735ef337baf92fae6e4f848f48d26acec60cd14b8c6388a17e501d16ed61fcbb

Analysis

user interaction
yes
max time kernel
435s
max time network
465s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Data.Center.v1.0.40-P2P.zip
Size 645.7MB
Sample260415-3e8ymaby6p
SHA256 735ef337baf92fae6e4f848f48d26acec60cd14b8c6388a17e501d16ed61fcbb
MD5 0a26886c4c81bc6b6b4cb4275189b44d
SHA1 d0616358ae54e3d5e5cff6f2d129ecc115835eff
SHA512 3745121875c7f7ebe75a1a796e7c03bd057e8feecb94fb9746fa5b02954df08deff27662e77d3fd58cdac3f8d2b5fa71b1864711366a8b8bbd51378ca1d47fd4
SSDEEP 12582912:t/oxxmbF0utACJItgP8QEWS2lpzoVvU7CShpI3acLYkqkif09dGa6R0zEjNBK0vZ:t0xSt6gHhlF2s2ShpIK6eRf09dGl7vAQ
TLSH
T1F769338B814F0F5EF8AB2137847AAE0396A06D71E3E68058C942D3D91D57EE4B07DF19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Data Center.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Data Center.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Data Center.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Data Center.exe

Checks processor information in registry 2 TTPs 40 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Data Center.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Data Center.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Data Center.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Data Center.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Data.Center.v1.0.40-P2P.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3984	Data Center.exe
3984	Data Center.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	firefox.exe
Token: SeDebugPrivilege	2396	firefox.exe
Token: SeDebugPrivilege	2396	firefox.exe
Token: SeDebugPrivilege	2396	firefox.exe
Token: SeDebugPrivilege	2396	firefox.exe
Token: SeDebugPrivilege	2396	firefox.exe
Token: 33	4708	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4708	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
2396	firefox.exe
3984	Data Center.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 2396	444	firefox.exe	82
PID 444 wrote to memory of 2396	444	firefox.exe	82
PID 2396 wrote to memory of 4724	2396	firefox.exe	83
PID 2396 wrote to memory of 4724	2396	firefox.exe	83
PID 2396 wrote to memory of 4724	2396	firefox.exe	83
PID 2396 wrote to memory of 1636	2396	firefox.exe	84
PID 2396 wrote to memory of 1636	2396	firefox.exe	84
PID 2396 wrote to memory of 1636	2396	firefox.exe	84
PID 2396 wrote to memory of 1636	2396	firefox.exe	84
PID 2396 wrote to memory of 4032	2396	firefox.exe	85
PID 2396 wrote to memory of 4032	2396	firefox.exe	85
PID 2396 wrote to memory of 4032	2396	firefox.exe	85
PID 2396 wrote to memory of 4032	2396	firefox.exe	85
PID 2396 wrote to memory of 1584	2396	firefox.exe	86
PID 2396 wrote to memory of 1584	2396	firefox.exe	86
PID 2396 wrote to memory of 1584	2396	firefox.exe	86
PID 2396 wrote to memory of 236	2396	firefox.exe	87
PID 2396 wrote to memory of 236	2396	firefox.exe	87
PID 2396 wrote to memory of 236	2396	firefox.exe	87
PID 2396 wrote to memory of 236	2396	firefox.exe	87
PID 2396 wrote to memory of 4472	2396	firefox.exe	88
PID 2396 wrote to memory of 4472	2396	firefox.exe	88
PID 2396 wrote to memory of 4472	2396	firefox.exe	88
PID 2396 wrote to memory of 4472	2396	firefox.exe	88
PID 2396 wrote to memory of 4532	2396	firefox.exe	89
PID 2396 wrote to memory of 4532	2396	firefox.exe	89
PID 2396 wrote to memory of 4532	2396	firefox.exe	89
PID 2396 wrote to memory of 4532	2396	firefox.exe	89
PID 2396 wrote to memory of 5008	2396	firefox.exe	90
PID 2396 wrote to memory of 5008	2396	firefox.exe	90
PID 2396 wrote to memory of 5008	2396	firefox.exe	90
PID 2396 wrote to memory of 5008	2396	firefox.exe	90
PID 2396 wrote to memory of 452	2396	firefox.exe	91
PID 2396 wrote to memory of 452	2396	firefox.exe	91
PID 2396 wrote to memory of 452	2396	firefox.exe	91
PID 2396 wrote to memory of 452	2396	firefox.exe	91
PID 2396 wrote to memory of 5096	2396	firefox.exe	92
PID 2396 wrote to memory of 5096	2396	firefox.exe	92
PID 2396 wrote to memory of 5096	2396	firefox.exe	92
PID 2396 wrote to memory of 5096	2396	firefox.exe	92
PID 2396 wrote to memory of 3664	2396	firefox.exe	93
PID 2396 wrote to memory of 3664	2396	firefox.exe	93
PID 2396 wrote to memory of 3664	2396	firefox.exe	93
PID 2396 wrote to memory of 3664	2396	firefox.exe	93
PID 2396 wrote to memory of 768	2396	firefox.exe	94
