Analysis
- user interaction
yes - max time kernel
18s - max time network
24s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 18:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://archive.org/download/animate-installer-high-resolution-logo/setup%20%285%29.exe
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
900 seconds
General
- Target https://archive.org/download/animate-installer-high-resolution-logo/setup%20%285%29.exe
- Sample260420-wmc3labv8m
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 21 6056 firefox.exe - Executes dropped EXE 4 IoCs
pid Process 3312 setup (5).exe 5844 Setup.exe 3412 IKernel.exe 1752 IKernel.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\temp.000 Setup.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\setup (5).exe:Zone.Identifier firefox.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup (5).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKernel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKernel.exe - Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E1B9357F-24B9-11D3-88B2-00C04F72F303}\ = "ISetupInfo" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE6115A1-7DE5-48DC-AD2A-25060E00FCE2}\ = "ISetupTransferEvents2" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED5FEEC-225A-11D3-88AA-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{251753FA-FB3B-11D2-8842-00C04F72F303}\ = "ISetupFileRegistrar" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DADAB3-28A6-11D3-88BA-00C04F72F303}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B14-E59D-11D2-B40B-00A024B9DDDD}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B15-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\ = "ISetupFileErrors" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{348440B0-C79A-11D3-B28B-00C04F59FBE9}\ = "ISetupShell2" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE6115A1-7DE5-48DC-AD2A-25060E00FCE2} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B13-E59D-11D2-B40B-00A024B9DDDD} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC3-B5F0-11D2-80B9-00104B1F6CEA}\ = "ISetupComponent" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2061-CB55-11D2-8094-00104B1F9838}\ = "ISetupObjects" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2065-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC1-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4FF39B9-1A05-11D3-8896-00C04F72F303} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\ = "ISetupLogDB" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DED5FEEC-225A-11D3-88AA-00C04F72F303} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DED5FEEC-225A-11D3-88AA-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4AAC3B1-C547-11D3-B289-00C04F59FBE9}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\ = "ISetupFeatureLog" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB3-28A6-11D3-88BA-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.LogServices\ = "SetupLogServices Class" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB3-28A6-11D3-88BA-00C04F72F303}\ = "ISetupFileService" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}\ = "ISetupObject" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39040274-3D36-11D3-88EE-00C04F72F303}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C3C1B17-E59D-11D2-B40B-00A024B9DDDD}\ProgID IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\ = "ISetupTransferErrorInfo" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DE38-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\ = "ISetupStringTable" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\ = "ISetupRegistry" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4FF39BB-1A05-11D3-8896-00C04F72F303} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\ = "ISetupFileErrorInfo" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2062-CB55-11D2-8094-00104B1F9838}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\ = "ISetupFeature" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\ProxyStubClsid32 IKernel.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\setup (5).exe:Zone.Identifier firefox.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 6056 firefox.exe Token: SeDebugPrivilege 6056 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 6056 firefox.exe 6056 firefox.exe 6056 firefox.exe 6056 firefox.exe 6056 firefox.exe 6056 firefox.exe 6056 firefox.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 6056 firefox.exe 6056 firefox.exe 6056 firefox.exe 6056 firefox.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4412 wrote to memory of 6056 4412 firefox.exe 79 PID 4412 wrote to memory of 6056 4412 firefox.exe 79 PID 6056 wrote to memory of 4476 6056 firefox.exe 80 PID 6056 wrote to memory of 4476 6056 firefox.exe 80 PID 6056 wrote to memory of 4476 6056 firefox.exe 80 PID 6056 wrote to memory of 1172 6056 firefox.exe 81 PID 6056 wrote to memory of 1172 6056 firefox.exe 81 PID 6056 wrote to memory of 1172 6056 firefox.exe 81 PID 6056 wrote to memory of 1172 6056 firefox.exe 81 PID 6056 wrote to memory of 5992 6056 firefox.exe 82 PID 6056 wrote to memory of 5992 6056 firefox.exe 82 PID 6056 wrote to memory of 5992 6056 firefox.exe 82 PID 6056 wrote to memory of 5992 6056 firefox.exe 82 PID 6056 wrote to memory of 4196 6056 firefox.exe 83 PID 6056 wrote to memory of 4196 6056 firefox.exe 83 PID 6056 wrote to memory of 4196 6056 firefox.exe 83 PID 6056 wrote to memory of 5868 6056 firefox.exe 84 PID 6056 wrote to memory of 5868 6056 firefox.exe 84 PID 6056 wrote to memory of 5868 6056 firefox.exe 84 PID 6056 wrote to memory of 5868 6056 firefox.exe 84 PID 6056 wrote to memory of 4388 6056 firefox.exe 85 PID 6056 wrote to memory of 4388 6056 firefox.exe 85 PID 6056 wrote to memory of 4388 6056 firefox.exe 85 PID 6056 wrote to memory of 4388 6056 firefox.exe 85 PID 6056 wrote to memory of 5832 6056 firefox.exe 86 PID 6056 wrote to memory of 5832 6056 firefox.exe 86 PID 6056 wrote to memory of 5832 6056 firefox.exe 86 PID 6056 wrote to memory of 5832 6056 firefox.exe 86 PID 6056 wrote to memory of 5520 6056 firefox.exe 87 PID 6056 wrote to memory of 5520 6056 firefox.exe 87 PID 6056 wrote to memory of 5520 6056 firefox.exe 87 PID 6056 wrote to memory of 5520 6056 firefox.exe 87 PID 6056 wrote to memory of 3076 6056 firefox.exe 88 PID 6056 wrote to memory of 3076 6056 firefox.exe 88 PID 6056 wrote to memory of 3076 6056 firefox.exe 88 PID 6056 wrote to memory of 3076 6056 firefox.exe 88 PID 6056 wrote to memory of 3312 6056 firefox.exe 90 PID 3312 wrote to memory of 5844 3312 setup (5).exe 91 PID 5844 wrote to memory of 3412 5844 Setup.exe 92 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://archive.org/download/animate-installer-high-resolution-logo/setup%20%285%29.