2fd8e62725a640d5204cec9276bb18cfb75db230ea8449f148e8b5a23129ee96

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
157s
max time network
161s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/05/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2fd8e62725a640d5204cec9276bb18cfb75db230ea8449f148e8b5a23129ee96.pdf
Size 7KB
Sample260528-b9ngmac15n
SHA256 2fd8e62725a640d5204cec9276bb18cfb75db230ea8449f148e8b5a23129ee96
MD5 7acb4997fd23ab92fa26b9cc2bb21d56
SHA1 0f37fdde3f106bd11d90bd16dba85fcdb92de60c
SHA512 edbb0d371d21952116a3e0ba04fc39418f36109d2c8b553b5d0f197fcd2e2535c5b8e906dbc77b3b9aedd1862772d18786ba1774357eb3ce0a2c6f4dc5794ac8
SSDEEP 192:yWLHlcRVHkFiVFrm1cFsjLKAVJ+J5JKY2pNMWOmcqzcmgTYiV99L:0R5kFg81BLxuJ5wfgqzcmgTYgf
TLSH
T150F19AE0EC47ED94F995A59ED2BFB50AC9237E5855C95E804810FA1960F21C0BBA03BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 40 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2684	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	firefox.exe
Token: SeDebugPrivilege	4540	firefox.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
4516	AcroRd32.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
4516	AcroRd32.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
3344	OpenWith.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe
4540	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3844	4516	AcroRd32.exe	84
PID 3844 wrote to memory of 540	3844	RdrCEF.exe	85
PID 3844 wrote to memory of 540	3844	RdrCEF.exe	85
PID 3844 wrote to memory of 4572	3844	RdrCEF.exe	86
PID 3844 wrote to memory of 1872	3844	RdrCEF.exe	88
PID 3844 wrote to memory of 5040	3844	RdrCEF.exe	89
PID 3844 wrote to memory of 1884	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 1884	3844	RdrCEF.exe	90
PID 3844 wrote to memory of 544	3844	RdrCEF.exe	93
PID 3344 wrote to memory of 2684	3344	OpenWith.exe	107
PID 4904 wrote to memory of 4540	4904	firefox.exe	111
PID 4904 wrote to memory of 4540	4904	firefox.exe	111
PID 4540 wrote to memory of 3576	4540	firefox.exe	112
PID 4540 wrote to memory of 3576	4540	firefox.exe	112
PID 4540 wrote to memory of 3576	4540	firefox.exe	112
PID 4540 wrote to memory of 2940	4540	firefox.exe	113
PID 4540 wrote to memory of 2940	4540	firefox.exe	113
PID 4540 wrote to memory of 2940	4540	firefox.exe	113
PID 4540 wrote to memory of 2940	4540	firefox.exe	113
PID 4540 wrote to memory of 2332	4540	firefox.exe	114
PID 4540 wrote to memory of 2332	4540	firefox.exe	114
PID 4540 wrote to memory of 2332	4540	firefox.exe	114
PID 4540 wrote to memory of 2332	4540	firefox.exe	114
PID 4540 wrote to memory of 2196	4540	firefox.exe	115
PID 4540 wrote to memory of 2196	4540	firefox.exe	115
PID 4540 wrote to memory of 2196	4540	firefox.exe	115
PID 4540 wrote to memory of 2848	4540	firefox.exe	116
PID 4540 wrote to memory of 2848	4540	firefox.exe	116
PID 4540 wrote to memory of 2848	4540	firefox.exe	116
PID 4540 wrote to memory of 2848	4540	firefox.exe	116
PID 4540 wrote to memory of 6052	4540	firefox.exe	117
PID 4540 wrote to memory of 6052	4540	firefox.exe	117
PID 4540 wrote to memory of 6052	4540	firefox.exe	117
PID 4540 wrote to memory of 6052	4540	firefox.exe	117
PID 4540 wrote to memory of 6072	4540	firefox.exe	118
PID 4540 wrote to memory of 6072	4540	firefox.exe	118
PID 4540 wrote to memory of 6072	4540	firefox.exe	118
PID 4540 wrote to memory of 6072	4540	firefox.exe	118
PID 4540 wrote to memory of 6084	4540	firefox.exe	119
PID 4540 wrote to memory of 6084	4540	firefox.exe	119
PID 4540 wrote to memory of 6084	4540	firefox.exe	119
PID 4540 wrote to memory of 6084	4540	firefox.exe	119
PID 4540 wrote to memory of 6092	4540	firefox.exe	120
PID 4540 wrote to memory of 6092	4540	firefox.exe	120
PID 4540 wrote to memory of 6092	4540	firefox.exe	120
PID 4540 wrote to memory of 6092	4540	firefox.exe	120
PID 4540 wrote to memory of 5920	4540	firefox.exe	121
PID 4540 wrote to memory of 5920	4540	firefox.exe	121
PID 4540 wrote to memory of 5920	4540	firefox.exe	121
PID 4540 wrote to memory of 5920	4540	firefox.exe	121
PID 4540 wrote to memory of 384	4540	firefox.exe	122
PID 4540 wrote to memory of 384	4540	firefox.exe	122
PID 4540 wrote to memory of 384	4540	firefox.exe	122
PID 4540 wrote to memory of 384	4540	firefox.exe	122
PID 4540 wrote to memory of 2444	4540	firefox.exe	123
PID 4540 wrote to memory of 2444	4540	firefox.exe	123
PID 4540 wrote to memory of 2444	4540	firefox.exe	123
PID 4540 wrote to memory of 2444	4540	firefox.exe	123
PID 4540 wrote to memory of 6120	4540	firefox.exe	124
PID 4540 wrote to memory of 6120	4540	firefox.exe	124
PID 4540 wrote to memory of 6120	4540	firefox.exe	124
PID 4540 wrote to memory of 6120	4540	firefox.exe	124
PID 4540 wrote to memory of 5592	4540	firefox.exe	125
PID 4540 wrote to memory of 5592	4540	firefox.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2fd8e62725a640d5204cec9276bb18cfb75db230ea8449f148e8b5a23129ee96.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D938781469537EE3C3C4F97A5F778CB6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D938781469537EE3C3C4F97A5F778CB6 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:540
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F24EDF317996D02279A57AB60B424C16 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4572
