hxxps://doxbin[.]org

Resubmissions

22/05/2026, 15:00

260522-sdlftshs2x6

22/05/2026, 14:59

260522-sc2resey4j3

22/05/2026, 14:58

260522-sb9qmsg15x5

Analysis

user interaction
yes
max time kernel
32s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://doxbin.org
Sample260522-sb9qmsg15x

Score

5^/10

discovery persistence

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	58	https://doxbin.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=9ffcae2648d4ed08	7

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5504	chrome.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5796	chrome.exe
5796	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	firefox.exe
Token: SeDebugPrivilege	1196	firefox.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe
Token: SeShutdownPrivilege	5796	chrome.exe
Token: SeCreatePagefilePrivilege	5796	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe
5796	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe
1196	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1196	2216	firefox.exe	86
PID 2216 wrote to memory of 1196	2216	firefox.exe	86
PID 1196 wrote to memory of 1572	1196	firefox.exe	87
PID 1196 wrote to memory of 1572	1196	firefox.exe	87
PID 1196 wrote to memory of 1572	1196	firefox.exe	87
PID 1196 wrote to memory of 2020	1196	firefox.exe	89
PID 1196 wrote to memory of 2020	1196	firefox.exe	89
PID 1196 wrote to memory of 2020	1196	firefox.exe	89
PID 1196 wrote to memory of 2020	1196	firefox.exe	89
PID 1196 wrote to memory of 4744	1196	firefox.exe	90
PID 1196 wrote to memory of 4744	1196	firefox.exe	90
PID 1196 wrote to memory of 4744	1196	firefox.exe	90
PID 1196 wrote to memory of 4744	1196	firefox.exe	90
PID 1196 wrote to memory of 560	1196	firefox.exe	91
PID 1196 wrote to memory of 560	1196	firefox.exe	91
PID 1196 wrote to memory of 560	1196	firefox.exe	91
PID 1196 wrote to memory of 372	1196	firefox.exe	94
PID 1196 wrote to memory of 372	1196	firefox.exe	94
PID 1196 wrote to memory of 372	1196	firefox.exe	94
PID 1196 wrote to memory of 372	1196	firefox.exe	94
PID 1196 wrote to memory of 3052	1196	firefox.exe	95
PID 1196 wrote to memory of 3052	1196	firefox.exe	95
PID 1196 wrote to memory of 3052	1196	firefox.exe	95
PID 1196 wrote to memory of 3052	1196	firefox.exe	95
PID 1196 wrote to memory of 2372	1196	firefox.exe	96
PID 1196 wrote to memory of 2372	1196	firefox.exe	96
PID 1196 wrote to memory of 2372	1196	firefox.exe	96
PID 1196 wrote to memory of 2372	1196	firefox.exe	96
PID 1196 wrote to memory of 4088	1196	firefox.exe	97
PID 1196 wrote to memory of 4088	1196	firefox.exe	97
PID 1196 wrote to memory of 4088	1196	firefox.exe	97
PID 1196 wrote to memory of 4088	1196	firefox.exe	97
PID 1196 wrote to memory of 1644	1196	firefox.exe	98
PID 1196 wrote to memory of 1644	1196	firefox.exe	98
PID 1196 wrote to memory of 1644	1196	firefox.exe	98
PID 1196 wrote to memory of 1644	1196	firefox.exe	98
PID 1196 wrote to memory of 1476	1196	firefox.exe	106
PID 1196 wrote to memory of 1476	1196	firefox.exe	106
PID 1196 wrote to memory of 1476	1196	firefox.exe	106
PID 1196 wrote to memory of 1476	1196	firefox.exe	106
PID 1196 wrote to memory of 5564	1196	firefox.exe	108
PID 1196 wrote to memory of 5564	1196	firefox.exe	108
PID 1196 wrote to memory of 5564	1196	firefox.exe	108
PID 1196 wrote to memory of 5564	1196	firefox.exe	108
PID 1196 wrote to memory of 5580	1196	firefox.exe	109
PID 1196 wrote to memory of 5580	1196	firefox.exe	109
PID 1196 wrote to memory of 5580	1196	firefox.exe	109