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://archive.org/download/animate-installer-high-resolution-logo/setup%20%285%29.exe2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {e604c434-0fb9-45e1-9ca3-c60ebf381c97} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:4476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {77a96e25-9b9e-47f6-aaf7-b208e2280929} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:1172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25164 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {b640e18a-10e5-459e-a6f8-13dad2c93b9c} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:5992
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27274 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 4124 -initialChannelId {e6403004-4007-4737-a52d-a788f8814f64} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:4196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34773 -prefMapHandle 4472 -prefMapSize 270279 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2612 -initialChannelId {c8dfba0c-6d37-4f06-b00e-23f09c7dc35b} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:5868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5092 -prefsLen 35010 -prefMapHandle 5116 -prefMapSize 270279 -ipcHandle 5128 -initialChannelId {69264e11-a489-4c5a-b766-7383be50f793} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:4388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4524 -prefsLen 32952 -prefMapHandle 5304 -prefMapSize 270279 -jsInitHandle 5556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5064 -initialChannelId {f2e2a28e-91a7-43f0-a524-322bd29957d5} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:5832
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32952 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {40de6b34-5882-41af-84da-aa8c0f74e1a4} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:5520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5772 -prefsLen 32952 -prefMapHandle 5776 -prefMapSize 270279 -jsInitHandle 5780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5788 -initialChannelId {a65e2554-710a-4854-b4cf-a9fa466ed023} -parentPid 6056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6056" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:3076
-
-
C:\Users\Admin\Downloads\setup (5).exe"C:\Users\Admin\Downloads\setup (5).exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\Setup.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe"C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe" -RegServer5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3412
-
-
-
-
-
C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exeC:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exe -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe"C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER2⤵PID:3972
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\corecomp.ini
- Size 27KB
- SHA256 5214789c08ee573e904990dcd29e9e03aaf5cf12e86fae368005fd8f4e371bd5
- MD5 62d5f9827d867eb3e4ab9e6b338348a1
- SHA1 828e72f9c845b1c0865badaef40d63fb36447293
- SHA512 b38bb74dc2e528c2a58a7d14a07bd1ecaaf55168b53afc8f4718f3bf5d6f8c8b922b98551a355ebb1009f23cff02fd8596413468993a43756c4de7dfed573732
- SSDEEP 384:2ERJ48bJNafWlc/n++TOa2SZ4+CIPo2S4m:2ER3JNaM+MJIPo27m
