 wrote to memory of 4256	1720	bonboncraft.exe	99
PID 1720 wrote to memory of 3948	1720	bonboncraft.exe	100
PID 5092 wrote to memory of 4576	5092	cmd.exe	101
PID 4256 wrote to memory of 6092	4256	cmd.exe	102
PID 3948 wrote to memory of 1796	3948	cmd.exe	103
PID 4400 wrote to memory of 1916	4400	cmd.exe	104
PID 1912 wrote to memory of 5424	1912	cmd.exe	105
PID 4768 wrote to memory of 2240	4768	cmd.exe	106
PID 1720 wrote to memory of 4184	1720	bonboncraft.exe	108
PID 1720 wrote to memory of 4440	1720	bonboncraft.exe	109
PID 1720 wrote to memory of 4988	1720	bonboncraft.exe	110
PID 1720 wrote to memory of 4080	1720	bonboncraft.exe	111
PID 4184 wrote to memory of 5920	4184	cmd.exe	112
PID 4080 wrote to memory of 4528	4080	cmd.exe	113
PID 4988 wrote to memory of 2512	4988	cmd.exe	114
PID 4440 wrote to memory of 2004	4440	cmd.exe	115
PID 5028 wrote to memory of 5776	5028	firefox.exe	134
PID 5028 wrote to memory of 5776	5028	firefox.exe	134
PID 5776 wrote to memory of 5268	5776	firefox.exe	135
PID 5776 wrote to memory of 5268	5776	firefox.exe	135
PID 5776 wrote to memory of 5268	5776	firefox.exe	135
PID 5776 wrote to memory of 2824	5776	firefox.exe	136
PID 5776 wrote to memory of 2824	5776	firefox.exe	136
PID 5776 wrote to memory of 2824	5776	firefox.exe	136
PID 5776 wrote to memory of 2824	5776	firefox.exe	136
PID 5776 wrote to memory of 4188	5776	firefox.exe	137
PID 5776 wrote to memory of 4188	5776	firefox.exe	137
PID 5776 wrote to memory of 4188	5776	firefox.exe	137
PID 5776 wrote to memory of 4188	5776	firefox.exe	137
PID 5776 wrote to memory of 3828	5776	firefox.exe	138
PID 5776 wrote to memory of 3828	5776	firefox.exe	138
PID 5776 wrote to memory of 3828	5776	firefox.exe	138
PID 5776 wrote to memory of 1140	5776	firefox.exe	139
PID 5776 wrote to memory of 1140	5776	firefox.exe	139
PID 5776 wrote to memory of 1140	5776	firefox.exe	139
PID 5776 wrote to memory of 1140	5776	firefox.exe	139
PID 5776 wrote to memory of 5816	5776	firefox.exe	140
PID 5776 wrote to memory of 5816	5776	firefox.exe	140
PID 5776 wrote to memory of 5816	5776	firefox.exe	140
PID 5776 wrote to memory of 5816	5776	firefox.exe	140
PID 5776 wrote to memory of 5984	5776	firefox.exe	141
PID 5776 wrote to memory of 5984	5776	firefox.exe	141
PID 5776 wrote to memory of 5984	5776	firefox.exe	141
PID 5776 wrote to memory of 5984	5776	firefox.exe	141
PID 5776 wrote to memory of 1904	5776	firefox.exe	142
PID 5776 wrote to memory of 1904	5776	firefox.exe	142
PID 5776 wrote to memory of 1904	5776	firefox.exe	142
PID 5776 wrote to memory of 1904	5776	firefox.exe	142
PID 5776 wrote to memory of 5476	5776	firefox.exe	143
PID 5776 wrote to memory of 5476	5776	firefox.exe	143
PID 5776 wrote to memory of 5476	5776	firefox.exe	143
PID 5776 wrote to memory of 5476	5776	firefox.exe	143
PID 5776 wrote to memory of 1968	5776	firefox.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bonboncraft.exe
"C:\Users\Admin\AppData\Local\Temp\bonboncraft.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Encoded WwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAJwB7ACIAUwBjAHIAaQBwAHQAIgA6ACIAUQBXAFIAawBMAFYAUgA1AGMARwBVAGcATABVADUAaABiAFcAVQBnAFYAMgBsAHUAWgBHADkAMwBJAEMAMQBPAFkAVwAxAGwAYwAzAEIAaABZADIAVQBnAFEAMgA5AHUAYwAyADkAcwBaAFMAQQB0AFQAVwBWAHQAWQBtAFYAeQBSAEcAVgBtAGEAVwA1AHAAZABHAGwAdgBiAGkAQQBuAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkARgB0AEUAYgBHAHgASgBiAFgAQgB2AGMAbgBRAG8ASQBrAHQAbABjAG0ANQBsAGIARABNAHkATABtAFIAcwBiAEMASQBwAFgAUQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHcAZABXAEoAcwBhAFcATQBnAGMAMwBSAGgAZABHAGwAagBJAEcAVgA0AGQARwBWAHkAYgBpAEIASgBiAG4AUgBRAGQASABJAGcAUgAyAFYAMABRADIAOQB1AGMAMgA5AHMAWgBWAGQAcABiAG0AUgB2AGQAeQBnAHAATwB3ADAASwBJAEMAQQBnAEkAQQAwAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGIAUgBHAHgAcwBTAFcAMQB3AGIAMwBKADAASwBDAEoAMQBjADIAVgB5AE0AegBJAHUAWgBHAHgAcwBJAGkAbABkAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkASABCADEAWQBtAHgAcABZAHkAQgB6AGQARwBGADAAYQBXAE0AZwBaAFgAaAAwAFoAWABKAHUASQBHAEoAdgBiADIAdwBnAFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBoAEoAYgBuAFIAUQBkAEgASQBnAGEARgBkAHUAWgBDAHcAZwBTAFcANQAwAE0AegBJAGcAYgBrAE4AdABaAEYATgBvAGIAMwBjAHAATwB3ADAASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAbgBEAFEAbwBnAEkAQwBBAGcARABRAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAFIAagBiADIANQB6AGIAMgB4AGwAVQBIAFIAeQBJAEQAMABnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFIAMgBWADAAUQAyADkAdQBjADIAOQBzAFoAVgBkAHAAYgBtAFIAdgBkAHkAZwBwAEQAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBNAHcASQBHAGgAcABaAEcAVQBOAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAFcAMABOAHYAYgBuAE4AdgBiAEcAVQB1AFYAMgBsAHUAWgBHADkAMwBYAFQAbwA2AFUAMgBoAHYAZAAxAGQAcABiAG0AUgB2AGQAeQBnAGsAWQAyADkAdQBjADIAOQBzAFoAVgBCADAAYwBpAHcAZwBNAEMAawBOAEMAZwA9AD0AIgB9ACcAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgApAC4AUwBjAHIAaQBwAHQAKQApACAAfAAgAGkAZQB4AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ujlo3t1g\ujlo3t1g.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71FA.tmp" "c:\Users\Admin\AppData\Local\Temp\ujlo3t1g\CSC507772AE361849D3B02A22E6CF5BB47E.TMP"
        5⤵
        
        PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera_gx.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discord.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordcanary.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordcanary.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discorddevelopment.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discorddevelopment.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM discordptb.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM discordptb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:2796

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004C0
1⤵
PID:4736

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2488

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27098 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {ced599bc-7e4e-4d31-acc4-5a379583d7b0} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27134 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {f0d1e2b8-63a3-4c53-a67a-daa499f3b86e} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27274 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {16ea75d3-29f3-4d7f-8e89-bd15dba0986b} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27274 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {bd662c67-aa08-4385-b479-a8047371ce46} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1632 -prefsLen 34773 -prefMapHandle 3008 -prefMapSize 270279 -jsInitHandle 3048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2832 -initialChannelId {09f2f2f1-b530-480c-aba2-9b0948b12a8b} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4960 -prefsLen 35010 -prefMapHandle 4964 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {6e857632-246c-474c-8d58-94793b752f07} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2704 -prefsLen 32952 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3392 -initialChannelId {5525e6a2-4278-402a-8484-cb29360d12a1} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {be03ea65-3c06-40e9-ae20-bf19bda0aa53} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 32952 -prefMapHandle 5792 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {7859ed11-dc22-40a0-8316-d4f05b7b7a4a} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2944 -prefsLen 33071 -prefMapHandle 6616 -prefMapSize 270279 -jsInitHandle 6620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6628 -initialChannelId {f6598f67-cf89-4172-a244-dcb5128fce31} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6444 -prefsLen 33071 -prefMapHandle 6448 -prefMapSize 270279 -jsInitHandle 6536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6304 -initialChannelId {bdb05ac9-c682-4641-baf4-d7470fb1aba0} -parentPid 5776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
Size 579KB
SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
MD5 153a5d422243f7f95721f6c2c5de8c9d
SHA1 b0f73501859500acd1eccbff3d790abb610511ef
SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
TLSH
T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffitarget.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
Size 4KB
SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
MD5 4ef9928ec21c398681ed3357aa400c48
SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
TLSH
T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.h

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
Size 13KB
SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
TLSH
T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.uv1.node

Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
Size 588KB
SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
MD5 d1f6e50334a50a3f1f8e35e02d788ad9
SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
TLSH
T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
Size 550KB
SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
MD5 ee6e80bab410c751c935e6175acf8b5c
SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
TLSH
T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 f3789b460115507674413a1b5c10b32fe6e2596b7ba9b413a7ba42af543f3ee5
MD5 51731634052015082064412707f269dc
SHA1 4d374d0ed9c708bd7562b446419ac9981dc48ca5
SHA512 8d8a4be0931a0dd044a682f82784f70b66099674a91aa40d1b1c59f9b44e349d9d77ca950d6337b4702462ec5d97f6b6d726c6c29af23a408fe61edce0d633ca
SSDEEP 384:H9XghOiO024Y3dcs3hk2nhfdDE2Ba/rIVy8e35kU95kUU:dX+ZY3dv3hk2nhfS2sDIVy8+5z5u
TLSH
T16E729DBFCF107C5919579585C8A99369DD05FDBBCBF6D0B608243549CB8432AB0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES71FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES71FA.tmp
Size 1KB
SHA256 305e306d3999fa3325ad36c1c87a8f32567a702b2c0ef2342d133c3ee19491f5
MD5 0d42637e330622f7acad5f03db5defa9
SHA1 8c49c6e06a84a871103fc774139ff5fdbf5eea4f
SHA512 2e006aedc3ad85b14d50bcd2f8e94bf8664320a82e776d61a3848c4bd7b2033acd7ede416f75158620e0978a2f4fc6f8c29690a1c5ef6ac68368fa7166fc9964
TLSH
T154216A4583E8471EF07347327AFA136F9275FD66DF62A75A448442282C51504EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujlo3t1g.dll

