e62bbb6d100cac48018170a991f34dddfcbd0ca2b8f020800f97c85ef690e41b

Resubmissions

04/05/2026, 16:37

260504-t4rwzafx5y8

28/04/2026, 00:05

260428-add3msay8x7

Analysis

user interaction
yes
max time kernel
177s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.zip
Size 173KB
Sample260428-add3msay8x
SHA256 e62bbb6d100cac48018170a991f34dddfcbd0ca2b8f020800f97c85ef690e41b
MD5 346904d0ed33b162979f169727a7bc63
SHA1 07afe2de00e38ca989a2382341b4f0edb2d5248e
SHA512 b1f1146c752858d6783c4d3c89d732eee14bb7b27d9bbd2b80d7961dcd01e1fe0f0169286f55981758729bd266f34fe486e2d68e6c2e940bef80500ba67c299e
SSDEEP 3072:e+Jcjd0YvFBGIU1nQ9Jr/1H6KVpQTjzmcgpCeVLeuRYbJKEp8LzqDv3TVlOuGZcY:eicjd0cRU1nQH/96KVpQzJ2Cq6uRwoz5
TLSH
T1920413BED32A4C65F3611F1948E2854ABF35ACED29C2187B8C1D86DF448FDE671A9050
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware google discovery persistence phishing spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6408	WindowsOobeAppHost.AOT.exe
6412	WindowsOobeAppHost.AOT.exe

Loads dropped DLL 2 IoCs

pid	Process
6408	WindowsOobeAppHost.AOT.exe
6412	WindowsOobeAppHost.AOT.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
131	6028	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4956	chrome.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218083666983203"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000003e5ca308100041646d696e003c0009000400efbe3e5c72029c5cc0002e00000063e101000000010000000000000000000000000000005d20c400410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000003e5c1c0810004c6f63616c003c0009000400efbe3e5c72029c5cc0002e00000081e101000000010000000000000000000000000000000d6c2e004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000009c5cc300100054656d7000003a0009000400efbe3e5c72029c5cc3002e00000082e10100000001000000000000000000000000000000442c7b00540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000003e5c72021100557365727300640009000400efbe874f77489c5cc0002e000000c70500000000010000000000000000003a000000000032db1a0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000003e5c720212004170704461746100400009000400efbe3e5c72029c5cc0002e0000006ee10100000001000000000000000000000000000000a98c0c014100700070004400610074006100000016000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 44003100000000009c5cd60010003100340009000400efbe9c5cd6009c5cd8002e000000f4440200000008000000000000000000000000000000327d1d003100000010000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5728	explorer.exe
3296	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5128	powershell.exe
5128	powershell.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
6236	chrome.exe
6236	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5128	powershell.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeDebugPrivilege	6028	firefox.exe
Token: SeDebugPrivilege	6028	firefox.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe
Token: SeCreatePagefilePrivilege	4896	chrome.exe
Token: SeShutdownPrivilege	4896	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
6028	firefox.exe
6028	firefox.exe
6028	firefox.exe
6028	firefox.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
6028	firefox.exe
1764	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe
4896	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
6028	firefox.exe
3296	explorer.exe
3296	explorer.exe
5728	explorer.exe
5728	explorer.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 6028	1924	firefox.exe	94
PID 1924 wrote to memory of 6028	1924	firefox.exe	94
PID 6028 wrote to memory of 4748	6028	firefox.exe	95
PID 6028 wrote to memory of 4748	6028	firefox.exe	95
PID 6028 wrote to memory of 4748	6028	firefox.exe	95
PID 6028 wrote to memory of 1872	6028	firefox.exe	96
PID 6028 wrote to memory of 1872	6028	firefox.exe	96
PID 6028 wrote to memory of 1872	6028	firefox.exe	96
PID 6028 wrote to memory of 1872	6028	firefox.exe	96
PID 4896 wrote to memory of 3932	4896	chrome.exe	98
PID 4896 wrote to memory of 4180	4896	chrome.exe	100
PID 4896 wrote to memory of 4180	4896	chrome.exe	100
PID 4896 wrote to memory of 4956	4896	chrome.exe	101
PID 4896 wrote to memory of 5104	4896	chrome.exe	104
PID 4896 wrote to memory of 3312	4896	chrome.exe	105
PID 4896 wrote to memory of 5104	4896	chrome.exe	104
PID 4896 wrote to memory of 3312	4896	chrome.exe	105
PID 4896 wrote to memory of 2240	4896	chrome.exe	103
PID 4896 wrote to memory of 2240	4896	chrome.exe	103
PID 6028 wrote to memory of 2912	6028	firefox.exe	106
PID 6028 wrote to memory of 2912	6028	firefox.exe	106
PID 6028 wrote to memory of 2912	6028	firefox.exe	106
PID 6028 wrote to memory of 2912	6028	firefox.exe	106
PID 4896 wrote to memory of 6004	4896	chrome.exe	107
PID 4896 wrote to memory of 6004	4896	chrome.exe	107
PID 6028 wrote to memory of 5632	6028	firefox.exe	108
PID 6028 wrote to memory of 5632	6028	firefox.exe	108
PID 6028 wrote to memory of 5632	6028	firefox.exe	108
PID 4896 wrote to memory of 5084	4896	chrome.exe	109
PID 4896 wrote to memory of 5084	4896	chrome.exe	109
PID 6028 wrote to memory of 3392	6028	firefox.exe	110
PID 6028 wrote to memory of 3392	6028	firefox.exe	110
PID 6028 wrote to memory of 3392	6028	firefox.exe	110
PID 6028 wrote to memory of 3392	6028	firefox.exe	110
PID 6028 wrote to memory of 1492	6028	firefox.exe	111
PID 6028 wrote to memory of 1492	6028	firefox.exe	111
PID 6028 wrote to memory of 1492	6028	firefox.exe	111
PID 6028 wrote to memory of 1492	6028	firefox.exe	111
PID 6028 wrote to memory of 3492	6028	firefox.exe	112
PID 6028 wrote to memory of 3492	6028	firefox.exe	112
PID 6028 wrote to memory of 3492	6028	firefox.exe	112
PID 6028 wrote to memory of 3492	6028	firefox.exe	112
PID 4896 wrote to memory of 4888	4896	chrome.exe	113
PID 5128 wrote to memory of 2800	5128	powershell.exe	117
PID 2800 wrote to memory of 3164	2800	cmd.exe	119
PID 6028 wrote to memory of 3088	6028	firefox.exe	120
PID 6028 wrote to memory of 3088	6028	firefox.exe	120
PID 6028 wrote to memory of 3088	6028	firefox.exe	120
PID 6028 wrote to memory of 3088	6028	firefox.exe	120
PID 6028 wrote to memory of 6764	6028	firefox.exe	121
PID 6028 wrote to memory of 6764	6028	firefox.exe	121
PID 6028 wrote to memory of 6764	6028	firefox.exe	121
PID 6028 wrote to memory of 6764	6028	firefox.exe	121
PID 2800 wrote to memory of 5192	2800	cmd.exe	124
PID 4896 wrote to memory of 5716	4896	chrome.exe	128
PID 4896 wrote to memory of 5312	4896	chrome.exe	129
PID 4896 wrote to memory of 5836	4896	chrome.exe	130
PID 3296 wrote to memory of 1764	3296	explorer.exe	131
PID 2800 wrote to memory of 6408	2800	cmd.exe	132
PID 5728 wrote to memory of 6412	5728	explorer.exe	133
PID 4896 wrote to memory of 6236	4896	chrome.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\1.zip
1⤵
PID:4684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\explorer.exe
    explorer .
    3⤵
    PID:3164
- - C:\Windows\explorer.exe
    explorer .
    3⤵
    PID:5192
- - C:\Users\Admin\AppData\Local\Temp\1\WindowsOobeAppHost.AOT.exe
    WindowsOobeAppHost.AOT.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6408

