Analysis
- user interaction
yes - max time kernel
72s - max time network
123s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 14:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ogulniega.com
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
900 seconds
General
- Target http://ogulniega.com
- Sample260415-rfjvcabs5y
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 36 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe - Modifies registry class 46 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000 firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff firefox.exe Key created \Registry\User\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\NotificationData firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000 firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ firefox.exe Key created \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" firefox.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\Ogulniega.Minecraft_0.0.8_x64_en-US.msi:Zone.Identifier firefox.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 828 firefox.exe Token: SeDebugPrivilege 828 firefox.exe Token: SeDebugPrivilege 828 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe Token: SeDebugPrivilege 5176 firefox.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe - Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 5176 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1456 wrote to memory of 828 1456 firefox.exe 80 PID 1456 wrote to memory of 828 1456 firefox.exe 80 PID 828 wrote to memory of 1416 828 firefox.exe 81 PID 828 wrote to memory of 1416 828 firefox.exe 81 PID 828 wrote to memory of 1416 828 firefox.exe 81 PID 828 wrote to memory of 5004 828 firefox.exe 82 PID 828 wrote to memory of 5004 828 firefox.exe 82 PID 828 wrote to memory of 5004 828 firefox.exe 82 PID 828 wrote to memory of 5004 828 firefox.exe 82 PID 828 wrote to memory of 752 828 firefox.exe 83 PID 828 wrote to memory of 752 828 firefox.exe 83 PID 828 wrote to memory of 752 828 firefox.exe 83 PID 828 wrote to memory of 752 828 firefox.exe 83 PID 828 wrote to memory of 4536 828 firefox.exe 84 PID 828 wrote to memory of 4536 828 firefox.exe 84 PID 828 wrote to memory of 4536 828 firefox.exe 84 PID 828 wrote to memory of 3556 828 firefox.exe 85 PID 828 wrote to memory of 3556 828 firefox.exe 85 PID 828 wrote to memory of 3556 828 firefox.exe 85 PID 828 wrote to memory of 3556 828 firefox.exe 85 PID 828 wrote to memory of 1420 828 firefox.exe 86 PID 828 wrote to memory of 1420 828 firefox.exe 86 PID 828 wrote to memory of 1420 828 firefox.exe 86 PID 828 wrote to memory of 1420 828 firefox.exe 86 PID 828 wrote to memory of 776 828 firefox.exe 87 PID 828 wrote to memory of 776 828 firefox.exe 87 PID 828 wrote to memory of 776 828 firefox.exe 87 PID 828 wrote to memory of 776 828 firefox.exe 87 PID 828 wrote to memory of 1184 828 firefox.exe 88 PID 828 wrote to memory of 1184 828 firefox.exe 88 PID 828 wrote to memory of 1184 828 firefox.exe 88 PID 828 wrote to memory of 1184 828 firefox.exe 88 PID 828 wrote to memory of 820 828 firefox.exe 89 PID 828 wrote