PID 1196 wrote to memory of 5580	1196	firefox.exe	109
PID 1196 wrote to memory of 5852	1196	firefox.exe	110
PID 1196 wrote to memory of 5852	1196	firefox.exe	110
PID 1196 wrote to memory of 5852	1196	firefox.exe	110
PID 1196 wrote to memory of 5852	1196	firefox.exe	110
PID 1196 wrote to memory of 5904	1196	firefox.exe	111
PID 1196 wrote to memory of 5904	1196	firefox.exe	111
PID 1196 wrote to memory of 5904	1196	firefox.exe	111
PID 1196 wrote to memory of 6044	1196	firefox.exe	113
PID 1196 wrote to memory of 6044	1196	firefox.exe	113
PID 1196 wrote to memory of 6044	1196	firefox.exe	113
PID 1196 wrote to memory of 6044	1196	firefox.exe	113
PID 5796 wrote to memory of 2676	5796	chrome.exe	118
PID 5796 wrote to memory of 2772	5796	chrome.exe	119
PID 5796 wrote to memory of 2772	5796	chrome.exe	119
PID 5796 wrote to memory of 5504	5796	chrome.exe	120
PID 5796 wrote to memory of 1584	5796	chrome.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://doxbin.org"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://doxbin.org
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {69e7a7f0-fc58-4f98-97d4-007051d6d005} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {2be3badd-cb4f-4a81-a2c7-90d9fac2d01a} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 25164 -prefMapHandle 3760 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {4920515a-3d18-4717-afaf-80c113b5f207} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27276 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {a855247d-0271-4a16-ba21-40679507dcd9} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4272 -prefsLen 34775 -prefMapHandle 4276 -prefMapSize 270279 -jsInitHandle 4280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4288 -initialChannelId {6a27ae28-d38f-445f-ad96-e1b686d466c3} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4876 -prefsLen 35012 -prefMapHandle 4880 -prefMapSize 270279 -ipcHandle 4820 -initialChannelId {3a827d9b-2c94-420c-82b6-14f930a22638} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5028 -prefsLen 32952 -prefMapHandle 5032 -prefMapSize 270279 -jsInitHandle 5036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {94d2d09b-5882-42a2-850a-3ea63106b740} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 32952 -prefMapHandle 5068 -prefMapSize 270279 -jsInitHandle 5072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {5f7c454d-53f0-4c0e-a787-a3fcc061f63c} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5428 -prefsLen 32952 -prefMapHandle 5432 -prefMapSize 270279 -jsInitHandle 5436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5444 -initialChannelId {7e863cce-f9b8-448c-b804-14237b5ebeea} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5068 -prefsLen 35064 -prefMapHandle 5804 -prefMapSize 270279 -jsInitHandle 1384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2816 -initialChannelId {2392eb2c-77e9-4ae4-9248-a9cdb1223a20} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6624 -prefsLen 33031 -prefMapHandle 6640 -prefMapSize 270279 -jsInitHandle 6692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6688 -initialChannelId {835ad3f4-abf9-476f-a0cd-fe6f351b070a} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6916 -prefsLen 33031 -prefMapHandle 6920 -prefMapSize 270279 -jsInitHandle 6924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6932 -initialChannelId {7f346e2d-2fe0-4eb4-b32b-82bc9e6da4ae} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7468 -prefsLen 35143 -prefMapHandle 7472 -prefMapSize 270279 -ipcHandle 7452 -initialChannelId {ac753d69-14ce-455c-95b6-f67ec24ed7c7} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 7372 -prefsLen 35143 -prefMapHandle 6384 -prefMapSize 270279 -ipcHandle 7380 -initialChannelId {dd18e0e1-732e-49c9-af51-b7fae6c375be} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5156 -prefsLen 33031 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5136 -initialChannelId {6c2d68e9-58e1-4447-8ddc-2d471b3c698e} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:6044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7576 -prefsLen 33561 -prefMapHandle 7164 -prefMapSize 270279 -jsInitHandle 6644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7580 -initialChannelId {87153db7-d391-4e5b-942c-0628a3455851} -parentPid 1196 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1196" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    PID:6832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff536ec728,0x7fff536ec734,0x7fff536ec740
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,322716008375674057,7161942349921106132,262144 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,16350146409574740267,9487338475996713235,524288 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,11160524764284219234,11068935705115923534,524288 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1412 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,8975219548810827648,14727635204029022122,2097152 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,13482231018006990425,14202181884372792122,2097152 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,17722904462428803819,4735623287826632158,2097152 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:6156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,12480160130655493619,4339877577122230066,2097152 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4940,i,273611283951709184,7568257314089840055,2097152 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:6780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,13223777796697066602,5487135714362390614,524288 --field-trial-handle=1996,i,16584068689417852775,1082247454643786343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:7088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 cb2b78c3ba8fbbf52048c33ac60f942267ee1e457e8e8d42f99c54414ac6a70c
MD5 0d01554748bb4696d4ea8a906e6abb61
SHA1 37cab41930efc02f08e863c1ea45d6cba80a2a0e
SHA512 f1ce360161f7a5bd7fad4870e759d8c59dea562ebb75ad8e0294159fcb1ad3fa81ced18dd3293fa7057cc2cf5c427202f706b3ca8f93d350bf32ba11161cbd2c
TLSH
T11EF02DB6D931EC3718FC1B2D20945B46EB5113672750889B3B3C420C8FB167B4585C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 31e828435dfa4caf343d1117a133deaa4423197601dd3234ec4e04577f48df13
MD5 6ffc20ed6f4afdc1293b457a2cb8c1ab
SHA1 3d4b0d941f051082baa8cb5ef55e39e2234e0829
SHA512 a1feee639ad712a9bb668c67a79a85a67c9e835d9f441f033a4674cfbf30017bad821ff09147764abfe5f9d2a4ac71510b174757b545eb84c09378b0efeacca9
SSDEEP 192:bRMmxH984A3nv7ApAPRp2u69qHOyb+WNnYHhgf2WHewkPmGVyIsnAUge:bRMmSvkUXukbQi2RRe
TLSH
T16842A72EE910697FADD7C21AFA667727E7F1203521842EC0EAFC8A1C24E75CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 562f4640ceef36c4f615e712d0f81ec1fef26a825783166bf759298262389d37
MD5 37b98780e6de50dabc6e8f841b05bf66
SHA1 df602c130a0a6ec286522df9c2ad3862367fb1b4
SHA512 cf3741aac81c89b783a2c58398ea16cdf70deb09df5d8cb44493903d5dde377a9d070675d450f66f22077ef3e24f9125e8c0c053ffdbbba8a81952f2439ce100
