81eae13027d3a8f1236d7429f7d40360237c70af649296d5e3a095a0269d06c2

Resubmissions

02/05/2026, 22:20

260502-19j7mscs8l6

02/05/2026, 22:01

260502-1xjekscs4k3

02/05/2026, 21:58

260502-1vphtacs3k3

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CONVOCACIÓN (ANSP).pdf
Size 283KB
Sample260502-19j7mscs8l
SHA256 81eae13027d3a8f1236d7429f7d40360237c70af649296d5e3a095a0269d06c2
MD5 21b43b96c47a98a720904055360dcf1f
SHA1 f373c1d459672524923d9a2889492f440f80a921
SHA512 2d2ff1fc58c0d89a67e8710953d35c4607b2af2c63d44b364297b722a95268c8b670c04a68f6073bf4ca460ec0c41ea941d98dc66d14a4f459f008c9b29617a2
SSDEEP 6144:WL77Cj1nnm5MNmNbs54f/ywBSUu+hERdH1nTK0ygVCDUiGot5w:WnejOsC6wkN+0Pvzk+
TLSH
T19C5412028A8878CCFD1241706F4B5816876E357136C6D4407DED898FC3A9F4ADE9B6E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware google discovery persistence phishing spyware

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
41	5868	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe
Token: SeDebugPrivilege	5868	firefox.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2820	AcroRd32.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe
5868	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
2820	AcroRd32.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5132	OpenWith.exe
5868	firefox.exe
2820	AcroRd32.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 5264	2820	AcroRd32.exe	79
PID 5264 wrote to memory of 5048	5264	RdrCEF.exe	80
PID 5264 wrote to memory of 5084	5264	RdrCEF.exe	81
PID 5264 wrote to memory of 5084	5264	RdrCEF.exe	81
PID 5264 wrote to memory of 2296	5264	RdrCEF.exe	82
PID 5264 wrote to memory of 2460	5264	RdrCEF.exe	83
PID 5264 wrote to memory of 2460	5264	RdrCEF.exe	83
PID 5264 wrote to memory of 3404	5264	RdrCEF.exe	84
PID 5264 wrote to memory of 916	5264	RdrCEF.exe	85
PID 5132 wrote to memory of 2092	5132	OpenWith.exe	88
PID 2092 wrote to memory of 5868	2092	firefox.exe	89
PID 2092 wrote to memory of 5868	2092	firefox.exe	89
PID 5868 wrote to memory of 3028	5868	firefox.exe	90
PID 5868 wrote to memory of 3028	5868	firefox.exe	90
PID 5868 wrote to memory of 3028	5868	firefox.exe	90
PID 5868 wrote to memory of 3564	5868	firefox.exe	91
PID 5868 wrote to memory of 3564	5868	firefox.exe	91
PID 5868 wrote to memory of 3564	5868	firefox.exe	91
PID 5868 wrote to memory of 3564	5868	firefox.exe	91
PID 5868 wrote to memory of 2656	5868	firefox.exe	92
PID 5868 wrote to memory of 2656	5868	firefox.exe	92
PID 5868 wrote to memory of 2656	5868	firefox.exe	92
PID 5868 wrote to memory of 2656	5868	firefox.exe	92
PID 5868 wrote to memory of 1224	5868	firefox.exe	93
PID 5868 wrote to memory of 1224	5868	firefox.exe	93
PID 5868 wrote to memory of 1224	5868	firefox.exe	93
PID 5868 wrote to memory of 1212	5868	firefox.exe	94
PID 5868 wrote to memory of 1212	5868	firefox.exe	94
PID 5868 wrote to memory of 1212	5868	firefox.exe	94
PID 5868 wrote to memory of 1212	5868	firefox.exe	94
PID 5868 wrote to memory of 2728	5868	firefox.exe	95
PID 5868 wrote to memory of 2728	5868	firefox.exe	95
PID 5868 wrote to memory of 2728	5868	firefox.exe	95
PID 5868 wrote to memory of 2728	5868	firefox.exe	95
PID 5868 wrote to memory of 3960	5868	firefox.exe	96
PID 5868 wrote to memory of 3960	5868	firefox.exe	96
PID 5868 wrote to memory of 3960	5868	firefox.exe	96
PID 5868 wrote to memory of 3960	5868	firefox.exe	96
PID 5868 wrote to memory of 916	5868	firefox.exe	97
PID 5868 wrote to memory of 916	5868	firefox.exe	97
PID 5868 wrote to memory of 916	5868	firefox.exe	97
PID 5868 wrote to memory of 916	5868	firefox.exe	97
PID 5868 wrote to memory of 5900	5868	firefox.exe	98
PID 5868 wrote to memory of 5900	5868	firefox.exe	98
PID 5868 wrote to memory of 5900	5868	firefox.exe	98
