ac2dfd4519b1b8a229335e4d6f27a39400cc9e55d387958f58d17cbe2167dc11

Analysis

user interaction
yes
max time kernel
181s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20260421-02741.js
Size 360KB
Sample260511-plefpshy6y
SHA256 ac2dfd4519b1b8a229335e4d6f27a39400cc9e55d387958f58d17cbe2167dc11
MD5 0ea192e3607b83e9b97fda2e2304f39f
SHA1 e641f9c5cbf7eeea5580417376e7cfea93d2b556
SHA512 9dc6b79f29913abea76b2c61af594a091c1afb6a09165f408bf0cb22c51271ea1db2328bf7ac68210d09821982f1b7b5484a3a369f044e19549b86b5514a803e
SSDEEP 6144:zNdWzVrrxjNveevD4+OW266aWh5jEE81MjUTyF5Z+QqGXB3jVts0IvZoESznhx26:zNcfz5zq52MwsZfqWQuEwi6
TLSH
T107743970CA2002774F87AB9CFCA50661C66DC315867B45F0E6DA870D900A9ECF77D66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware execution persistence spyware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3360	wscript.exe
8	4980	powershell.exe
44	4980	powershell.exe
44	4980	powershell.exe
54	4980	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	explorer.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2532	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4980	powershell.exe
4980	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4360	firefox.exe
Token: SeDebugPrivilege	4360	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe
4360	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	explorer.exe
2532	explorer.exe
4360	firefox.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 4220	3360	wscript.exe	86
PID 2532 wrote to memory of 4980	2532	explorer.exe	89
PID 2428 wrote to memory of 4360	2428	firefox.exe	104
PID 2428 wrote to memory of 4360	2428	firefox.exe	104
PID 4360 wrote to memory of 1652	4360	firefox.exe	105
PID 4360 wrote to memory of 1652	4360	firefox.exe	105
PID 4360 wrote to memory of 1652	4360	firefox.exe	105
PID 4360 wrote to memory of 1348	4360	firefox.exe	106
PID 4360 wrote to memory of 1348	4360	firefox.exe	106
PID 4360 wrote to memory of 1348	4360	firefox.exe	106
PID 4360 wrote to memory of 1348	4360	firefox.exe	106
PID 4360 wrote to memory of 4748	4360	firefox.exe	107
PID 4360 wrote to memory of 4748	4360	firefox.exe	107
PID 4360 wrote to memory of 4748	4360	firefox.exe	107
PID 4360 wrote to memory of 4748	4360	firefox.exe	107
PID 4360 wrote to memory of 3840	4360	firefox.exe	108
PID 4360 wrote to memory of 3840	4360	firefox.exe	108
PID 4360 wrote to memory of 3840	4360	firefox.exe	108
PID 4360 wrote to memory of 176	4360	firefox.exe	109
PID 4360 wrote to memory of 176	4360	firefox.exe	109
PID 4360 wrote to memory of 176	4360	firefox.exe	109
PID 4360 wrote to memory of 176	4360	firefox.exe	109
PID 4360 wrote to memory of 2932	4360	firefox.exe	110
PID 4360 wrote to memory of 2932	4360	firefox.exe	110
PID 4360 wrote to memory of 2932	4360	firefox.exe	110
PID 4360 wrote to memory of 2932	4360	firefox.exe	110
PID 4360 wrote to memory of 4388	4360	firefox.exe	111
PID 4360 wrote to memory of 4388	4360	firefox.exe	111
PID 4360 wrote to memory of 4388	4360	firefox.exe	111
PID 4360 wrote to memory of 4388	4360	firefox.exe	111
PID 4360 wrote to memory of 1044	4360	firefox.exe	112
PID 4360 wrote to memory of 1044	4360	firefox.exe	112
PID 4360 wrote to memory of 1044	4360	firefox.exe	112
PID 4360 wrote to memory of 1044	4360	firefox.exe	112
PID 4360 wrote to memory of 4144	4360	firefox.exe	113
PID 4360 wrote to memory of 4144	4360	firefox.exe	113
PID 4360 wrote to memory of 4144	4360	firefox.exe	113
PID 4360 wrote to memory of 4144	4360	firefox.exe	113
PID 4360 wrote to memory of 3164	4360	firefox.exe	114
PID 4360 wrote to memory of 3164	4360	firefox.exe	114
PID 4360 wrote to memory of 3164	4360	firefox.exe	114
PID 4360 wrote to memory of 3164	4360	firefox.exe	114
PID 4360 wrote to memory of 852	4360	firefox.exe	115
PID 4360 wrote to memory of 852	4360	firefox.exe	115
PID 4360 wrote to memory of 852	4360	firefox.exe	115
PID 4360 wrote to memory of 852	4360	firefox.exe	115
PID 4360 wrote to memory of 3724	4360	firefox.exe	116
PID 4360 wrote to memory of 3724	4360	firefox.exe	116
PID 4360 wrote to memory of 3724	4360	firefox.exe	116
PID 4360 wrote to memory of 3724	4360	firefox.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\20260421-02741.js
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" Z:\port\can\windows
  2⤵
  - Enumerates connected drives
  PID:4220