to memory of 820 828 firefox.exe 89 PID 828 wrote to memory of 820 828 firefox.exe 89 PID 828 wrote to memory of 820 828 firefox.exe 89 PID 828 wrote to memory of 1808 828 firefox.exe 90 PID 828 wrote to memory of 1808 828 firefox.exe 90 PID 828 wrote to memory of 1808 828 firefox.exe 90 PID 828 wrote to memory of 1808 828 firefox.exe 90 PID 828 wrote to memory of 2796 828 firefox.exe 91 PID 828 wrote to memory of 2796 828 firefox.exe 91 PID 828 wrote to memory of 2796 828 firefox.exe 91 PID 828 wrote to memory of 2796 828 firefox.exe 91 PID 828 wrote to memory of 4656 828 firefox.exe 92 PID 828 wrote to memory of 4656 828 firefox.exe 92 PID 828 wrote to memory of 4656 828 firefox.exe 92 PID 828 wrote to memory of 4656 828 firefox.exe 92 PID 828 wrote to memory of 4580 828 firefox.exe 93 PID 828 wrote to memory of 4580 828 firefox.exe 93 PID 828 wrote to memory of 4580 828 firefox.exe 93 PID 828 wrote to memory of 4580 828 firefox.exe 93 PID 828 wrote to memory of 4168 828 firefox.exe 94 PID 828 wrote to memory of 4168 828 firefox.exe 94 PID 828 wrote to memory of 4168 828 firefox.exe 94 PID 828 wrote to memory of 4168 828 firefox.exe 94 PID 828 wrote to memory of 704 828 firefox.exe 95 PID 828 wrote to memory of 704 828 firefox.exe 95 PID 828 wrote to memory of 704 828 firefox.exe 95 PID 828 wrote to memory of 704 828 firefox.exe 95 PID 828 wrote to memory of 4628 828 firefox.exe 96 PID 828 wrote to memory of 4628 828 firefox.exe 96 PID 828 wrote to memory of 4628 828 firefox.exe 96 PID 828 wrote to memory of 4628 828 firefox.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://ogulniega.com"1⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://ogulniega.com2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {6e554647-a9cc-4559-865a-95e9c68abcf1} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:1416
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {0c2ed8e5-d036-4dd4-9ec4-3b9f4c5a833b} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:5004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 25164 -prefMapHandle 3760 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {60dde13a-310e-4f07-af4a-da1e15a5e26f} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27274 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {fc118b53-1acc-4102-8033-e1fb32db733f} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:4536
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34773 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3144 -initialChannelId {12eb6d45-9822-4f28-9d59-2e81ab4debb8} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:3556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4988 -prefsLen 32847 -prefMapHandle 4992 -prefMapSize 270279 -jsInitHandle 4996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5004 -initialChannelId {a5bd9453-3653-4eb8-b15e-7a88d9d17cd2} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab3⤵
- Checks processor information in registry
PID:1420
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5176 -prefsLen 35010 -prefMapHandle 5180 -prefMapSize 270279 -ipcHandle 5188 -initialChannelId {bfd67970-f6f1-4893-9467-d009f560372d} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility3⤵