- TLSH T1F0D2211A552A1ED5EAB8328D3C907C8C74CCF1610AF2F6A7C4FE748649B745C2E6242F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\IScript\IScript.dll
- Size 212KB
- SHA256 381fda810cd074793a60d98f74890d99a940ac6ffc1b09b2e108f1b5efb2dd26
- MD5 53ba21f5204ded3154de5892cff9139b
- SHA1 7ea90e5d861d9c5ea8de0605016fc462d65c1f46
- SHA512 accb2630176fe915e45731cb5ef49a5db84b3895d1abf6c81f3d5f46c4c543b8d2091c267a40667bf48d37840f7cf47c599b8922c09364e8117f09119261eed0
- SSDEEP 6144:PlcWzXLZOVrkIIj4cxC8U9Eq/ADY5TjH:9VDFEr+0Qk9EYlb
- TLSH T132243B1238B4C076C39F0732EEAA2F75F6FDDE544ED948871F482E5C9E39D45892212A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe
- Size 584KB
- SHA256 8bbb0caa6320a2a892d465859b6ab4b30eb49adc6316f3f12aef06948f40025d
- MD5 c5472b073c6b08ebe210cf55d5317e0e
- SHA1 738c83b149ffa5ead915ec841c8787f3a991d517
- SHA512 1ae642b2240e9f153eb786830ba56753ed2a3e5adef7af7b9aaef369ea0aa762a9cabe4c42c0d6b2f9292d0c0e47388a439ba0641b162e9f243bdc37fc9d97fc
- SSDEEP 6144:822A6G5avxHHmvg8NFlN5QHxoJw+4dq21BJrMCxzrVkjiXwJ+d3vWagD+0+TWepe:WU5Nzy/rwwBn/0+TXpTvYb
- TLSH T1ADD46C263DF5C136C223C1718FA88BE4EAE5EE654D220D873B88371D5E75D81C72792A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
- Size 76KB
- SHA256 9339a6166821155e883c393327efaf918dd2cbe705eff2691b2c1de23770c6ce
- MD5 387a69f66da4ca5e8eb387b928f69426
- SHA1 c480c9bb95902af06ec3cb64282338566c43a3ae
- SHA512 0d60939cc67ffbb22836bcae3f91c4b728fd91fbf704898c14b58e192775083f0033a9e27bc451fa37530b869c0c6a95cbf04eb781aa152aae078b543bc3bc4d
- SSDEEP 768:RxgRRSvLpenZHL+vs06U9uTwMTeNV1vOtXjB6fvSzK7plQ0B8jEOxtEJ6UnAXUGm:RxgRRupIKV6I5AkSm7plQr6u7tg5Wb+
- TLSH T1787318327B83C673D1421771ADAAE6DAAF65FE075DE512073EA27B8F3C31605C859202
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
- Size 212KB
- SHA256 b9257e288ba16bb6cea1d6b92a8b2bfc6bf406e570f6efb4978454adbff0c3aa
- MD5 f2d9fa751d98281465396e5f373d1be8
- SHA1 9d14b946be7c34c10e3f8ee7696aa14de97fae90
- SHA512 23e62ba2a54c887df527c074c6098f1491cc480e6fad691bf315afa781e65802374fdea3b17df8f035960b19bcfd286d104ffd3696c50e0f0adf4eacb8fa32cf
- SSDEEP 3072:mD0s86+s8tmC4UcKJNTKRxCCDx7VvyfVK8lKVL4FldsVylT91zWT:g86d2r/NGCC9RvaGFylT0
- TLSH T10624A61337E3A9B1E1A50F39183A46FF677CFC234FD4B84A9AA2374C187B702A559149
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
- Size 32KB
- SHA256 769075b02300d38a727f96dfe0dcbe136814126077bd8299c4315ae7c22069c8
- MD5 534a4135703b8dbfdfbd1e66935cd5ec
- SHA1 5a6d9408f4442340db6210c88ce40e99fe0c4882
- SHA512 dd5203138bc684c8227782a9014c577ca038a75e0dea8ec884164f014173e85f540aee10e66f53c73f05c31d652b6becc46f67ca0d7e13eb6eef9aa44b994e68
- SSDEEP 192:EEPi0uGpQ5BoQXfP/nOBogjMOSitpwe9o40Sw8d8IA1x3hX:EdjbOf2son1px3
- TLSH T16CE27412EFA695B2F2C540703D7725A7352D2C3008E5D022EBC6DC4E287E2E3896EB17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\PFT5A7~1\IKernel.ex_
- Size 327KB
- SHA256 6d40f43b89c06a15ad193ea06a4810669a3b3be773e6e3556c064c12e34c4db5
- MD5 0dafdf8e3b1f78f7ffc5f8f28153f01f
- SHA1 d3ba0e35ecafd7f717374170485fc23244569067
- SHA512 dc327002650ca3800c923425aee356dafd4f788ab2d555ed6412c70002692f7c7429c024ec0e34f5df872e0472aaa4d4e7809c91bc8d6181c56f136682c19f30
- SSDEEP 6144:j+s6GL+607dqItyEvJlUwGlPuq/YAM0+/KEUKJaaoEDBkhCmCgJ5R609Lp/QGHD:jr609I/hJqRPyAM0aZ//tuCbk6ALJvD
- TLSH T15D6423B5C4F6C42E4ADEA8111230FB17AF92F3808723934B6A99954DEC04CFB5B5165F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\Setup.exe
