a7e46a07ee091890b151fb81160181638ad384c4eb58d4524db676b127de88b2

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
141s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vega X Windows_25262697.exe
Size 702KB
Sample260820-xq149shn21
SHA256 a7e46a07ee091890b151fb81160181638ad384c4eb58d4524db676b127de88b2
MD5 2e37c309f75f00ffc64d4eff21fa0427
SHA1 d147d40b5ab42843db1401a5ddfe662282432a27
SHA512 595c3b42fa3ee8e4d72a25df83a7e407645b013dfeb840e869cbd1881bf70ed926e8a044d3cc9912146b4360e8b242600a53dcccd4149bc156c5cebf8fc6fefe
SSDEEP 12288:AtflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4nFZ:At9J6MB8gGaUtze74nT
TLSH
T1F9E48D16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vega X.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\OperaGXStable	Vega X Windows_25262697.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Vega X Windows_25262697.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\OperaStable	Vega X Windows_25262697.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Vega X Windows_25262697.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	Vega X Windows_25262697.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Vega X Windows.txt:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Vega X v3.0.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1648	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	firefox.exe
Token: SeDebugPrivilege	3328	firefox.exe
Token: SeDebugPrivilege	3328	firefox.exe
Token: SeDebugPrivilege	3328	firefox.exe
Token: SeDebugPrivilege	5396	Vega X.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe
3328	firefox.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1648	2516	Vega X Windows_25262697.exe	81
PID 3008 wrote to memory of 3328	3008	firefox.exe	83
PID 3008 wrote to memory of 3328	3008	firefox.exe	83
PID 3328 wrote to memory of 4508	3328	firefox.exe	84
PID 3328 wrote to memory of 4508	3328	firefox.exe	84
PID 3328 wrote to memory of 4508	3328	firefox.exe	84
PID 3328 wrote to memory of 1728	3328	firefox.exe	85
PID 3328 wrote to memory of 1728	3328	firefox.exe	85
PID 3328 wrote to memory of 1728	3328	firefox.exe	85
PID 3328 wrote to memory of 1728	3328	firefox.exe	85
PID 3328 wrote to memory of 3696	3328	firefox.exe	86
PID 3328 wrote to memory of 3696	3328	firefox.exe	86
PID 3328 wrote to memory of 3696	3328	firefox.exe	86
PID 3328 wrote to memory of 3696	3328	firefox.exe	86
PID 3328 wrote to memory of 5064	3328	firefox.exe	87
PID 3328 wrote to memory of 5064	3328	firefox.exe	87
PID 3328 wrote to memory of 5064	3328	firefox.exe	87
PID 3328 wrote to memory of 948	3328	firefox.exe	88
PID 3328 wrote to memory of 948	3328	firefox.exe	88
PID 3328 wrote to memory of 948	3328	firefox.exe	88
PID 3328 wrote to memory of 948	3328	firefox.exe	88
PID 3328 wrote to memory of 1528	3328	firefox.exe	89
PID 3328 wrote to memory of 1528	3328	firefox.exe	89
PID 3328 wrote to memory of 1528	3328	firefox.exe	89
PID 3328 wrote to memory of 1528	3328	firefox.exe	89
PID 3328 wrote to memory of 4636	3328	firefox.exe	90
PID 3328 wrote to memory of 4636	3328	firefox.exe	90
PID 3328 wrote to memory of 4636	3328	firefox.exe	90
PID 3328 wrote to memory of 4636	3328	firefox.exe	90
PID 3328 wrote to memory of 2988	3328	firefox.exe	91
PID 3328 wrote to memory of 2988	3328	firefox.exe	91
PID 3328 wrote to memory of 2988	3328	firefox.exe	91
PID 3328 wrote to memory of 2988	3328	firefox.exe	91
PID 3328 wrote to memory of 4564	3328	firefox.exe	92
PID 3328 wrote to memory of 4564	3328	firefox.exe	92
PID 3328 wrote to memory of 4564	3328	firefox.exe	92
PID 3328 wrote to memory of 4564	3328	firefox.exe	92
PID 3328 wrote to memory of 4060	3328	firefox.exe	94
PID 3328 wrote to memory of 4060	3328	firefox.exe	94
PID 3328 wrote to memory of 4060	3328	firefox.exe	94
PID 3328 wrote to memory of 4060	3328	firefox.exe	94
PID 3328 wrote to memory of 2664	3328	firefox.exe	95
PID 3328 wrote to memory of 2664	3328	firefox.exe	95
PID 3328 wrote to memory of 2664	3328	firefox.exe	95
PID 3328 wrote to memory of 2664	3328	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Vega X Windows_25262697.exe
"C:\Users\Admin\AppData\Local\Temp\Vega X Windows_25262697.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1648