SSDEEP 3072:ACGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:ym7Rkm1tYpBeh2BAog
TLSH
T120C3023B5E75EC3B5CB5A74EB08E0B1E2EF149A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5bb66437919217999d8f8cff8b62a29a47518eddff384d64b50e4c9bc64a91cb
MD5 5af595862023de2389fd502128520f1f
SHA1 984008c705d518966205e5473e4fa20df99a6c86
SHA512 f47eda67499a145bf88ce6f7584fcdf9f0f979753a03bc502ebcaf052648bcd941131865fb51ad0176164881c8f3adf18e25151b4acf30e6feea3bec63e2a822
SSDEEP 3072:DcPGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:Bm7Rkm1tYpBeh2BAoB
TLSH
T1DCC3023B5DB4E8375DB5AB5EB04E0A1F1EF149B7C920DE9288D85B0433E97CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 6fa4e6ec83e7658aafc7148434ac9f29c6dc965545b66e804c68f4aa82879cfc
MD5 45beed07de9cb7865dd9ee904ae378d1
SHA1 f057ee4f9322895465c2b5e9c2245b99fdb23b47
SHA512 9ad0a4b8a46e8a825354b5abeec7188d7e1c3b3f7a27cde4ea328b534c56b7991df76986034ce0fc708e5ad82ae3b84acba1cdf0a1827dfeacd934a5d172d062
SSDEEP 384:HUr7iO024Ymo6J+Sl1xDnZBPsac4j0lpDII+orLAMzrLAMa:0SZYmo0+Sl7zZlsac4ID8LorFr8
TLSH
T147528DB99F0138B91A27D091D9BE9248CD05E7BBDEE3D05619143C04CA847B9F4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 114cbcb832815e6673351afe01ea23eff1ff60b5e01fa1596bbf62d5b38da503
MD5 41743e4af6780caeb7e2a48273778e5c
SHA1 f4721276c773196d542b752b31adcf30381f6820
SHA512 bc842596532c735744921576c8232170bdef4247c162c8f782ab6554adf35cceec2db27a2fe53c0868123900b36a072f65cf5227169e335c1b9abefbdf4c6da0
SSDEEP 384:HHMO0iO024YVo6J+Sl1xDnZBPsac4j0lpDII+mdNh2:nrZYVo0+Sl7zZlsac4ID8LD
TLSH
T11A528DBD9F1238A91A27D5D4E9BDA245CD04B6BBDFE280661A143800CA447F8F4E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 56811bdd412055d23a65ebd1886103f25709dadb6886f4304f5e6a546a76f5f3
MD5 04ac3d1ada0cce46d8b9e4fcca1711e2
SHA1 62d240a2fe11b749083857de8fa0f1967f0c157e
SHA512 6da9adc3762703130a4a0a6a090a881dd498353ee05d54ca0b8ac2d94e6cace38f69474aabe91f02796a947ed750cc0c31f69a9c15f486d0fcc1ec2be7e675cf
SSDEEP 192:zPOv5zbowbqmyjFiAgglIWf1d66JozGzgCl6mc0dz:zgbowbqmyjHnd66JozGzgC1jd
TLSH
T186D11FA4EA28463FC408023BCDA60F510F35395BDC4E7F2A319D741C2D5629E768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 88516c819aa3e9ddb837d7ea8d084972986e8ed3c17c89a2aa619a948b00ae51
MD5 4fde21d1885cd399fd33bbd404fb77e9
SHA1 f4fd4b8a55fe9c8e95eb50e9ddd91acc8fca2a82
SHA512 6d8b49b8b4baa5b67c29681dad69762473d5ba691d053f1debc9dbf365a23cb3628884cf71c34fc43e92abdd1c0dca63eb372dea4e397fb66e8847fabac4cc7b
SSDEEP 192:cPOv5zboPbRZqmyjFiAgglIWf1d66JozGzgCl6mc0dz:cgbolZqmyjHnd66JozGzgC1jd
TLSH
T1BEE10EA8E628863FC408027BCDA61F910F35389A9C4E7F29359D741C2D572DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 5ff782f1d141dbea8f229f7e2a2ed3f472efc659a67432ee98af69a600751fb3
MD5 03ffd5bac7ee99314de72af5bdd43602
SHA1 be80c2b7fc7770c753b03ceaa6b1ab5cefc38dc0
SHA512 29a86ff5b0a7dbbe2a2487eae3d6d0cb1d2618d69c12d02e7ddbee01a05577ccdb9813f9ce4c57932e00277e22ef841678465e6d622a426cbf2b294cc2e48dbd
TLSH
T1CA619758F229863FE449813ACD825F512F343452A8AF7F2A35ACA04D1E5B2CD76CE03D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
Size 1KB
SHA256 26fdeee3d69d29ff9776d2ee86ba818c9fb829945cf656298fba3dc64b352406
MD5 f39d593da321695a4f53f295bb348d98
SHA1 bc7c60435d59bccadd2850b8fc2ad8c3de6174bf
SHA512 bd373f47ea9945f5a4ced8b655277bb1181fd546737af8eeaf1c38198d01a5fa5198acdf491e330260e3a0bdcdb3639136393aa4fe30e49ed7ae5aa01ff16f83
TLSH
T14521ACEC39B84D6A98DBE29C7440028E53918E4729C71C438D42DF8CCDE5AD932AF43D
MD5 SHA1 SHA512 TLSH