PID 5868 wrote to memory of 5900	5868	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CONVOCACIÓN (ANSP).pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=93147B9F9155C7B9896F74C23DCC9A9D --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=68AE7FD797A68A3C6AFD9D53F15D1A6F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=68AE7FD797A68A3C6AFD9D53F15D1A6F --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=81899DC1813441D51A38674AE16DA940 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D868485091DCAABE80E551CEEE8D6D11 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D868485091DCAABE80E551CEEE8D6D11 --renderer-client-id=5 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2460
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=731B59D12333D91B639246869559E6C8 --mojo-platform-channel-handle=1960 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3ED6322B90332A7A703E1E5AC83A11AD --mojo-platform-channel-handle=2796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "mailto:[email protected]"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url mailto:[email protected]
    3⤵
    - Drops desktop.ini file(s)
    - Detected potential entity reuse from brand GOOGLE.
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27097 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {69eefeea-f217-46a2-9055-4caf8ceb8aa7} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2312 -prefsLen 27133 -prefMapHandle 2364 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {7f16b48d-d26c-4606-8089-e2ceecd0388b} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 25164 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {7254bd82-7bc9-4f41-a736-dc3cfe3ff03f} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27274 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {6f42034b-8f07-40cd-bca7-3a2366b9b570} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4544 -prefsLen 34773 -prefMapHandle 4548 -prefMapSize 270279 -jsInitHandle 4552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2916 -initialChannelId {4017e0be-86d9-4748-85d9-620919b677f9} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:1212
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2812 -prefsLen 35010 -prefMapHandle 2816 -prefMapSize 270279 -ipcHandle 1280 -initialChannelId {8961ee5b-5594-4334-8aa3-441bfddb3f25} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1276 -prefsLen 32900 -prefMapHandle 3204 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {afcac3e8-5815-4bbc-89e7-9942e7be8f13} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3960
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32900 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {a15ac30c-fc9e-4fe2-9046-db1f3860dcfc} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32900 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {99f66f1e-ac1a-4812-8259-6317c47edef7} -parentPid 5868 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5868" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 e17146276e98588765860724581f663990d7729a9db7a2889baa2cbb8b4f477c
MD5 7a277784f752a2f4d1128aab63bf0346
SHA1 71aa6d1f37d4dcc1b04c98b3193150148a5b4521
SHA512 6f41b81e2675c8cad3c186e930e0dcf8bbc28873e18bf9cc22d0494f9ffbfc8f8171536f2b97a3189b70dbd8089c333cb1ed69000e5ab9c361d27ce46d2879a9
SSDEEP 384:ye6dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:p+eUZsLQCZsL3hUS4
TLSH
T12D53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 6fc336c6c0eddacd923bbef938e460be34070939f8d0b440d69105d193ad6601
MD5 f58082ce598a3798a082c8d2377f7188
SHA1 555a92e529ba94a48e905d7859ed3fccbe22fb49
SHA512 db7f754668363c277b71b0f4f883246a6030929beccc723b447fcf4c2de24a8ec14651180d5b8f86328df0ede6f8ef8c03ba4f79d4e0455ce531b600b239d6e2