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {e3b37702-d2c5-4a14-b8a9-ae984dd42d88} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {f4553da3-ad05-4376-8c1d-685069854472} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744 -prefsLen 27274 -prefMapHandle 3748 -prefMapSize 270279 -jsInitHandle 3752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {9d47ea40-7fa3-41ab-8396-170790e915cb} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27274 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3936 -initialChannelId {c830db31-3678-440f-aa7d-1067ef62e380} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2792 -prefsLen 34773 -prefMapHandle 1696 -prefMapSize 270279 -jsInitHandle 1700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2988 -initialChannelId {428b6816-4eed-4d52-9b8f-526b98d1028a} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4784 -prefsLen 34822 -prefMapHandle 4788 -prefMapSize 270279 -ipcHandle 4752 -initialChannelId {f55150d6-d92f-426c-835a-2c90f7624438} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 33031 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {afa98651-33cd-43c6-b1f2-e84847f70182} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 33031 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {625dbfd7-c890-4a6f-8776-f68266c4620a} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5728 -prefsLen 33031 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 5736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {60a423a1-7d31-4861-bac9-624ae3bf0375} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4588 -prefsLen 34041 -prefMapHandle 4584 -prefMapSize 270279 -jsInitHandle 4640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3212 -initialChannelId {0881b922-49ec-4b63-b910-a23372c8b861} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3124 -prefsLen 36847 -prefMapHandle 6972 -prefMapSize 270279 -jsInitHandle 6980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2636 -initialChannelId {f4b914b3-d62d-4be8-9a6b-e8e86a9f5f03} -parentPid 3328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2664

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Vega X Windows.txt
1⤵
PID:3228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:752

C:\Users\Admin\Downloads\Vega X v3.0\Vega X Dev Mode\Vega X.exe
"C:\Users\Admin\Downloads\Vega X v3.0\Vega X Dev Mode\Vega X.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