PID 2396 wrote to memory of 768	2396	firefox.exe	94
PID 2396 wrote to memory of 768	2396	firefox.exe	94
PID 2396 wrote to memory of 768	2396	firefox.exe	94
PID 2396 wrote to memory of 2964	2396	firefox.exe	95
PID 2396 wrote to memory of 2964	2396	firefox.exe	95
PID 2396 wrote to memory of 2964	2396	firefox.exe	95
PID 2396 wrote to memory of 2964	2396	firefox.exe	95
PID 2396 wrote to memory of 4648	2396	firefox.exe	96
PID 2396 wrote to memory of 4648	2396	firefox.exe	96
PID 2396 wrote to memory of 4648	2396	firefox.exe	96
PID 2396 wrote to memory of 4648	2396	firefox.exe	96
PID 2396 wrote to memory of 3280	2396	firefox.exe	97
PID 2396 wrote to memory of 3280	2396	firefox.exe	97
PID 2396 wrote to memory of 3280	2396	firefox.exe	97
PID 2396 wrote to memory of 3280	2396	firefox.exe	97
PID 2396 wrote to memory of 904	2396	firefox.exe	98
PID 2396 wrote to memory of 904	2396	firefox.exe	98
PID 2396 wrote to memory of 904	2396	firefox.exe	98
PID 2396 wrote to memory of 904	2396	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Data.Center.v1.0.40-P2P.zip
1⤵
PID:2224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1496 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {7d0aef31-ea12-49ec-a67d-b6e58544834b} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {30b1bc3a-6cd6-401a-a0c7-3d057cac63f7} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27274 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {45c88e68-5191-449c-bd88-a1d0eddbd64d} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27274 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4012 -initialChannelId {8d5c9788-0e64-4cad-86d4-dd1a8798cf5d} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1684 -prefsLen 34773 -prefMapHandle 3144 -prefMapSize 270279 -jsInitHandle 3140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2600 -initialChannelId {e1b95af1-27a2-46ec-9915-a85acb39b563} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4824 -prefsLen 35010 -prefMapHandle 4828 -prefMapSize 270279 -ipcHandle 4888 -initialChannelId {c380e6e9-4d24-49fc-add8-2887e6ee6633} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1668 -prefsLen 32952 -prefMapHandle 2772 -prefMapSize 270279 -jsInitHandle 2776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2872 -initialChannelId {bb73eec2-e601-4a5c-951a-ef779f28518d} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2768 -initialChannelId {1f59418b-a3c9-4e97-a805-d3aa27412950} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32952 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {99fc352d-ab0f-4cc3-bd79-721852fe05ee} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6176 -prefsLen 33071 -prefMapHandle 6308 -prefMapSize 270279 -jsInitHandle 2736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6200 -initialChannelId {808bb629-4341-4864-b3d8-4689c04271bf} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6660 -prefsLen 36758 -prefMapHandle 2796 -prefMapSize 270279 -jsInitHandle 6652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2656 -initialChannelId {27bb9804-c576-4d2c-99dd-2ebc2e6e076f} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5828 -prefsLen 36758 -prefMapHandle 5832 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {6f0122fe-49b2-456f-8395-1fb9731b1592} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6776 -prefsLen 36758 -prefMapHandle 5880 -prefMapSize 270279 -jsInitHandle 6752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {7082d4e0-8552-4010-a19b-d188a793f25e} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:2964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7044 -prefsLen 39875 -prefMapHandle 7048 -prefMapSize 270279 -ipcHandle 5848 -initialChannelId {b86a3a67-994a-463f-81de-2a29645ff3e3} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6220 -prefsLen 36758 -prefMapHandle 6952 -prefMapSize 270279 -jsInitHandle 6752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6244 -initialChannelId {53e3464a-d0f0-4fbb-b684-dc168967a4a5} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7024 -prefsLen 36758 -prefMapHandle 6940 -prefMapSize 270279 -jsInitHandle 6564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3088 -initialChannelId {2294538f-cd94-452f-a8cb-b2bb491b2fd3} -parentPid 2396 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2396" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:904