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EC4F60941A978C684CA9EFBA83D782E6 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=44D7D5555ABECA722348811085545EEF --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5040
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6FF2F671FFA2579F74C30DA3BC9E27BC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6FF2F671FFA2579F74C30DA3BC9E27BC --renderer-client-id=6 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1884
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=891215211D6BCBD83E888FE9B01B2929 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\2fd8e62725a640d5204cec9276bb18cfb75db230ea8449f148e8b5a23129ee96.pdf
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {61a7888e-7b05-4bf8-aaa0-5960048097e0} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27136 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {c18dc7be-ae6c-4673-b2a9-5e4562723e4b} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27277 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {536962e3-3336-4f8e-87fe-aa58b594b899} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27277 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 3812 -initialChannelId {6a55d693-6223-411c-abd9-b0f39a596332} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2820 -prefsLen 34776 -prefMapHandle 2824 -prefMapSize 270279 -jsInitHandle 3128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3020 -initialChannelId {4615e141-75e2-4676-a342-d68b887d0560} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4960 -prefsLen 34906 -prefMapHandle 4964 -prefMapSize 270279 -ipcHandle 4968 -initialChannelId {1caf5563-a7cb-4b03-89e5-c4eb79ed7791} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32793 -prefMapHandle 5152 -prefMapSize 270279 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {fbb9eb17-6951-4807-bdab-e182e751f1ab} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32845 -prefMapHandle 5384 -prefMapSize 270279 -jsInitHandle 5388 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {d51d0666-dbef-4f42-b855-4092c08d139a} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32845 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {057a5dfc-fc64-4b78-8aee-f0871bf21bc3} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6300 -prefsLen 33071 -prefMapHandle 6324 -prefMapSize 270279 -jsInitHandle 6328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6336 -initialChannelId {c5481021-db76-4607-8e84-f18297651925} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6656 -prefsLen 33071 -prefMapHandle 6832 -prefMapSize 270279 -jsInitHandle 6728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {757ec32c-987a-4c4b-b309-8df29b41ca13} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3960 -prefsLen 33071 -prefMapHandle 5164 -prefMapSize 270279 -jsInitHandle 6264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3172 -initialChannelId {81eb440b-c096-4ae4-98fd-039a762d82d7} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4784 -prefsLen 33319 -prefMapHandle 4700 -prefMapSize 270279 -jsInitHandle 4692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4704 -initialChannelId {9b178f0d-4b97-481f-8b13-8df1fa3e997c} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:6120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7184 -prefsLen 33948 -prefMapHandle 7120 -prefMapSize 270279 -jsInitHandle 2908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7156 -initialChannelId {923054c1-66ab-44a9-8d88-8a5845586973} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6488 -prefsLen 33948 -prefMapHandle 6876 -prefMapSize 270279 -jsInitHandle 6868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {0a805e28-5ebf-4484-a90d-3896ec27627d} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7676 -prefsLen 33948 -prefMapHandle 7680 -prefMapSize 270279 -jsInitHandle 7400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3076 -initialChannelId {707de852-ddc6-4db8-896d-d826e360d114} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8008 -prefsLen 33948 -prefMapHandle 8000 -prefMapSize 270279 -jsInitHandle 8012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7980 -initialChannelId {2cd6667d-e5d2-4f8b-9b72-6e73c0260bdb} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8296 -prefsLen 35991 -prefMapHandle 8300 -prefMapSize 270279 -jsInitHandle 8304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8312 -initialChannelId {80d50dbd-de82-40c5-a614-756ca91131c6} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:6596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7972 -prefsLen 36807 -prefMapHandle 7964 -prefMapSize 270279 -jsInitHandle 7960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7688 -initialChannelId {82b6fd36-db52-42ab-a67b-3530c0bbb13e} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:6456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 f561f93f9647d298dcd74bac26c0972f0656b3d6bb2c214e88a8b3959a97ece5
MD5 fdd2c024dc133dd2c310e486b82a28e5
SHA1 db553964daf20e72e237aac20d646984c7000504
SHA512 9a1653133369d1d3db8a0ad0b0e50695fee860fe9f763b7a9cdea0f084fb161ad4d6bafaef43bcef4c88a77d57c27d06654332b6785f16ab4c1dca67dd3523a1
SSDEEP 384:yegdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:b+eUZsLQCZsL3hUS4
TLSH
T15553CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4C18F2016606B43D054C8200B2142B749FA7F8F7