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Jemeda=($HOME+'/appdata/roaming/Kibitz');$Berigen=gc $Jemeda;$tangly=$Berigen[3045]+$Berigen[3046]+$Berigen[3047]; .($tangly) $Berigen"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {7beb3700-be85-470e-9f8a-e08f3d3c14de} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {9d22ac66-8804-4e5c-8c2f-0577a30c05a9} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:1348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 27276 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {2cd65571-930d-45f5-b0ac-3a689af29884} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3888 -prefsLen 27276 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {e7159a05-e5c7-486b-b526-3ebd740e80b3} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2828 -prefsLen 34775 -prefMapHandle 2684 -prefMapSize 270279 -jsInitHandle 2688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1652 -initialChannelId {69844cfb-3bfb-44ed-bfef-b6c59031b6c8} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 35012 -prefMapHandle 2744 -prefMapSize 270279 -ipcHandle 4896 -initialChannelId {236dc997-5f3a-4040-83b5-a28fc2a56718} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32900 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {04bbf787-4f89-4ab9-badd-b566ce395ea7} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32900 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {9fe643e7-3242-4b81-b49a-1e5ecf169a91} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32952 -prefMapHandle 5556 -prefMapSize 270279 -jsInitHandle 5560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5568 -initialChannelId {94de66c9-c3a5-4761-aa76-ca002e5a4b06} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6180 -prefsLen 33031 -prefMapHandle 6184 -prefMapSize 270279 -jsInitHandle 6188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6196 -initialChannelId {23c544e9-7fac-4546-971c-27359ee3f28e} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6856 -prefsLen 35143 -prefMapHandle 6860 -prefMapSize 270279 -ipcHandle 6852 -initialChannelId {2e3d6431-1467-43ee-b290-d7b0cbb69b51} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6972 -prefsLen 33031 -prefMapHandle 6976 -prefMapSize 270279 -jsInitHandle 6980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6988 -initialChannelId {7f9b982d-a01a-436c-a569-852c5d68dc4e} -parentPid 4360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_rpdlz1kn.kif.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpdlz1kn.kif.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\AlternateServices.bin
Size 8KB
SHA256 0be914f5a302652b651ba2331b3fc79dfd511148bd4c55e376b5b4643b247e4a
MD5 aac54cef038507bb7adedc420c0d4e67
SHA1 7eacdb5e4394df3e35e22d103d814ff4d7ed5b6c
SHA512 d7521d8dd76aeffd666e4ef8f2eb99d55f67ec63f740804969e24cfbe33e06ddf3bdc9a124e9a238d0694e24fc817beafdb92a482bd1dde5cd007a39fb022c88
SSDEEP 48:tebOJSb2gbgzAbDbvbObGbxYbXK9bDbfb:tebOJSb2gbgzAbDbvbObGbibabDbfb
TLSH
T1BB028FFB0B765452F2635FF890A878CC8C33522D58E9C1A48A14D09317F9BD5D0BAB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 9d54dfaba737fae827c65791e5ad04b03bfd23b0754b65349c12cc12c6965278
MD5 d3ca75ee4e6c17c2a4516a882c7979a8
SHA1 44d77905946a1687028e8f5f75ae8996718041c7
SHA512 34ab577861a8ea804123c8c60d063a7d4fab57ca999520e9b720a3c69429cc0e56f85564e7a309fcc25eb80fa32d587d8aecbbfecd2b6f281015aa55dfb731be
TLSH
T18561C858F228863FE045513ACC961B412F347456A8AF7F2A39ACA08C1E1B2CE76CD07D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5a8ead86b0c7320f661c82ae5e2ead18a56ecd875fc87ff68abcae970f7dbbfb
MD5 ae5caa9ef031f6df7c24820f229e3112
SHA1 f2490d61b296ee7a06113645d5979a9747d0c573
SHA512 f2e22a7612272bbe551dc38bf134eba230b16e9c96e4a4da9331378b4dbf575a2fea87c7235d625d268fd21fff693d78bc7a8b5d75343b12e7b23752483809d1
SSDEEP 192:KG1d66JozGzgCl6mc0dNOv5zbowb8Fyje6m:hd66JozGzgC1jobowb8FyjX
TLSH
T1FBD14FA5EA28463FC444127BCCA52F014F39395BE88E3F1935EC658C2C5B29E768D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9bebcdfb25844095e468f3f97eafda0597695bb38785b559dfb3eb13a2c46a5e
MD5 b459bbcada680f3424d02d72944bb773
SHA1 dfdabc2dabd221dc1e79371e1409fe39a3eba7c2
SHA512 cf03cacd0b5dd4ebc643dae95d8041d9fa4558f82c53ebd569dba176417a157ccd8f0e0c88d1baac09639f455da878ae7027f8806aba8f394b953fca3d0a66ef
SSDEEP 192:bOv5zbo4Z8Fyje6mjG1d66JozGzgCl6mc0dz:Ebo4Z8FyjXrd66JozGzgC1jd
TLSH
T124E12EA4E628863FC055127BCCA12F404F39399BD88E3F1935AC659C2C572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8f7f1c4ca8fa32c8e4b5fe764df2bb10c21322a8594c5c38de346635e53dadb8
MD5 a01a780c5d6fa232be529e25effd1965
SHA1 ff3f42adafc4f2d9efc33d3f1a63cf825a206e05
SHA512 bb09d70030d83359cc92f89553824fc3f6c6fdded7c5b3e9213ee35f08670510dda2b895d15cf3523b5df81a57805ed36ac3bbdeeeee091d91af96ff23b1cb38
TLSH
T13211609C75B94DDA9A9BE2ACB49102CD53614E0204871C434D23DE8CCE94AD932E943D
MD5 SHA1 SHA512 TLSH