Path C:\Users\Admin\AppData\Local\Temp\ujlo3t1g\ujlo3t1g.dll
Size 3KB
SHA256 900193e838b2c3ec8ca779ecdad4fd731f51c5595a8b0341e5128e354c6fda1c
MD5 ad4eb1ef5859218511a78499f01d1787
SHA1 cf4530cdfe7d602bfd0379e1b3d716c3651c4941
SHA512 cfec6d0ed9458113dff37374df81474829e9da53ba46d342257522b68966d65fdd626b194bf6bff89cbc296e7273a9c38f37425839d02ebbbc7426b92b2097ca
TLSH
T19B51DD1653E8466BE4770735AEF3471637B8FC509B73671E48C0421CACA43649E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\AlternateServices.bin
Size 7KB
SHA256 bdd1637f5c8e4bf604113531b62f6d636fff0ab9e864b74bb1bf1fd3cd8a726d
MD5 7e1b553753113520aa82fe6cc800e172
SHA1 f41d91f625d6aaed333c3021a00ff18b03161a0e
SHA512 f397f88b74c986b9053a09c64991c785379e9941775b770e5026940972940164d70c9a6b8a9267ea17565721f55f7d22b0e6f51f25d6e8b292546ff6dd4c2929
SSDEEP 24:ouhMZA9VvJid9BSiA913i1I9Ftit5q9F55A54i:BBQXXKgUCjI56v
TLSH
T1E1F19DE36B72A872F0928FB45098728C9C731325067E9584CB4090F702C6BDDA07EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\AlternateServices.bin
Size 12KB
SHA256 c8d71d543d0eba852901070a3956f17af9fa266b29ae0dc7376adf9c3557a374
MD5 c52909c74ac6651d93e8ac6166f0a3e7
SHA1 82f188b5574d4a17a5877e9b14837c9ab53754eb
SHA512 9f8068b4eae05677010e20945cbd70114e5eb2f3a7178d88bee6273c3d7232e99dd3a93ba8b16067b3236f406063a7b09819cf0a6a86e02f9dd1d689ca688934
SSDEEP 24:ouhMZA9VvJid9BSi291Qqi1I9Ftit5q9F55A54iK9lhi/9Bbw3icWN9VxWAG3iUM:BBQXXsKUCjI56voOl9wScM/pGSlh
TLSH
T195425FE36B727863F0928FB49099728C9C731325167D9584DA4490EB03C6A9DE17FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\AlternateServices.bin
Size 15KB
SHA256 dda56fa795e4e04a5b3b5d6c020e59c10d05084444d113628e6610126c22577e
MD5 d39872d9ae6194a38ca4858c34975e2f
SHA1 6819dc862fec9632b30f4eb46a1e48401df702ee
SHA512 1e4169335967656af577341f58ff562128aa2175929aec481975255db2768c0da3a7d9576a1e563f5acb80d53e3f21d4c35d7e363e11d3dd493e866d81277671
SSDEEP 48:wBPrrsKmEjI56vKAi9oJM/pKi23lpQ4/:wBPrrsKmEjI56vKAieJM/pKi23lpQ4/
TLSH
T1E3628FF36B726863F0929FB48099724C9D73172516799584DE4490E702C2BADA07FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 98KB
SHA256 3f085d24fe64f8ef9b018d05e4b57483e669e5571475f90f0a263506846fead7
MD5 8500ceff0c4ac6ae4229fa4d18419c75
SHA1 10aead9852b8923559378e6ff32e3abbe3076ea9
SHA512 f494815ae2034dfdc3efaacddccededcf0231b92536d79f5b220c88a2e9c318f98aefaff67fd6691783edc32c30393327af7f84268ac89a9c00de24a4165ae7f
SSDEEP 1536:bTdgHULLzvGGzb+vUY2McEUU4iEL0DPspFZ3oRAls3griF5JXhxNA:bTdg0bei+6nNUQgwP4R/Qri5JXhxNA
TLSH
T145A30F84EB1A403FEC2445BFB8951B282735F4654A595B0B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 98KB
SHA256 ca113809921194ab8675270313ac1aab48f22bc3043c2e5f070caf2b4163bdbe
MD5 8ff56f11f2c9119a62de0043dd50f183
SHA1 52c5c4402c09f322b8d9fc729607c54ee9be2ba7
SHA512 5738459fdf4bff4e89c2e0807d207a0a69c00f21a9daf321b4b621441488bbb330bfe64ff9ba0c7d811d95d2c97268af76158e1b2bbb45fc909951dedfb3c274
SSDEEP 1536:9TdgHULLzvGGzb+vUY2McEUU4iEL0DPspFZ3oRAls3griF5JXhxNa:9Tdg0bei+6nNUQgwP4R/Qri5JXhxNa
TLSH
T1DDA30F84EB1A403FEC2445BFB8951B282735F4654A595B0B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 98KB
SHA256 7df47922921ab4f2363f2e25276465b780aa5ce815fcf70b42705104380c63a6
MD5 f966404edc709393c04a217057d520f5
SHA1 317b3ae35e0dbf2ff0c623f88f312aa2bed94911
SHA512 a99ef80fc4bab3b69dc12c7eb4027213e85c1a4d3dcaf1f8a383ac5af9a8fab8b90c488a1dad5c05d97b41731adc0e76627c5dd873e298024f394a22780c7865
SSDEEP 1536:0TdgHULLzvGGzb+vUY2McEUU4iEL0DPspFZ3oRAls3griF5JXhxNl:0Tdg0bei+6nNUQgwP4R/Qri5JXhxNl
TLSH
T1EFA30F84EB1A403FEC2445BFB8951B282735F4654A595B0B3AAC04752DCB3FF2D0E66E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 446f6b45a230b9211d249734768d2acb401820cff800b8937d17900e463b4e7b
MD5 2153ebf91339689540eb71a819e07041
SHA1 9e2d259114dd8e260da09a19f63839a0d0a1ba1a
SHA512 c3daad14e98b4285a41e32cce6a52d4ac999b467ec9446ec038d7588b4beef74fbd85f062c743b6219334de82dcf220a6456c8ba2c1cac65d49f26ad8b2a2870
SSDEEP 192:eOv5zbodaZ4hyjyyND480t1d66JoztdzgCl6mc0dz:1bodaZ4hyjf480Ld66Joz/zgC1jd
TLSH
T108E11F68EA29867FC414037BCCA21B400F79388AD84E7F19759D644C2D5B2DE7B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0e50134b063b79e0eef387c4448ec67906939d031d2c5c430062ab0a649f34bc
MD5 ba221f3107cbf7329ae19e57f9223b47
SHA1 1c1bfdcee84e53059358e4a30029c519129354b2
SHA512 31f2795a9f3867282f0174e2c10ad07d97bcb960364877c81ac74079e20010e90ef07c65c302eebe9987304ec88c81f03a239ef24deeb19d3003ff38b6a026a0
TLSH
T16E21674C39B84D6AA8C7F29C74C102CE9F954A0605971C472D43EE8DCE81A9D326E439
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 5KB
SHA256 ab3555689cc93d23ada1fc7ce22f7c87177f5779a7f8b4b06233baec4fe27fe6
MD5 b4a51d80af588392177acd4e57c4dd79
SHA1 e67a5b0efcbf22cd092f7631cdf4800c6572ddbe
SHA512 8b5552cc483b1e7b43d0347b311af841915420f99ad78eec0bf39187e99c2fc2d2262e4df3050a1f41055416664abf951e49b9a1488e7084d15639f59d7b752a
SSDEEP 96:Dd2uqjpfHqRY5WueF4gdpdfYUIOkXWHOr:Dd2VZqeWF9HfYFWHOr
TLSH
T133B1EE1D75B90C7EAA97E39DB8C5028D8EDD4B0299871C874D8BEE48CD85A5D321F03D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

157e7246-f84a-43d2-844a-08d6347bb824

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\157e7246-f84a-43d2-844a-08d6347bb824
Size 15KB
SHA256 ec4000c965def0da18388e97580aab15e4d4244e4792a82f8eddb2f63fb0660c
MD5 70d6d943819e7a24f6a87384243d9776
SHA1 b5bfe2d877789116bbaa7c22e47a793d9a7c4b0d
SHA512 8b6aa6bb2e5d48d8d10ede5413ff8adf3f89b2a97d3ef3dc17589e7e02878d63ba13c93c3751d1eec7dec0bd08f5a6f1c50cde7b9d5765f30248e86d318e0ed3
SSDEEP 192:ZhCCYC+WO+VSxzgR6biGH3Puw9yUs4CFp5IQG6qhDh74BlVpXOm12VAJeQ03CL:ZhVYC+WTSxER6biGfuvg4WftS
TLSH
T19462C8596430497E8691E368D8F97FC3E2F518CF8C019FC99BE47E0869EA0AE5127C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ede85e4-0b85-4bab-a0df-a4f14d089914

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\1ede85e4-0b85-4bab-a0df-a4f14d089914
Size 235B
SHA256 f786c4a9ee4d02563dc4964e11f8dc45b386f235a4f571d361df84436cb66d2e
MD5 becae62b7eb8a53360eee6226e8036b8
SHA1 915013cafca74611477670e60b603743d3bbf418
SHA512 5ca61cad2fe2cef501709517994b1b54ad7ab87b73d2baf054a04842015ecd423c023e5d57ed288a38bd4ac855214b3c81a81f834c2d07a0ec97debc9516305a
TLSH
T192D0A7C154AC6BAD0C146F0AF0E46AC731994C371869686497954674A9B9BC85292817
MD5 SHA1 SHA512 TLSH

Submit Download

396f3eed-43eb-45f8-9aeb-c50b28c5d4d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\396f3eed-43eb-45f8-9aeb-c50b28c5d4d5
Size 886B
SHA256 85c70f321005afafbc6137f63aba9f41ae7789cd9f41149a6da63ac5daeef16c
MD5 9af83149faf00e0fe71a8b1103902bd7
SHA1 0ef777e691f2d24760427c1a5761b85f4bbb5d82
SHA512 2e109ef1b02d6588f89d6761ebea3f66898a40ac6432022c271c84bd302f4838b6de1786bc3d510ce90b81cce4f88fee5d39ab60003676ff59ca41f1a1b80f4b
TLSH
T1101100989A75BAF3CC78929BD5E137068BE4B423C0C649147D995B080FEA54BA36B207
MD5 SHA1 SHA512 TLSH

Submit Download

424f9941-f24a-4d1a-9e40-a57f6100e229

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\424f9941-f24a-4d1a-9e40-a57f6100e229
Size 235B
SHA256 73c8f89bbc99b4ab34578adce5733de185bed779fdfe387941f4411b40e06d36
MD5 d699e8c9ab74a2a2641be70760da3b4b
SHA1 148a76a7f1370b3624d0d3f224533c4146724b4a
SHA512 9a0ade116ecf7163159f34c68b1691024081dea917e41bbafc7f863db8e404c20dae49ae8e38887deb5fe83bc54708b8ec382bc3d8588938063e088346190927
TLSH
T1E0D097C01A88A76C0D252F87F0A028C231884C3310E9981095A00274AEFC9C411A584B
MD5 SHA1 SHA512 TLSH

Submit Download

6f532cda-a8d9-4862-b74a-60f26619e2ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\6f532cda-a8d9-4862-b74a-60f26619e2ef
Size 883B
SHA256 120ce0508ae7314609ea3cc623c871e0da4c436f83fa0cebd7de961784480556
MD5 2f940a9d63e5883c9b800b8fb60bddbe
SHA1 286a30df6acc550ba831369e876c5b7980f1d1d6
SHA512 8c3f667968e93224438edeec37f2a24da9cab8c488023fff047c6e3ef42660d2901e3056461e66efdb4040b8f8b2342a10f4a5c7e6b00c48f7b11f953ac72164
TLSH
T1FE110494E634B6F2CC7C825AC9D5370287E4B423C0C655047DA51E140FBE61BEB5A247
MD5 SHA1 SHA512 TLSH

Submit Download

70f71d8e-b350-4aa6-881f-b0410982c193

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\70f71d8e-b350-4aa6-881f-b0410982c193
Size 2KB
SHA256 1ef61aac82f0bb18c9fa4d1ffac4d83b80b4d53fe001a9a57dca2d6ed87d55ec
MD5 608c5c473ccb818284eb42d08a4400fa
SHA1 b5405697b85960b880fdd66c7b77a2055fc59560
SHA512 23e1f92aadc00d24d70d9f7434b036fbccdf69f9728c65022f94768d01adacc43f374ebfb61d0b2deccd3bfcdcd4faf9e820888bf2e58c93f941b221188b9482
TLSH
T15441526C35B89D778CDAE15C90A233CA83A19A5340C21C433E41EF4CCE97A9E736E41B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extensions.json
Size 16KB
SHA256 998dc9486e1f9632e538fd69943cad00edb9fab397073828022b39acb67bf241
MD5 7fa8f92e0fedcbc6a2a3a6cc35b2b083
SHA1 d0a2f926c4cebc3cd640a756a094c6145f78b125
SHA512 060625537b72363708167a988efbf68621277e5ce7cc8c8d7929c7b7f512691fe52afcb11dc208ee6c78b0df77f62e44bc0d9d65518b55e365b96248767407a8
SSDEEP 384:9kI4vcUmldvD8dhWr94zS96oJL4HZL4PGL4H7L4HML4HERG4hd:+I4kRfQXC4q6+4x404H4m494X
TLSH
T16572421545048EB8298FA78AAA367D01C37D573B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 12KB
SHA256 6eb9f6dbd446dff635f748a25eed5633ccde4d55287f217fc89bf013d63aeb72
MD5 1547bfe1b8337350fedd92e15eec68b6
SHA1 4ee8e223f5b112895d3118a234ccd1397bb9dc7b
SHA512 7923d8604491f3b9277f4df8cf20313803314be5632380b0d91d37038ad54287ad51af56a1c3ddf2a747a31ade9be69abdb95a0f22dd78029c04cb6109f94716
SSDEEP 192:GGCRsfYSyEXCi9ESS/LRjAA0Sc7OBw8848lZ8xXU7:7IMsRMYwnea
TLSH
T1BF42CD3C50408F3F64B2327DAC614AA159A1422777BFBCD609F95482044CF6D55FAAFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 1c2d1f156dbe9ab42933eca24ab3301ecf84406710f735a97b89a2af35159c15
MD5 90d984f2186f57b32f589843d18a7224
SHA1 a36416a7296d4e3fb97d1f2cea8401f304d7e071
SHA512 4f1d2a5598a9dd1527004642c744b8fa8f03ce018a06a4937fc347c6ac07c716083e596fcefdaae45df7eb5c89ae6f6a83acc827f09e66de2c4da2c0a0326c6d
SSDEEP 96:xH+UTUQqGqsfu0SyEXCkzSH9ESSlvdv9jOnAHdA0ScSqBw88u8L4cnEVgsGS:ArRsfu0SyEXCJ9ESSldA0ScDBw88e9
TLSH
T100E11F785008CF7F65B677ACAC6888716AB2413BBBBF68D650B554C4014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 7KB
SHA256 71cbcf1fd78791bb721edc22a07e1141ea8cbe331b99773a47d8e189788ee3e3
MD5 b5391d82ff064857bb410556d79ad510
SHA1 37313dba2ecf0f87c3bcef0112511c8b61d9a33f
SHA512 887bbec02ee516e3cd74b12653407e186f200345c47accedb29e50737b53aed5b7defd41f84155bde8ea79b47e5a74a2907f8755639b44ce2a5759cb9bf80dee
SSDEEP 96:xH+UTUbPqGqsfu0SyEXCNbzSH9ESSlvdv9jOnAHdA0ScSqBw88u8L4cnEVgsGS:ALCRsfu0SyEXCi9ESSldA0ScDBw88e9
TLSH
T1B4E11E7891088B7F69B6776CAC6888716AB2413B7BBF68C650B554C4014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 7KB
SHA256 477dbe685327fa0a7c293fb30c3b97fc78e7ab9c656d760f1e18d595a450a4d9
MD5 2d22b0c22fc0256111883a2af3ddfbc6
SHA1 f1d61adf5e4382e88dede83d8a7bcf015baf38bd
SHA512 db0761941c15de0c13ec1120643226e2e704ea1eecc5c0446c9bed31864438b8c682a59c70a1761728e64424b539c8e7697f84a8e60cc6cc5fcac7f9447a3417
SSDEEP 96:xH+FTUbPqGqsfu0SyEXCNbzSH9ESSlvdv9jOnAHdA0ScSqBw88US8L4cnEVgsGS:AGCRsfu0SyEXCi9ESSldA0ScDBw88P9
TLSH
T19FF10E785008CF7FA4B6767CAC6489715AB2023BBBBF68D610B954C5054CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 8KB
SHA256 728edace3b9bbb4be5ec490232fc5ed75aac4c3befabd9607c0da78ba0fac582
MD5 2ceff8dfaad4d2cd370ea5d8181dc931
SHA1 1aff6361b12f07c6b402471c955294bc710c4cbf
SHA512 ebfcb4f98b00bff945d058d7ffdcc7a3adace24275e69964aa9ba61975c3e6cce74feca8221875440a4c62637340aa73441d3df9302e52e80ce3dc2ef42c47e5
SSDEEP 192:AGCRsfYSyEXCi9ESSldA0ScKBw88c4Qc7:5IMwdQwM5i
TLSH
T15802FF386004CF7FA4B2767CAC6449715AB2023BBBBF68D614BA54C5054CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 1b24c4fffd9fb30465c6042c2a6700b5af75335247562636e87cfa4c3489d297
MD5 5d360724c6b352abc15192378ca6de30
SHA1 456cc553fbcc98c732e364f51322b067e0309437
SHA512 60ce88216c26963c7d7a635d570983c71a67131dfcc00ca22fe614ae27f097c7dc5fa282d8d96ec9fc17bf3043529082bdedcec1967d01370a8170d3574204bd
SSDEEP 96:xH+UTUQqGqsfu0on1zSDAdSSlvdv9jlanAHdA0ScSqBw8828L4cnEVgR:ArRsfu0onsAdSS/dA0ScDBw88W+
TLSH
T116E11F789008CB7F68B6776CAC6888716AB2413BBBBF68D650B554C4014CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 7KB
SHA256 4f94c657786c44b85a41d55ce27844f6f0b0c16cfb69fd3bb9f5c9e5d3c5dcf3
MD5 3a6535fa8524596908d3c774f1434920
SHA1 f78282fc5680788fdb67a9583719ea11841f492e
SHA512 3b14c3e0f3fe4047dd44f7ea4b3fae759cc38ff3831ca23d4b29cb0eb381a758b4be3a7a790195a39f6794ba4b5ef36870faa7775e1bb9521876b397f23ca2d3
SSDEEP 96:xH+UTUQqGqsfu0SyEXCNbzSH9ESSlvdv9jOnAHdA0ScSqBw88u8L4cnEVgsGS:ArRsfu0SyEXCi9ESSldA0ScDBw88e9
TLSH
T188E11F7891088B7F69B6776CAC6888316AB2413BBBBF68C750B554C4014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 30403f369eee11e78ba189aae557e1d2d378cae216fc1824eed84164fb607988
MD5 0f3d6200ac8bca93c906bd62983447fd
SHA1 677abb077d2566dfe9ba80855de9b227de6d04bd
SHA512 7fab4fdf66997f087716b3ceaddb13cafe09357bd538b30e6e2b02fbc43591c4eff974ed9beede88f33010086bc1a3ef1f205b3ccf8ea01efbdd17da6b4a9a99
SSDEEP 96:xH+UTUQqGqsfu0SyEXC1zSH9ESSlvdv9jOnAHdA0ScSqBw88u8L4cnEVgR:ArRsfu0SyEXC29ESSldA0ScDBw88e+
TLSH
T1D4E11F789008CB7F64B6776CAC6888316AB2413BBBBF68D650B554C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 6fab680cf440b677fc9163f0bec6eecf0ab9adbdc25ba991f3d93443e45be56a
MD5 da5baf06455358fbfe0172de00b1b970
SHA1 dabe94e589977cc6b32e413021ba56b264aaae71
SHA512 8ee5bbf4fc872e79b3a233d0c7893396961aa2d1fa01fcd6215adc2f8be6b711c807f135753d67f079fb387e91aea4e566366daca969311f60f7c55cde044540
TLSH
T15821E7D86EBA1CF53A15D006E0C85FF4C56555270724AC64D8A941030E8DB1D6ADB20A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.jsonlz4
Size 153KB
SHA256 37c24bdc3dff6c72352edfe530e4345b6944509fc4a344ab0cd4a7c108937286
MD5 3eabcea4f9fb5272611610ea362555e4
SHA1 89eaf0718cdf88718c321e08e3e7bc82274f4c4d
SHA512 3715328f7ed530b997f92adf88b39904260bf3856c0eb7f5a4d3478f654a0fbc5097086920f2987ad24fedd7803fde2f1e0c29177ca5a07f989a4d0a106337d1
SSDEEP 3072:Z5CspQXH3GWwB+wakKNrOPWtdFiH5i9ukgka4IzB+5vF:HCX2Ww4wlKJfHFU5iUsa3BE9
TLSH
T16EF3134B8D3A7EB50A32A6DF10AA17470A549CD4378C8A5F0C83770F16FFB26A9B5C51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 aaa7bd45d145ae075ea95d0870af7d44719c8ebd2f0dad23a6fb58615f9de145
MD5 dd49d77bd1acb9fdd1accfcbe04a3391
SHA1 b7e232b3ddb7ad70c12a39e10f3d5d53a54152c4
SHA512 d2023941ae8cc71a3f3b2b679f7c172f12a8b76e8a25edd169d036fefb8dc23c661c63287032a1f3f165ba75569810080010c23a788308de823c743c66251dcc
SSDEEP 49152:xLELyiaeUT6QC5zYYZQlJ5DNb/AZebwz8+rUbl0b0RqGk+Q0jYiq4YUdNeERU3z7:LIIcERUjMfIQG/8eW
TLSH
T13A765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bonboncraft.KKi9_LAc.rar.part

Path C:\Users\Admin\Downloads\bonboncraft.KKi9_LAc.rar.part
Size 28.9MB
SHA256 50c765bbc009af5c063c82e2e814e0b7324bff34d106ce37cc5dc059b10f3e1c
MD5 9b1fd2da28010c0163f055981156aa35
SHA1 33cff16aa36c65cdfa6f16402c8d66db27d131c0
SHA512 1d76fccc9468bd3de1779b6893f878ec63f714a76e697d6ad6b4e21fd21227b667f9291b04b1136d5ee12cb9a6d35fa2402562d7ef1373ac5f3768c7b04278a1
SSDEEP 786432:v2ySS/OgDXb2h4HJQiV+9mojzar2SAfGO:9zzCh4pQNFHarGGO
TLSH
T17967333D86CE9D86D182EC2CAF589553650AAC078F6A783CFCED6CE41D78B18D235712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC507772AE361849D3B02A22E6CF5BB47E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ujlo3t1g\CSC507772AE361849D3B02A22E6CF5BB47E.TMP
Size 652B
SHA256 97caab5d2e80a5cfb7422511de0f6fb4692bc5e2702bbaa1488c7baabc977a6a
MD5 539f1a05d53bef8f6de7e3a626fae10f
SHA1 8a95bd7adb51411eca18f448e1a59e76dde2de12
SHA512 740123ed483fd8dd9148992d47705ee42e5eaed8ae5750d6010017228620c386023671bae91f696928dfb976e440dc42e087030d1b233327c89eb7508f7b939c
TLSH
T18EF05E0963F8020EF0F34B71BEF643A791A9FC66DE3293ED1490032D28645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ujlo3t1g.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ujlo3t1g\ujlo3t1g.0.cs
Size 342B
SHA256 6914d7afe54b19a22b8dad75c0781e9dc7321bbf43d3fd8fb00179d2d6a7f3f2
MD5 fb818b5af427cdf4bd5e9e48265dbd9b
SHA1 4494f9fe806d3d0ec6601ab8a6bdb5ff9b37a4ed
SHA512 843c02c18c777ae614a49d27722c495472c2b3ed4d45dc26bbb03d009a189e7241440a77107a7f17f26d03a8771c74efb49af9c98ce83020535c9027abb64cd4
TLSH
T1A1E0CD1866A29E70803304254D47D0FDF60B5427157B1E0475FD1311DF7B0099629A5D
MD5 SHA1 SHA512 TLSH

Submit Download

ujlo3t1g.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ujlo3t1g\ujlo3t1g.cmdline
Size 369B
SHA256 b112b747eef1ed2f55b840456ee4060ab5fcad00844c079ce5c426f65cd48338
MD5 5ef898f2e96471ee90904dffde43c73c
SHA1 12f2fa8452c7f0175a6d7f1f8e4addc744f48de7
SHA512 914fdc53cd5d899a41d9d78a041f00f78a0989053ac50ba5de8dc27b256391f46ac98b1f893ee84607e53d8991c5157e0ec77ae89a8e561ce92bf137513f6050
TLSH
T1D7E0687A4287C67E15D9510F2169C4AC8272074329403F885088481ED01B008BBE17D9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4612-789-0x00000262F6B00000-0x00000262F6CC2000-memory.dmp

Download

memory/4612-805-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-803-0x00000262F6930000-0x00000262F6938000-memory.dmp

Download

memory/4612-788-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-787-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-786-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-785-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-790-0x00000262F7200000-0x00000262F7728000-memory.dmp

Download

memory/4612-784-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-806-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-783-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-781-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp

Download

memory/4612-782-0x00000262F6630000-0x00000262F6652000-memory.dmp

Download

memory/4612-778-0x00007FFF27A3F000-0x00007FFF27A40000-memory.dmp

Download