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\cache2\entries\4C18F2016606B43D054C8200B2142B749FA7F8F7
Size 71KB
SHA256 8d40098aa260de8d6b703c494e24e6eb67a7bb6c6322a8561970dfdf6d2a5cbb
MD5 332f002d25e33957a9ef58d34704af80
SHA1 cd82caef03d0d7b2a1bbe8e26ef3ed416733d899
SHA512 192dbc30e283a1ec8b33a31544e7afc6d1d3c65647d741ddf71c0c8826b4e8c248e2dfb381516ea284c19974375cd05c7057c82acdeb675d91388b8618b9502c
SSDEEP 1536:go2pgpSDJ5GJIvZ11SnW2Pz0AzJB4FP82gWTn5aWySnGX0fFIhzLmyQfZ4IhzLm0:goZpO2IvZ11g7b0AzJB4FHDnOSnGX0fN
TLSH
T19E63E0BB594FD30D17A0BACA872A760D5933E10FBCCAADE5ED04225491D8FB1598244B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 f35da38927457e67aa3fbc512eec4f39e6287ff42ca63bd6a07ff90c441ee186
MD5 3beab9c767c2b8bf4c3335007bd61c76
SHA1 2526fd84b4790a7029bf9ec08c5d27f573f93a9d
SHA512 d56f9c0e639ddefdf5a6420dbe5a67bdc2f95b035ba7a21acba7428d986b8103b58803d07485d14c87b8665b41c60d7d376d5c1aebd49dc6dfc2d84d8977e9b2
SSDEEP 384:HUr7iO024Yeo6J+Sl1xDnZBPsac4j0lpDII++mZbmZw:0SZYeo0+Sl7zZlsac4ID8LF
TLSH
T154528DBA9F0138B91A27C191E9BE92448D05A6BFDEE380660A143C04CA446B9F4F64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
TLSH
T189A42315F4A41CDCE8B5200CCADED74501995084F126FE2A5D32EEEADDDF683E26C8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\AlternateServices.bin
Size 25KB
SHA256 5c3a32b3c060a124c0602159d6cb4bedc965bca7a07ea904dec034a8bcc8991c
MD5 645f2494e07821654ed1cbc084bccbb8
SHA1 f732670f21a74ad2e56821b68e82d11af09cc968
SHA512 c013e71044812a4547db3be8501e2ee315fb0b1afd500de29bb4361392c31f5fdc5e2bb61efbc1053f2da9f0f298c45394c06a537f2e761b3a07e52e37021bfb
SSDEEP 96:rEBJksLD40YtxG6GjGgEuEbEF54CazV5kWOXDN2waZd:CYt1bgo5kbN2waZ
TLSH
T18AB25AF767727012F0A18FF0409DB69CA837091F58B986CCCA08D0D78695390D9AFF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\AlternateServices.bin
Size 13KB
SHA256 3d7e58dbb8b4f78bc21e2255f0391167564b5da542196361f8ac973dffbc880c
MD5 02bf082f2e9a6710143e99f8ead3022d
SHA1 5ea0855edf25d8c838fb000d173793c31433f4ea
SHA512 b7cfe775cc1cba808bf5e32a81a33d129c57b99d74c9d2653af0acc016e45d8176a2eb1229d8d614af4a4910b84724f2cbeb4d13114a275545ce05507e800b4f