- Checks processor information in registry
PID:776
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3940 -prefsLen 32952 -prefMapHandle 3952 -prefMapSize 270279 -jsInitHandle 3908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4304 -initialChannelId {488167a1-1115-4357-baa3-4672d7d86250} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:1184
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5764 -prefsLen 32952 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {b423764b-778a-4c25-8854-887055a6fc28} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:820
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5936 -prefsLen 32952 -prefMapHandle 5940 -prefMapSize 270279 -jsInitHandle 5944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5952 -initialChannelId {529bbf34-0cb0-44a9-9377-017e54c6a944} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:1808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6124 -prefsLen 32952 -prefMapHandle 6128 -prefMapSize 270279 -jsInitHandle 6132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6140 -initialChannelId {793993e0-9b99-47da-94c9-9b02e0403fec} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:2796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6084 -prefsLen 35062 -prefMapHandle 6080 -prefMapSize 270279 -ipcHandle 6148 -initialChannelId {71cfd8d8-a199-438c-9dd1-11f0bea4753e} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility3⤵
- Checks processor information in registry
PID:4656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6396 -prefsLen 39796 -prefMapHandle 2576 -prefMapSize 270279 -jsInitHandle 6848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2644 -initialChannelId {4772e9e9-d9b0-4935-b3d9-c2e4fbab70eb} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
PID:4580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7144 -prefsLen 36798 -prefMapHandle 7148 -prefMapSize 270279 -jsInitHandle 7152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6820 -initialChannelId {8ea990f8-b629-48b6-833a-77f6293a1c38} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab3⤵
- Checks processor information in registry
PID:4168
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7416 -prefsLen 36798 -prefMapHandle 7420 -prefMapSize 270279 -jsInitHandle 7424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7432 -initialChannelId {bc12e416-0ee4-4b59-ae6e-79b1dc2c7f4f} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab3⤵
- Checks processor information in registry
PID:704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3236 -prefsLen 36798 -prefMapHandle 2624 -prefMapSize 270279 -jsInitHandle 2628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7728 -initialChannelId {22d36964-2ab4-4c39-8875-e2a4cabff7a5} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab3⤵
- Checks processor information in registry
PID:4628