SSDEEP 384:HHMO0iO024YiFuhw+5EL1pPsac4j0lpDII+OrOcrO9:nrZYiFuK+5EB9sac4ID8LP
TLSH
T102527D7D5F1238BA1A27D184D8EE5214CE04E6BBEFE2D06216543C45C684778B8F54DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a85199192b339672408b285113bd40faafe6ecd70926b9f19d4cc0e4eb46902b
MD5 3f84e00f865eff4fd2dd322c2a7233cf
SHA1 3079b1edaf470602a7795a8e4c3b3b982523bc20
SHA512 b9244962e85ba5c22895f036938bb6a0e8eb3a7c8de378c5243748cb10a28658dea67452a9abe246cfc681ae20891cd6d55adc5bd4d4f64691ae7444324e60cc
SSDEEP 192:Lb1d66Joz0dzgCl6mc0dzOv5zboH4Z4myjH6mQ:LZd66JozQzgC1juboYZ4myjaz
TLSH
T1AFE1FE64F638863FC408437BCDA61B404F39399AD84E3F29359D610C2D5A2DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 85355e947cc3a04ea44726ff0fa366a90e88145b4cac204b0fc206f27c0f69ca
MD5 b8b842091eaf4b87962636971199f3c5
SHA1 774ed87acc24024db2c348f1ae2d1a2d85e29d2a
SHA512 1cef31cce35066e3ce68319be0be4126d50d460ddc37647190c22d0da100d6b15419e3dd44626c216d778d4fc63f16a06e8d220cc84ab85bbcb958f62ab2e921
SSDEEP 96:cjSdF95/7bkW6QXjrcE4gjyUR62WZjFG2FcFiAFDFW/dd66Joz0dzgClKtmc0d/U:MOv5zboob4myjxZb1d66Joz0dzgCl6m5
TLSH
T108C1E024F638863FC408423BCCA65B500F36395AD89E3F2935DC640D2D5A2DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 113321c271a6b2193888c4f5a2c5060cb465d21ca760ad6b1e563edcb49770f5
MD5 bdeb4fb2ac88b72fcced4e58376062ba
SHA1 fd4d2f068fa4b4f3e3903cba5ca5c6fa12cd150c
SHA512 ffbe2234439a125496b8dc4936886855cf8cd4be2edcf620a9512785649c29c7e8bbc3534ff8a1da847546eee0a05e76f15c0be2ae27fe3f1c9fe52625cedc0e
SSDEEP 192:oOv5zboZb4myjxZb1d66Joz0dzgCl6mc0dz:TboZb4myjnZd66JozQzgC1jd
TLSH
T1C6D1F124F638863FD418423BCDA65B500F36395AD88E3F2935DC640C2D5A2DE7A9D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 42KB
SHA256 d815ef14b83a4ac4b88871aa78251154bd077934188508e09381d72a576fbaea
MD5 389cb919069eab527c2d5e4376d52eac
SHA1 ebc4180b203a7fec79c3dc06fa220bf7f5693f92
SHA512 39ab2a279c5e4b874163e5d37f7fc70117c6cf2b6c30f40234b08ae820cb3f89454cf07d9c32ba4d16dc3ffe890f14aa673e950b152330b6b9da847b8189d2c7
SSDEEP 768:xP/j2Cj56GcphunM6uKiH07tn8UpEw1bIbnb3bYbSbMbcb6bbI7CKZZlYOWm/:lj2CW6uYI7CKZZlYOB
TLSH
T130130044EB2E913FD82812BADCA607002F79F88959192F673A5D64786C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 42KB
SHA256 7cc2d70feea00ba25e5b2f309462267e963b882435ebd62a72e3f7172f3828c4
MD5 77ebea947c3cd4f5a0949e7c7ac327d6
SHA1 9ec7a94a3cd0bb52dc62a7a09c09bd20265e06ca
SHA512 8f7ec99b3a6c059501ba9c06709e568afc37fd0f1613560592c34e99ede625b99f26b10362cc13625251b7aae5add464482c823876ec3cf6cd008299d30a81cd
SSDEEP 768:LWmQP/j2Cj56GcphunM6uKiH07tn8UpEw1bIbnb3bYbSbMbcb6bbI7CKZZlY1:LOj2CW6uYI7CKZZlY1
TLSH
T1E8130044EB2E913FD82812BADCA607002F79F88959192F673A5D64786C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 42KB
SHA256 b6751ad0aec98c57668bf1e989ddd384c0ca9dc09a5e2e15051ab82520a74577
MD5 160d6050d22ec8241eec9a7dac6a6fb0
SHA1 1bc4f77d31cddc39b83e8aae3986b89e3536a618
SHA512 3c9896f170a05a9fe815d0de3a6a28e86c0f1ee5a5f41d6f3647d2882fc12c6936c9622f3cafca2a3fb2b720b3220969cf2a95614c005f307c77b5077181c58d
SSDEEP 768:gjrHu56Gcphunj7hKiH07K/n8UpEBibIbnb3bjbSbMbcb6bbI7CKZZlYOWmQPH:gjrHm7hhqI7CKZZlYO0
TLSH
T13E130044EB2E913FD42812BADCA607002F79F889591A2F673A5D64786C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\events\events
Size 1KB
SHA256 4c6622bc9c508571d9fb7690c4542be9fbcd8afc7f03f9ab8c7067931d3debda
MD5 6c4a16e1df777bfdd91a67c953b25143
SHA1 87657dac936774fbebf58a71772b8074d1842bd3
SHA512 45ea713e9a85236be3dbe005e0a6cc15f16ed6d8f6f60240351e80d6500586fee0cbb5f56d74bb06389dfe6b180cf049d7c0c4e776cec52cda069273b6cbaad9
TLSH
T1CF21976C3AB84D2A9C9BE29C7445828E93998E074DC72C470D43DF8DCED5A99326E03D
MD5 SHA1 SHA512 TLSH