SSDEEP 48:u7XLfg4BbpEY4TVy1ytIwG6GjGSzEuEbE3V5tiSfE9A:u7LLBNn40YtxG6GjGgEuEbEF54
TLSH
T10F526BF727717012F0928FF08088B68CDC370A1A59B986CCCA18D4E786C5795D56FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4cda4ede3470d66907d439a6ff518cdda6c706c7ea6925efd323f8c25cceefca
MD5 dbe1b956767d9129eb587c2fe3d43ffb
SHA1 9f8cc8969a4ed9091449ebffd013a5eb5c18f11a
SHA512 616417eeb8b23099f06db49b61b20723ee511309c3adf08032e14317167e9512b2b4b5c6836fe632fec56881cb275a5572ca3e43cca1a07dd58fe4abef0f7110
SSDEEP 96:YFW2F+FqFVFx/dd66Joz1zgClKtmc0d/UU3TlDDSdF95/7bkW6BrcEjW1TyUR6mQ:I1d66Joz1zgCl6mc0dHOv5zboBb6pyjF
TLSH
T11EC1DC24F639863BC418427BDCA54B410E36394B984E3F2531DC651D2D9B2EEBA8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4e05b18e2d22f89ee32a9d12c3a8d92dffa1fcf22a449d55dca7a72550c11667
MD5 df99ff0eacf85c0c3f621f4b963eea03
SHA1 6291eebb7896d62598f2e5fd8cdb099fb6385dbe
SHA512 83780b5165f255147606fd242facafaa644f213fce9e3733ab408d9e140095a4148116615b8812decd7d3559bbec579e92e1381fd050c2336a15cb3d6c26e004
SSDEEP 192:8Ov5zboABZ6pyjyb1d66Joz1zgCl6mc0dz:/bogZ6pyjgd66Joz1zgC1jd
TLSH
T10AD1EE58F639953BC418027BDCA60B410F36798A988E3F2931DC641D2D9B2DE7B8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\events\events
Size 5KB
SHA256 ad16f62982eb4d86ebc51e42f52b141bfbd3459bbbec976813faf6719ebf8ba0
MD5 e30f865902dcd979418a1d24864869ed
SHA1 e015ebb880b6764561f914118c2c5e662836e224
SHA512 7454c921ea280257c63a3dfe88b51ba0695d249f0a9ea5a4496e238c0749c8686e3b9e730ba4d51dd2c6f9f33ab888fc705b79646d3e4de8e5b2df7a5451c2d1
SSDEEP 48:YpzibKApZ8sJOwKpu/qNjIi/4I8dYkMcmlQNmsWi/HcoXUdviMVn4hG9EmmGGX4l:OciNeA6+gJSqm4wzGnfA7ZCVSq24BYH
TLSH
T13BB1F22D7DB90CBF6ADB9AA9744243DD82ED4B4390CE1C434C9ACE49CCCDA89325A534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ef9c5cbb3b16c90152f71767bbe87f9404ec987533a251cf40e2feaad9d1f4c1
MD5 58693f7a0f8df96b86817f9846bc0ef0
SHA1 a0ae4e03f8637bbdb772843497ac8b5e02c20d49
SHA512 26656cbaa91f3f48594001bec0bdb12ef9c2aa96fdab8a592c34ddeffe1bd4978df611f6b9bcde16b3b1e48627fa5b0facecbfa2822a9efb48613526f911f6d8
TLSH
T18421674C7DB98E2AA8D6EA9C74420A8E63544E4714CB1C470D42DE8DCDC9AD9326A83D
MD5 SHA1 SHA512 TLSH