Submit Download

136229b2-8d3b-4955-b5ef-89a741d9993d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\136229b2-8d3b-4955-b5ef-89a741d9993d
Size 235B
SHA256 0b33de549dc4f7681e6c8423dca5a343304a123a9bce681cbf9b1e5feec3d444
MD5 e62933b6fee591be1585413b52b57f9b
SHA1 4e787dd74a0c94cbe9f5b9a4d1d302a6cb14bf7a
SHA512 b299c710a3c88c0c6194200e918c64147f4b476ba13109ddcb153d18d07383fcdd8df406568b3482b9b3ccd1df70aa6ab441d00c531f3b07d48dbae327f8536a
TLSH
T168D0978058E8A7AC48001F43B0E13AC630944C33387168A4999204B4CEF9DCC015190A
MD5 SHA1 SHA512 TLSH

Submit Download

21a029d6-ef8d-4ded-9f8c-f04623482b4d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\21a029d6-ef8d-4ded-9f8c-f04623482b4d
Size 235B
SHA256 8b4c0d6f3fb69a5133e07411968d7d37b0a238c27e2d98ea67ed8be0cc01f4d4
MD5 f5124eaacff7ff3980e4784b6b54ece0
SHA1 92a18386ab37df10b1ec173ae2924c3cf83fa615
SHA512 5609b376ebb40a6c0d5e91aa439ff67bb952d947a63ef1ec98cfe122ff84c1003fb797f614f40cbe89807b6fac18fedad8aa7d65b84e7d41cdcc3e6fa36ef769
TLSH
T1E9D097A42C8D272C1C240F13B4F079C2308C4C33A0B4A860CA90017489BAAC88221867
MD5 SHA1 SHA512 TLSH