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {93aa7c73-4031-46cd-863f-92234e8167e1} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2452 -prefsLen 27135 -prefMapHandle 2456 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {e26f0474-1f18-4775-8f7c-936fc5dc9533} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:1872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 27276 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {cdda4112-8a67-4cf4-80c0-c67e26538443} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4044 -prefsLen 27276 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {1722274a-513b-4b10-ba32-9ee6236d0d2b} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2952 -prefsLen 25213 -prefMapHandle 3056 -prefMapSize 270279 -jsInitHandle 3060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2784 -initialChannelId {294df53a-366c-43e3-b88d-345e5c7daa6d} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 892 -prefsLen 25213 -prefMapHandle 1268 -prefMapSize 270279 -jsInitHandle 1272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2984 -initialChannelId {2817a52f-2482-4dca-b1eb-ff69881fde3b} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
    3⤵
    - Checks processor information in registry
    PID:1492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4512 -prefsLen 25213 -prefMapHandle 4516 -prefMapSize 270279 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4600 -initialChannelId {a156bf28-8cf6-423f-9940-574e645161c1} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4816 -prefsLen 34841 -prefMapHandle 4824 -prefMapSize 270279 -jsInitHandle 4772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4792 -initialChannelId {ad8f54b5-a561-46d0-9510-32e7826a202c} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5112 -prefsLen 35029 -prefMapHandle 2956 -prefMapSize 270279 -ipcHandle 2884 -initialChannelId {9052ea5b-6bd8-4bda-a082-dcea23ec54b8} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
    3⤵
    - Checks processor information in registry
    PID:6764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9ba21c728,0x7ff9ba21c734,0x7ff9ba21c740
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,6160906765126964616,5513902013703715071,262144 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1592,i,16627077627562033055,17515337767141503487,524288 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,11486963448153290292,5837459872584246188,524288 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,12548338662455823676,10681099255293841551,2097152 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,7008769362457253221,2887301544970321535,2097152 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,16838209175323714379,14725295043808263302,2097152 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,4306207364064211563,252649848017919935,2097152 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,12707597863590587986,1121932822075083430,524288 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,10647189751937882323,8932425543625375803,524288 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,10964213875511389684,6141679906671296033,524288 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,18066394717181983603,4172689903165482516,524288 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4536,i,370184600870206390,5731909774135516463,262144 --field-trial-handle=2036,i,16221831797652312178,18074826189941570946,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Users\Admin\AppData\Local\Temp\1\WindowsOobeAppHost.AOT.exe
  "C:\Users\Admin\AppData\Local\Temp\1\WindowsOobeAppHost.AOT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6412