- Size 40KB
- SHA256 03cacf9199912dba9ef3cd85349b21f9494518b4370c2979f5a98cf79605fa85
- MD5 b02652120d46b18b478676577a703416
- SHA1 75f71e9c45dce29dd0836220ddd37848eec294fe
- SHA512 c1a2b1597ce4f4592bcc9ca7f316d09b692b76f991387c732ed9c26a7bc77c28d7ba0096f50ff543928131b78e5e0692c348a843f8d4ee19dada82238bed873a
- SSDEEP 768:aOSPagH6kVm1YUdfII/pqGK62f/YeroHhBT2vg0EypNbA:UaJIXUd/h/d1HhBT2vgCp
- TLSH T1E713F7061FF28461FEF34B30A8BE2AB58A69FD170E34954F4BC0594E9D71A41DA30767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\data1.cab
- Size 437KB
- SHA256 6778ac49312d924e3be11ad7ec165b446b3109ae84acb6c2b811582cc2a126e5
- MD5 4c74ee1a84dd8f9e34a1d8e06d621782
- SHA1 966762d5db3bff11b4d00afc4d044f713a8cbb3c
- SHA512 6ef5fd36c78e16587170cb7f7b62f1370885f60eeef3839bdaa7d94ad5bb95e3f74101cb8c2b646f76a9e1212a5720db19b45d716532150ab3e57fea3a84a4d2
- SSDEEP 12288:u6b8c88VktdpmTCQrqmJsPsTtbdmCfzwbhIkP6Q8:uXn/nIJ2lC0bhIu8
- TLSH T155942360184F6F1AE18E6C3E873AAFB0D73261C36D26253D77169D90F241E3E7946392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\layout.bin
- Size 462B
- SHA256 ba3897731bbc4cef424f533db6078ba21cf04a37465a2bb4d3e58ca662a1d297
- MD5 c7d96217aa4bfe21143cf1bb18dee7c2
- SHA1 dda00147d622b4112bcb1c2b26eaa712972ea3ea
- SHA512 5135155701bc7a41af9319593c98cd61740985044d9a4026b6122feb2a902dd83eb0a35e56f00aa29634558c9146dc9e0ea07b7580f2b85039ce146f7a18acf9
- TLSH T1C6F01219370BD704E0040D3965BF794F93D1B77409219A07364066AEDC1D708FC84182
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\pftw1.pkg
- Size 40.6MB
- SHA256 a1cabd7973a163f082ad1d20ca3ef856d31923afc267a5d1542869ad8954efff
- MD5 961b1a75150bba1bff857a49a37c76aa
- SHA1 260a86952623d45431f83099594a03a823c0c7a2
- SHA512 d3abea1f7347c747649c4b4785cd314e5a98c09ed888f3e322d692392b3dd462e9743eea2731919354812989e60f006559994a7d13a16f8c524132dd00441cba
- SSDEEP 786432:RnR/ZP6Es8tYnNLAGekOoWKKKTO7EBFqik3v8kgwVF5jTQBpkZ:RRhP6N8cLBekO9YOILqik3EkDX5TgyZ
- TLSH T1E69733FECC4BDB7D580EE196C100BB1401E129D58195AB39E70D8AA8B0A7C8775F7EC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\setup.bmp
- Size 157KB
- SHA256 5d66b9cd2616cacbae6d0b25800e490e317a5f6a035fc0fccb86dad211d45e03
- MD5 cca515f87eb37dcc07b6c23d79f49c0d
- SHA1 7d2e5c499f6a9083f076fcf1aa2029feb27cf167
- SHA512 b7c4c0328a41c181af49e528c4721fa7b81134216ebf731310672202187fada30957f126c03a840618ec035a41fcc2f23574d8f42a5a82cd93b92e3987b0ff3c
- SSDEEP 768:e1Qir+NfrpSvHnnzidnEdEKxWXnU2BdZCJ+8kvDjASKHVhUuFmZx7MzDT92:/NrpInqEdEKYXNBqJtCXASK/1F87V
- TLSH T134F33DD6BDA9ED56D540D430981CF2E8F210FC79AF67DD1730EE7B1B603A220289E219
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\setup.ini
- Size 94B
- SHA256 859b8d314d6e15416d8fdb823424d0a48acb9d7b56a66640887592d0f2c1fca0
- MD5 18f86bed6ef32b310974f0f7d7d51ccd
- SHA1 526753361fb52769c05f3798aae4039b37210165
- SHA512 0e3520f367a71ccde2533a62522859062a497998ef355bb0808560e7cd6676ad80cb513d996f9755ccaccd1847fb7dd6f6f4c6f2db0f83cc7d6798ecf89c3ffe
- TLSH T124B01214610CFE0D1444141130242AD8A0D034284151D00441D16D0819178284484062
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\pft5A71~tmp\setup.inx
- Size 160KB
- SHA256 0c04fdda19f6369f809184aa553bbcfb7d8e1f7da8b66fecf2d98710a402beca
- MD5 0f5db9178f0603792cb347b510d79db3
- SHA1 1e1ccab89033d1e9da442082c597b64220798ddb
- SHA512 7ba32de738d98587d003363f8f06ae61c0a36d564fef62dc282e52a120d3eddf7cee30c9dbc40ea46df3a458ecb260589d5e2a0aa6b9f0f1abd17356de45c1f1