Submit Download

66fcb220-8725-4288-bfaa-1ed789d34573

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\66fcb220-8725-4288-bfaa-1ed789d34573
Size 16KB
SHA256 3d9fc3605f1fbc923c9f7e306163229a083072dc327cb36347b34a2f0c978a4c
MD5 7200ce74bfa2c5382ed0fe9f979431d6
SHA1 341a0b5b7bf3bda008626aace43ec40750ab735f
SHA512 3a04ea4ca17070f47cd40506c1196b13abc460b76d88a54fa434d181068961311f9ab5150f83745c3fd512839bad10373996dfc7694a8f6d46d7f455fa79e840
SSDEEP 192:5tG81nmsUzS5R73cr57SdYy3XCna5oEdoxOMYW/02+AqJrTV8/BOnCdjg1Vu2jed:/QTnae3xOMYW82+An/KCHN7+LRiYKJ
TLSH
T1B272D956586049BA8291E3A894FC7FC3E6F528CF4C028FC997E4BD086DDF06E512794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

773f3901-be38-4f2f-830f-781a192e53fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\773f3901-be38-4f2f-830f-781a192e53fa
Size 2KB
SHA256 5b919f1dae41544816d490fa30bf7d0ee580830f9b41a2e6b9b4d65c8ea31d17
MD5 0670965f1b3335af7700698de60d2317
SHA1 edcf1f15454680ad7c03bf65485f137ba35382cc
SHA512 a93729fe84522ba95651ac75efbc6ee92b548cd7bd5c54138cc15caa1f6b0cf1134b22a44cdbddae87cf2c145ab25e579b4a0b955bb93d35456e9407930e2688
TLSH
T1CA41219835B85DBA8CDAF19DD082338E57A45A0340C21D832E91CF4C8C9A6E9736E52B
MD5 SHA1 SHA512 TLSH

Submit Download

78d52893-8adf-4b06-9059-0b18fa4e9f85

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\78d52893-8adf-4b06-9059-0b18fa4e9f85
Size 886B
SHA256 36a008e8f61e4966461d136203a126bc5ac0f5ef25cd96623dd26db0f0f8740b
MD5 56efcede10abd4a4b54219c92cd6ba46
SHA1 6bc5f45a11efd5430c4569beaee25e5ff3a27b9b
SHA512 31efb33c256954a86dab380caa5840adaf30ec77aca762a6b253bd7ce51ba933eda97a589b6aae4f3bd5b278c6d3565612e222948672e080815f3c86a11f3a83
TLSH
T14411008285A479728CA8A29B85E4774647E83123C0DA09187EA54F280DBB11FA3AE607
MD5 SHA1 SHA512 TLSH

