donutloader | 74f3d90db9440e86d167b28863b506957a0cf96df6d0d852f48ea5d469af9a03

Analysis

user interaction
yes
max time kernel
114s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20260513-ja
resource tags

arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
10/09/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
badata_x64.dll
Size 81KB
Sample260910-k57jdagd29
SHA256 74f3d90db9440e86d167b28863b506957a0cf96df6d0d852f48ea5d469af9a03
MD5 2a1d2dd258f7321dbd8779cdd60fe100
SHA1 ef91b4a48e0ab9556c432ba8776c563dfcafaf9b
SHA512 94f9152983c6d35af38700c6d5de8b18213d64aa02431b3f92b8abb89063efdf99a721e9207b4e5a116779c8df1fb92c5bc2fe0c6b9fd723ca3013a27c82fc10
SSDEEP 1536:0buYnmyU5FEKaYHdJFZ0GlazxV1HLUZ6t:0buGq52PYHdJFZtlalbrrt
TLSH
T1E083A72263A5345DC766D63E01062732D6F13C6A271012BA0AB8AE612F75ED73F3D6DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader overlord loader persistence rat

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/4428-344-0x000001BA13BB0000-0x000001BA142D1000-memory.dmp	family_donutloader

Detects Overlord RAT 1 IoCs

resource	yara_rule
behavioral1/memory/4428-351-0x000001BA17A70000-0x000001BA1ADE1000-memory.dmp	family_overlord

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	4624	rundll32.exe
13	4624	rundll32.exe
15	4624	rundll32.exe
22	4624	rundll32.exe
23	4624	rundll32.exe
25	4624	rundll32.exe
26	4624	rundll32.exe
53	4624	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
2592	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate_xYQh = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_xYQhBb8S\\rundll32.exe"	rundll32.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
55	api.ipify.org
56	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{1213100C-9CF0-48A4-94A1-10099500B19C}	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{7F43D75D-D8FE-4308-8EDD-9F97F11D5E81}	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4624	rundll32.exe
4624	rundll32.exe
4624	rundll32.exe
4624	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	firefox.exe
Token: SeDebugPrivilege	4740	firefox.exe
Token: SeDebugPrivilege	4740	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4740	firefox.exe
4740	firefox.exe
4740	firefox.exe
4740	firefox.exe
4740	firefox.exe
4740	firefox.exe
4740	firefox.exe
4740	firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
1460	OpenWith.exe
4740	firefox.exe
4740	firefox.exe
4740	firefox.exe
4740	firefox.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 4124	1460	OpenWith.exe	101
PID 4124 wrote to memory of 4740	4124	firefox.exe	103
PID 4124 wrote to memory of 4740	4124	firefox.exe	103
PID 4740 wrote to memory of 1812	4740	firefox.exe	104
PID 4740 wrote to memory of 1812	4740	firefox.exe	104
PID 4740 wrote to memory of 1812	4740	firefox.exe	104
PID 4740 wrote to memory of 1472	4740	firefox.exe	105
PID 4740 wrote to memory of 1472	4740	firefox.exe	105
PID 4740 wrote to memory of 1472	4740	firefox.exe	105
PID 4740 wrote to memory of 1472	4740	firefox.exe	105
PID 4740 wrote to memory of 3964	4740	firefox.exe	107
PID 4740 wrote to memory of 3964	4740	firefox.exe	107
PID 4740 wrote to memory of 3964	4740	firefox.exe	107
PID 4740 wrote to memory of 3964	4740	firefox.exe	107
PID 4740 wrote to memory of 4724	4740	firefox.exe	108
PID 4740 wrote to memory of 4724	4740	firefox.exe	108
PID 4740 wrote to memory of 4724	4740	firefox.exe	108
PID 4740 wrote to memory of 4652	4740	firefox.exe	109
PID 4740 wrote to memory of 4652	4740	firefox.exe	109
PID 4740 wrote to memory of 4652	4740	firefox.exe	109
PID 4740 wrote to memory of 4652	4740	firefox.exe	109
PID 4740 wrote to memory of 5828	4740	firefox.exe	110
PID 4740 wrote to memory of 5828	4740	firefox.exe	110
PID 4740 wrote to memory of 5828	4740	firefox.exe	110
PID 4740 wrote to memory of 5828	4740	firefox.exe	110
PID 4740 wrote to memory of 5876	4740	firefox.exe	111
PID 4740 wrote to memory of 5876	4740	firefox.exe	111
PID 4740 wrote to memory of 5876	4740	firefox.exe	111
PID 4740 wrote to memory of 5876	4740	firefox.exe	111
PID 4740 wrote to memory of 5904	4740	firefox.exe	112
PID 4740 wrote to memory of 5904	4740	firefox.exe	112
PID 4740 wrote to memory of 5904	4740	firefox.exe	112
PID 4740 wrote to memory of 5904	4740	firefox.exe	112
PID 4740 wrote to memory of 6024	4740	firefox.exe	113
PID 4740 wrote to memory of 6024	4740	firefox.exe	113
PID 4740 wrote to memory of 6024	4740	firefox.exe	113
PID 4740 wrote to memory of 6024	4740	firefox.exe	113
PID 4624 wrote to memory of 4428	4624	rundll32.exe	114
PID 4624 wrote to memory of 4428	4624	rundll32.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\badata_x64.dll,#1
1⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\RuntimeBroker.exe
  "C:\Windows\system32\RuntimeBroker.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  PID:4428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3936

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\badata_x64.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\badata_x64.dll
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {040bf020-3d55-4401-80e2-b51a0212510f} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {43649256-3fdc-4533-95f3-15236e3274d0} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:1472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27325 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {32d393fa-7948-4257-af65-aacc1d37d7a6} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3980 -prefsLen 27325 -prefMapHandle 3984 -prefMapSize 270279 -ipcHandle 4048 -initialChannelId {10b10c84-ee06-4d3b-8cb4-0312760ef720} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4308 -prefsLen 34824 -prefMapHandle 4320 -prefMapSize 270279 -jsInitHandle 4324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4332 -initialChannelId {df96bd31-06c5-49b0-bd53-b6da76c2d076} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5136 -prefsLen 35012 -prefMapHandle 5124 -prefMapSize 270279 -ipcHandle 2868 -initialChannelId {e86a6724-9a35-40f5-931e-19ceb4117b9a} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32900 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {5f82d3b3-9b67-4b05-b9b8-a7e573a6c371} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 32900 -prefMapHandle 5308 -prefMapSize 270279 -jsInitHandle 5312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5320 -initialChannelId {78803f42-ecdf-4e76-b390-4430e4a469a2} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {9e7473f1-cf1f-4f55-a688-402bc8aaad66} -parentPid 4740 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4740" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6024

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_xYQhBb8S\rundll32.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_xYQhBb8S\rundll32.exe
1⤵
- Executes dropped EXE
PID:2592

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rundll32.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_xYQhBb8S\rundll32.exe
Size 70KB
SHA256 b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
MD5 ef3179d498793bf4234f708d3be28633
SHA1 dd399ae46303343f9f0da189aee11c67bd868222
SHA512 02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
SSDEEP 1536:J8qpnO/qRUNReI3fu6Uw2mTARPw2cm+YRQln5IUmDjoX:C/YUNRBfukTreXRQln5I
TLSH
T16B630BC9A66460F4E077953444734E099272BC22D7625ADF54F0F17C0FF36E0A93AAAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f2f1331e0bc3409f1be592c83ab31c0bc8c4e884d122ca628705e186e00ee070
MD5 2862d2f8036f9aeb6ead0c744363dd7c
SHA1 823653ccf13774572371ff5e99f3e5ddc2af34fb
SHA512 dfa095c1345ab719adb6b7a54e49046bb8a0fce6162bdbc77a43c9802c38d8f4d200953f22a05ad3677e23ebd63aa540a10ac965f87c895f6c541520cc8efdfd
SSDEEP 192:CPOv5zbowbqmyjFA611d66JozGzgCl6mc0d:CgbowbqmyjLzd66JozGzgC1j
TLSH
T171D10DA4FA28463FC448023BCCA61F414E36395BD84E7F29319D741C2C5A29E7B8D07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4898ae080071c809e5c1aef8530e6f2f43d5ad95ed4656f64adbd98fa6f3c2f8
MD5 0bb6ea00e488a3b9fb0655562833ff88
SHA1 4908dbe0ae39aecba693ad25d34ac5a95ebc472a
SHA512 c163f00a17e51cd52ababd5dccf2a65584ff208436b9202b59146d98d2950610e9c4bc98653a0fd59b55848d9bef142ed914cec2c75ca1a7811e6b4dad50c35e
SSDEEP 96:zSdF95/7bkW60rcPyUR6axhWxFOwQFfFsFNF4/dd66JozGzgClKtmc0d/U:zOv5zbowCyj0A611d66JozGzgCl6mc0d
TLSH
T104B1EC68F528463FD444433ACCA22F004E3A395B984E7F1A36EC74582D5B6DD7A8D0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5099ee7d021a570bdfb95352b640cc7ace6060bbb746cb142ae14cf65727279f
MD5 560dee179880e7b57487b00757952285
SHA1 ac495cc76f773e3bb15bdbd182f3dc83da138a10
SHA512 28927d188447cade850aca7e1c7494a051f524eead7234da13c8139f6dd4c1a1450c8d0e680f9b163e4c79288f4867c815f70ba90f565bd310226d0d0a20a885
SSDEEP 192:RPOv5zboPzZqmyjFAb11d66JozGzgCl6mc0dz:Rgbo7Zqmyj0zd66JozGzgC1jd
TLSH
T113E10FA8FA28463FC408027BDCA61F414F39395AD84E6F29359D741C2C562DD3B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 49a5b7e129638a0245195b6152740d2344edd5c5d430f0e51edccb92c37afd31
MD5 592ec682c8cb995e1b9cfc5d32d3824f
SHA1 3b9c3192e957069dd5ea7ae6c1d1ea22b8f89957
SHA512 6820d51cb2785a8ec883a3b845b2d8fe3f35ecdf0724efa3896bd067b9a5bd7f39ccee193898f5c7f640e008c6f6e661af027178c8bb9f269ade7b364110175f
TLSH
T1F8216A5C39F94E6AD9CBE39C7582028E93114E8706871C434D52EF8DCD816DD327B539
MD5 SHA1 SHA512 TLSH

Submit Download

3525ca6c-2729-4fab-a05e-5f4f3bdb3c2f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\3525ca6c-2729-4fab-a05e-5f4f3bdb3c2f
Size 235B
SHA256 02ff850e8c02d9908e20f3a70fcf9933885e84edaee4ab47100d3ce381b77628
MD5 680c885e7c0c6987a58c2e26e9a560fe
SHA1 4fd24331eb18de31b425cae5ccdb429011cb7c4b
SHA512 26a0f9349de38cbf5e735fe2109f3b46c0a07c6d076022972d4276c01ee34991e675065715bb99acaa238ba6c4daf8b290dc6aca44c7517fe01c63040cb1ff30
TLSH
T1B5D097C464982BBD08090F06B0A029DA30888C3724A2A8208A524138AAB8AE482A280B
MD5 SHA1 SHA512 TLSH

Submit Download

40d31669-f898-494e-bec3-caa283ba6111

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\40d31669-f898-494e-bec3-caa283ba6111
Size 883B
SHA256 a0ffbb3ec058d89c440aec930507225badf42ecd0e7437cee95f2c1ea0e423eb
MD5 913f1ea5cfa665b30195dc3dbf31f3d4
SHA1 9b461cd7e7f5e33183e52da03c3b24fe6ff95d53
SHA512 ecd2e075507b1ac7b1e2598a79c5bd5b66d964f033d410535bca7a332a398cd3b6338dd0bf67bdb9cd32e072a811b818c15da77b4b4bacb5c2223ac47a83d5e7
TLSH
T1461100D1A93075B2CC7CD24BC6D27B425FE47923C0CA84143EA26D280D79A1E976A207
MD5 SHA1 SHA512 TLSH

Submit Download

7456510d-0907-480e-9c4f-6ca0113cf53d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\7456510d-0907-480e-9c4f-6ca0113cf53d
Size 235B
SHA256 4b1ea3b9c46775de2836f63e8bf66b19321071ce95fe7774bd0f331da2ac509e
MD5 85b59e780358fd04d0735b253da196a4
SHA1 cef7f4e42380ae5cf445bb4cf81e8e336181a6e1
SHA512 af9270671001351debc3760b121763a4320c5dea23fd96b904118e6076ac3793a297d4b2b7d0daa1d4a7b55921574e7fb7b056938f17a3b705a09aeeb0be86e9
TLSH
T133D0A78058BC676D88140F17B0A46ACA32858C377878A860DA9149789EBDAC44162C57
MD5 SHA1 SHA512 TLSH

Submit Download

bdffecd4-d2aa-4ae9-a1ff-ee4a73039d8a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\bdffecd4-d2aa-4ae9-a1ff-ee4a73039d8a
Size 2KB
SHA256 87e076e085419504839589dc6186486e081801db5d091f05de04ce0c248aed12
MD5 952542e16f89ca5cb82591d0e79ac878
SHA1 b46a31a13fe9476cb5c243b806420db3b8d1e71a
SHA512 ea7e6385c2096f5db0eeb55c546cfe3bee42a63dc22629865e0a0b15988213c8a10a57bfea98748dae9522822ebed145a021807215b8b5677bcb37fe25be03e8
TLSH
T13841235C79B85CB75CDBE59DD1D2338E97644E1380C618832E92EE0C8C8A6DD236E52B
MD5 SHA1 SHA512 TLSH

Submit Download

f32256a0-ef54-4186-9582-9c7acf010c81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\f32256a0-ef54-4186-9582-9c7acf010c81
Size 16KB
SHA256 1100bb561071fad3f883259afb2e0a33023bdbdd518ee589cc2b5a2d7877cd04
MD5 e1b109cab29d9e503a451be8409e6aa7
SHA1 81f41fdb478732692d8c4afaf4436b6b8829e3cc
SHA512 6eb31959ee417a8d179213772b44efb9f9ce52538fdbf72e8472add43a0208d34033f421ad9ef14603d707bb858637fe1748036cd37985723a2b6662176a8c6d
SSDEEP 192:tT7r85gnt1EGTP1DVNQ+fBj4tds0ytPLMiDcRN/Szx7cTcZI4d9tLxLI4gE3dYUe:xugt1Ndk+f2tdxytPL2RN/Sl7Scqiep
TLSH
T17E72DA56282045BB8551E36994FCBFC3E5F538CF4C419FCADBE4BD0829DA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fedcdf83-e8db-479a-9314-584378b80edf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\fedcdf83-e8db-479a-9314-584378b80edf
Size 886B
SHA256 ef6e8679a39ff0f03860c28243fd99a75051dafec413272e63faa910d16b5021
MD5 9520a3d7096a2a095d1f2b072c1df7c2
SHA1 03baadcac9a77a6c1a976734c8bc8c46fea630db
SHA512 4c4b1289a8a5cb4b530d46d782e3a02a2368e1abca00266460b6328f90b9b786d1d576e9e2292ccb1c1b50c8612d80eb1f64b96bfc7a094b5f21025f938f5c96
TLSH
T1BF1104C1993479728C6CC147D5E1B7428E943533C0C658183E556A180DAAA1D572B207
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 c40ff1eb7010e8751a1c547531e90c23c5a9151a3974dd78c50649d2d1119958
MD5 14b0690883770dad4d6a9e2db7823208
SHA1 4a07241c395ad1a10ba6cffb15ef3063b9bdb4d4
SHA512 a2fce4637ea10b6a22a2f9d793d8fa6391da6dc4a8931ca6355555ecbb43f7838afd61d531f24627d66169501665a738df6e19a857c58fbfc8dede3a8b2c6cdb
SSDEEP 96:xHcUTURPqGqdf2UyoObzSzPSSlDdv9jenERH9O+y1Bw8On8L4cnrzSK:6hCRdf2UyotSSt9A1Bw8O+B
TLSH
T13CE12E7894088FAF64B6766CAC6888716AB2417B7BBF68C750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 8108cd4f35e2947dfbf40ee38642be67a55a74b1a2494d886d4d0e3cfbc68894
MD5 853bb35288bf7c51bbca138b2f65d1f7
SHA1 b448e3d78ece70adeabc71c06cf5ddb6ce4319ab
SHA512 7ab85ecd67e2328306e20b0d1e988eac5225d5bc3cbf98f8310ea1d779f99461099e7b9d5859ce226696db1df22357800a051dfcb82bf881ca1a2f1c4c29b0e3
SSDEEP 96:xHcUTURPqGqdf2Uyo1zSzPSSlDdv9jenERH9O+y1Bw88n8L4cnrzBHK:6hCRdf2UyoiSSt9A1Bw88+w
TLSH
T134E12F7894088FAF64B6776CAC6888716AB2413BBBBF68C750B554C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 8a355b15e09da56ad54cea0fb9a785716f29f946fe2fb637f5b063a924826958
MD5 00ec6102dcca31781bae6299576537cb
SHA1 e411ccab0c71b65b618cc2e1f0797651b128de88
SHA512 743ab80566db138e7e2b29d95b45bf6340594221dda505504be99c27cb10c1b4ac23cdc75152f659c84b6725c7679f1ca0a0a640a86b7260ee37beea0ad7a55a
SSDEEP 96:xHcUTUuqGqdf2oE1zSzPSSlDdv9jMnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEiSSX9A1Bw88+w
TLSH
T1C4E13F7894088FBF64B6776CAC6888716AB2413BB7BF68C750B954C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

badata_x64.dll

Path C:\Users\Admin\Downloads\badata_x64.dll
Size 81KB
SHA256 74f3d90db9440e86d167b28863b506957a0cf96df6d0d852f48ea5d469af9a03
MD5 2a1d2dd258f7321dbd8779cdd60fe100
SHA1 ef91b4a48e0ab9556c432ba8776c563dfcafaf9b
SHA512 94f9152983c6d35af38700c6d5de8b18213d64aa02431b3f92b8abb89063efdf99a721e9207b4e5a116779c8df1fb92c5bc2fe0c6b9fd723ca3013a27c82fc10
SSDEEP 1536:0buYnmyU5FEKaYHdJFZ0GlazxV1HLUZ6t:0buGq52PYHdJFZtlalbrrt
TLSH
T1E083A72263A5345DC766D63E01062732D6F13C6A271012BA0AB8AE612F75ED73F3D6DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4428-344-0x000001BA13BB0000-0x000001BA142D1000-memory.dmp

Download

memory/4428-351-0x000001BA17A70000-0x000001BA1ADE1000-memory.dmp

Download