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7900 -prefsLen 36798 -prefMapHandle 7904 -prefMapSize 270279 -jsInitHandle 7908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7812 -initialChannelId {42a442ba-b37a-4e5c-a6df-d2592403a014} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab3⤵
- Checks processor information in registry
PID:1852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 8104 -prefsLen 39915 -prefMapHandle 8108 -prefMapSize 270279 -ipcHandle 8088 -initialChannelId {697eebfc-7a98-4749-adca-bfcba2a7f408} -parentPid 828 -crashReporter "\\.\pipe\gecko-crash-server-pipe.828" -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 utility3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5176
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\96276qki.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
- Size 13KB
- SHA256 d1fbf8ed903d881433ee94b1f401b571b28c1d12d93178661b93cfb6800aafe2
- MD5 3944aefa9efd944734271505cbf42900
- SHA1 a7ca1ddca72a9a7f8c0460bd6ec33b24bb88f4e9
- SHA512 2ba371e54d7e38cc5ea7bc11be7d8c0a819af82977597e56073567509714ee68465ae291fe1bcb6b1687020dad23a8d894b6def6b849eadaef7a2616158edd88
- SSDEEP 384:HbaFrLiO024YlFuhw+5EL1pPsac4j0lpDII+2Qk:7aAZYlFuK+5EB9sac4ID8L2
- TLSH T10F527E7E9F0138BA1A67D2D4D9A95304CE04E5FBDFE2D05605143845C6807BDB8FA4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 10KB
- SHA256 cbf5881001cdc3a47f9762d07da73bfe5e94f17f81ef2f68703cbd36d255c883
- MD5 96191eb661644af89a757f5cccc835f7
- SHA1 423c1df2443baa643903142334a337ae6f05b415
- SHA512 bb67066acbf178e183bfa4937c59230819f575b25f4b8dfcfe7a50adb1298831edfa435cc730d0398388e8b6dd4bfe40443a93978ee67b4198404ba2e64c08fd
- SSDEEP 24:GwJFwJ5UuhMZ4sWYJheHN0ssJV0JxLmJlIMVqJ1t+AL3JxXfIqJFgyMA:7yJHICpYeJxeqxdttgeeyMA
- TLSH T12522C3EF1FB69032F2A2CFF8A56D74DC8C23166A59A5C0EC4A10D0D702D97A5D03AB19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\AlternateServices.bin
- Size 12KB
- SHA256 3f5e9b3ae71ef689dbac38806f154d8fb4b598da9ddca971cba2eccf26a8d8b2
- MD5 6ae36e317f47c81a11182f29e931fa0e
- SHA1 ff3561a4c7b3830296698ff817348a97918fece8
- SHA512 de3c2055b5ede035f6b9305d26bad14a8ba1837e5379b7b610af3bdf05c6e2e287c7fc41bbcf0a7ace07dabca954de0570aeb56c2842be08502549eedcacd7d5
- SSDEEP 24:WwJFkJvUuhMZtfEWYJheHMbssJV0JIAmJlhQVqJ1t+Qj3Jx/IIqJFgyMlXZeTJVO:r2/r4YeJILDtp15peeyMlXZW4w4
- TLSH T13642A0FB0FF69421F4928FF8A56E359C8C231A7A59A4C0DC8714D0DA07DD7A5903AB1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 75f1b717637b8d3cbb37bcb53ed3d23ea8886d9a5107f320f2704aa75ac1c5dd
- MD5 14d6094d9f7a565db7c0253054fb256f
- SHA1 7e0e5d10ba11c1b7eb62c2e597a60253143f7999
- SHA512 bf8f5fb4fd18a3d2319aa4c0a0b18789310a42654673a3c59b5a73f817267c8867f24e0a285e46ae418c44166b1bf975b17b19937e881130c4433c9e77741928
- SSDEEP 192:L1d66Joz0dzgCl6mc0drkOv5zboHDZNbyjql8:Jd66JozQzgC1jZnbojZNbyjq
- TLSH T19FE13FA8EA28863FC454027BCCA51B414F39394AD84E7F1A31AD254C2D572DE77CE17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 09d6e70b1e94dbf3e7986d85066bb7afa9e9c5dad728a92804c786bf8fefa0f8
- MD5 607f81ad0e1190991fd0f0f8a9ce537a
- SHA1 7665d47a9100cdd0fb3280f466e49d5122c113da
- SHA512 f706906767ab2c4411cde38fa4457e77bac780cb795f334c9db0ae6e0ee226f04d5f7c0d56f76ad5fbe6cb761deead8884da4f4b19528f41db2384cafd298553