Submit Download

061afa0c-7df2-4111-88a1-2d7061104e4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\061afa0c-7df2-4111-88a1-2d7061104e4e
Size 14KB
SHA256 4e5e59c272c9ab4e69b7d746eeab1a94ad2b97b485e60f7a3a4b67915db04a7f
MD5 dc9297725496bcb315f57f7e55f10440
SHA1 82c2ee39b16162fc7e83e171bffa886ff6aafbbd
SHA512 306ddb5f97f8a9fccc52b305c9f137ff1620c7fe89a15fbf6afc6c1842bc0888f0460c0d320a9ac21b1c95eb4baee855b175d0e60771ca4593fca7ba3cb79358
SSDEEP 192:25FzOdifGlouKWPU/RWv5znyfjT1aV5pFxMM2HjU4/yK1rBJKMyKqzZtoHylM19b:OFSdiulfKC5P4jOVZtoEM19b
TLSH
T11062D856642049BA8651E368D9FC7F83E2F518CB4C419FCE9BE47E085AEE0AD1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

086320e5-fb88-4283-b790-8a3ccd72b510

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\086320e5-fb88-4283-b790-8a3ccd72b510
Size 886B
SHA256 6de20ad3524385defa23048ad06ad4bee42f484fee1bde8233897888c9270aa8
MD5 f532c67b1a8581c4848b2772d6b76dac
SHA1 392a1b7ce6e53b527a3b5ea332dcf0d8a3840e3a
SHA512 1e21c6b52feb258748be560844b3bc980f11e546ab3d4b8f983d6045d0a5ae05d17b5ed6f815b0ab41845594644320aa52e5a2c219c1973fe7899212633c70c2
TLSH
T19E11C0418531BCB38C3891D795A1B7468BE4B52380D959287E619B1C0DAF23EA766307
MD5 SHA1 SHA512 TLSH

Submit Download

7c4dc694-7214-43ab-bf69-2137aab12728

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\7c4dc694-7214-43ab-bf69-2137aab12728
Size 883B
SHA256 ba8b274e0723b7ab767506c31b49c52f46e032b74a358da8a06c16bcc276aa70
MD5 31278c8516d1423c84ffa5c6373a6ed0
SHA1 8c89cab32647172044ea2dc49ad769ea45bb3eef
SHA512 8f4c210fe7817b86ef7908db8df858d23d745b46dd642e0fc505ef637bdf8eba1717a8afcc3e1cbc9194ca05fd06e6fe7646440f0cf9cab09319578b1cf7b171
TLSH
T18B1100419531B9B3DC78D2CBC5653B068BF4342380C954283EA19A180CBE63EA76930B
MD5 SHA1 SHA512 TLSH