14903

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v1pny25i.default-release\cache2\doomed\14903
Size 19KB
SHA256 a9c226c04d94b3f7e970f5e967299484ac5a0ff06bd16d144914274a48f28217
MD5 12d4dc0b551f145a9d1ee05e5cc8c50e
SHA1 ade3f38da6f45672801e5de4712847cc75d2bd3a
SHA512 fea1ed276c881c74ac6a74adf212042bd385a173484d7ba3adb832226b79f0b82f25a909b9c00a82cab16a84b7ca3f1b492d64e3d21141d0d19f8578474f46d7
SSDEEP 384:VlXVgM2BtV1uCQIExdaeliitrOeliit0aGUzHODWoh1B9M0lpDIIg:ruMef0CQBxQeliMOeliLaGUzHODxh1BC
TLSH
T17C92C03AAC91FC3965E144F0E39D65128E8986177DC5C2BD2DB9300397241BAB9346DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v1pny25i.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 d42ac1a75ab3d546269aed9e7dddfefd86d5e6301eab54d3d59ac91fbabbaec6
MD5 4e83a199d862ca51d414270c1072a01b
SHA1 2612b36746ed81c7c5641e7cb55856f0c98905c0
SHA512 f0cf66fa51ef7547e84a84b5d3aac6ae2c3a240c161db1360f5e5b5a52659afff11d1139d888ebd1575ac68784dcde0a5479f2c63dfd0f618f9e053bcf2473b6
SSDEEP 384:HXkRyiO024YtDL84KKDL849B7SOEAd9KVRaAcP+AWRMAH:3mZYtDL8lKDL8CB7S/AmVAf+hRMm
TLSH
T108727D395F003CAC25A781E8C4F992A94D18BBA7DFE6C0AD21183D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 eabc757fc797a8d7cb088569fb4320a2c3f6e2bac0fcec618f70025c812b8b22
MD5 9e49ef81b5e63be016a4d3e1eaf33eaa
SHA1 f222dc1cbd5a50b154ff68d7abd7c5355892970b
SHA512 d6030210e47650ac38ae2acbf20574c87460871f58236938fdb6821f8c8a1d7f387ec4627ba03009df1841a85d657b925c4e6c5d3ad6a071a4043e9fc2a7f343
TLSH
T16FA00294E48051495C4BDA7835D0154551944D4301BDD255CF244B41450AB0651A2659
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b2e52ff7c2095828f0ea8dba1634cf10121125267fd3c1259765d8518eb24c12
MD5 888e57b1fbe465b9a86bfde17a27ab30
SHA1 c59f16dbcfa2ea86e3d1b887f751a4fd3cfd8b69
SHA512 e79ace2ca6d0bdbe4cb3e489df755d3fe464fd929f8832bef9a30aafd55d44b88b87b94339dea6d1e717167eebd555ca4d0353f660c1bf25e8c72034100a4a59
SSDEEP 192:hOv5zboeZ0ryj6a1d66Joz0dzgCl6mc0dz:+boeZ0ryjJd66JozQzgC1jd
TLSH
T1C4D1DD58E639867FC814023BDCA61B400F36789A984E7F2531EC641D2D972DE7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 269f5b0621bb2d50fdd8e08da02af0bab5ca8097ddda3888b1650200c1233f67
MD5 e42fb1d4c1f2a600169b548febc1ecff
SHA1 44a67b0bd6b336462059f080c929dbfbdd06c5b8
SHA512 7f4574bfecb36dccdd83718ba46bf8f419911d6dc9bb749f88aaf64979ed8fada68594cdfcd55789bd77f3ce58ae71ba5acd2aa71e4d2b405c15c72f1b2b400e
SSDEEP 192:SOv5zboHnZ0ryjYlM61d66Joz0dzgCl6mc0dz:RboHZ0ryj8d66JozQzgC1jd
TLSH
T1A0E11068E638867FC804027BDCA51B410F39385A9C4E7F29719D651C2D472DE3ACE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b9afd60abad7ef2d3be500490c2df2cee00303151c3b9748aa9bf27bd91262e7
MD5 1c6ed1792c041052259d7f5277f942f6
SHA1 8fb914c25b498b2d8538d57a4256b78a3938987c
SHA512 47a9539307cb54d2e106116340f34698c535b6b73b48c916ae1518aa35b307d54e6bc850212b6b2e7db4086129db0a0a81d12d09afd4dc71aee3ede88b42c438
TLSH
T1AD217C8C39F84D5ADCCBF69C7881028EA7168E03144B1D534D03FF8DCE95ADA326A839
MD5 SHA1 SHA512 TLSH

Submit Download

8005b0f4-5606-4958-99e1-d0ca29100cc4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\8005b0f4-5606-4958-99e1-d0ca29100cc4
Size 235B
SHA256 d03bae3783ff9a3b5c6396994ee774a8089a95eac4f083683d63ca97ca9e38ac
MD5 5178a5b6645c766ba698df6b6972ce67
SHA1 457783194dc9b33a840e17b59ed47985ef32019f
SHA512 1dd3eb8b299f29f161f43434e4dc781f0a9f253de91edb663c959ef3e971414fd1150daeb4d311c680cd7c1bda2597ae9173a5381268ae3cadfa16352cdf028f
TLSH
T1D7D097802499339C19204F07B0E02DE631448C3318A05CA08AE142789DB9DC44265906
MD5 SHA1 SHA512 TLSH

Submit Download

817b6002-8845-4471-b40e-1e9e54923e14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\817b6002-8845-4471-b40e-1e9e54923e14
Size 883B
SHA256 295ce1d2e30d3a1b39925aee3b002ea27307d399d0c7aff5fbc43f62f1613f54
MD5 8ab1995d35b0d0fe474c6f4ad78e7084
SHA1 d172431cba22f8f4f31cd63f6dc9e97c83555e8e
SHA512 0f5e969ff02ea69c7101f5be77ce93923f0772873adae110d9bb4b27ca8155988070b16a6cf6082721968347371d9ccb84011b673870f841fd97cf6a915b3640
TLSH
T1EE11E342A534B4F6CC38A14FD69277918BF4B43380C655147DB15A080DAE61EA3AB60B
MD5 SHA1 SHA512 TLSH