- SSDEEP 96:PFl2FWFnzFngFnb/dd66Joz0dzgClKtmc0d/UUckSdF95/7bkW6QXjrcENbyUR66:K1d66Joz0dzgCl6mc0dGkOv5zboobNb7
- TLSH T1A1C1EC68E629463FC454023FCCA51B504F76394BA88E7F2632EC28482D572DE7B8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 4b821e02c0b66e468caf0d437739dde6bfe044e67e67b102486ef1462000a4cd
- MD5 e5b5b79772038762c05c1edae6017c14
- SHA1 7a38101caa83b2d679d157edc6a0c310c54a2e1d
- SHA512 fdebc75765c155345f0fefb47c1b90eb88702bf054e34b3e30a3e7520ce7895cab54c3646c6a78fbf22d185c307777742d6d2b2de70be8c128c0c4779c894a7d
- TLSH T1B4216A5C39F9CE6AB8CBE29CB44003CE53554E4B08871C470E02DF8CCE99EE9316A53A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\events\events
- Size 5KB
- SHA256 7e7b9f022c53bad5333ec9d8b356c8eca46f9de804c841cd3e82c5d915d68d7b
- MD5 59fd131c2030d34c4e4e14ea3b5c945f
- SHA1 05a99f64eeef8382aad8e65829ac6b007702556e
- SHA512 4770532fdeaf38fdad99484fb9af60b497a497a3bdfc056689ea4f39f305a9a6087360e38caf5257dcc1414e8d0aca71b2ff560b953efe38649169c9882ee19d
- SSDEEP 96:Msi/xPAN2+/HyZ/0nMBaWs364rb6zjdfsd:MsipPv+/HyZ/Tu2zxfsd
- TLSH T1EEB1EE1C26F94DBE6CE7D29DB84003CD43C94B0699CB1C4B0D96DE4DCD49AAA311F27A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\035d11ed-03fa-45b7-8ff1-f93f352f6cc5
- Size 886B
- SHA256 2aff8a4b38cd71b75a434bf8ec2f84eea75850323042ee7e16f5340fa8763644
- MD5 a424953722a3a048a56b31fa89fc5cf2
- SHA1 3bd05205bb957df9880ae28d4a5f7b11fd415709
- SHA512 0a77e4622b0a167b941c8caed66b65cc592a55304f8ba93ac88aa2733683d736cdaf390a38349277d0699222a67b8ce6ee6b0879cb579a570b6ee12d64f6df97
- TLSH T1FA114451C9657DB18CA8A14F8CD1B74287E47513C0C69D143EA45B080DAA01BA367707
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\1743bc90-3d3b-4f4f-87f8-98b663cc4728
- Size 235B
- SHA256 3321b4db38b21256a0462640809a0358fd3537be617e06ddd43ece754b3439ad
- MD5 90487b36f207a50c7d18e1aafbdecddd
- SHA1 68da6e189958ece90ee04ff4aeacfc5220049739
- SHA512 d79e8e4d09a31c1198d586d0a06235444e53964d0c6beb11daddb89d7bf853a8e574e38ce47362b9f63d10693f51b31a6941e96b7869ee2594006a11ee31e435
- TLSH T16ED0978418E8375C48104F03B0E028C231948C3310A0A830D65254BCC9B8AC54191807
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\5a9c67d4-b3a1-4635-b7a9-7e3920cc6118
- Size 235B
- SHA256 26bc98b68548834ad7e9291506871f17bf0e173b03645d067fb249cd12be455a
- MD5 c68c4d6fa9922a1716cf440ddb9750a3
- SHA1 e7f31f4ff1b0b50ced68b32bc9d6a1a421ddbbbe
- SHA512 7053252906652bd1419fdc5c52a149845062e9ab7565fdfb69bebc909f160ff0fe6bfd0de52d573a1ffee52d7934db0cd7ce0d2a62a4b7ef6f10e9f96ec1f732
- TLSH T1C1D097802498A31C08000F03B2A06EC230848C3324B56C20CB630538CEFCAC82122877
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\7094c585-d084-47f1-8ad2-3feb1d491702
- Size 16KB
- SHA256 962ddee988d54955e03d2479668bab1a667414245e20ac63f6bd51dbf7d8d57d
- MD5 a26607cf487f0e8924352eeff135b222
- SHA1 e3451463c2176946672b0e66cfbefb823c7b6ef0
- SHA512 8105c0f1bb0e165672013b1ac6964b58f65dc78dff4051591002f381249c5b8f5cedddd068744973bf5dff33aeb1b72bbeba379b812bb79db068cd7e5320abda
- SSDEEP 192:ALvTMjh1CrJZXNb5zxsikFDfAiZKJIK5NLRbXp5ikZZOaxzFzvGXmDYXayBNlMIs:YvTamXB5lsiWDfAiw6KfRbZ8uaLVc46