- SSDEEP 1536:HzZLrOUF8jkr8cs5HLeqoQkzTAYf7IAYPlsltlUNlfu6WgcUOty3jj+nat9o4HsZ:JiyuiFB23X6
- TLSH T1DAF3BC70B0516E4BE37D9B3BC857D97373A0B0649F23AB26219B77385C8552B2F422B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\plf59E3.tmp
- Size 4KB
- SHA256 f9efb3e6fe099c649fb4cc20ac6f9b7e90d3f60b8d98f48fb5d167f1a0b1b7f2
- MD5 414378bee661b0df11bdb2be32e15b84
- SHA1 b14fd9207864d6053b2cb099736b4dafc2084af4
- SHA512 f042d5a58c5f4d6dee054eebc9270619a79318bdbaeeb9cd23969aba09d4ef1bca77a139c08af718672ec87b7adbd6ef0e4bfeddc1a03e559eac91763d9361dd
- SSDEEP 48:zWq2or3ynA0KA07bjaNebeMFFVeag8TYbbtIeEAVki4X2iy5IfsMnV6LQdQ9DPgc:Kq2orCnavjaYCdaMd1scMeJgocuEaegn
- TLSH T1E991B76ED7C2933215914A85275923D2DF08B86C236323D0B949C0CC3286BD4A7FFAF1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{4c93c363-414e-11d4-9756-00c04f8eeb39}\_IsRes.dll
- Size 212KB
- SHA256 0888d2a696ca222ebc35641502548e5b79b55c9f7c094466a1a52d9d4d429a64
- MD5 37554142e54a38de6d2142ba80353f0f
- SHA1 6fb0102aa862674169cb7f506ee185ad5299ff19
- SHA512 1b3c16d792993569999e0e8271daa4165e29400942e21bcd73423c8d517144aa487d906ef593c7bc67c5877ba3fc098f25386170ddebedf8156f87adc947b181
- SSDEEP 1536:78pTehPWGVKnFq6BTNqskkkkknItQFMnjURpukpDRoR6n27nT+1IkFTRBR7N:7XRVKUskkkkknDp/DRw6n28
- TLSH T18D244450AAF78D10E6BE2A35D971BE71086D7C0149B48F7D56942E0E0472EEC9FD0B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{4c93c363-414e-11d4-9756-00c04f8eeb39}\isrt.dll
- Size 312KB
- SHA256 d71dc33bed67eec58af8148b8e529c4bc0364a86a5dbed66741a9d8802e3f2c3
- MD5 c416462f667408acf0b9c5c66739e7eb
- SHA1 678539d6f1ac968db6ce808d30f2fbab0ed1ce1a
- SHA512 1da4d26a66e5a2bc83c693d36cf40798e18bf79c51e603a6bd38ad0247fe52046a0044ecf97437414ac87cb2f42668c166b25c167428619b9469924b7b99be73
- SSDEEP 6144:ljq+wL4/QiC9S4aBw7tDtaUeg1+4XSSff5AOwd2PDH55AiHr433skP:Bq+VGdp7tpBj1T5twdJ2b
- TLSH T1D2648D123AF5C53AC68B0234FB185BB8BBFD96541EF1D8835BC44A5C9F37846C126A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{4c93c363-414e-11d4-9756-00c04f8eeb39}\value.shl
- Size 2KB
- SHA256 1ae88584647237e4c23081e29d1582cfa24dccb9ad22cc8382ee8b84f409db4a
- MD5 fe92541dc4c8468ebf205aed0bcd6130
- SHA1 95fe174cfce413368795061851295aa74d57599c
- SHA512 6097150c02b9bfa7ca87066397607e60a04045d6a7759e8ec7f7952ea211e0fb10ebc388f6e680d2d14ca7a61ff6b335af58e5df0e8aa0c91ded493597c4b9d5
- TLSH T1605156FDF68A162E5703D2A8334906865AF4F0AED6F40550AC5A227817AD1E403FE377
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 ab5a3daeaecc435b17d0562a20f992198445925a20d3d55fe4f6c20a03acdfd2
- MD5 15f40d4221cb571296f35e1fc5db82e5
- SHA1 92b7fbd533777e020c952efcb90bb3c64d8a20ed
- SHA512 d3aafee424ade456e142dd546ea90a6ef45190d868d7fc114fd1c0c0cd5b60cb004ec8f140772bd8601cacb045b4f26fdd9eecf55be962738dcfcb3dd7ebb8e0
- SSDEEP 192:NOv5zbolbl9yj3e1d66Joz0dzgCl6mc0d:ibolbl9yjId66JozQzgC1j
- TLSH T1BBD1EC24F639863BD448423BCCA61B401F76385B988E7F2932EC64492C563DE7A8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 541bdab3bf7fae4e426235864252a759af256866e91677033e48952e6cdfe7a6
- MD5 256cdcdd035fd8396eb81d7310df762c
- SHA1 26ffc8e624da870db12915672dba3e93e797ee40
- SHA512 501ed3033722e80d472822f16252cbaecafb69a7e45cf1cb0fb9541f4aff232154eb063fa68b47313f6c146613afe1051a3ee19dec4023e5a45919dcd0bf91fb
- SSDEEP 192:41d66Joz0dzgCl6mc0dfOv5zboH8Zl9yjR82:Sd66JozQzgC1jCbocZl9yjn