Submit Download

b453bb75-eafc-4a3a-985e-04f2c4f881a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\b453bb75-eafc-4a3a-985e-04f2c4f881a8
Size 235B
SHA256 8da3a4556202486393e628108b4132337ce592e704d2f35ecbdb5d1f20a0ea23
MD5 8dec0724b3944e5f9d7ee3d404424161
SHA1 7d6388917c41505be15a131771702aa8a294ec00
SHA512 b5223f8de33124e6ad0d996bc98f6755c7e61a49ba1b6ff851d9e9f9560a4011ea168a0159b6fbb1a1c2bde8c0105ad1c25d84a6588a20c2511b97cbd28ba57f
TLSH
T175D0978124ECE3AC4C100F07F0E06ACA30488C3314A4A810EBA104388AFCAC48265816
MD5 SHA1 SHA512 TLSH

Submit Download

b72b0954-6ba9-474d-8324-585cb0805cdd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\b72b0954-6ba9-474d-8324-585cb0805cdd
Size 2KB
SHA256 63b6c6480f1cfb02040546295d805fe9f25eeac0821cb01e080d0b16fef98ccd
MD5 328fa42dae814c3fcfcb8a6ccd2e900f
SHA1 b89669aa27891c1e150c466bac38b62a2d150f05
SHA512 7d529a59bdcd693a39f3582730fbcbde0eac0659064315f1ae5bc782c78a70d060f15239f8956b07a499888ef317a51a7f8f784397b2bbe0869b6c2832268e80
TLSH
T15741115C76744CF75DAAE1DDE0D1234E97A04A0300C61CC32E51EF0C8C9A6AD336A67A
MD5 SHA1 SHA512 TLSH