- TLSH T16F72DA466820497A8251E36C94FCBFC3E6F538CB4C419FCA9BE47D486DDE0AE512784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\9d6d5505-f09a-49bc-8d62-b84e8509dc22
- Size 2KB
- SHA256 6ff5ad4f82a4c634cff6de20cfbc488513d0e63926228fe54ba104ef5aca502d
- MD5 d330ef12135ddc6ffd9fdec25e94a269
- SHA1 a0f2e8ab8a9a7806c038d0bf5f20f7975fbfe273
- SHA512 9b63a8c5db3dd4b4573354561451936f54481c27d621b19005faa343466f65045ce9281bdd702ae352838133be68e48bae426322dc050654f9b6cf2f20e64b3f
- TLSH T1D141206C26784D7B5CD6F19E9483378D97684E0240821D832E52DF0C8C9A3AA236A517
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\datareporting\glean\pending_pings\d368040d-a8d1-4553-b15c-9914f81d4b21
- Size 883B
- SHA256 0c957937afbd69aaf5a773c2b320adf3cce97f4db3def8aee42f3ddfcc18b65d
- MD5 ccb0cd74bd28abc8173d88a3e5f6c65b
- SHA1 5343ecfb0c331ce7caf9270223f9dc13bd62f11b
- SHA512 f651bbf3d0b854d3dda9dbbe2c4b60363db66f1ef04c79005a267a9ee68fe47ad399b5103d97138b930bad95daf6c5860cdfc413b2a33ba1c51a4eae2994ccfd
- TLSH T119110C91CA347DF2CCB8A24F899177469BF8762384CA84102EF55F140D6A52AE3A660B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\extensions.json
- Size 16KB
- SHA256 4a79d212e334ebd2c021ca300e4693745c43f2a171425fd18885eae2a78dd06d
- MD5 4ca3a919eca0f4976339ac3d9ff21aa1
- SHA1 e70237450d22dacec9af56886d4e48aac28627f4
- SHA512 b9e3cb3da9ab5900ee75d8ae2ff4879d77aefe020f006e53cd5372906b84faf2acb7f8879253f4da6459f133036aa4ec15b1b481a01df049a29942e9ad9a227e
- SSDEEP 384:kkI4vzUmldvH8dhWPVy94z296o84L4H1L4PGL4HotL4HUtL4HGP4he:rI4bRfkXh4e664V4E4It40t404o
- TLSH T14E72321545049EB8298F979AAA367E02C37D473B60845C78F4DD8FC842FB5B902FB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
- Size 1001B
- SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
- MD5 580786a5ec9eb650dde3e0e75db8588a
- SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
- SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
- TLSH T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
- Size 18.9MB
- SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
- MD5 15fa9ea03f6f451d587b1dabb2f7b036
- SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
- SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
- SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
- TLSH T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
- Size 6KB
- SHA256 be092e54b53387ca667f3dd8c72a87a571fa563f446eb1679f5d1e03cae772fe
- MD5 60c12b30163b92f98cf78ae4910c31d0
- SHA1 84aad6f87f4f88aa408ac8a2b279ecb1eef69e9d
- SHA512 4ba6969e1bb9ed4d2a3f9674ca3cc0c6bc8ae72f7976dac675837a974c9e8dccf14153e03a2d33fbebb03e680077f4b5b752c2088b217299f5eff730a379ddb7
- SSDEEP 96:xHWgUTU9PqGqFyzf3EKObzSdHSSlldv9j2PnoHdDaCHV4Bw88H8L4cni0v:FNCRFgf3EKvHSSm20CHWBw88q
- TLSH T151E10F7894188F7F64B6776CAC6888716AB2413BBABF68C750B544C4051CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs-1.js
- Size 7KB
- SHA256 3d012dbbbcb7b619a87352b3ae735d75a84a584f66ce04a16aee7ecefb5ff7a6
- MD5 615e0a36372a56fcbed5469d71cf6674
- SHA1 7fe8abdeb14616eb6147c18b13141235fb329b77
- SHA512 d58928e5e5c664bde3ca001cd4bd66d08d8fb064a044b4323123481ab28616fe683601d2997fed824a90d9ceeaec2f32c7b5db1245ad659adeda30e81f614532