Submit Download

09aeea63-3bcb-4ad5-b46d-3f09f92897f8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\09aeea63-3bcb-4ad5-b46d-3f09f92897f8
Size 235B
SHA256 919c3ae67dbbe6302c9b6d6e5e880ccbb54f2bc008ef5cfd3797c3d80be61889
MD5 6fe5f724157f40a82e3d3b3528fcdd11
SHA1 0f2c3d13da5cc04a1d94c09e073e2e1d9f0d499a
SHA512 73825e54b3342633a86589f69ddc36e9d36cbd3a9dd60edfeca09cb219df5c025c04b5ee2b831de8875463d340cac51e4cf53cd0c0fe806e4623b505c6889505
TLSH
T121D0A7D42498677E68180F17F4E46DC671894C3324647850EA72557499B9DD441A1917
MD5 SHA1 SHA512 TLSH

Submit Download

13513eab-94d9-4613-84a3-f57252c619c0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\13513eab-94d9-4613-84a3-f57252c619c0
Size 16KB
SHA256 d43395805219ba90afbdf1768b384507322f5901eab553bb458c282452f2704c
MD5 f1d4432846c5de2e9ad84948f2ddba99
SHA1 a879c481eaac5cdc4f136dddccfda86bcaf311df
SHA512 ee02a445711dddccbac9cabc1d2375081c2d0e0ca02576b3888e0e2381979d43718df0d415e3df4da707af0174cf6e8916157a1a5b7a11fb4aa47db852db7a2a
SSDEEP 192:xPCDbKa94oWu0IZsLwtOWGbAupl2s5iqBPfuAT+i12EeQ8iW9KHj0D/S8j6+u4qb:8bKT1tf3+DBsHja/S8j6J4qlqauK
TLSH
T1FB72EA56682045BA8651E36998FCBFC3E5F638CF4C419FCADBE4BD081DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a4e814f-9553-44f3-a173-1905e6789cde

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\2a4e814f-9553-44f3-a173-1905e6789cde
Size 883B
SHA256 efc061e9fafe61dfa37d4f644f51e5ea9829c654d812d989d82b30a4ec787f56
MD5 5f757675acdf2e9e9d043f12ee25819c
SHA1 33ee4f31233844e22fa1cc0c65cdecdcca00d5aa
SHA512 0d88da59eff3d8eb1cd09d123975205d432d908c937e211259fce107d745eecc273292762d616871976af860f10a96898c9f94a96a30de4c2ab1c35178cb1908
TLSH
T13011E3D19630B572CC7DC24BC7A17B529FE43533C4CA94143EA17E280DBA51E935A60B
MD5 SHA1 SHA512 TLSH

Submit Download

2e59f2cf-62a5-4c2e-805a-ad67c7625aa5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\2e59f2cf-62a5-4c2e-805a-ad67c7625aa5
Size 2KB
SHA256 004e6df4177bce7ed9c646a79478729e42f6bd775fbc606a7067541ce09eebf3
MD5 a191fb0860df02d3ea2b69d3c656c78d
SHA1 e78667d62a8c5da9927d90f33d08f847509ced04
SHA512 5c1cdce3c0f7fea381a74902417355f82323ad7adc9b9a73d4d0f61d126e415170d9514a9187837eacaeaf661474939925e7bc299e0c7432d745d6fb10141782
TLSH
T10741216C75785D778CDBF28DD192238E97604E2340C619832D51EE8C8C9AAAD236E47B
MD5 SHA1 SHA512 TLSH

Submit Download

9cf93bf5-fd55-4f20-ae00-14484a3468bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\9cf93bf5-fd55-4f20-ae00-14484a3468bf
Size 235B
SHA256 71ed2b8fb1f5e38f8c861cbe8f233b5351cdbcf1c6f16d4225e87c245ccab5e7
MD5 f9c394761bd2e1d6f2cd89a5fad792ba
SHA1 af8046b7f26714f4a9d5591dbd9061a7953169e9
SHA512 7c27bedc9cee9be9767ebd25818ed81ac586cd9c5598b64de3e8aaee7abc873e364f233017b5623b173ff54509bd690885092b1b8ec61099561109d98da640fe
TLSH
T1E4D0A7D56498775E0C255F5BF4E06DC630988C3724649850D9A186B49EF9BC84261C17
MD5 SHA1 SHA512 TLSH

Submit Download

ff744a5a-d239-49df-9fa7-b5c36e42d2bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ff744a5a-d239-49df-9fa7-b5c36e42d2bd
Size 886B
SHA256 2f6cd804a5ca734f2ba134e253dcb515d6029913ce14fcc07113a29657fa7267
MD5 d6cb3fbc9ea5e237a60bdb6e70263112
SHA1 58d53caad04b38c5dc0d5c9fe130f7500d86ea4e
SHA512 b641421b97cc9affb5af3afc3e3d9a63182e86ac06dc318b3006caead476bc7142e9948b595aa67e0f0610a429f2bc8d5ca9c20f3c555ae5351cbe14ed58a447
TLSH
T1031123C19A70B572CC3DD287D6E1BB934AD06533C0CA68147E907A2C0CAA51E579B307
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
Size 16KB
SHA256 c451d0a09f6fce9cd4b970f874c769d78f3f3f49189a0ecf592247705d74ae4a
MD5 2eafc540f0648997d2573e2ec2498369
SHA1 4304d2413e6e0d6b6f8b767f48242513a4048155
SHA512 ec7134e6532166413591aa7f028fad4785a8eb7cf3e82711d6f338eba54b73a997db90e5aea8d12d2cf2c79328877d1f9d644d0937eb1fda0de2b6f99dfce32c
SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4HHY4hv:ujI4VRfOXN4e60434L474f4Y4J
TLSH
T13172521545148EB8294EA78BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 7KB
SHA256 e6ca4731b42ceb6bdb9d6fec1f1fdfd0414be4119847f9ffd2984d2ef702de19
MD5 f1328211aa037228f9acdd3cb1cd4d07
SHA1 d3cd88ca30cd5c6b010832d159742f3952666b44
SHA512 e1f343f8296724b99c59f84c20c71a7eaecb2ac39e3e0dba26bca33189203b39bf0d89ccaa619d74cc5b6c507597cd1e4721c29159cf786b5e6737b29e32b28b
SSDEEP 96:xHcUTUuqGqdf2OBObzSOdSSlDdv9jxuZnERH9O+y1Bw88n8L4cnrzBHjGS:65Rdf2OBIdSSL9A1Bw88+X
TLSH
T19BE14F7894088FBF64B6776CAC6888716AB2413BBBBF68C750B554C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 8KB
SHA256 8e48e93e3d1a6e57237f3de473b421fc8de26580e4d5ea977de17c329ab60c1a
MD5 e1d28c61f695799ddf1cff2158e351de
SHA1 ccd63ebad471511777d94d398bb7262171750525
SHA512 4dd2d90c9339069855fc70da64a1f6ebfcedb7243a3207d00551a10468cff50a44c0f9f434c68568ec51d63187272122a235b72663ec8424e16adbb816ae0e1d
SSDEEP 96:xHcxTUuqGqdftOBObzSOdSSlDdv9jxuZnERWRTdBO+yFwBw88b8L4cnrz3jGS:68RdftOBIdSSL8RyFwBw8861
TLSH
T1DF021EB854188F6FA4F6776CAC2488715A72017BBABF68D710B954C5011CF3442FEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 59ac87eee939c39cb1f6d02905d1c2cdd051cb17721b7c7e8247579d956a2799
MD5 ad7e3fac9752cdf42ecee4dfcd63a70b
SHA1 5948a76490db196419c2d3f08b74ba754e3d0b80
SHA512 d99aa186a079bc1d38e4ad6195da6ed421733f658e49056985099a2ba25f3e357785708a0ec87e8cd1d95816965867b8f70797ce810678cc2cbde6b2bd4c0bdd
SSDEEP 96:xHcUTUuqGqdf2oE1zSpSSlDdv9jtqQnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEUSS+9A1Bw88+w
TLSH
T124E13F7894088B7F64B6766CAC6888716AB2413BB7BF68C750B954C5050CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 d512a975d7619c1a43b3effc9ffea6bc324cae13ed2d4f58cf9cf68dcba551c2
MD5 177566cd1b9aa0f8d7b2115244c49c23
SHA1 d883d5b1ae02e2177af6da30bedfb79aa2db7807
SHA512 67ff80fc5e13c257342e4de7ce889aa9c5832ec9440db24df58c871520efb26d870e20aa7915f2ce731cf265b5383f2d3b83a8b82617553937576231da339c7c
SSDEEP 96:xHcUTUuqGqdf2OB1zSOdSSlDdv9jtqQnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2OBLdSS+9A1Bw88+w
TLSH
T112E1307894088F7F64B6776CAC6888716AB2417BBBBF68C750B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 d34cc372940e89b025f49fba9880228ff3ceb8ce9e17bc8c48b835be7636de0f
MD5 4aba5c29f697aebf5c0dabccf2d63365
SHA1 8ede0d37cf2fd7e473bd3a8ba32e453be6e95ef4
SHA512 47601a09545367aede1f5b73cfdfc78d975fe9f7f307f8ff28634df0539f9c7b1adbf7dbeb98415e37fb2fefe356d873e898d79dbbe7dd3c8b9395a919ce20cf
TLSH
T1002108997A3A299E9B28E14B439FA67CC30E2024427CC5B1A55EBF22433C20F714C198
MD5 SHA1 SHA512 TLSH

Submit Download