Submit Download

033a4453-38eb-48e7-878d-919741ad3c4a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\033a4453-38eb-48e7-878d-919741ad3c4a
Size 886B
SHA256 d8b1490cd1351af55df10ff6d173ef3c1b4186c134fd715d912c5ac14f4c2d36
MD5 cf731b9c186a6b4066ad6f5ef49f82eb
SHA1 eb6e6f697941df9d8e1cb2e783e8b6ea204ce570
SHA512 e7a2265d92c4656d778e7e6096a904237fbda0d66ddcf1b4e9d349c9640151c9eeba1248da42d6e011e5e66400b820366bd1991c0d6a6fa28a156f01cad33e06
TLSH
T192114450967075F2CC38D28BD5E6B7414BA47133C0C709087DA146080EAE07A977A70B
MD5 SHA1 SHA512 TLSH

Submit Download

4f8dde1f-64e9-4b63-9a5b-03e553512a36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\4f8dde1f-64e9-4b63-9a5b-03e553512a36
Size 235B
SHA256 3395d745000ab628915c408e92a6c15562361de03d4156bca15766ecc98bb342
MD5 0c319296f0a6229dc97ba3ba6afbe54c
SHA1 2a97f3979498058484b19df61b25f24d24c7358b
SHA512 e23d0c605a1991020c1c687aae6b6ec185fe10dcd124ce18b1c850669d138dfd83ae2a1eb46c4208ce1c35a3de6390c79ff05358e6835239f5637a246e8a8cc0
TLSH
T102D0A7D1649CA76D88144F07F0E0B9D63195CC3364A89860DE554574A9FF9C5429681B
MD5 SHA1 SHA512 TLSH

Submit Download

7cf89082-25ca-45ae-a99f-ced89dfe812d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\7cf89082-25ca-45ae-a99f-ced89dfe812d
Size 235B
SHA256 11645dcdf9dc04d1ff64abeb007f76f45b3353198ae8345edc8dcf032a1567e0
MD5 c0e88c7eac27afdfaf828ff0622ced30
SHA1 74e6fc5ba4b71b337b0f05e17798e39829af0f3e
SHA512 c8a94e9fc90de48780b680d16ee8947da58a56658e315422f410f3202d2de1332ab7dbd779bec48a9a10e0e57f3babc443cab585718d4391bdaf4cafd244d6e5
TLSH
T1F9D0A79138AC679D48294F0BB0E579D630CD8C3354B568109E6545B4ADB9BC5826281E
MD5 SHA1 SHA512 TLSH