C:\Users\Admin\Downloads\Data.Center.v1.0.40-P2P\Data Center\Data Center.exe
"C:\Users\Admin\Downloads\Data.Center.v1.0.40-P2P\Data Center\Data Center.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3984
- C:\Users\Admin\Downloads\Data.Center.v1.0.40-P2P\Data Center\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\Data.Center.v1.0.40-P2P\Data Center\UnityCrashHandler64.exe" --attach 3984 2411381067776
  2⤵
  PID:2804

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 d4320a76ce6f8c6dd317df124a8246c73bc42d59d9f82cac22cf2eb2c0269a6a
MD5 0e4e6e24ea9afc01c99020156f218271
SHA1 df47703d03246d7f234da905866adf58b128ddaa
SHA512 86f46d0286f89c05cc80063ededaae48e7b607dfacf0b3509a426d8d3bb21abc01d16b920b55ffee63d11a5eacbdf5e3e5731e49e2d7299fa89cae2a2a6df94c
SSDEEP 384:HbaFrLiO024YbFuhw+5EL1pPsac4j0lpDII+TOp:7aAZYbFuK+5EB9sac4ID8LO
TLSH
T1B3528E7D9F0138BA1A6BD294D9AE5204CE04E6BBEEE3D05205143944C6847BCF4FA4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
Size 10KB
SHA256 9e0f46554c494befe7de8bd4084b27a9b3442436e4c13baff053bbb962cdbc92
MD5 f1659a590387d63d93996a429ee4ed18
SHA1 4eb37ab306cffb236c2f93f47e762652521e1e03
SHA512 7a568eee23c421781c117d882ed15b021f9bf6cd10bfa1e0e439f037d70f3586541c1abc6d2c3a25cccd7d8132ab0a434f9cba32cb7c63f057142432364496ab
SSDEEP 24:5eUuhMZW4391Edm9xQBT9BlGVE9Vvz0h5q9F55A5MwC9lbfq9BbS:F+WejflBzoI56M1pg9S
TLSH
T1682261E76FB6A462F0A2CFB0805872CC9C33172515BD9185D754C0F706E6BA9907BBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
Size 17KB
SHA256 08da4e3af06f12541f658df5fe77245da8c85c5858377b94453bb3aa5ccb8590
MD5 15520c564370ffbbf72a69913b558253
SHA1 5473740c4713a6ea6bd41fca11fbac6b012e483d
SHA512 c4d1bc34df6ce1aa6af5f70143a4f21ce4c9a4640219279a753c0997a8c8774d2449a8f7682c6cfb073f6edb341ff5afb0a6841157a9261811a7fab5e9967c8a
SSDEEP 96:5+WejflBzoI56M1pgYhM/pqF4r0AMUM7MjMzMfM:UQ
TLSH
T1CB8286F76FB2A422F0A6CFB08069728CCC33171519BD9191DB5490E706D1BE6907FB68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
Size 25KB
SHA256 9acf310b46e5050f18275cb530765448114b6e75301713121a8a8a278e043e64
MD5 a30366df7a5fd02ad680c4d60ae08ae4
SHA1 48aa2ccd6241e9ded094146d8863c727a7ea9947
SHA512 462e1edb23ec3f6aa8d765b4cc0a6d19314432fc7210518d12b6b226d694f8f47be11adc1d4c166b9a8fd4d4d8c9b80a9c41be55ec7d9c086253bbc84cc82d21
SSDEEP 96:J1YWVYX3VBT0I56EB1gQhM/pqF4r0AMUM7MjMzMfMbjMMhAMj7KM0Wy6Gg:4QAdh
TLSH