Submit Download

94dd0ec1-ebc7-4f52-a50d-d6fa120cb0e4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\94dd0ec1-ebc7-4f52-a50d-d6fa120cb0e4
Size 886B
SHA256 a6f910911467075ee8e71554075e9bfbd5fc4a61e9c19352248c2fa563126f3a
MD5 c2b3e5a4212b3c42736b39d941e42f26
SHA1 2c1f17e2a67545f0ef6f88a515da7f5baabc7c1c
SHA512 bf720139916db94b0ff87382328f5c9952f2db3467dd177e8ee3d3f4a1b91da4f8897e9a998dcc8994a0f2c4659399bbd5d607217f4dbcc87a876ca58d90f476
TLSH
T14611E3418574B5F2CD38A25FA6E1B74287F4B43380C64D247DA15B0C0DEA11E67EB60B
MD5 SHA1 SHA512 TLSH

Submit Download

b9969103-86bb-41f4-9703-894788d18add

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\b9969103-86bb-41f4-9703-894788d18add
Size 2KB
SHA256 ce158e3b89b7684bc5a31f8fad0e5f7ac21d6cce815668956cdef2f03b124fa3
MD5 feb0423e370e0a1a3e423788daf84cc7
SHA1 509b73bcd6b15910fc8766e6fe8f58089f46ab14
SHA512 d0ff47a14cfaf3cde25260aefa744c4ac955261cddcae8268928e6b026a42ec7a41dc7bcd156954501fd2fae0ea95ca5f7be9cef8683df8f706d2b396c60756b
TLSH
T11641335C74784CB6CD9AE29DD582378D4370CE1300CA5C832D61DE0C8C9A7AD337A52B
MD5 SHA1 SHA512 TLSH

Submit Download

f270bf3d-a6db-4ae7-a0b6-72a48dec1370

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\f270bf3d-a6db-4ae7-a0b6-72a48dec1370
Size 235B
SHA256 43d55b941cbdd34d7d49a5bc53c37803eaf2fef6ab21e3498dc7537b3c9184f3
MD5 2b007e85672b271241fc1717ec1a3f1f
SHA1 144299a31967d5eb733feb6d6ea908d88b21a4e4
SHA512 80ed2a8a4ea72f288cc1154d443f6178acfc7b4c77968a21b1a76eb8042d66105edb09729b626e79f068cb105f7a01ce4da1332b779cd84bca8afc339fe03a9e
TLSH
T1E4D0A78064D8B76D4C280F57F4E06DC631488C3324B56854D56655749ABAACD6191E1A
MD5 SHA1 SHA512 TLSH