Submit Download

e415c479-5fd7-481a-894b-c328e782a385

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\datareporting\glean\pending_pings\e415c479-5fd7-481a-894b-c328e782a385
Size 235B
SHA256 c0f4ab233da00589e33f69c7f7b62a17d74250fa86390045b8cff7c08a287c68
MD5 acc3f3b651fd79077fcfc54ac3d118cc
SHA1 72b4da4c9fc3371e6308facd7dd6c739962e80cb
SHA512 ed1e9a7ae3c005516e2c07f8e6648c7bb44cda2dfdea4657b95bde5d2d2aa8076484b453a74e9c41c3db47ecadaf6605ea85238698d01e62ef44b4cb9bbb7f2f
TLSH
T18DD097A128D8631C0C040F03F8E5BDC232548C3B12A098609A9286B48ABAAC40161A1A
MD5 SHA1 SHA512 TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
TLSH
T1D9358D0AF1A311E9E41BC074867EA622F639344D572568FF169587203F77BC0AB3AF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
TLSH
T176B022002803B0B0082282030C380AA02A3A3382E020082CAE2F03E0838832303AC0E0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-widevinecdm\4.10.2830.0\manifest.json
Size 1001B
SHA256 25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827
MD5 2ff237adbc218a4934a8b361bcd3428e
SHA1 efad279269d9372dcf9c65b8527792e2e9e6ca7d
SHA512 bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542
TLSH
T111115B00DD388D9326E4BAA21CC6580957661DAF4CC27E98379E161D8F1C8AFA37376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\gmp-widevinecdm\4.10.2830.0\widevinecdm.dll
Size 18.3MB
SHA256 eb98fa2cfe142976b33fc3e15cf38a391f079e01cf61a82577b15107a98dea02
MD5 9d76604a452d6fdad3cdad64dbdd68a1
SHA1 dc7e98ad3cf8d7be84f6b3074158b7196356675b
SHA512 edd0c26c0b1323344eb89f315876e9deb460817fc7c52faedadad34732797dad0d73906f63f832e7c877a37db4b2907c071748edfad81ea4009685385e9e9137
SSDEEP 393216:FPRzXYeXFyjsrZuvpYl5SJIhw7PJeP9TZHZMaMq0Vrq8P:DFyjs0pYl1hwDJeVT7erq8P
TLSH
T1D817E04AE26310A4E85EDCF4827AD972D0743C4E0376A7EF16D876356E727C06B29F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs-1.js
Size 7KB
SHA256 b10f7eded8f84107bb43fc4b14352036196b3063b5373de8b7cba872ead9617a
MD5 a77ffd977cb7399fc9d0cba283805107
SHA1 1e5ce3473e5e8a7c7a6b51d4c0a9bf43638170d5
SHA512 ec72299dd6fdf205118e8d5627736ac2bf81b1b0d153eda958d57fa4c1a6bbe79e7fb846d594216e22ce163ce8866b7941f066333ca5e8883913c7ad335697c0
SSDEEP 96:xHydgJEgIjTUGqGqqfvue2eNbzS0SSlVYdv9jOnGHTdfs6wBw88P8L4cnogOKNGS:AdgJEgI2Rqfvue2eZSSiuBw884
TLSH
T1BFF11E789414CF7F78B677ACAC6888715AB2013BB6BF28C700B95484055CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs-1.js
Size 7KB
SHA256 bc95b3176b808a6191284e0ccd108ea56d07a81740fcd2e62aa7a69599e38270
MD5 c10ede2e85885cc64b9924b62e38603f
SHA1 ebeafd45fb76455e39d06f54a43b0aeddac73db2
SHA512 ab8365c2bcdd96c5ae443fc012263234586e82a10229427161f6a258f54a42a8711d3d02c4a47fc511cf5731fc9ee3eed00574d3b70e2e2da036f8607501c7c1
SSDEEP 96:xHydgJEgIjTUGqGqqfB2eNbzS0SSlVYdv9jOnGHTqBw88P8L4cnogOKNGS:AdgJEgI2RqfB2eZSSiWBw884
TLSH
T1A6F12E789418CF7F78B677ACAC2848715AB2013BBABF68C710B95484055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\prefs.js
Size 6KB
SHA256 a27cadba7995b1516d94ccb975bb92c9089bcf883a86ba9c1b54f75bcfeea01d
MD5 bd7a3929b6b13a72c3ca638f5d783eb6
SHA1 d1ad5a25c889038595ddf7472739ba1f0c085cbf
SHA512 e8d2bfec9821544b98a689f052d86dd4f3b9a0171f745485983878621f9f528d4040b58745f5fa35e8c6f6f5f8250cc2349cce161bce2dd2ae3025ac02591725