- SSDEEP 96:xHWghTU9PqGqFyzf2EKObzSdHSSlldv9j2PnoWR7ZDaCHVMBw88UGY8L4cnixv:FgCRFgf2EKvHSSmTRMCH+Bw88UGK
- TLSH T15FF1EC789454CF6F74B6376CAC6889715AB2013BBABF68C710B94485050CF3446F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
- Size 6KB
- SHA256 fe581e64dde8638d4055b24650b14233ca052fad8386003e456a66a954c882cd
- MD5 361757970a9f584d379c9617d430ad44
- SHA1 6bc801ca04be79ed4049ba9da9770a04e8c5dcb2
- SHA512 7544a56cc0b1877a8d7d7a14f8d18fd08f2e6a0cc982e373e1c87ed1d121e58895601e16f641f3c44b74e8b88a4446e897605febeb68f675a1cf9b92c89bfd7a
- SSDEEP 96:xHWgUTUaqGqFyzf3KjCnjo1zSNSSlldv9jQNnoHdDaCHV4Bw88H8L4cni0v:FdRFgf3lEUSSN0CHWBw88q
- TLSH T193E1107854088F7F64B677ACAC688871AAB2413BB7BF68C750B544C5051CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
- Size 6KB
- SHA256 d1b6e0f22978a2f7b54bddad400d65374198de7670982e1f9517b2384b9a2aa3
- MD5 f52e51bb5631e813fe34ce4566ad81d4
- SHA1 525d10d347eb9ebaf850a23daf67bc1e57ad1fd0
- SHA512 f83a69aff6c96bf62b80355b43b72a0ba73a066d7b99ffdf487b78b9142958fc594d791dd357e7c393ee9eb99774bdb7ce1726c24492ec501ed80b295bf22553
- SSDEEP 96:xHWgUTUaqGqFyzf3EK1zSdHSSlldv9j2PnoHdDaCHV4Bw88H8L4cni0v:FdRFgf3EK0HSSm20CHWBw88q
- TLSH T19CE10F7854088B7F64B6776CAC688871AAB2413BBBBF68C750B544C5051CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\prefs.js
- Size 6KB
- SHA256 c6d8634f4246e644504bce7aaf5cf54611e917040db6b59615b9ad18c2dea687
- MD5 ab5d48fa1c64481c2a1255514dfef4cf
- SHA1 788835950b6b09296500036cfd3723fc4ae151e7
- SHA512 18e0ac5779a0e7b320ff6aa996f4bf26782ed0811630b4d6c4f35798b9b78144c7f6103584aa4a49e0ef556301a7b3b36f1b12fabd4051cf23d1b04de928ec03
- SSDEEP 96:xHWgUTUaqGqFyzf3EKObzSdHSSlldv9j2PnoHdDaCHV4Bw88H8L4cni0v:FdRFgf3EKvHSSm20CHWBw88q
- TLSH T144E1107854188F7F64B6776CAC6888716AB2413BBBBF68C750B544C4051CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 12KB
- SHA256 0d1cee36c66c3b9f5a03b5f6907e785ec9ad853eef6c0da30961869e6f60c03e
- MD5 f831d9417aaaf4128e86b6bfdc97dd6e
- SHA1 10c6e04710832d6db6f8d469af544e602cae940a
- SHA512 06a5c6a67b92c23fd6c1fcab2564c5c15f98f2f09934410796cdf671e06ff01a2769a7b446983d2760d82d9321773f7985c1f23862cae8fa14b2abe44c99469f
- SSDEEP 384:b157W+L+0gY11zJ50w1hiSWpJqVqZPDIV:bTf+031BJ551UzCVqZPDy
- TLSH T1A0429F915F933C47A6E28301C44B8BC8DF2B2C3A5A7A0DE046CE7A5562FD6F83294147
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 12KB
- SHA256 f409f68832ee951de119deadc44352b9935ce84890a36e79df0265f2a981fc8e
- MD5 c383220bc743bd4b14dc470f9947d2b3
- SHA1 ec8df0dc8afe0e61f2bc7b3fb26bf2068cfa5320
- SHA512 c4047f4582b6aea319c73346b1aece8403b5d249a39641e641e38061d78f8a0153a143d4790819b357e843fcbf65242ea3fd1709453ac91afda61e06a22eaa7f
- SSDEEP 384:z16VW+L+0gY11zJ50w1hiSWpJqVqZPDIF:zqf+031BJ551UzCVqZPDM
- TLSH T11D429F955ED32C43A6D69305C4878FC8DF1B2C3E5A7A0DE04ADE7E5526FDAE83394006
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 12KB
- SHA256 b9a053621e76b022796bbe3ffe5eaacab9d8d146f6a5a50b20f5eba2076d9b2e
- MD5 7dd5b06e6dca096c69788d5dfd4e8b11
- SHA1 61b347da29bc070fa6ba54593c4df01e9c1ccfac