T1EEB2A3F7ABB2A422F0E68FB14068768C8C33161558BD8190D75491EB06E5BE6D07FB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 836375058af5950ece27112c5dd0c3649a67299759ed67e4d60a6c95a2fd8286
MD5 29369e0e35910158ed49655dc92ffa13
SHA1 57661ca208c217bc45bf3f88f90f8cb338defec7
SHA512 728a3e2cad0270d2e8d50de0717998e96f12351dc24ff2357f78f934c307494eca706f9019e8e40d76c705934cd7b5f9cddf604fcc61dce99e08e51bf58c0e61
SSDEEP 768:nmjiS3Ht3bSXSGcmhu+MRDWMvpibIbCbfbO:Y3Ht3bgMX
TLSH
T194E20144EB1E953FD45412BBDCA50B042F78F88A59192FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 84KB
SHA256 1e46a3f60b161124d294e9837d71fcf85d13432f3a9903e3e6b701901c9256f4
MD5 da1bebe45746a5973a3a04163a4955fb
SHA1 12c82d7c1afa80a6596384333d2e7fa856ec9d22
SHA512 135c9d57da8a2b37a1eb4e6544a89311a91fa681c93ee635bfb4fe2402b9e1f19d00d17f3ff0cb46b15d162d667743e15338a6f3a9813c6bd0ef80773c4a9c01
SSDEEP 1536:YuY8efKmjLalxG6fpsrLlByP5V2tyH2TsxwSOcxc6SQ2uhceJDYxuCS:YP84p2vDgr2VWCX5+tuhZ+u5
TLSH
T19F830D44EB1A953FD86803BA9CD61B103F78F8895A1A2B67271C54387D873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 0c68959bed577fec80caad17a30359f289fc0307888bf2edc5532e3dd3c91d85
MD5 167a8d015c931f25cb5443bbbab72c56
SHA1 6d366b3ece1e26cb07acf0615b75ab40645ae9b4
SHA512 d07e79bf89896c67c67f358872e14ae6ad4be932abb863f2da418ca13c4039d0b767a3aaee674bdcf218f75722cddcbf0cb1c0cdc3ee91199fcc094aa66a0c12
SSDEEP 768:A3Ht3bSXSGcmhu+MRDWMvpibIbCbfbOCTSm/:A3Ht3bgMXi
TLSH
T17AD2FF44EB2E953FD45412BBDCA50B042F79F88A58192FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d2244fd164f99c1a1a8fc2c3e25327bd22a7ccb5ef3448c1c31570441f4a686f
MD5 2d1f7d468ce4f29db4b3084b20282e0c
SHA1 d615d1733e1e355f3289073ff24a5af9c833bd0e
SHA512 3d04eddec7a049a46482967130b4f83f4c0572ecfe865ae3d4b29de958a44ce0dd4e51204375018a448fea6b5df26de70a2a43ada7396647667042dd6f2eb61a
TLSH
T18921635C79F94E6AB8CAE39C7490038E57518E0A14871C430E02DF8DCDA5ED9326A53D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\events\events
Size 4KB
SHA256 80500b377f2cf889a8d2dac0a55e4d7cde9d6b606d10b9e0a3a67752fca44a60
MD5 851542e1d8f793a762c4d3d168437b6d
SHA1 3c74b8ece39e9ada068fd4b9e94a3de63910d9e2
SHA512 742b1e3ff45c691b61e96cd515dbc1c3f9a7f3b89718c45160d8ab816c600b810e1508469bfd33b4e5714e0d8d7634b810231f4f9396b30ae12eabe9d923e5db
SSDEEP 48:YaClhYs6XY2PYKXZG+cKMi/wLsGmjQxs09yU9RlhYh834Jl3qg8w5dyva+K82adc:OcBqjseY+34qEddi2udXJsrwU
TLSH
T1ACA1EB1CA9EA0C7E79DBD39DA840038D4A984B0294CB18874D97DF4DCC69F89325E57D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16b92395-a59f-48c7-8ea7-71f15e035e11

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\16b92395-a59f-48c7-8ea7-71f15e035e11
Size 871B
SHA256 33ef1b03bc0a756f96e7a2046dd9e9ddaddff0270e7249da32b018017b2525a8
MD5 e31012a6c668992368c1a7f3acbd1282
SHA1 83669cf85d2f2c5afa34e95032401bade1668b52
SHA512 97594791b7b823c04b23cbd449ee809651cd2876e7581245c540cbbc4b8108ef1986ec11ce24998c91efe2a1d32957901f1cdc8f4e2ad456276516ea63efdcd9
TLSH
T162112395C634B9B2CCB4A25FC99137029BF4B923C0CAC8103EB01E144D7E52AA36B607
MD5 SHA1 SHA512 TLSH

Submit Download

83f4dc24-516a-43a9-992b-97c70715983a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\83f4dc24-516a-43a9-992b-97c70715983a
Size 235B
SHA256 6c33d96822d4425cb3c384d393c0a773c9e20e9e6cd37745cc263322f464f364
MD5 98a4d2597e13d7665570afd20bfd709a
SHA1 8d1d919fe847dfaca6e6cf6efe93f9c5021ee19a
SHA512 ee22580db19b177da5e4b778acb2650fbc34b93305e6444e311ded1969f404312802d34277d17a28877a6460ed8bad22a0238bea0034d181b8b7a3242dddfe40
TLSH
T190D0978024A827ED0C180F07B0F22DC230848C3320E4A8109AA242B4DAFF9C94121807
MD5 SHA1 SHA512 TLSH

Submit Download

ac2b7bb0-35d5-4c78-b5e6-80c8dd250fb4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\ac2b7bb0-35d5-4c78-b5e6-80c8dd250fb4
Size 886B
SHA256 84ed3e48202532ce5e81c113d04f7e29a5ef67c636c560350811e0a074033eda
MD5 a6adba2b8feb934bb4ac57df4dad0abf
SHA1 921b9abeeb7b960605ac09918d20dae67c303cb4
SHA512 7cf0a0d605707cdf249f3764e54c87446e16d8cfe38f46b108403e7b821f103969ba0a09d2af0a898cd8c2b4430b7140335e96afe6714a6fa6d0860ef922162a
TLSH
T18B11049489747DF28CB8A18F8CD17B4247E47523C0C648143DA05B144DAA41BA396707
MD5 SHA1 SHA512 TLSH

Submit Download

b8af8f95-73f9-4f14-855a-0102ec38bdb4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\b8af8f95-73f9-4f14-855a-0102ec38bdb4
Size 2KB
SHA256 9015ac960816c320c084fec268839414fb766c519de6236757ff2033d966efec
MD5 0e041ca6ea95e36db9c415444f64eb29
SHA1 e02d44f53dd107f96c2420bb8f0510a0758c274c
SHA512 0467cd6ed072b0b0e09de8c00a565704caa62d31310ea9100cc9be7ab3537c97ab18e40f7b0ea8b2d0036f3a9bc135ba8fd878bc4586b55868d9c28fd8e9fd49
TLSH
T1ED41346C75785DBA8CDAF55ED482334F53A88B1300C61C932E51DF0C8C9A6DA73AA41B
MD5 SHA1 SHA512 TLSH

Submit Download

d1310efb-b189-4dab-9677-43b6c92e8d0e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\d1310efb-b189-4dab-9677-43b6c92e8d0e
Size 20KB
SHA256 af9a765f2c68d3ca1216236d2da9bcf1ea477956de57d87da72c6679cffb90bf
MD5 7237923b8af18fcec795eb780cfc1bbf
SHA1 468c88de4900f09a4207d3fdaafccb8bffa077aa
SHA512 db6847fd9fbaeeb0e7604aec53cf11bf6d04bf2ea3809426b676d810f5df0e0820105dff118457cf1f2c0b0d0bac88a4e643b8f4c72d61f7d6192108b70bc613
SSDEEP 384:t0faSvr0lBv5Zjhr9aq29XIWOigmR2mSE:t0faSvr0lF5Zjhr9aq29XhOigmR2mSE
TLSH
T18292EBFDDD1240473D25E51EF2EAA96B2017293249CCC7DE6AFD083A2AD6D7B0517328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58590b2-501a-4779-be44-eaad3032d622

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\e58590b2-501a-4779-be44-eaad3032d622
Size 235B
SHA256 22eb2031b74dc7b435cd3748685602f8eed21d45cf8fe48accdd87cf62a559b2
MD5 4aa0a18b5a8840bad4b33a3a758a2a8f
SHA1 8ec6fe252c152a7eee4236f0e36f4a99cda63ac1
SHA512 7ca3aa3bb28d15ba146e76f6c2ac2c4a409652881a5c090c0ea5a4a8afe8b5d4511ffd5bd51d3e37a3b4a523f605ae225820f7ef176ad389a7aaf445069a2f5f
TLSH
T168D097C818DC3BAD88001F0AF0A0B9C230CA4C331074A820CA6005B8ADF8AC45111817
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\extensions.json
Size 16KB
SHA256 413d6160e84c0b4e26e81a29b49735e488285fed365a5a9d7cf86004cc8c2f81
MD5 24464838b0e4913ea34daaf5b7acc7ae
SHA1 ac4222dbe4daf570ebb95f404052a4595057aa06
SHA512 e91a4810a39f8491e36fe0299ef2fce9a06333915f5bab92f26207f3e3a471ee7a1c226f7d390b9359cb3c085672792d3c94b02d27503aae3272b913e7a85b6f
SSDEEP 384:kkI4vzUmldvH8dhWPVy94z296o84L4H1L4PGL4HotL4HUtL4HGcV4hI:rI4bRfkXh4e664V4E4It40t4F4i
TLSH
T14272431545049EB8298F979BAA367E01C37D473B60845C78F4DD8FC842FB5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
Size 12KB
SHA256 c892feeec94148df074db93629852a61d81c44bd0392bea57f351271325893c0
MD5 199f2a7ce109a84c87cbb70054df0666
SHA1 63ae236ce8c074230fac81fcd77ce2dd851aaaf0
SHA512 a0f7f57a9f25b4e54e76e5d44ed88f074da15f722feb1ed4f91117055b0c1554faad9374392ac5158941e2881da0a0cf5f4eb4d87a40fe3cf5b90655a6b1c7e8
SSDEEP 192:FQCRFgfcqnBSSzhLRCCHs0i4mBw8OGeBoV/u:ng5RRyrwXgG
TLSH
T12542D03C90458F3F30F2327DAC295AB01951092776BFBCD606F986D5486CF6441E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
Size 7KB
SHA256 2b148e2641b1ad7a51359fdacdb6871363e003157941f07e07823bf66002bef4
MD5 df4510aa89496a06c737b4f31cafcd98
SHA1 cf5ecff9aa82e9ed96f6289b5c99c50cf5fc188f
SHA512 ff7488d8ad06fd0daa11c77dacd283b85c68129aaaf967406e8c38feb7aa8f21f476c65e6c9b0554cae405a743e886ab38f04b63212720a0e6af96d17ad2d0a1
SSDEEP 96:xHWgUTUaqGqFyzf3qnNbzSQSSlldv9jDOnoHdDaCHV4Bw88H8L4cni0GGS:FdRFgf3qnBSSzf0CHWBw88Z
TLSH
T145E1107894088B7F74B6776C6C688871AAB2413BBBBF68C750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
Size 6KB
SHA256 12ab58c938043160764ece57b97499f8779a8737a8171922c7eb1938d9cf7762
MD5 3e51642c384686a60a0378e2f13ee0d1
SHA1 9422981fcf1c3f30ec963a8805cdaffad2c6f459
SHA512 dfd725b5b0b57b3ceb2e86f7ac8a10797dc2188f96fa4f0c345f16775853790f59809dcf0946b40797d13fcc2e14ca44ff0cd385070abddf2172d2ead85cc48e
SSDEEP 96:xHWgUTUaqGqFyzf3qn1zSQSSlldv9jDOnoHdDaCHV4Bw88H8L4cni0v:FdRFgf3qntSSzf0CHWBw88q
TLSH
T188E1107894088B7F74B6776CAC688871AAB2413BB7BF68C750B554C4051CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
Size 8KB
SHA256 3610d4ff44224de0dfa5bc3873582412f0919d6c8bceab45541cdae704eab110
MD5 2e1ed738534c79855bd7c9d85d6209ea
SHA1 786f3a2c6e65ceabfd4ca4d65964cd66ad9d7ced
SHA512 9163939da799f9438096e92233949918619f87121868c9ddb6e429a6300ab6038c4527318c67edbca933c5d7e74a17d6f8dfabfcad7d1ccaf46f49ab3b63a536
SSDEEP 96:xHWgRTUaqGqFyzfcqnNbzSQSSlldv9jDOnoWRBZDaCHVNUx07Bw88jI4n8L4cnit:FIRFgfcqnBSSz+RCCHs07Bw88nd
TLSH
T160020D3890448F7F74F6376CAC6889705AA2053BB7BFA8C711B955C50518F3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
Size 6KB
SHA256 b88609402280eeb6837ecde9863e7e7c5cc08fc46bca91ecebca211e4233ea9f
MD5 b7c584ecbb5fd97381aa96fae6d38a4d
SHA1 93897c6d176d050d816ded10a156853220aaf000
SHA512 d6e7e9de516ba0e6a3d1abd5b4df627c46bb8a1bb4d1f2991c4b64ab293263641d1ce311e49d8c40c19013359067c267dea3b1d21992ffe859a9745898067c9d
SSDEEP 96:xHWgUTUaqGqFyzf3KjCnjo1zSLEFSSlldv9j4noHdDaCHV4Bw88H8L4cni0v:FdRFgf3lEcEFSSx0CHWBw88q
TLSH
T16DE1107894088B7F64B6777C6C688871AAB2413BB7BF68C750B544C4051CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
Size 7KB
SHA256 ab954a504ab92286c5ccebd2cb324b86f59b51a1d337f61912bb452880bff8f7
MD5 92c36ba57f5c0d4e57102f543f71c725
SHA1 5ea82766dc78127b23d0154f880c2420e8666374
SHA512 82a164a660b26e7bd4e665a8b7d98d731e5335d310d0abf0b759c26f27978614c99937cfebb442da652236238dedb47c02e8c819a63e65b4bd3d62046f601406
SSDEEP 96:xHWgUTUaqGqFyzf3qnObzSQSSlldv9jDOnoHdDaCHV4Bw88H8L4cni0GGS:FdRFgf3qnCSSzf0CHWBw88Z
TLSH
T186E1107894088B7F74B6776CAC688871AAB2413BBBBF68C750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
Size 7KB
SHA256 242f16b58137c739dc8158b94cd4429e3c38d0746d53280d852dffc84e601195
MD5 6e1e67ec50cc637dd0ae92bbb403d97c
SHA1 e5b7ad41f43d716e83b3b9200af39366dc241952
SHA512 83e14bfa94c1d4aa1e8b11505c8e89d8fda739100dc66f0dcaef22dc8829008778ea89254d448e69ab18582f99eaf09f2d3a1b182b84e9c46a36141577f4e4e2
SSDEEP 96:xHWgRTUaqGqFyzf3qnNbzSQSSlldv9jDOnoHdDaCHV4Bw88R8L4cni0GGS:FIRFgf3qnBSSzf0CHWBw88r
TLSH
T145F1FE7894088F7F74B677ACAC6849716AB2013BB7BF68C610B544C4451CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
Size 15KB
SHA256 ba0acd423977d167c7617e75869c80f68fdb4c7aa49e72e625d71e0b728d93a6
MD5 fa22b391cd991345cee021c4c0567364
SHA1 fa319ec69c40388939ad4101ec0d0ebe18fd289a
SHA512 12d2df328c20b8e73063529f2aef1c16ac86eaae0193056ebf107fbd4af7fd8bcd408142c93cbf40747418b41edf13d0a21d38c275cfd6dd94ef4b84dc8b506d
SSDEEP 384:SjkJtyXUO7wgVQsNnrH9T7daL0ySJMrN4rxH:ptyXT7wgVfnrHNdEtSCrN05
TLSH
T1AD62C06FF752BED00AF8DA0504BD18184AB21C03CBD9561C6A2B6CB54AFD6262E5873C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 6187c319db224740d3d301330a6550b248329b038852615272f9be9a9a594fbb
MD5 5169cdc3a2e1c7e5aedc543a3e00e0fd
SHA1 9c0ed21463e745709e5f126faaef071ac3a9dc6f
SHA512 7aeeca10ead8cf1bfe48b3b10cf2fdb53301aa3629cf1af26c01f74feed805cb46fcf6b1bd256a5f55da05a9cc459b429f256ef34d4269e7ff1947b1615aa0a6
SSDEEP 192:OtbH9azJnJHr3vDdXLa15sDzl/ybgunD4NLHT:QjkXT7daL0yUIszT
TLSH
T1D702AE36AB1176D50390D75409863829C6772E439AC80BECEF5F693E4BB8B133E28705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 ae6c6f0063e55796a89488157f93b08dce8bf14a86cca83818ab2799dbde3e2d
MD5 449ac0fb5a3fc2f18d6646d7f31d981c
SHA1 aa381387435e0dc0ab52c47e6bb22cd4387c34d4
SHA512 fc9450907a1fd19e84402f9aa9821a21c7c1c8c1352cd3f199b5c573df39f52aa17653b8910d4e61768f3b059dde61bbf437125dde1546e7396f18910019cf78
TLSH
T10221B78EEF7F3CE56789C14580C93FDAEE95A0500628E8E0C999679121D858633D9609
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 aa197435d1bd21f917ef1fe3a1fd133e301ed534a42f1bd9f2007c686558bff5
MD5 a538d0839394f23d125f20478836d586
SHA1 df746b919753fb159b589d98d9ace2293e87ae65
SHA512 d35ab75ef9c4f2f71a35a4c68f4bc4e7d813e445b54602104948c52ef38959e407f2aec170e4cbaab1bea685dfb3712c2e38fcd0898faababf249d161d29438a
SSDEEP 192:OtbH9agJnJHr3vDdXLa15sDzl/ybgunD2NLHg:QjksT7daL0yUICzg
TLSH
T1BB02AE36AB117AD50394D75409853828C6772E469AC907ECEF5F693E4BB8B233E28705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 cc4221c8f694a0d2849133dc7a01b4c13c3810e36ef9c97eb3fd0100ddc843a1
MD5 9c8472bafb7c9b9b782e6940e6288fd1
SHA1 0ed067c522e7972ba0d24d2ea9f85e65d07d3a81
SHA512 5f9f107b584e672acb7ddf0653995347410596a89c96fa9156256328e11b11d45d7b264ad5eb4bd06a1c16a7cddf1bcd65b0d18a52d9803883b6b1d8a3471a98
SSDEEP 96:M2x5+jXH9K0ByPuCd01VrqM4EcZZi6rLKJy58:MtbH9aPui0v/4T8
TLSH
T152918DB35D137DA623F0C4A0ACDE0F29C6F3040444F802685F2D5E3601BC28A7B6876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 2cdb87825ffaac14929873f08fcb3618d9f3eebae8ffa399c52e39e2fbbaa5c5
MD5 9d25c7bdf6575627f50c671febe0b379
SHA1 f5521a2541a2c8f004ae7b331579c3e3e4fdc7c4
SHA512 116d48ad937ec5556dc2ee7a0aa64cf71a9db26e4a2fb6c6dea0ad1e1f38c4a7a84f16f40435d9a30c5d66d58e709f07a8a83b1bdd9a55693560d856e375905e
SSDEEP 24576:QE+OO/IgzrJErR6lZYDyrRLvcMkrf2vOWlr3Ut:QVbfJE6kDyrRjcMkrevOwr3U
TLSH
T1DFF52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 778bd8eecb564f24e3cdf7f5762c5c016f117f504bf3d49eedbeff678d423db0
MD5 9d5416b2b64e23b80327624bba39350b
SHA1 490bbd4c807952360278965972f32359021ee301
SHA512 a0e5bfc00d30ffe62d2242b508d646f9fb103cb41b8884021657077d3c93843f9e3bd96f836d2fc6343daf1038d14c10bec0401a769e2850b936729f573680a8
SSDEEP 24576:kE+WO/IRU1h62rc6lZYDyrRLvcMIfy85cWlr33tx:kV+ih6b6kDyrRjcMIf55cwr33j
TLSH
T1C8F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2804-1358-0x0000013F27940000-0x0000013F279EE000-memory.dmp

Download

memory/3984-1336-0x00007FF8B7E50000-0x00007FF8B7E60000-memory.dmp

Download

memory/3984-1357-0x0000023171970000-0x0000023171A1E000-memory.dmp

Download