Submit Download

d5717c5f-e749-4a0c-85a6-44fcef39d887

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\d5717c5f-e749-4a0c-85a6-44fcef39d887
Size 883B
SHA256 2e6793fdf3b2207872b8c76d1128298d525a79f9ddcab4ade26c92876cdaa9d5
MD5 d034272a08e12b50e675b0fb1e2767e3
SHA1 015815cfbacf391a43dcabd22988838b461aa932
SHA512 b20fd909c3d2f727c9e89c22aa28a0605f4ce3567541ac83baa4b59c58285db06f9f096814716e148fcf4bb48f5a7171b234cedabef767520e05748102451184
TLSH
T121110081963475B2CD68E29BC46137064BF87223C0CA44047EA50B180D7B51FA39E20B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 430e7b63f5187a8214c0d8f7497bf05cd5381dd3954a105bb3af009226d76860
MD5 d05d50f0c990f85f19498e8b8fe5c741
SHA1 93d306628313f9e64fa24fbe8554f43fc7385aab
SHA512 4751d143f9122d950c255c27b3a3ecbd2293e1d8528033767afd4885b3b36da24bf6eaefdae97a26635b0b9207c1a2270076ea8c6b5cacf8d6d86cf62a76bbcd
SSDEEP 96:xHJsUTU9qGqvfClKjwnj21zSpbiSSl8pdv9jAnq3RHKG924Bw88n8L4cnA8b1:MwRvfCl36obiSSG79KItBw88ap
TLSH
T166E1FC7891088B7F74B6776CAC648931AAB2013BB7BF68D650BA44C5050CF3445E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 fee00b29ba551d70a814dda638189ef425501eef4a9ca37dbe589b25d0e9def5
MD5 119c78c4eb83a5bb3c8549fddf989b1a
SHA1 bebfb77cc4ae8253a08256e2dbe7c19a86685003
SHA512 370050090f513c8c68024f5689001beae0ee3f40d5008c168c518b155ee4182aa84413996408f82e3f24950ebd7f9a0584930a8633be1342cbd2e4029ed5f9cb
SSDEEP 96:xHJsUTU9qGqvfCl1Ed1zSTSSl8pdv9jAnq3RHKG924Bw88n8L4cnA8b1:MwRvfCl10WSSG79KItBw88ap
TLSH
T162E11F7891088B7F78B6776CAC6489719AB2013BB7BF68D710BA44C5011CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{bd4a6892-ac63-431a-9a84-64659c45b81c}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\default\https+++www.youtube.com\cache\morgue\28\{bd4a6892-ac63-431a-9a84-64659c45b81c}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
TLSH
T113C0225846A8EE3620A3CB3CC827E2820A3B831000498484E6F94A540C8BE850129A01
MD5 SHA1 SHA512 TLSH

Submit Download

1953866332yCt7-%iCd7b%-7per0edf.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\default\https+++www.youtube.com\idb\1953866332yCt7-%iCd7b%-7per0edf.sqlite
Size 48KB
SHA256 6c0038ad673006e0c4f5e3f06af6671b6e5662c01373f5ad58c024bc86dc9f14
MD5 4d6d14533d1358428bbf3ce3f140ade1
SHA1 b9d76c475f6a877a965a8a8796262389d25f8a64
SHA512 2b305e56894bfa160bac54e353d746e3b382a8537fdf572ed3f9e4d7ffaf9472b15fafddee4dca677df948e97a29c4e15d29fb4ee3ff834b33311ce27fe00285
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEJ:Oa16S6CKnqlizbxV+2xVeU7X2B0J
TLSH
T189236F8E3F07F511C53AF0B178A08D52B85E321D17222AD57990DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kibitz

Path C:\Users\Admin\appdata\roaming\Kibitz
Size 3KB
SHA256 2458b8a84f30b12c7596f9df8d8db78ee3cc9a2a4017421ec837b2a284b9f0b9
MD5 7977e61b8dcc135c7b31fca6006371d6
SHA1 6558dab61412529cb4bfd858e0762716bb33c1d9
SHA512 6e31cb96a1152b79ab7cc846896ad402b351030ad1ba6b967712ce89ba20780d1a2e3b1378f641633a6d11392e63d25c1475ddb6d381ad84b0b1eef4c37c46dc
TLSH
T10E51E88E4B3C3CBF6EB08173A11559089C3AC6B50E01EF0B933DE29616768951E5DCCD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2532-17-0x0000000001330000-0x000000000139B000-memory.dmp

Download

memory/3360-16-0x0000028013CB0000-0x0000028013CBC000-memory.dmp

Download

memory/3360-15-0x0000028014110000-0x00000280141BD000-memory.dmp

Download

memory/4220-4-0x0000000000D10000-0x0000000000D7B000-memory.dmp

Download

memory/4980-18-0x0000028F8ECC0000-0x0000028F8ECCC000-memory.dmp

Download

memory/4980-19-0x0000028FA7400000-0x0000028FA74AD000-memory.dmp

Download

memory/4980-11-0x0000028FA7380000-0x0000028FA73A2000-memory.dmp

Download