- SHA512 0ecd786632092f51ff30c6316131e6c6d238ebe5b3231f202fdd22527ad2f60606006ccadedfa2f4e520ad8bfdbe8f6e9757b981b172d2dc4c06c81b063326fc
- SSDEEP 384:b15uW+L+0gY11zJ50w1hiSWpJqVqZPDI5:bmf+031BJ551UzCVqZPDI
- TLSH T16C428E515F933C47A6E28301C88B8BC8DE2B2C3A5A7A0DE046CE7A5566FD6E832D4146
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 15KB
- SHA256 bae17a16094c9bd858287d993b8f4dbd888f6cfc915822fd1894b02c2409cf95
- MD5 e2f59a8c1ea168c895b9d3bc647a5a22
- SHA1 2a8be8b0e75033b965912bba8e022b3ac1ccb90e
- SHA512 0e3cb9d18f15e5998cf80503a02b741231da6d0f4bb761143ed3a29275bd8b89e3c518c9d1c87bf4e444afb34870143e8c505bd1929bc5edb9bf79208840ba35
- SSDEEP 384:A16VW+L+0gY11zJ50w1hiSWpJqVqZPDI3buNkE0bJvp:Aqf+031BJ551UzCVqZPD+K6bFp
- TLSH T16662B0925D832C57A3E69304C48B8FC8ED571D2A5A790DE08A8D7B9955FCBEC23C8443
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\sessionstore-backups\recovery.baklz4
- Size 15KB
- SHA256 96fa82287161f3e2f5e9910f56e4cf07bb5aa77c220593bcfe44b95c51e6242b
- MD5 4fbb8d8ea75b56b9402f93b752b3444b
- SHA1 9ca15911713c80fa198c4743199f799b6366b354
- SHA512 77ce84c3402789a6a7e50d1dc1fa3c15ff254b77e31419fe213e7ba3efb61ab4760c564a981d8750e4319b6be6594c5a44f1f0e31c33ee3c5788faf15ba21671
- SSDEEP 384:v16VW+L+0gY11zJ50w1hiSWpJqVqZPDI3buNkygviW:vqf+031BJ551UzCVqZPD+K6yiv
- TLSH T10162BF926D832C57D3E69305C48BDF84DE971C29467909F08A8D7B9925FCFE823C8457
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\default\https+++www.virustotal.com\cache\morgue\128\{3f9d38ed-aeb7-48ab-aa6f-befc2d002e80}.final
- Size 68KB
- SHA256 1314950477f1530ed2d537170c7792201e1a69759185ea9fc20e1b85fb470181
- MD5 5ffbff1d022d2743d3814282f47c322b
- SHA1 a7446fa8f399ad12f901853f4c5f98121b695ca1
- SHA512 f73201c03bb2a32ffcf38a01f79d2bf3421aececd7f207d802c6ba038250a14ede0a561a6e22f22c561c78fc144af6a342dcbe45523d4d3cf65f84e19e469fa5
- SSDEEP 768:8s+FcVOn7NCvwdtSHreBveK1ZftNl8qyTonQfV/Bzeiq+Nw9pkmTjdkxEsp8H/Wr:zAU4yjKDFj9twBi+NduyEy/UXCKhFY+U
- TLSH T12D63F2387A90B7BB283D4392FE22EDD427DC6512F8A5E181D0D777C621EB295EF08149
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.9MB
- SHA256 b4b881723ea0c2b1154b463306f19e1780964278c9a7722f046322ca5ae67b5e
- MD5 932a59224066a1f169c5ef1e11fad41e
- SHA1 fa816a51c7be99c00cf1e842f93c6f443f3ac144
- SHA512 05d8a63423b26aa4aa306bedbd41d0f934fb8d3f4481e45113461a653c5ccb7f632cff215086e096d5cb86e56b41eb6c0c36468ef96835b71f7d12af04447728
- SSDEEP 49152:smkkRVaAIoW8zN6wlQaN8lxle16bsiNAHqjhsuddICnzpN/m5GvmELT+7rL4bJft:aGE3+3L4bJfcxUE
- TLSH T19D565DE420E2D252F38544B3719A53FB10EFC01C60768E44579896FAA9B8CEB4D877BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Ogulniega.p3J5dxmD.Minecraft_0.0.8_x64_en-US.msi.part
- Size 7.3MB
- SHA256 7a8eb344adaf1d1eb6834060d7ed5e4853f822a285d8b8e20d9ccb037c2a498d
- MD5 7a26ae0ea9c394daf51f0dc9bb301127
- SHA1 bf5d84c8c3a3c8ab43a343b078c4c73095b61ddf
- SHA512 33c2d1b5e55731082096b6975a1f52e47325da11b12848de1ce9a2cb7d07df8526b305864433edabdb9f5ed3f6e871d4fffdc5a3327d67dce83efebdb496d5b5
- SSDEEP 196608:wzBHPjgUwzBUCtKko+33XYwqKPDTMOSx8V:MBHbwtMkoAIwqKPvdS2
- TLSH T168763359B9084932E4A92835161F6F018B747DF467A87EA38738B30D3F743E195B34EA
- MD5 SHA1 SHA512 SSDEEP TLSH