Submit Download

899d7f59-72d1-452b-8970-e80717d2e175

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\899d7f59-72d1-452b-8970-e80717d2e175
Size 16KB
SHA256 278e743cee9acb657c218b588ae07aa3d41a5fb58dc2e029a61498cad72a301d
MD5 a5e7c496d43b18db025646ffc6e3f512
SHA1 ebab172b45a8e4312463d6a50996575b3d849a58
SHA512 10eb01fb84b2d5ddb5f46c9212234e40d2da2ca1330a3050abdf0b13f00d2312a45a25ec6b387994faf194209409916da149f580fff22adec1072190949993c6
SSDEEP 192:QSj/gKaGI2UgoRA2sDMEz/t0VX7IlqGav5/ec0KiMk2zxtSeKEqJFm0J4D1GBS2o:zj/gKtIvUKsW/ec0KiMzltSEsc2lf4Sa
TLSH
T10F72E956282049BAC251E36894F9BFC3E6F528CF4C015FCA9BE47D085DDE0AE512798F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a269bf4a-2108-407f-9a32-701a992a32b9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\a269bf4a-2108-407f-9a32-701a992a32b9
Size 883B
SHA256 d6d5132a2544c3c21c2793052dba4daa02e8f475d800edef40368cfb9df5925c
MD5 0946c5ce654d6b0d5234a6d60df90dd8
SHA1 f6ff6dbeaed973b340800b667651d56db58aa695
SHA512 402a74d549be0b04ba71bedde1e110867fc23180a2c109a6e01907033ec556ca7f639f0067fd924bae11ee937a796cb2bc5dee4d4b9d06f75b87629c5f4eb814
TLSH
T10311D0509374B5F5CD38D25EC555774547E87523C0C745182EB146080E6E46BD77A60B
MD5 SHA1 SHA512 TLSH