- TLSH T159E11F64E639863FC448527BCCA61B450F3A385B984E3F1936AC75482C472DD7A8E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 14b9a5b7d28eb1d51db3283b3b3646faa7bba6a26f5dde0457c4c0cf62c2ce4e
- MD5 0615dfa48cb5c7ede03de6f06e7beeda
- SHA1 6355d8aa994fa2a5f3fdb3da229182e6e2ec5cb4
- SHA512 fe5605b02d8b6cc22e1f16afa57e18f046d40e2c6a06f5efe1e0e44f3d1679fdebdd8fd419c0c161f6b47833a2952b0839a641c4c401a54ab019e4abf187cc40
- TLSH T191315A8C39B84D6A6D8BF36CB84003CE9399CA4A84C75C438E43DE8DCCE59D9716E578
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\00045562-3249-408f-9efc-d1661a1dbe26
- Size 883B
- SHA256 1254ec4cc62a9d445c44da20c56138dff3ff1c368d55e6f1b8fd4ab59556fdbf
- MD5 dc8affc7effd9f052d344d6837b341b7
- SHA1 3611f9777155a7f7e420245b905db744794d5f82
- SHA512 90b58046652ff1a3c9972f90e3ac77e88940c3a9c870e92a92842d9188e9c09f885e5c69c29a023b9ec912de3158e2679db8e1e39aa325708d7f25b15e49b6e2
- TLSH T118110C51E335B9B2CD7CD29A89927B469BF4742380CA54183FF49A040D7A62E939A70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\0f3d5363-407b-4287-b52a-02a301aa6a52
- Size 2KB
- SHA256 630412a8333d273ca64c6da5102444c58746d4ff119f0ebd2a2279bee2b1cadf
- MD5 8c511bb14c9f2b73373fced380a073da
- SHA1 6fc0a2c397bae5a6b4f893ad4ddb7471dac5714e
- SHA512 64299bccb3d888241166c8fee479b23674c32553b533fe5cf4cf2dd6c859024e77efa0738ccfc3bf5405969eafe003aef683bd286ef3b9b70647c70a0e81cf1b
- TLSH T1FC51849836389CBB5CCEE15C9482338E53E0CA4314C62C836E92DE4C9CDA2D9736F526
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\4576f4d8-8d45-46a6-bec4-b2f1d74f4d9b
- Size 886B
- SHA256 c5965ca87b6e22a301680e7d6fc40ec993d487e69668ea414078da50ca0974d1
- MD5 5eeed9ea616cb5be9656b914176141a0
- SHA1 6c9344e2a7be4b2fb7daef9dc9e004afae077559
- SHA512 a784d86333e0dd36bdd3b994fd7eba2b48af0e81114fa23452076402dc3cf1d6a92cfaf1752d3071217c0a6bce9533f577ecb0c01df71af9b45c69eda8a1c83e
- TLSH T159110010C6757DB1CC6CE29A85D1B70697E4702380CA48187FA49A180DAE12EA39670B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\490ace89-491b-4411-b9c9-50c6f28c228e
- Size 235B
- SHA256 bd8a4874326b91e61066cbb07a60698c89b50413eb63757890438abe99a77a12
- MD5 911e583e8b98b751e95a3988defe7077
- SHA1 5ff8eb459c991a2f1c9d562df19b5397836b9d3b
- SHA512 6b01a4aecc094afaffa083c58780ec003760beaa258e8d9d1e9b426ef8904f2dee9d2d9e7ff9bf1de4ca4b150d80bae222880801714982e229d2587a022a8188
- TLSH T147D0978024982B2C08108F0EB0A039C6308C8C3310B07820996181B4EEBDEC91292807
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\4e3961dc-a6be-4b0d-8545-85a01e0d19e0
- Size 16KB
- SHA256 8e1a6472c7e8742bfdae680518dc9ce53cb62802a6e0ed94744a59e9ffbb5e20
- MD5 fa15b9b84bed06e8d55d969724b41bf2
- SHA1 2d7eb2fb7f2f5ca1f1f7c1bdb5f8deb00641ceff
- SHA512 40888a373f461b2b106e68385dca03cd8147c5de94871200a972d546869584947e445635cad6b0b150651e71f91a7ae36f8613dacb58b5fa6e233969d241daa6
- SSDEEP 192:vPqRxHxY1JNJ8zWu7bbiDSzlRewIymVqjJI/fffHzjfqn1SVQIl1BV1B7MZjfZ19:vPuVx+Kd7bbiDSzlR7A9EZVuU1
- TLSH T19D72B856582049BAC691E3A894EC7FC3E6F528CF4C418FCD9BE4BD086DDE06E512784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\adeb9a45-f1fc-4cc1-8c5c-647792ca5828
- Size 235B
- SHA256 d2d95a7d434f9b749145a4106762406379e8f67aa7d382ed1ec33d208cbe9eb4
- MD5 c243ec6bb987b8da915ec01a6823c06d
- SHA1 1586159a0896471e1a4cdd0ae539644a6d23af72
- SHA512 a1631e5d444bcc00620985c7865d3007799c7b86c13e7a24fad14bdba2107f23c620855ca471af7934ecd586127888c735642af85f24d8e759d6491cb7278aaa