Submit Download

f30e81e5-dd7a-4a5e-a038-dfe3825e78fd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\datareporting\glean\pending_pings\f30e81e5-dd7a-4a5e-a038-dfe3825e78fd
Size 16KB
SHA256 6e21815178332ce81a818f50360f7d98a7c502fce812412216d86a9ac57717ae
MD5 12e91c465380d519a614e649545d3957
SHA1 8e1da382679c12d0176df605e3d039ffb504c9fb
SHA512 6ce4cd6d32e482a6613b22e81213a4ed246cede7162bf22fba3dd7790735eb9f0aa4942805a1fc2c29d3a4d95d791b83b9fba3faa7bb8cd12fafa41469d44a4b
SSDEEP 192:t08qFMOKdj8KmlpfjnehuZ3zGQ32zhH71ZL9VUIFo3xc6jZZTH8GcziHRiRvDMwH:TqFMIKqnsQsAXTcGc0RiRvD1vdQJ4
TLSH
T10672C756182085BA8251E36894EDBFC7E6F528CF4C418FCA9BE4BD0869DE06E113784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\extensions.json
Size 16KB
SHA256 ea83844a061bac9e4c0c0f938552e64969f05a7a861ba5a254c6015b9b90b375
MD5 0eee55c197c9d14dac2557c3df2d544f
SHA1 d0e9ee03e57100168d8b1a7ef5cdfe3625f5c426
SHA512 8ee8d1fe3f5cf16f4163d78647f7d841ea3ce9c50f0124e4889ef3c296798a185279c63e1a7d8b808f3e1091f799234f1b5d5fcc4af21ea42b60bf5d6210c24c
SSDEEP 384:jkI4vvUmldv7s8dhWg94zz96obL4HTL4PQL4HLL4HaL4HG24hJ:gI4nRfztX94F6w4/4a434I494/
TLSH
T15572421545048EB8298FA78AAA367E01C37D573B70845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs-1.js
Size 8KB
SHA256 05af8d03d8691481134d06260ca15ebd73f8e98dc194aadc097ed12913a559e6
MD5 c37119afc362d1833bdd921d18a412ba
SHA1 8fbde74ac7ce691cd7e7ec201da9dee6d010ab78
SHA512 e53bba173776fc091c7d170943885ac9c499749948fd226fbc66a32e6f51bbf42ef7382e535ca652e280fd8dddedd738d3c4cd04b32453bd1837d481393dbe98
SSDEEP 96:xHThTUSPqGqgfYupcjObzSSSSl5dv9jGnLWRdRBoefQBw88nap8L4cnj9WGS:ZnCRgfYupcjASS/RT9fQBw88aD
TLSH
T15D020F785044CB7F64F2777CAC2449316AB2023BB7BFA8D610B95885411CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs.js
Size 6KB
SHA256 8ecaccfad923333a0bb845356d37054fc1959f818f0ba4661a90b8f331579070
MD5 ca134cfd3c500aab5f3045b4ce499b9b
SHA1 cc76b6654f8b97d69d69ed1262b4533af62d8005
SHA512 3a61eb12bc338344a5f298b193aaaeb9192025408c2d7366f7e2bd33af9822b20cb422a30f2348e0754de7ceb599a3d78c98b29de0c89f9b3e4fad1547dc0b16
SSDEEP 96:xHTUTUfqGqgfVtk1zS6SSl5dv9j+nLHlBoe6Bw88H8L4cnjzu/:ZiRgfVtkbSSyl96Bw88UM
TLSH
T1C9E11F789418CB7F74B677ACAC688C716AB2013BB7BF68D650B65484050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs.js
Size 6KB
SHA256 409590a721c41992d20bbf87d46a669528fc734bcc0c158decb1eeae742339f9
MD5 1f34ce5c81a29b71026014bc8e2864d8
SHA1 3cec1c9e1d137e1b07f743d421f4930ce9c40153
SHA512 7e4122e5171adb2874d57b8eb23aa210f4e8ca4b30f587ebdc84ed774fae7d652381eb78a10f4ba8fbe4107afb0a1573ec9f317ba5573fc0abb4d31f951e402f
SSDEEP 96:xHTUTUfqGqgfVcj1zSSSSl5dv9jGnLHlBoe6Bw88H8L4cnjzuWGS:ZiRgfVcj/SSql96Bw88UD
TLSH
T1B2E110789418CB7F74B677ACAC6888316AB2013BB7BF68D350B55485051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\prefs.js
Size 7KB
SHA256 4e1b012f39c065a30f7b1268b8459899987f23ef009a6fb364b4b0d61196213f
MD5 40bb5db8cd7b0f9f8f1fce1be06c18fd
SHA1 8a913a7da170b01cd175138418d09e45511beb5a
SHA512 cb377c06bb683844cc13ee693a80ffc3d43f63a26d1da66f218c110417f0a330ad48737328146661e0da56175cddd17921fde0b53a5276460af7f40e696077ad
SSDEEP 96:xHTUTUSPqGqgfVcjObzSSSSl5dv9jGnLHlBoe6Bw88H8L4cnjzuWGS:ZiCRgfVcjASSql96Bw88UD
TLSH
T159E1FE7894188B7F74B6776CAC6888716AB2013BBBBF68D350B55484051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 c9fb499eb36dbc6a1fffa0dfaba9d349deb7931b633949809f37272d6210395e
MD5 e89d119dcfc4af61b9fe0ad4d5b28bcf
SHA1 255efe97e7c0d492cf19f744aa4716ebffbaebab
SHA512 71cb7615df8c6a20d066fb25b066d5c454d42bd7e5c19a41cf951808dabaeaca0eb7522e26e0feb89f01552716d5b6265f9e561b36dfce85646350edfb4d460c
SSDEEP 96:X2jOMftiAFa9hSvR8ZY0Y0hDJ14a6m0PINe910HA2UozUq19phU4zorAqYzSA:XOOMftiAFa9h6yZJhtfEAN2w1UC9phUK
TLSH
T15BA17DAE5C6EBD806CE4C242454E4E5BCEC841E9D6FCA7C4AB5C0D020C29541FA8F797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 a83a4b071ebc707c5cccc8ebc6639c57fe634b24ff9d68e5d09397cc452165b4
MD5 48739f2a9b485bc4769daab2ff300078
SHA1 fdf780c00cfae2e1b6b44e12e1f9cce786989c78
SHA512 f867a3df2b38d164dc098fc31a3d2c53ca2f7ded6770cb138eaa945f9c01c52d40d7d865ae0798ad85b5b5144d4137cb82ce239b5f760f31ab3328abb3544a16
TLSH
T1D421E7C6BF1FBDB722D9920D80C82FD5EB92506246BCB0F0D8642B420E4854FB29A305
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 9411461f7874ab58b9d6af68a77a6da1a29767589cbaf336c289f8df1b5cbab5
MD5 5e70edbf50c310b9148b95998778be19
SHA1 1aba22d4d6521552dc3a581b34df9367745a8c3c
SHA512 ec27ddf0fdc8063f0e6277c2c19e76f71a53fb992daaa89fd9f5a84c2632929309a4dd14fb02ff53f2e11d03bf4a06c139830c8b7068321d8f6b4152cb22e5a0
SSDEEP 96:92jOMftiAFa9hSvR8ZY0Y0hkJ14a6m0PINe910HA2UozUq19phU4zoT5fekF+K:9OOMftiAFa9h6yZJhmfEAN2w1UC9phUR
TLSH
T150A18FAE9C6EBD9058E4C243454E5E1BDAC952E9D6EC93C4E36C0D020C25581FA8F79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{fd27f850-0427-4bf6-9782-a6730ed511a6}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\storage\default\https+++mega.nz\cache\morgue\166\{fd27f850-0427-4bf6-9782-a6730ed511a6}.final
Size 1KB
SHA256 4564b6c7621a5c0e4bbd0da9845cad643d999e43c4446a5085085625681d8065
MD5 f452a91d1d0c47792f0ad99b3d27d017
SHA1 f02f18b4692d98326a4bb1f699391be16d70b24d
SHA512 9cef88f5cf989a1ef118b33046012aa6b34d85b9fb31e6a6ceeeac5b19d1b07965998a215b201e6c33cc4eb88393eeb16050a4773ab50cf339dbc0b66c45cef0
TLSH
T1DC31FD86F7FB5017D412E3A8CD3C7449C515AE2C6A34416565E8A6C02C9C9FEF7645C1
MD5 SHA1 SHA512 TLSH