SSDEEP 96:xHyUTUGqGqqfBW11zSgHSSlVYdv9jAnGHT+Bw88P8L4cnolOKQ:AhRqfBW11HSSwCBw88S
TLSH
T148E132785008CF7F74B676ACAC6888315AB2013BBBBF68D750B95485014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 b61cb870e9f96b5062fb36f8710c2ab8628e5331796a8d3b50073c498933e074
MD5 708bdcb3346a74d2fb50e1ba7e910092
SHA1 81993d0e630ae42100d7b5bfc934b55fa35946f2
SHA512 3fc9d9cea8eb41fad1b2bc188b62058886310a27fbec978d881568b0f6e86993a7ea5a7ff0c5fe26c5e6bf74711970ddf737feeff4457981a7c660303d128e38
SSDEEP 384:O/TQ8xU1q5NtYCXsgL0P/wUZhkWsCL9BN74eKfvOu:41sqBYCcgrUXkjC5Byeivp
TLSH
T1E052B0C6794B2C9BC97CC00F48894B661B382D2E987213AEDBC67C540E7D7065EE8255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 47dbb1e8f6b6120abb004397c625e385707fbfce0982bd816be555a2eddc6898
MD5 a3401d46724cb5e74cde64f9ad41d2a4
SHA1 1aad5336212a5ea6b4c8359969f472b9339e90df
SHA512 952dc76f6352702ceedeff7f48b5896c35f9ca31940abbea46f4405d120b7d144cf077e4f4b35b8a3276c6199c9d94bf0ba14314edde0363dc20cd6c258a9659
SSDEEP 192:BlBvAMTov92xlVIR8aY9Ia8qepjGtjYCXsRFfbMtko0PXpRw8hZ7tbH2t4YJ4tUD:J/TQ8xU1q5NtYCXsgL0P/wUZ7YJvlVD
TLSH
T18A42AFCA7F4B3DE3D57CD10A48CD5A468E241C0AA9A2975C8FC17C741D78A43EFD8661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 3640a867bbc9bf4ba6da2247e5cc998492b9918485c3d18fc9b9b1d8bfb972cd
MD5 57e2b7f6e49fd143ff1168327a4b899a
SHA1 c80c0378220e7c1590e6f486cf31a31466cafe53
SHA512 0e15f86662a14d8d2681451d7125594c8a41c67735f3ad16156ad62b65f09880f88bb7401e4ce60c71ba8a336eab101e37fffbb02055f23cb21060b2fd8efc15
TLSH
T17221DA86BE7F1CF22564E3D760C48ADCD3215403436884E0CD4994001F9C405FBEFA6A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 d3d748fb13a272bf732dffeb978b6d1a0b9a3c5452c52e15430e6f7e6411069e
MD5 8671326c105fd7e21a7d21e41c7bf1e6
SHA1 617273b5d8a8f7f99a019d4efcb408c3c601a1a2
SHA512 f0cdf6dbed799ecfab0e3dfde30481e7c0bf122517595cb9afda49e98879a8ab10039096e5189170ebb66c3405c34a6b192d9009eca533dc27096956a2359e07
SSDEEP 96:wC20+4vg5MYQV+v92xlV5wWqdPFspaY9IAezm8KgSvIpQFWDo:LlBvAMTov92xlVIR8aY9Ia8bwkQE0
TLSH
T155A14B9EBB462CEB8278C015488D9F1F1324240BD5A6A794DF7A8C721D58709DFEC269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 9KB
SHA256 ad5ea574d7189bec03a6e9c0198880902483a18108613454be6e7d58a756a79f
MD5 dff0b3f3ab8c59e9835c97234d88567c
SHA1 1a405aa8e1760275476ec239ef0483eee5685f22
SHA512 3acd58659b3c0c23cfdc33a433532b67063ac4aacedc121bbb25f55552c1e3ac499b603e2e7b0f79f4973a75f6b029458ed234baa29db3cc25191ef3172ae8fc
SSDEEP 192:7lBvAMTov92xlVIR8aY9Ia8qepjGtjYCXsRFfbMtko0PXpiEj2cE:3/TQ8xU1q5NtYCXsgL0Ptj2b
TLSH
T11612AEE57A0B3DE7D53CC106408E4E5E8F38190A69A253ACDF917C640E7C605AFE8B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6rjjdvz.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 b18511eea0c843835ff2a7558d098d21e375b9c61c39c81fcaf830f46a6d2cd0
MD5 275069c3b10f4887e379eb6570e7a1e8
SHA1 2ddb20bc037c0c06f0e3f6f724b7265d0aa96eee
SHA512 af127df0d495b0d03f7b9a059687485e462efacf3349f5a67f78c5dcc93e9db3b8d205d9dd3464514a73efc35b5b136864e9f8bdd1aae2a77a0e3c6ca3a644c8
SSDEEP 192:3lBvAMTov92xlVIR8aY9Ia8qepjGtjYCXsRFfbMtko0PXpRw8hZ7yg1zS9RvJjt0:L/TQ8xU1q5NtYCXsgL0P/wUZhk9RvJ+1
TLSH
T17232AEC97F4B3DE7D53CC10A448E5E4A8E340C0AA5B3539C9FC17C640EBC602AEE8665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download