- TLSH T13DD097803898B3AD08100F13F0A068C630884C3328B99810EB610974AAFA9C84191D2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs-1.js
- Size 6KB
- SHA256 a7ef9bd0539028f8222ecb3d5afe6f7edf629dc5d18654ec01db94322a187b3e
- MD5 5c618c27e2993f276785b30327c3263f
- SHA1 5ef0a7a84a239e58a96b4fd84ce8428b18fc92df
- SHA512 03423ad73e405e896745ca6678d349add9255a6b5a2a14b65c9231a029ee826107eefca2c34717f14e3cc8734586d2f55989fd1d7020e0cdb9300b44ea43e8b3
- SSDEEP 96:xHX9UTUq1qGqafuI+1zSNSSlIdv9jtnlHw303tBw88H8L4cnQVJ:d91RafuI+oSSGw303tBw88B
- TLSH T1B2E11F7894488F7F64B6776CAC6888315AB2413BB7BF68D750B644C5050CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
- Size 6KB
- SHA256 5a3471d59be3737fd7fa359e9fd6ad08811cf87673cbb6831d60fa026cd0aaa7
- MD5 bf31aa45c9dbb8092bf259dc3ed596a4
- SHA1 252b8829425299964af5ab73aa611c0521561b8e
- SHA512 8b7218915399cbc45beb583e709f679626597dc85ebd13dfe9a22ee7c196b5fccc58bde358dc9982e4ef366c5950e856eaab837b4dbaadfa8e100c88c0f29869
- SSDEEP 96:xHX9UTUq1qGqafuKjmnjv1zSaSSlIdv9jAnlHw303tBw88H8L4cnQVJ:d91RafuNDDSSXw303tBw88B
- TLSH T162E12F7894088F7F64B6766CAC6888316AB2413BBBBF68C710B544C4054CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 3.2MB
- SHA256 52bc4f7f0ca621e9235bfde8199be5c80be0fc11a5bc439cb9f75c9c4f64669c
- MD5 c286a5f202fbf57e8cb8b58d84aa9bd6
- SHA1 bbfae4337620cdb990a9faa387d2703e47826f5d
- SHA512 c10a8e72b3ccf69413e49ba02aba34a425046aada31b72472545fe4350f08e0c53465ff1213a2edf68185015b9f9311b310b0a4fd9290409105ac8bb98e592e6
- SSDEEP 24576:xE+OO/IgzrJ4rV6lZYDyrRLvcMIrQwxOWlr3zt:xVbfJk6kDyrRjcMIrrxOwr3z
- TLSH T1ABF52AF820D2B357F3418033A64553EB21AFD00CA467DE044BA956E995B8CEF9E05B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\setup (5).exe:Zone.Identifier
- Size 134B
- SHA256 cc0131efb811eb6184239aad3d7f2886e2442c064540db310c9932218d8bb46d
- MD5 b9c2a39a4ceb2674121d99fe17277a9a
- SHA1 51da85652da3ba6d2300618fd2fc7b8e571af568
- SHA512 7b455ace2bcfdcfc9acbc690147abce26489303f9c4242ab18dcfea8022b9b6d1d10ee8345fc8489cca74380f3f977d653394547f2751d570bed42358c073183
- TLSH T1D6C02B0F0A1718071775324DED6FA414782E38634A8002E0DAC3408574001A9D73D003
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\setup (5).yEyY6bio.exe.part
- Size 40.8MB
- SHA256 341e216ff5c5d89efca6b66b6e3e89be164a31ba9e034de0cd70cc1c55c9b0d6
- MD5 caa043453d128e518802e3d09e8d9136
- SHA1 eac19987bd8f07608d2a0d73a4614799609d923b
- SHA512 2c08eeff64e1ee52b8c90dd94f58cb979af683335d17d862c8aa275d94ce27492e8870f207c60153ac57f51c032f85f37a00028a6eed8f49fb624738b88d0d1a
- SSDEEP 786432:pnR/ZP6Es8tYnNLAGekOoWKKKTO7EBFqik3v8kgwVF5jTQBpkZ:pRhP6N8cLBekO9YOILqik3EkDX5TgyZ
- TLSH T1199733EA8C9B8F7DC809E172C100FE7001A5399441D5AF65E74D8EA460A2CDF67F7AC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\users\admin\appdata\local\temp\pft5a71~tmp\data1.hdr
- Size 160KB
- SHA256 70a33ee61eac3913c017fc5303f067038fab12a0c28bbc0340d3370983b07002
- MD5 355753c6d91f0450083739fdaf157957
- SHA1 a68a8aa7cdaaa2e36deb6a625a6d843246dca396
- SHA512 0bcb7bda9a26d5c312a397efdc6bdbc3186106fd9e5d693f1e39594ec3fc103628392cb498e444d516b16dbb753fd1cec47ac262158c9af21f02dea5ab1977aa
- SSDEEP 3072:WYZRGXtYF1EFncykVSJ4X2k00TJGAtmjsZCfI1Nl47exEXadwgOroVKH0hGD/DG6:DLEFncyD330CdH
- TLSH T1C8F3C556DC19992BC9AEE37EC1EB15013734758EF33391835A48BA2D749230268973FE
- MD5 SHA1 SHA512 SSDEEP TLSH