Submit Download

1409365021%s2p4.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\storage\default\https+++mega.nz\idb\1409365021%s2p4.sqlite
Size 48KB
SHA256 6957634784d47ada827ad0f80694e740c11d433f3a0ccc9b9fc6849341bb51af
MD5 26093c0a0161485e5261edd186b9c1c8
SHA1 be00da2c9e2aa6f0745bfaf22622b57aba31f689
SHA512 fcb6bf28ddd0444729fe61319483111746c344277ce0c445bb7e33c0b38ecb8ccf43c738664af14bfdc30b55d50e37c690849df628438418460fcb87cf011069
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEd:Oa16S6CKnqlizbxV+2xVeU7X2B0d
TLSH
T1892370CE3F07A511C53AF0B178A08D51BC5F321E07222AD569D0DAE4C8F211AEE1F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 0368c795fc6af7bb7fc18281b5276b3466dcf34eee7e19019d5da230a82d97e8
MD5 25d29428d670a163df76e78ae0fe1b40
SHA1 be09bf6f9aa20b2eda49904269b8927c5cabb45f
SHA512 9256f27329bd7b0d168b9ee7687ecc4a1c4a07d7f53bc78789fe4c39732f7980b54fafe2bc1d5904a375d38d9a9851d1c177356ba23630b2431626b1494689a5
SSDEEP 49152:B7l3Q9jg9SieDVYTuB+JXZaW3seb02/qEw21:5l3Q9jg9w+JXYW39b9/Y21
TLSH
T149163AF824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v1pny25i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.6MB
SHA256 3f0470e4bd077c501903e90f37432aa55960ee3ffbc1fad15f1d37ec3b10e60b
MD5 8488046f33d0cb0a541f70cd0828d5de
SHA1 47d2e734bfa4c481aa924649f929b02803c242bc
SHA512 b6819f305789b16f81bc7757a9ffdbd33e8438c65ee53ced4c642ab439ff38e85639425e2276d4ed93f3b2af49a535f6bb2a0caf938dc6cfd13b27db665620b3
SSDEEP 49152:Y9yWkhn/X1We4y2D3/Y0fiMxTl6Nk2ZXkVTtcj5YS+NI6nB9vyj1K/rvq7Y90BZM:8lMZMTqE2uOSHhHyo
TLSH
T1C9665CE420E29252F34180B3719953EB11EFC01C6077CE445B9896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vega X v3.SCb6j5Du.0.zip.part