Submit Download

cab66f43-1981-436f-91ee-caebefeea226

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\cab66f43-1981-436f-91ee-caebefeea226
Size 2KB
SHA256 c51af00340582abd24c602bd63ec9564ffa30d174ac680662969114597bd5481
MD5 b6f593cebfe3c7c0d97011bb1408a9bc
SHA1 0c3049ead0b5f8edefea28d98070e8c08231be67
SHA512 3d55404bb8b3c92979c3fb8e805bc320abc4f66f99fd9b3486eb102617c9d504720e72f269ae58e462eb5ef4456579157941c469991c7411d90571248719e750
TLSH
T18541215C36789DBA8CCEE19DD482338D53A04A1300CA1D436E91DE0CCD8A6DA736E52B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\extensions.json
Size 16KB
SHA256 8531446621456ac6bbccfaaf6a6b99526c7ac6c3c1806bdb933f34cef6dd638c
MD5 c0385ec99897aafc21ad96afb882d793
SHA1 4facde6aacf24b5bed1b6ca8d517f7aa82aa79ca
SHA512 451e848ea97ec19529eef91f7965124f6a3c7c2241aaf2afb8c8caffd5559693ffa73469f18f826f26386fa8ad19d13ed1097fa556bfdd20846011c4ecc58a15
SSDEEP 384:nkI4vrUmldv38dhW294zj96oAL4HNL4PwkL4HgtL4HtL4H4S4hh:kI4TRfEXb4l6R4t4L484N4T4T
TLSH
T10172321545049EB8298F979AAA367E02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 7KB
SHA256 a33aabc0e44b7bc87a06653c69f2feb3285c813453341ce0491037232c8b16af
MD5 c88d4c1a64a53312bce5680ef5113b67
SHA1 fd0c436ccb1909a4b1bb75b10900b58e382edddb
SHA512 4dd24ebdaa981d722a1a7de71fcdb8cac56017316a0e09d113c170e0f5b804ed1d62f4b70f1c0332ef25a3a1987a0e5116ceb7c12ac536454d70c6991a54a94c
SSDEEP 96:xHtjFTUubqGqV9fdbiFObzSnESSlldv9jmncHJRL9I17Bw88J8L4cnfV4O:Pj32RV9fdb6GSSfn5uBw880h
TLSH
T1FBF10E789144CB7F78B676BCAC6888715A72013BBBBF6CD610B94484064CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 8KB
SHA256 9744d6de0c1cfa1b8747ff806e30391ee074fa7b4c772318b638cedf53c1d77c
MD5 bc94ee8e7912543b86c2607345e06d23
SHA1 bf814c13c8722b6ac5ac1c8ce1fc72b29ff02423
SHA512 666481e8949edda7a86c2bae276e67a5b7e40ca61eeb7af0e957b9b2e39927b7bfd6bb96495251f7b41884e6a3fb7d30809ac8bc87d0bdcde224a4d8f5cc3a6b
SSDEEP 96:xHtjFTUubqGqV9fibiFObzSnESSlldv9jmncWRvNtRL9I1P1Bw88Wkc8L4cnfV4O:Pj32RV9fib6GSS+Rl50Bw885h
TLSH
T197020E786044CB7F74B6766CAC688D715A62013BBBBF6CD610B948850A8CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 6KB
SHA256 2068ddd7229e240b25147b5183966e98be829cd588087511ca74a38c0b1d2d30
MD5 34e06866a0b066ce3884b1e646097b3c
SHA1 e872432fbd1149456ff2df5dbb8c080fb2ab8245
SHA512 177b4257229fcdd118b6ab3e6042662fd153546c2c22bce4b051216959833e4ad17e6d9feae9cb3adf79785890f7b24cd368f208adba64325bffce728d0e29b0
SSDEEP 96:xHtjUTUubqGqV9fdKjYnj+1zSYTSSlldv9juncHJRL9I17Bw88H8L4cnfV+O:Pj+2RV9fd7yhTSS3n5uBw88qT
TLSH
T1E4E110789548CB7F74B677AC6C6888315AB2017BB7BF68D750B94484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 6KB
SHA256 4886415554a1decf21e62376b2571e508c9bdc6463284062b14466aaf2cd9876
MD5 160dc64793e563313b999b6f4efeaa81
SHA1 29f553c7f9e42a2f109af837fb17559463892cdb
SHA512 8483d60069cde32402539ca9c2eea478c1b20d510de5d358bbdbc86fbff44a748a4815a00e625b4bfb50b4559fafe00918835572a257d97a4bb2624b9059b298
SSDEEP 96:xHtjUTUubqGqV9fdbiF1zSnESSlldv9jmncHJRL9I17Bw88H8L4cnfV+O:Pj+2RV9fdb6RSSfn5uBw88qT
TLSH
T19CE110789548CB7F74B677AC6C6888315AB2013BB7BF68D750B94484054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 cefb5b72c030995955808392a6b5229bcf8027f07758adc962e24b079807618c
MD5 f206417c3508d26a43c1f3ddfc3eed5c
SHA1 89bc1477083821b9a1647038d2d8c82bf7787e05
SHA512 08ad6211c593e0e247dacab3b57f00f428591098638623221752ac3f7c55aa36bc3d0c0598ba241787ab890bc28a30325ede2149e86e5553aaf71186318313f6
TLSH
T1E721D883D8DB1EF6BF21658DA444AFA9C24A607245746CB080580F076EE9809F7CB139
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 f8dddd240ebd9c251b649ef0cbfbd840f58b3870a5043ad7b8da8b5b5013c648
MD5 75503bd9a1781256567688a7fb41c49b
SHA1 cdcf55e4f78647b2baaf9e74b061293b0c8f09b8
SHA512 addc2449e3ee13c636a359888247a4bb36ce91977029770b063df12a62788b17783e47fbff179d10b4a2911600d9983531e341c25f7f238a741dcf909d2e5ba8
SSDEEP 24576:XCWk+tIYI0Lgrb63BDcYrVQpa9dfH9EQ8lQyjH:Xjv7LO6pcYrVEa9d/9EQ+Qyj
TLSH
T14FF52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-19-0x0000000001AB0000-0x0000000001B4C000-memory.dmp

Download

memory/2296-13-0x0000000000CF0000-0x0000000000D8C000-memory.dmp

Download

memory/2460-34-0x0000000002120000-0x00000000021BC000-memory.dmp

Download

memory/2820-23-0x0000000000AB0000-0x0000000000B4C000-memory.dmp

Download

memory/2820-363-0x0000000000AB0000-0x0000000000B4C000-memory.dmp

Download

memory/2820-447-0x000000000B190000-0x000000000B43B000-memory.dmp

Download

memory/3404-16-0x0000000001EF0000-0x0000000001F8C000-memory.dmp

Download

memory/5048-6-0x0000000001720000-0x00000000017BC000-memory.dmp

Download

memory/5084-33-0x0000000002110000-0x00000000021AC000-memory.dmp

Download

memory/5264-27-0x0000000002670000-0x000000000270C000-memory.dmp

Download