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\1\" -spe -an -ai#7zMap18788:82:7zEvent4774
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b9d99c52281cea62832f44eb52a52acfa47397081d59c1ff3a760f18bab41e9a
MD5 a5344471e0ac2c53e1ae4041b249eecd
SHA1 758d0759b843fbaf2fa3f3a4c99f198ff29b5821
SHA512 0228fd31d44b99717b47cc7a2d75122f6d598f1b5de19f7f9d381ce43c8c8e875b6bbd8cf2ca891297d22431498170d57182fa04030170d24aa1cc200aad9b8f
TLSH
T1FEE02BDAC921EC2718FD177C70550646F64403563B44595F3E3D82088FB463F468281C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e707648d27c19a45a98100a02f00cb86398701c1ac3281d6c6554185aa47aa96
MD5 9d7fa852d5ec6aac98d96ae21e7ac8ef
SHA1 53e14641839082d26d2f330b5e614e2c81284c69
SHA512 4f0908ad297532b98a869d8ca61c3ea3db3823641567b82047b1509e7eb825afef66aaed4b76acba2f8d636ce03a43848af981ef15e124b270414534e1123c1a
TLSH
T19B518AF3D3E4866D891296F4EA156E2FCE6D0924032C3C6288D4AF4B53F2972D34178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 728c792d43a10f2cfad6ce55203d2a3c6d57771aa93052ea5b8abc0b9745616d
MD5 762cea43e6ed1453769220e3eb9c7e41
SHA1 a2b38330645988eaf0bccf3e5c60f0349347c312
SHA512 564a6434c510c049a10830cd54d8e00a99752317424123155e1ffb37293228e4846ada400b1dbf25543c31f011a8ae0d2b703817616c40605f90a62673e98044
SSDEEP 192:gRen0PZdaZUv7tYpAPRp2hm9CHsb+WNnu80HTeSo/GkVyIsnAUgraJ:gRenaqQhYUXem4wp0Ho/Gge
TLSH
T1C742C82EE914793B5CC7D229FDA27B57E7F1103121942E94EAFC8A2C25EB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8ade42af441c2d538b9a2bf3493334d974454a34b29bce5e475fed301d77c465
MD5 2024ad9c73ffe27ed223d627f032847e
SHA1 b859069573dcb1c8d289c2c2ca0a81c5a69af5d5
SHA512 6f1c172898b832c9471d358fb5b907aa676bd8c2424b679912740addd5d08dde393eb238f78a1d77c6ba2a53816dcf20eb5d03548097989fcd51e7b017e4e8f0
SSDEEP 192:gRenxPZdaZUv7tYpAPRp2hm9CHsb+WNnu80zTeSo/JkVyIsnAUgtaJ:gRenxqQhYUXem4wp07o/Jg8
TLSH
T11F42C72EE914793B5CCBD229FDA17B57E7F1103121942E94EAFC8A2C25EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ff69fb1a63d9fcc5f7592e73b5719ba820bf9dce9a33901bca0c662f53b5e0aa
MD5 0764a5cb249396e47f5f098900eccba9
SHA1 6f50fb1d07ea8dfa74d3a7e367c10901b16f46b5
SHA512 1a2fcf73e46c62cb2c983f0564932a453a6f242a0ab255399691f08a9621c4dd5ddc85b34c84ca7177b204387b04f3dcb3c45b6fb569248fd1383d92df83d63b
TLSH
T147B01250C0115512C04702F41182148D3A18AF14AF06570253E06DB5E8262E14064150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5881ae.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5881ae.TMP
Size 96B
SHA256 a14cdf814773c35c8dd7f257137b2f842210860033111f61a9286a51218f49a6
MD5 bf78b0fecc5b3e1f006f2b1e051623f3
SHA1 f6c12a869b6fca51e303df1a4641dc4ee8709e8f
SHA512 56abd4233073748c12bd9c930761b29ab28b40f25732dcd9e91e9fd45235d2668790b12efc3db8a4ca21b959d350cfe5c262e1fea6265f7180b2c5823d177da9
TLSH
T1DCB02228C002A223C00303B022A080EC3230EF20C2030203A2F00F22CC382F008382B0
MD5 SHA1 SHA512 TLSH

Submit Download

ae97d8b8-4cbd-4bd7-9688-f39d0c658289.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ae97d8b8-4cbd-4bd7-9688-f39d0c658289.tmp
Size 12KB
SHA256 b899c499af7113fa9e137b0b444032a3ee62feccacf8d3f989ec4957c2ec50c1
MD5 a12e6c0434436d0f30fa3eff98497bbf
SHA1 eda90eeb98868987ae7eb7164748ac41bb7eded1
SHA512 2ec3a98ea3367798ed0e3b3dfc8b6c5769a59ed104d06288e892346f03315d3c26aa98871820bc4668f871ba5b6fe48b0d4a9731b69ccdcc26c9615895ba8e1d
SSDEEP 192:gRTnxPZdaZUv7tYpAPRp2hm9CHsb+WNnu80zTeSo/JkVyIsnAUgtaJ:gRTnxqQhYUXem4wp07o/Jg8
TLSH
T16942C72EE914793B5CCBD229FDA17B57E7F5103121942E94EAFC8A2C25EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 e5df26dc74ce6ebd9f3c16c798536204a568391843c5040e3d7871302ff2aa0e
MD5 e1d8c8cdecf20b79dca34bf4a442b376
SHA1 c3943254b18d7627197f8ba963052d9d5801016d
SHA512 cb34f77808b5b92af4f335ce3473b35e50588775a02d581a26b6ecf913c55aafeca49fa86e4349c5b09e91d15dbaeafcc4c2b818517f1daa623a4e2a551b6284
SSDEEP 1536:0NtcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:It3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1DF9302BA4E1A4AE7957E4AC176AD7808CE12130D70AFA9CC316C639D71D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 238KB
SHA256 11eaacc9c4d9e0a092be391704b671d7887f2ea934a7ad0971435ae6aa0193e5
MD5 6aa13a6da57107da3ec451fdb6a24978
SHA1 736fbb6029cde02684de6bfe1201bef251470017
SHA512 7aeaf05497f5ac3754a14ffa7ddb511d16ccfea24008c04177e46c83f035e38f5290554fbbf03ba6ac13d8e0ab1b28c5e55cad501a8e1303d2760e0c0a6c7b92
SSDEEP 6144:95hpvh5TTjdrGYEHIJVNyr6trOk0HOGm/SFyEEk:rhpvbZrNYr6trOjuGdF2k
TLSH
T1FE342332AA178D6715320356B50E550DCE63533FD5EFF8D47658AA4E23C80A66B33C78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 bdff697ad0ea1646b3f314f68e844798134f1d42bfe9e1ac6dd455ccb2f16bd8
MD5 aa4e159e96238423c5a4b4148020125f
SHA1 4237e165fb727a391a2521f49ae72b787397b690
SHA512 ad3c6d961f2cef6b5925f524be86acca1b575f6c785cfdd7eb0094535637c77de938ba1d6dc10695b06afe274d954a40acc04fc1e343eb249b91bc2df54d805c
SSDEEP 6144:BTTjdrGYEHIJVNyr6trOk0HOGm/SFyEEk:BZrNYr6trOjuGdF2k
TLSH
T197142233EA1B4CAB51730396790E640DCE13531DA1AFB9C97764D28E32C80A96B73D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 7ba8bede877f3543b0d14c6816c1ef19bd6427709367ddb2a7560e9b58e11e30
MD5 6fe0a404c9f645664698b35c9fca08d7
SHA1 c6436ccf37546fc151ba177f6112ee8121338d84
SHA512 443ed070be690c9cc776fd1aebd43806a9733b8b2d659b597ff84379d8cc7480aa36f74ea5f21efb31b92a0b7523d432da9c5c9edae4da2de4340854e38519d8
SSDEEP 6144:mTTjdrGYEHIJVNyr6trOk0HOGm/SFyEEk:mZrNYr6trOjuGdF2k
TLSH
T1F1142233EA1B0CAB51730396790E640DCE13531DA1AFB8D97764D28E32C80A96B73D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\unfswcr7.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 a20705d52bf7d0ddaed44f51052a306cdd48b34155655bff1ecc0e2906bb6f6d
MD5 a554702c7a2b91b8941797613b6b2bcc
SHA1 d0b0d2098a47c448d8ee2458fbcfc8b2f1b0f983
SHA512 44a861654b82cf8c9269e052fa874b62ce92e20ef31d688de2a0c63b7f0394ffa2fda1643de8926869728d260a41fbea14a2e256f0d1ed571503a4f45b3b2ecb
SSDEEP 384:HbaFrLiO024Y5Fuhw+5EL1pPsac4j0lpDII+Pl/lp:7aAZY5FuK+5EB9sac4ID8LPhP
TLSH
T153527E7DAF0138BE1A77D2D4D9EA5204CE08D6BBEEE2D15605143845C6847B8B4F60EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\unfswcr7.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 359c39b8b3fc4f319a6fbb147879a3654af693a04d44c52462aa6f66e4b5907a
MD5 17071213d215ef7e8c4f0d6f11ee1f78
SHA1 0b8d0fa99a7e86499e3158df6145217142801adf
SHA512 bdfa0bd532d0ff3a9de652391eed9913e0292ac91b3b81912d0bc6126b2b831e829f4d887b49aff2ecff1a86569760991fc7ff5df3ee9dac4d4e22e93c309c95
SSDEEP 1536:jTrliAUQshDhDoPm2U6LR4cyZNpZo6hJ1Cu4GvxK2iOu+KqMDjKgou0MUSUtrmqo:j3lIvoPm2U1/Zto6hyCQaKqgo7tr/o
TLSH
T11AB3AEF6DFA28D3954FFD41DA682883EFD266044B3E33009CD23275462C6FB86679649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsOobeAppHost.AOT.dll

Path C:\Users\Admin\AppData\Local\Temp\1\WindowsOobeAppHost.AOT.dll
Size 11KB
SHA256 c1681d3aae736585c1dd656fe3ad66dafd3712ad4125e09fc97a4f1e5f367548
MD5 3decb20e3240b0753dd8a4df82ab78ed
SHA1 1f34a26664c13970d9fee92c79a98ff44881b538
SHA512 113d9c21ce3426a7a6ed5af42252e037303b5b2fb142dc7b10031c1f7b96f45d114078f5d7b2e30d59c8dd889a05037a61ac6290083a2d9e1e2dbe44fee90a3b
SSDEEP 192:WPttPB+Cy+2tQcXDpw7RhaDVhuLDL/xDrRiLUQ56wpd+wcpJ9K+EFzB6jMSF47yD:gttZ+Cy+2tQeVShCq/xDrRM+ntK6jMS1
TLSH
T13A325147E5B210E1C4B6E1B49682723BB9B5795583346B939F809B1B2772AA4E43EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsOobeAppHost.AOT.exe

Path C:\Users\Admin\AppData\Local\Temp\1\WindowsOobeAppHost.AOT.exe
Size 102KB
SHA256 07402ed9331519d57be87a3ef4a386ae7d18826bbfbc0c36c54135e48dee7494
MD5 1ff8e3db34f400bbbac608472044869b
SHA1 20c5168d544b04c323c4fcf9ca27e6256bf771ba
SHA512 8a30a875e1bdc0dc7748c188f28f0222fef88aeec9bc1a5800972e5daf83c2f738d659d06989fab5e434bbc4977345dd75259839305495dfe9afbbf9b60725c5
SSDEEP 1536:eA+aew+wVUabOfGijufOmgwTHHUPeQJty1K92HNmn3sWKdP9dlih4OS4kE3Rv:DQqGKfO8nUPeuty1KumSvoh4OS4kE3R
TLSH
T122A33A9B73A530F8E1B78639C8511A06D775F8310B619FEF4760469A1F236D18E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.config

Path C:\Users\Admin\AppData\Local\Temp\1\db.config
Size 117KB
SHA256 97e0714ee7279feb558aa38ab9d4c279731d3000c501aff7ad5c2967c3cb987f
MD5 dbe4c748658318e5ea7e9e34e2ad493e
SHA1 d3d61e7c7fae3cd48c821c2654a312881d28411a
SHA512 9ae0b884076c8e8471c468616007e88bd967589df04b397ddafc3261b1664619779a711cb55130166f778567f6afcae8f5af2b57665d6b4abda38e4cf1a7dfdc
SSDEEP 3072:R+Jc3d0YvFNGIUfnQ7Jr/1H6K/pQTJzmcgpCeKLec:Ric3d0cJUfnQd/96K/pQtJ2Cz6c
TLSH
T155C312FD962C9D2AA3D03F0D5AD3A89ABA21CDFC28C54D5ECC1D16EF049EDA661D8050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5116ae72-9221-46d4-a1b3-2df404777066.zip

Path C:\Users\Admin\AppData\Local\Temp\5116ae72-9221-46d4-a1b3-2df404777066.zip
Size 3.7MB
SHA256 41f88315ccb5feca6d1f0ca29ee131700bfe0f0a4a0cb4cc56912f7525275fab
MD5 3161f12ccf7dae28d5ba50957dcb38ab
SHA1 28750e8ab50cbeb7918f8b0e2c64df1d12a6f7f5
SHA512 f8a64ea32e684e0c7ca84f7faed743c74b31f194a8f8412cc41162c89e6c7a93dfbb90dc8041ce8e5dc101522c06ac68a4a57c12ad68baaa26072a9327b452d3
SSDEEP 98304:yLr0Cmjpv8wpUBBQBMEfINmTn7ylp5MAU:ewrtUQBMEfINmT7+MD
TLSH
T17E06E035DE9C1E08C98F83FA850C2FC29B4C4F668054A95B7E6A9571DFB31A21B47B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_scc5dbpr.fg5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scc5dbpr.fg5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 0b3fd42e171b01b0c8639d235a8c8f84edd4b69a0f720611af58d3beca71d85b
MD5 ca5c8140a90e31afc30c6f3e43f03e0a
SHA1 57afb459adc45c7e9de24acdfe051ee301075d47
SHA512 30f99136e39acf2059216dc619f5be0d4f0d3d93f4a72e247f87d5bc096ae960ea5bdf9cc5bf7709a442ce43031881fcd0c01dace8f9de0cafee5b242ebc5e4d
SSDEEP 768:TY76SnXyowtyGGcmhumJ0XKDNFa0a058EFlubNbpbbbCbLbzb3bFbTbDE4mE7pny:TY76SnXyos40XYE4mE7E
TLSH
T1CE13FE44EB1E953FD46802BB9CA50B002F79F88A595A2F973A5C60786C873DC3D5E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 9e34066f43680a9b67968ea8ef73a4f9385e27553895aca1ded9088a86bc7c60
MD5 39816c1ac73387b7cff34a6f7dc67408
SHA1 701fa24c494377b86073782f91a662fb66b134c7
SHA512 836b121c289cda2b04365d3c1ac034dd99921168bf6d7c1617e147823947e3b56d721c9dca3488b46ff44bab2dbb13b5ae1ab8934a0b3e997fe4c6cc7fe67ad3
SSDEEP 768:yE6nGY7k+X9owtyGGcmhumJ0XKDNFa0a058EFlubNbpbbbCbLbzb3bFbTbDE4mEY:9Y7k+X9os40XYE4mE7s
TLSH
T10613EE44EB1E953FD46802BA9CE50B002F79F88A591A2F973A5C64786C872DC3D5E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 e9cd67bd37dd3a2f030aea5502bffad99b1ce937e4c3bfa109f1ec017c7dc053
MD5 3906d75df7917bdaa3e06028454b9328
SHA1 8703717115b853c36fe4c23c28d56f99972b747f
SHA512 afbdf590f4723719474f79b70da9d9e9cc9dded41fc3592408319f23fbc62da6f38d45ba4e0d74b747e39eacc3f77b328f629afc536145c9bd9e61b74b069144
SSDEEP 768:DElJAN+zVhxlpqAsGcmhuNKRp3JFIXb5bDb1bh:/ozV7HiK2
TLSH
T15AD2E184EB1E953FD41912BBDCA50B042F78BC8A59092FA73A4C646C6C872DC3D5E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 407e9ec93ac88dfb365620bb4fbfea10a512f76611014b6c2a330156b3906e82
MD5 ad54e6fcf5abfc6c3d51eddc5933d760
SHA1 6e662ccc8b3e2fda1f7a16b1c63b7000cc25c6e2
SHA512 b6641f0fa26c7135d2388a4d190c9eab6d3b6b1e7b339d51633b610b2f015bf43bbf43dafc2ffb068095972ce5350a282599fae7ba23637787ed73bf18603dc6
SSDEEP 768:yESPSN+zVhxlpqAsGcmhuNKRp3JFIXb5bDb1bh1:hozV7HiK21
TLSH
T192D2F144EB2E953FD45902BBDCA50B002F79BC8A99092F973A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 0561652da525ce5dc74824ef81376fdf2381335d0fb1de2eab77242fdb9ba9a5
MD5 3eea278a4a0cf6ebfd189f6e04895813
SHA1 f37a2b915ef79ed0571a854d8454d38554239fe9
SHA512 6d5e276b25a0fbc89702956effd9185dc9b00f97203fce2cab7425ab8e28b2091801bd49f2998a23db8c756eb0938e808d1e615241d84c4441cbed91056df92c
SSDEEP 768:sN+zVhxlpqAsGcmhuNKRp3JFIXb5bDb1bhCEj5v:sozV7HiK2l
TLSH
T1C0D2D044EB2E953FD45902BBDCA50B002F78BC8A59192FA73A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 a7850aab9d75fcc6c21a6f24fc61b241dbdb0a19bb0393945f55eff8a7466f89
MD5 0b74e27c50298b46b626b2e98f107295
SHA1 7da14f92f6ba0fa631450ca4cab7cfdc4b179769
SHA512 5796d3125afb67be7ceea998071244d2a1ebb6ff1831348a4cd2c1a64252e2c36076c9f9470350771e0d0bf39bbb059dbebacb487cafff53858936f59d49da6b
SSDEEP 768:HnGY76SnXyowtyGGcmhumJ0XKDNFa0a058EFlubNbpbbbCbLbzb3bFbTbDE4mE79:mY76SnXyos40XYE4mE79
TLSH
T1B813FE44EB1E953FD46802BB9CA50B002F79F88A595A2F973A5C60786C873DC3D5E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8a2c3050d536eef2a8af9701ed8f6c5557248a1a55b08f1d4365727e0bd8567e
MD5 52c88cefa9a80bce925b7f5b1db71142
SHA1 d7ebf21d1db541fcbb0a7fa443f637ea437e9a10
SHA512 bf3edd282e38a912bebccf00af1678084b8767010040939179fa90ef9376156b2a1ceedcf504396e849f46a307ddfc768ec3e053fccb64dab0f9200e09b8a573
TLSH
T1A421256C79B88D2ABCA6E79CB846028E93554A0606871C430D13DF8DDDD9ADD326A438
MD5 SHA1 SHA512 TLSH

Submit Download

35a1366e-5061-4f50-aafd-f34f2429ce4f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\35a1366e-5061-4f50-aafd-f34f2429ce4f
Size 235B
SHA256 b4be016ab39591c9ad7a04559bdc85223b2acd6d621a1a605d3d7940d915b2f9
MD5 0f17d1df1cc599f276bf00e8e7a8632a
SHA1 d0b0b71281b8db283743095bb1dac337aa76a19d
SHA512 61b3df5c55611703967919a2c0b4c4c3c5f3375afa86c0d491d04904e67e9c52563c3a049c9390cab19f3f1b8453e7c64b12f37271e96e25c17d5bb6ff4ade74
TLSH
T174D0A7E86498676D88180F07B1A0AAC674548C377CA5A820A6914575A9BD9C45161857
MD5 SHA1 SHA512 TLSH

Submit Download

886e9db9-62bf-456f-8657-a0a4c2d02470

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\886e9db9-62bf-456f-8657-a0a4c2d02470
Size 871B
SHA256 bd21b7f3a086be791b76a9b690bbc275e132c86e593485f921dbd927cfdfae12
MD5 3b3dcf64bb0ead779277f7da3e343a61
SHA1 de2e8ba5abf7087427dfa2f737e121e729c0dc35
SHA512 e44d59a76ef22a1d19a6fa8bb3de880cd136c1a2b6c51f89dc3ef4ddd7ee2b036ef494bfee851b6672f216da60c3e9731961049382bb2cf75126e587a364776f
TLSH
T142110C84C634BAB28CB9D24FC4953B429BE47423C0CA09143EA04D280D6F66FE36634B
MD5 SHA1 SHA512 TLSH

Submit Download

93af17c3-5eaf-4d48-930a-4ba1a164e403

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\93af17c3-5eaf-4d48-930a-4ba1a164e403
Size 2KB
SHA256 83356e9237696791467bfd227e8549e5f5665193c58d6ac902572f43b320c5ea
MD5 f073b730a3ff1eae878a2aa2974237e3
SHA1 aa6b46ecfb93bff4ef9e78796d72333c487f38f2
SHA512 03a08bec333c26fa07a5c9b5192cc896180c27a72eb50a3cb8c85aa1833af0d678a3749b5f207855f5d9605519ede23a53aa9ec9694c1d9fe8261ba39fb95e76
TLSH
T11341115C35788D7B5CDAF59DE092378AA7A04A1740C22D432E55CE0C8C966EE636A12B
MD5 SHA1 SHA512 TLSH

Submit Download

a288f4eb-9ed1-4700-bed0-3bfaec1ca2cd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\a288f4eb-9ed1-4700-bed0-3bfaec1ca2cd
Size 886B
SHA256 b1f4ff3a5cce76655c6040cb38cab6d0dc69a7b1a34cc23f044160aa35ae37ee
MD5 155a5e3326173c6dbc5b3d0f05667080
SHA1 9710142e2f76311411a267cead2f4d546cbddd45
SHA512 6e62830f7c7f608fbdf59af7e5a64eac47a1e9d38dfbc494866399e825069cfd0d50c05b3a90ea0cb1a929b7dccb8515fd2acf4cc921686a5018d0709884aa22
TLSH
T1FC112744C535BAF28CB9D38BC5E43B428FE43513C0C70D147E614A280DAA6AF6766307
MD5 SHA1 SHA512 TLSH

Submit Download

c1730d47-21c8-4e24-90f4-abdc28d4593d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\c1730d47-21c8-4e24-90f4-abdc28d4593d
Size 235B
SHA256 d1efe0b56653ac4f57e08247f700823dce07e6f7609d61fdd50b6a938da4c1d4
MD5 6af42fc2e2d8134f2693bfa7b94edfa3
SHA1 2a11d5ef060a7bcfb96a1fb488e49265f3340b7b
SHA512 299154b2273072f1590514375b2a843914f1274dae112b9e3a15c6f7fa00d42cf0848f78d5364c067ba4a5f5d4ae6e955549d9c83f0c9fac2c7d51cdb0bf97c1
TLSH
T104D0A7D468A8677D88280F4AB0A179D730858C372474A910DF714574D9FEAC58251857
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\extensions.json
Size 16KB
SHA256 56928c5b359fbca9663a57a2e499b599f1110db1cd9925178d1e7da836339b89
MD5 58c033da0388c84c24e094bf9a243673
SHA1 9b1c27128a9afd6977ce2caee130da12bb72b6bf
SHA512 c8305c5f53fbbc9cdf320bd931981ea7378050c18cb67b2bdcbb020c8e8a44b786c021d56fcf3e47f71adaeb3aff83aeba1edd1f9b96f6dc6041d929c78800b2
SSDEEP 384:skI4vGUmldvU8dhW694zI96ohL4H5L4PPL4H1L4HDL4HOH4hW:jI4ORfNXr4o6q4R474V4P4k4g
TLSH
T17372421545048EB8298F979BAA367E01C37D473B60845C78F4DD8FC842FA5B902BBA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs-1.js
Size 12KB
SHA256 736984e23d76e24b492944bfc13cfe8ee0afdae621c4b2d43c3115197d21bc17
MD5 9d48d354dd9b318b6e5bb52f96e4fc8d
SHA1 8436d9007e62422dc1c997b73559a0586058fc71
SHA512 09ffd6ef80b75d33bda6ebde161709d7abf03424bbc5fe05b7eb9e0dcb3910453cdb726193f79d0443fee0817fca8b64fbf9536ddb98a7619b510d87c14e49d7
SSDEEP 192:KqRwf4W9Bs0SSGVTLRk2DvJmBw88gQsz8Jdm+:MClRZiwAeX
TLSH
T18842BC385544CB7F24B2327DAC6A4AF119A24127B6BFBCD705F984C1048CF7941E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs-1.js
Size 8KB
SHA256 ae77f3615c03f93bfc9b3a4a83797d758d91f31a539fcffffd91fa0fee1a5cc3
MD5 2d6458a1dd5475c777d02204587e2b3d
SHA1 8ab9c7d0cd64941e177cf2cde83689d92e2359dd
SHA512 7fad2387eb31feac626e5224eaa86840613ac5b7e9a133a27e13c47d85c7ff3c8e90ccbb43bf92d2fd7a718c4fc81ef756d95f2c37b538c88a076cc306bb82d2
SSDEEP 96:xHDNTU0qGqwf4W9BsObzS+SSl8pdv9jD9n1lWRUaM25YApxBw88bUg8L4cnMV81t:NqRwf4W9Bs0SSGVQRk2DHBw88AEyv
TLSH
T1FC020F785504CB7F74B2776CAC6989705AB2013BB7BF68C710BA4485054CF3845FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs.js
Size 6KB
SHA256 a4a8f7d637722a39fe12419ffda642397c30b9cb92ff6c579eb8466ab08b0288
MD5 bbfffeda57b688fcf10c73f96a950d1a
SHA1 38b9182a86a5ea779865de1fb47afbdf8d5e552e
SHA512 5dfe4342ac5954472251bfa443a690f4f69d3c2c05442edde9a68310e8e4f9cd13a7c91dc2f1931bd4fbea4061705d5af287f0ae667a6b69485ac5ee82b27917
SSDEEP 96:xHDUTU0qGqwfCjKjGnj8ObzSpDAiSSl8pdv9jKn1lHQ25YAp+Bw88n8L4cnMV81t:NXRwfCjFgPDAiSSG+ZQ2DEBw88lyv
TLSH
T149E130789408CB7F64B27B6CAC688C716AB2413BB7BF68C710B54484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs.js
Size 6KB
SHA256 dac1786c7396e5ee5dac8ea3854c21cf0b1d73f3dfbd435733c462f3c0c0dda3
MD5 335fd2ab16fe8f5ab207be2ff275c8ea
SHA1 27813113c54b6db74ae2654a4a19a2f5df445e5a
SHA512 c31b8b02e49c3b78402cd1e5edcfb22be524746c7e102004773695a9e042760710925ba6a26c51c4c41be8381162f7f34505512f1e072b14bdebf5e36e634674
SSDEEP 96:xHDUTU0qGqwfCjBsObzS+SSl8pdv9jKn1lHQ25YAp+Bw88n8L4cnMV81t:NXRwfCjBs0SSG+ZQ2DEBw88lyv
TLSH
T1A3E130789508CB7F64B6776CAC6889316AB2413BB7BF68C750B94484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionstore-backups\recovery.baklz4
Size 292B
SHA256 1fcbe37adfc7df4f50e46a76f0f4fa0aec1dd45ef5203591e97c335fa345b802
MD5 ca419705f3ca9aff0368abb5b1f24f4f
SHA1 9ad9d0c6921df091402a60cff3dbf55cfd6adf7e
SHA512 7c4c777e5ffa473c90584c46b694a04b0405361ab11492a8afa75f37824537cc1523114bb9af81dff06702c48d1795dca160166e12b8c7ecc23179c9a7e7b0a1
TLSH
T1ABE0EB08BA58C0722BA2824F800723F3CBD0218442AC0988AC3CA7CA0FBD0CF724B143
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 76d510b48990d45e3034d31be9cf48aa5b0aed2ec46a55efecd13bf2b85e718c
MD5 a8257f8dfb4e664a975a6be60e4e8317
SHA1 f84e5a273222794afeeacf876d6d89dcc5906073
SHA512 1521efcfc676d59d48e9397ea36f91d375f4c2f2d69880dffbdf00ff4cea2e42eae95ee80d2a61ef5ed390bb3304b235afd7810c5218940ce04cc0694d58c77a
TLSH
T14C21F917C86B1EF13BA1A282C0CE9FF6C3553072897904F040E99A8AA1DE71D37C6929
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 d05574938cb3de661238c3f3d0a734472fb88a3b1de7d39364b139a69321ff5f
MD5 f9f8de36f7bfa50a3e9d56efb12e8afc
SHA1 cb3b514b2727c9526c13e91ad13232eebd722ed8
SHA512 0da1a8c1f9f47251fe3daafa8199868b2f1ee2761c9925d99be54c1a704b7cd5b760e2881aee89d31db19075cb8df4ec27e8542880c1d45737ddfc9d0d52bd3c
TLSH
T11F21DA4AFD0F1CF23245D1C7C0CA5BE8E751F052862C65F0D8E46A8141D4A4A31DE705
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5128-13-0x000001E723380000-0x000001E7233F6000-memory.dmp

Download

memory/5128-84-0x000001E70A680000-0x000001E70A68C000-memory.dmp

Download

memory/5128-3-0x000001E70A7C0000-0x000001E70A7D0000-memory.dmp

Download

memory/5128-2-0x000001E70A7C0000-0x000001E70A7D0000-memory.dmp

Download

memory/5128-4-0x000001E722DF0000-0x000001E722E12000-memory.dmp

Download

memory/5128-12-0x000001E7232B0000-0x000001E7232F4000-memory.dmp

Download

memory/6408-776-0x0000020CA1DB0000-0x0000020CA1DCE000-memory.dmp

Download

memory/6408-864-0x0000020CA1DD0000-0x0000020CA1DF5000-memory.dmp

Download

memory/6408-777-0x0000020CA1DD0000-0x0000020CA1DF5000-memory.dmp

Download

memory/6408-771-0x0000020CA1BF0000-0x0000020CA1BF2000-memory.dmp

Download

memory/6408-775-0x0000020CA1DB0000-0x0000020CA1DCE000-memory.dmp

Download

memory/6408-773-0x0000020CA1DB0000-0x0000020CA1DCE000-memory.dmp

Download

memory/6412-890-0x0000020438F60000-0x0000020438F85000-memory.dmp

Download

memory/6412-821-0x0000020438F60000-0x0000020438F85000-memory.dmp

Download