Path C:\Users\Admin\Downloads\Vega X v3.SCb6j5Du.0.zip.part
Size 42.9MB
SHA256 992057e88c9e6bab5cfa15460ba7a8dfaedb56f25f32887820bdc38ec4e314bd
MD5 e6ee01480cf9daf82e34d03f840581d6
SHA1 dc1330733028c6c3151fb6f08d2b3c2c64d47238
SHA512 9accec551e191b23f9e23ce117ed01fb5687e7cbe038424e53ec59df0ff2b27e39a566c2a4014e0e4d8abe387673f96826a1a76b09c4a4014f276337ea6b4b29
SSDEEP 786432:4PTe86gkO5epGZ+xIiv8dkY5hocZylJNDjECrbE4/qeNepSH+0oVa5:4PTe86g9epZubtejEcv/oSe85
TLSH
T1CBA733A9A2F00653CF9F3137B7CBA5450D9D87D109A25D1225BC22C3ACC69D9378B26F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fO9cKeuG.txt.part

Path C:\Users\Admin\Downloads\fO9cKeuG.txt.part
Size 981B
SHA256 0452f6f2e31339197904bc47b3094dd9defa77cf50e11733f09449a81a717256
MD5 c6b8f693be589f6765249afe4682c2ef
SHA1 0a9f279f3bf1c8b68f6dedd651dfc4b400d4554c
SHA512 1d3f03411d2316e04fbcbd1dfe82350239d90ab85c9987f49d29fd1d6b0f6230742a0b0808f33575f77bce435098c65117e31685952463314a11ca8587ac8324
TLSH
T15B11544F7237D15404C99191F43B9AD6FB174178A36095ADB8AE902C7328364E4E698F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5396-950-0x0000000009F00000-0x0000000009F38000-memory.dmp

Download

memory/5396-955-0x00000000068D0000-0x00000000068E0000-memory.dmp

Download

memory/5396-947-0x0000000008CF0000-0x0000000008DAA000-memory.dmp

Download

memory/5396-948-0x0000000009960000-0x00000000099FE000-memory.dmp

Download

memory/5396-949-0x0000000009EB0000-0x0000000009EB8000-memory.dmp

Download

memory/5396-945-0x00000000005F0000-0x0000000000D30000-memory.dmp

Download

memory/5396-951-0x0000000009EC0000-0x0000000009ECE000-memory.dmp

Download

memory/5396-946-0x0000000007CD0000-0x00000000085FC000-memory.dmp

Download

memory/5396-954-0x000000000A250000-0x000000000A302000-memory.dmp

Download

memory/5396-956-0x000000000A3B0000-0x000000000A426000-memory.dmp

Download

memory/5396-957-0x0000000006920000-0x0000000006942000-memory.dmp

Download

memory/5396-958-0x000000000A800000-0x000000000A81E000-memory.dmp

Download

memory/5396-959-0x000000000E7B0000-0x000000000E938000-memory.dmp

Download

memory/5396-963-0x000000000FD40000-0x00000000102E6000-memory.dmp

Download

memory/5396-964-0x000000000F790000-0x000000000F822000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads