af49068338ae61850399dd3dbbb52d6a6e9f40933790fa2d24394135763508ad

Resubmissions

01/06/2026, 17:28

260601-v2cjyads2q4

01/06/2026, 17:23

260601-vx4gvsbv2z7

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inventorypets-2.2.8.jar
Size 7.4MB
Sample260601-vx4gvsbv2z
SHA256 af49068338ae61850399dd3dbbb52d6a6e9f40933790fa2d24394135763508ad
MD5 25673d8efe573a776e193deb797e72a9
SHA1 2428b4551d5cb9e7b862cf1fa8c10c75a1d1f1c6
SHA512 1a3ca34260ef165e85bc70a77df15e94666f552dcb7c6b7d8445e1a6236eb2bcc4ad07b2fce33cf76fddd0d01d2e01c1003515a0b82f4ec26fdddb2b6fb7f937
SSDEEP 196608:Xo/Xtw46lHhxnH/r6Q1Q+iBBNF+23BiXbz2+x2uJDKc:odw4cB5eL+CI2Riuep5Kc
TLSH
T17976236251DB0558CE3F9F74634E81A37E285AFF8960B2F72C608C9134367861B2D7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5636	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248083260169347"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
8	chrome.exe
8	chrome.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeDebugPrivilege	2464	firefox.exe
Token: SeDebugPrivilege	2464	firefox.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeDebugPrivilege	556	taskmgr.exe
Token: SeSystemProfilePrivilege	556	taskmgr.exe
Token: SeCreateGlobalPrivilege	556	taskmgr.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe
Token: SeCreatePagefilePrivilege	8	chrome.exe
Token: SeShutdownPrivilege	8	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
8	chrome.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe
556	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2464	firefox.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2464	1848	firefox.exe	86
PID 1848 wrote to memory of 2464	1848	firefox.exe	86
PID 2464 wrote to memory of 3980	2464	firefox.exe	87
PID 2464 wrote to memory of 3980	2464	firefox.exe	87
PID 2464 wrote to memory of 3980	2464	firefox.exe	87
PID 2464 wrote to memory of 4352	2464	firefox.exe	88
PID 2464 wrote to memory of 4352	2464	firefox.exe	88
PID 2464 wrote to memory of 4352	2464	firefox.exe	88
PID 2464 wrote to memory of 4352	2464	firefox.exe	88
PID 2464 wrote to memory of 3152	2464	firefox.exe	89
PID 2464 wrote to memory of 3152	2464	firefox.exe	89
PID 2464 wrote to memory of 3152	2464	firefox.exe	89
PID 2464 wrote to memory of 3152	2464	firefox.exe	89
PID 2464 wrote to memory of 580	2464	firefox.exe	90
PID 2464 wrote to memory of 580	2464	firefox.exe	90
PID 2464 wrote to memory of 580	2464	firefox.exe	90
PID 8 wrote to memory of 1276	8	chrome.exe	92
PID 2464 wrote to memory of 1408	2464	firefox.exe	93
PID 2464 wrote to memory of 1408	2464	firefox.exe	93
PID 2464 wrote to memory of 1408	2464	firefox.exe	93
PID 2464 wrote to memory of 1408	2464	firefox.exe	93
PID 8 wrote to memory of 5636	8	chrome.exe	94
PID 8 wrote to memory of 5644	8	chrome.exe	95
PID 8 wrote to memory of 5644	8	chrome.exe	95
PID 8 wrote to memory of 5684	8	chrome.exe	96
PID 8 wrote to memory of 5684	8	chrome.exe	96
PID 8 wrote to memory of 5852	8	chrome.exe	97
PID 8 wrote to memory of 5852	8	chrome.exe	97
PID 8 wrote to memory of 5864	8	chrome.exe	98
PID 8 wrote to memory of 5864	8	chrome.exe	98
PID 8 wrote to memory of 5892	8	chrome.exe	99
PID 8 wrote to memory of 5892	8	chrome.exe	99
PID 8 wrote to memory of 4504	8	chrome.exe	102
PID 8 wrote to memory of 4504	8	chrome.exe	102
PID 2464 wrote to memory of 2600	2464	firefox.exe	103
PID 2464 wrote to memory of 2600	2464	firefox.exe	103
PID 2464 wrote to memory of 2600	2464	firefox.exe	103
PID 2464 wrote to memory of 2600	2464	firefox.exe	103
PID 2464 wrote to memory of 4904	2464	firefox.exe	104
PID 2464 wrote to memory of 4904	2464	firefox.exe	104
PID 2464 wrote to memory of 4904	2464	firefox.exe	104
PID 2464 wrote to memory of 4904	2464	firefox.exe	104
PID 2464 wrote to memory of 3232	2464	firefox.exe	105
PID 2464 wrote to memory of 3232	2464	firefox.exe	105
PID 2464 wrote to memory of 3232	2464	firefox.exe	105
PID 2464 wrote to memory of 3232	2464	firefox.exe	105
PID 2464 wrote to memory of 4464	2464	firefox.exe	106
PID 2464 wrote to memory of 4464	2464	firefox.exe	106
PID 2464 wrote to memory of 4464	2464	firefox.exe	106
PID 2464 wrote to memory of 4464	2464	firefox.exe	106
PID 8 wrote to memory of 1772	8	chrome.exe	108
PID 8 wrote to memory of 6508	8	chrome.exe	112
PID 8 wrote to memory of 6516	8	chrome.exe	113
PID 8 wrote to memory of 6528	8	chrome.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\inventorypets-2.2.8.jar
1⤵
PID:1556

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {a4a9a8ba-bd55-4aaf-b753-938457b75508} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {f3501a18-10ec-4032-9902-b9c5c5c35773} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27274 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {7e34b104-bd00-4970-b105-27571301e421} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27274 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 3952 -initialChannelId {a5537c2c-3c56-414e-b59e-4fb6844faf09} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4432 -prefsLen 34773 -prefMapHandle 4436 -prefMapSize 270279 -jsInitHandle 4440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4448 -initialChannelId {c87549b9-5f64-4e68-b1b5-e73ad6b51902} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2688 -prefsLen 35010 -prefMapHandle 2896 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {1b021efd-c38c-4a18-a315-647474029275} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32900 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {f7e80dfb-ca93-4e92-a9e3-37846447b98c} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 32900 -prefMapHandle 5184 -prefMapSize 270279 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {a580c7bd-89cd-4258-a0f0-6a35559977e3} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32900 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {7f123ba3-5b79-4d9b-a724-992686031515} -parentPid 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2464" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ff95906c728,0x7ff95906c734,0x7ff95906c740
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,419202020545893818,17897996740208671862,524288 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,8504428492039901673,4344754330236096225,262144 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,721504733848579612,526563496580419549,524288 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:13
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,10883428497878402523,4751865684307514267,2097152 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,9364505602114955038,10678326082833839752,2097152 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,17346006861750765056,8413549501813531233,2097152 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,5779059167318498885,6966778041230416206,2097152 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,9160096432708625444,3573491062461531275,524288 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,992083032845782589,3547534107299552846,524288 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:6508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,12025139038385644804,637226774768310131,524288 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:6516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,2025685018631251611,12867721360231596845,524288 --field-trial-handle=2080,i,367416669105710101,7906207306572347644,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:6528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2512

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c0d522e5c037088ff84f690619aee4d814f5e939502168d023dead31057752f6
MD5 4aa70d6acb0d2927d04d6a3d7d76f92b
SHA1 884ab5ced6c6bdcacc902a14d4606115144304a7
SHA512 e62765e9ac419238a49b45e4dc33f598df47482c2082f20ee07041ad4123589246d24d1816c6135e0586e409c66ca06a58d6aaf72c243048a8d675a5a099486f
TLSH
T171F02DB6DE22EC7708FC2B2970551B4BF75413272781594F3A3C520C4FB153B458685C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 adb63e61e1a8fff97359b191f1a7771b1f3e3fe75ef33371db023b17bc2385cc
MD5 79bc02e4e46c491fd13a7c90ee29557b
SHA1 ed0f20f82ec4931114fd7ec3de3bc49b2aed0809
SHA512 dd90e5184e4f672b124350a94f42ee715e829afdecebe67915f6769a86e318d7cb51e3854a6cf789ae661eff3f41e4beb2eb1611c9f145c0aae76f4a38db7f84
SSDEEP 192:CRIfn/7IYy2Qv75pAPRp2A98Hsb+WNnqYWT0bw2eNzVyIsnAUgtaJ:CRIfnsiMVUXLuwq3T0bU8
TLSH
T16E42A72EFE106A7B5DD7D229FA257B67D7F6102125D42E80DAFC8A2C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e094c1f94e9fd5c5cf346de17468f9dbece7fac967ce6f08b9f64aacb8931b4f
MD5 608b858e927fcaf011b3f412eb79f4fc
SHA1 39bda2b9cf2a35988ca497904ef2bc8b629b39b6
SHA512 b15658829a21b289b75efc224c0e3a7b866cb8aed0b9addebf632e869279e4e45f1d619e94364945d67fef51a4842edd91f1ca23ee2cd9e863a13a17b4690eb9
SSDEEP 192:CRIfnyjTy2Qv75pAPRp2A98Hsb+WNnqYWT0bw2eNzVyIsnAUgtaJ:CRIfnidMVUXLuwq3T0bU8
TLSH
T10C42B62EFE106A7B5DDBC229F9253B67D7F5102125D42E84EAFC8A2C14E76CC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e87bdda0c0daa5c6f9c84df845b8e7112a2ee20b44bb9c2bbdc8f653f9c8cfec
MD5 91e0d32cdc29bb8ba52ad827ba154d43
SHA1 33c93262d38ba420f8961073cc0d7c23bdd11d90
SHA512 a79267e1921fc60853b6acd468b5b047a68757999e0653348d03bfd631e500a36cc3ca7522909c2448775023ab4fb5e5b3207163c8204cd1d2f9161124e9f344
TLSH
T125B01240C403D981D40302F411C6148CB114DF20960A270187E569328835150C114050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aad1a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aad1a.TMP
Size 96B
SHA256 948cacea5d3bcc179e35fbe96cda004ef8242b82874e73db88344f8a8143ba47
MD5 09bf95e75853cedbe73093ad54e6a6b8
SHA1 3db02d4cc506f47be33cdf1b4dfc15649b86501d
SHA512 967525b55778ec632b72b9c32c20d0693f504ccb287b03df6365ffaa50dc42ace311b525d5eaca04f9f0d7fb368fc6573fa1747c599b31d3f8921ebd9c33b373
TLSH
T1D6B00255C1227616C0C343B12D959DD8B1F0DFE5CA43133AA6E42B66EC3576485259A4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 b2c3e11d6bd685ff076448a62c3f1218b28ed6667bce2e99ee63627b08793a4b
MD5 f57840a531db887206917e46543d88bf
SHA1 e1fc27145d731d30baedb258aa2940e48e965e69
SHA512 012a4a6104005438e46cec28ed1da6884374f28ff3ea1cecf3f10258b5e3d558a9ab18acde9226bad54c64423323618e62339819c8c793e76bc4df7e0ce8343a
SSDEEP 6144:b8QfW/KOjYe7FK9Dxm7Rkm1tYpBeh2BAo0:b8eWCOcmaY9oBGcAo0
TLSH
T1173423235EB42E7A0839DF1A644D4F0E9CF25AC2C652CAD5CDD84B0813FBACE1E05D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3dab7a6f5728f01cb77aff429eb77cf8660abfeab2a06c936d1c8d2590d0a574
MD5 e3e0233939d741a8cb48dbe494f6b152
SHA1 9371e1d366c7a61af06035bc531131f04feaa984
SHA512 e1f09356ac2d074fb7ba60521cc32bca7c29abc3fee02cdb4707da404c6717d17cf91f46eed502b01f51e90de3f3939f999d3de80922fee672f3a7617a13a270
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:wm7Rkm1tYpBeh2BAoF
TLSH
T107C3123B5D70A97759B9BB4EB08E0B1E1EF149A6C930DE92C8D85B0477FA7CC0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 61fa5a55cef0b049c62a2544ad6f4df341ed1af57c7f38316cfc22a025bd2783
MD5 efc58859b5265ef1368605ee8a5ed854
SHA1 bd1e86c266167b64001171e22e04e803dbdb73b2
SHA512 d9fca2aa8fff6b2a6552d05dc5c27cfde19033d2387160630c1e2e83aa92eaa7416a52722fa4eccd080d352aa4d8b9e81d5658aaeee840bfe4cfe080f31b4811
SSDEEP 6144:q8QfW/KOjYe7FK9Dxm7Rkm1tYpBeh2BAo0:q8eWCOcmaY9oBGcAo0
TLSH
T15B3423235EB42E7A0839DF1A644D4F0E9CF25AC2C652CAD5CDD84B0813FB6DE1E05D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tz20xb5.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 80b94c0d29b9cd5a139460efa61461cc4749ed6d415d3651f354617d3435d83b
MD5 5a711109b15379f61fc65691a844d306
SHA1 6118fb9bbd0ec66a40f33b5b91771f0ea2c1ab72
SHA512 5c0f94e7d06c85fc40d7fa5b5cccbed02f1b47cdc9f7bc112762e8114b1b86e9ee04d967a1a9d925267fc5a23bc4d17a3fc2cde4b4651505a18eb77254802b20
SSDEEP 384:HUr7iO024Yco6J+Sl1xDnZBPsac4j0lpDII+zWGWQ:0SZYco0+Sl7zZlsac4ID8LT
TLSH
T112528DBE9F0139A92A27C091E9FE52458E05E6BFDEE2D06705143C04CA847B9F4F649F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6a1cd64517fcccc6400ecbba671ddb1d295a172d39fcfb448ce918e337e034f1
MD5 ad7b240519c81eda680df10e887efe27
SHA1 20deace23ac325f55110241fbea7b41c0f822f60
SHA512 2a1f20efde564bf1895b9bdc6fce61bb18621fac52f832d56415a4d6af7a1ce9dc30d1a54fb0c1a1cbff8e2f133e4affbd218b25d7eb6a2b752709c45c3abd02
SSDEEP 192:eOv5zboHeY4yjlixO1d66Joz0dzgCl6mc0d:1bo+Y4yjkod66JozQzgC1j
TLSH
T129E10DA4E628863FC454027BCCA61B450F35389BD84E3F6935AC644C2C577DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4cd534688161179aa56b5b776019beed112b4554178c6b82eb43f5e131d3e527
MD5 62ccc3e6753ef790ff6af511a58f2dea
SHA1 f5b14139bc35412dfd6772e1540412233ce2dca9
SHA512 a9bcf988c0e97ca04562ec7c98abaa6530010d77f675d08b467d12ab824f26c355f2f6e31a934dcc5d856327a81ce11b5d970af838988d529fcd1f3813e7f9ff
SSDEEP 96:hSdF95/7bkW6QXjrcEY4yUR6bx2WZvF72FTDFLFdFK/dd66Joz0dzgClKtmc0d/L:hOv5zboobY4yj1x8O1d66Joz0dzgCl6s
TLSH
T196C1FA68E628463FC454023BCCA61F500F31399BD85E3F6A35AC644D2C5A7CE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fa9c4d8e594a3b2a9185215732651ad10e76a635d5c9ed9bc52fe163c723ad1a
MD5 601bb709b3c4994e7332bfc5b847f853
SHA1 9091e8e7765db12da17fb56a1ac12ffd0fe94574
SHA512 1fe16d9cc70656d4c5f2212b644b690894c63adee98b71e8ab7a121ecc5bb6b08e2e2cebe3d0d00a04914e81aaf59100768681ed614f645dfd64187d2a368eaf
SSDEEP 192:qOv5zboIZY4yj1xHO1d66Joz0dzgCl6mc0dz:JboIZY4yjPod66JozQzgC1jd
TLSH
T1E9D1DA68E628963BC455023BCCA61B500F35388BD84F2F6A35AC744D2C577CE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8487c630492e66828d6c886f2f2c5d3f21583679811953e76c3f4267363fb7aa
MD5 968cf1d0937d6c6ffe687c8fee270732
SHA1 523dc415e62ef79885a30d5c20585f7ac90b4c72
SHA512 7765d450f82b9ef57e79c84875d9be6546b833ca279fcdb7dd1e32556761c4e13f359d46e3723bed4c3472e10324fcd349e8317a39d61e0e069bf9730bc9f0cb
TLSH
T18221375E39B94D6BA9C7E39C788002DE57564E0604872D434E13EF8CCED2ADE326A539
MD5 SHA1 SHA512 TLSH

Submit Download

8a492bd4-13ef-44c2-9df8-bdda06d90992

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\8a492bd4-13ef-44c2-9df8-bdda06d90992
Size 235B
SHA256 459ebce8fd6bf0fd164840ddb821fad85adb12ad78f622f148b1b4fb1a9e3173
MD5 34d730babafa80dc60567008b63acaf6
SHA1 a8707ed9e50b36aa4cf58938d1f8a6812b15d6a1
SHA512 38a266d560ff6a4267709992ef9d5773aae594cc41026b716f85bd47da282450d0102b52282e9f0f92c424458a1685da9cb76cbb47688cf827231cb5794979bf
TLSH
T155D097C028D8272C48180F07F0A0B8CA30CA4C3314B49820E6920678D9FAAC502A282A
MD5 SHA1 SHA512 TLSH

Submit Download

9f35808d-0563-47f4-8beb-fc931c4ebfc8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\9f35808d-0563-47f4-8beb-fc931c4ebfc8
Size 235B
SHA256 a674c2496debd9c35a6e7d3466bf55091554f53369b615806be4f7059c23bf2e
MD5 a054ac9672f0dd48c642bed40cf3d1c3
SHA1 5fdad992f68e0d84840a92eb415d54aa06816cd1
SHA512 509af706fe840dc8c6ca5d5f4cdac678a1c0b9377004b4fd3bec597b5b7f4b708e531647203fe28e875895f6db232e67a43a5643415563b4730f39d6d3fef441
TLSH
T161D0A7952C98676E48141F07B0E07DD631449C331465A870EAA28778ABFDEC44561D6A
MD5 SHA1 SHA512 TLSH

Submit Download

d87beefb-edc5-4cf4-b96d-8351cfc75dbe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\d87beefb-edc5-4cf4-b96d-8351cfc75dbe
Size 886B
SHA256 0b774c86e6b0e5c9d9a6f93a31d259a66ebc7b6e6752d0c89fcf447fe7bf9d36
MD5 94868cbc2ae4246b8edbbb25fa860194
SHA1 a28df972263726032d4cc45602f6bb647a5b7b24
SHA512 6e778b47fbfcf28aea8353311dab7c6c79aa23ed15f534d6547f6c85c0139723a61fea0307cc3f3dc965f5ddbb2cd2ba03058713b5182ffa663858a9563658d9
TLSH
T12F11C08085B5B5F2DCB8D28F85D177424BF4B133C0C648947EA4AE184CBA61EA3A7707
MD5 SHA1 SHA512 TLSH

Submit Download

dbf1cdf6-65f2-47a1-813e-79a50371c819

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\dbf1cdf6-65f2-47a1-813e-79a50371c819
Size 883B
SHA256 823a05d4c1378328515b46cd16d56b88c63dbadab41f5d8bdf36054d6d2f6b24
MD5 a6dde7f312914f6f48c8e30c50d33ccf
SHA1 1c385fca5083201b57bdb1031d2ca984187ecdc6
SHA512 453ace8aa158e2cce444d0babad79dad07a1c13dbf6871b79573e167a7794856362b8a5e0e0201c17ba19870a114d31db180a921dc9f5b4c450f7ee11d58aaa1
TLSH
T1BA11C481953575B7CC74924F8A9137135BF4752380CA84543EF49E040CBEB1EA35A70B
MD5 SHA1 SHA512 TLSH

Submit Download

e2398a95-0485-4388-b650-534786f29976

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\e2398a95-0485-4388-b650-534786f29976
Size 2KB
SHA256 f228a204bda0cdb431622a447648038989cd3b18c2e387cc8836f16c878a7c51
MD5 1bcfb10a4fafd8898fd4a805f7c9c24f
SHA1 c76df6f0244108287f4134dd950a3207cf75ba55
SHA512 648154ec811903fe47a639f6e3002360fbf0390bd435eede7583fdfd30f72989869c3cebbd8758c45c95a51f79c48fc7c8cc593b5206e30399761f644e5387e1
TLSH
T1EB410F9C75784CB79CE7E18DD482224E53608A2350C61CD32E51EE4C8C9A7AA736E52F
MD5 SHA1 SHA512 TLSH

Submit Download

e978e410-49cf-4ed8-a168-19211f276e82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\datareporting\glean\pending_pings\e978e410-49cf-4ed8-a168-19211f276e82
Size 16KB
SHA256 5467179690a8da54bb9003d7262dab306f0624ce6e8e3974677756bda6dce8d4
MD5 4853b33138d955b7402b300f5421c11f
SHA1 4fb0a9d18ab1f44568f1d314d8c8b8bc9138fb83
SHA512 d5fa6566702ea59e740f9638c25bc48eff1af2c3d0e01fc55420c7b6b665892d11b29573294778f0fc9dc24cc65bbefb9590e4bb4843e6af4b5dcca04cad399b
SSDEEP 192:UAsEmzqr8wwgcP8BLnB11zp9/BOzaIDLKTzPV360DyuzKjLuKJfy/+GiUdSzLjiu:UL7M/cP8BLVT/8z/LKN/iUdSHjixRm
TLSH
T1CA72BA56642055BA8251D3AC95FCBFC3E6F538CF4C019FCADBE4BE0859DA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\extensions.json
Size 16KB
SHA256 886c50101fec920738f8800dbc8e052b49d9f9d698709a1d96303f3171483732
MD5 c73078f95451d0f83579e09916340038
SHA1 84c9b94008639122f3fb4c8af7cb75f22cf75379
SHA512 7367574f9343663f094aeb66bc7d22d84636ba59b3e9adc8c58ffe8d70e2663edf68b3d356c94398f1d26a7ad06c466c0e89b2825796c294f798201d7dcbee72
SSDEEP 384:SkI4v4Umldvu8dhWZO94z396oPL4HFL4PIKAL4HCKAL4HgL4Hqq4hB:lI4ARfDXd4h6s4F4wKi4iKi4i4h43
TLSH
T1F372411545049EB8294E979BAA367E02C37D473B60845C78F4DD8FCC02FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 6KB
SHA256 807db89af0b9a0e0f1026a678636f72288c40e902ab35c46563b45310579dae0
MD5 66b3b85ad394a6e211227870bdc48c5c
SHA1 61dfe6f9b3ca4d664460b585308c542be5ce4c08
SHA512 e65289852af7fc4bc524d6fedf619cc6b57c428a682fdd6e7dcc86df75a6742f4c9b127d27b0032430347de9928c53ccd30a2dbe73716e67a2853e5d65962460
SSDEEP 96:xHPUTUkqGqDf2gL1zSwBMuSSl5dv9jnbn+H+StBw88H8L4cndyc:FHRDf2gLdBMuSSHc+StBw88O
TLSH
T127E12F7890188F7F74B677ACAC6888716AB2013B77BF68D750B95489050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs-1.js
Size 7KB
SHA256 26858ecb4f97e22d949bf6710e010afaea9a670a2ec7435e3bf7177fe1f9b28c
MD5 c977f74f51e2cb568141dfdf25acda48
SHA1 4016c2bbbe7d821d63150061a113c09afb98ec3e
SHA512 f21c79b871041c301b57552d305ec1cf85bbf570437297ff9ba7633f9a13859e4ebacc102ccdf21fe4a9d42f7e1fd272b546b6c52e29d153dff313b612e412e0
SSDEEP 192:FwxINxpoRDfzlgLSBMuSSHc+SOc+Bw88KQ9qs:Qrc+3wx
TLSH
T147F1FF7890048F7F64B637ACAC6888715AB2023B77BF68D650BA44C9050CF3541F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tz20xb5.default-release\prefs.js
Size 6KB
SHA256 829365315899d0e41799eb3aceabb4ae2e611190e4654c0ea06a58991d915507
MD5 32ab54de9eb6c5f1c97c26193a064aaa
SHA1 d503b37b6e75271aefab533339c14ea412395bbd
SHA512 9b7e02c1d6b07f3a87fc6b262b1842b7b7ae4e7d8d6e4008292d5a8f2b0bc770e82c65114ff360e530bdca18d4cfb62ca5a93250e9a6ea9a21abf81364fd1d97
SSDEEP 96:xHPUTUkqGqDf2h81zSxGVSSl5dv9jsYn+H+StBw88H8L4cndyc:FHRDf2h8EGVSSY+StBw88O
TLSH
T17CE120789018CF7F64B677ACAC6888716AB2013B77BF68D750B95489050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-395-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-388-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-386-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-398-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-392-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-393-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-397-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-394-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-387-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/556-396-0x000001BD9C6E0000-0x000001BD9C6E1000-memory.dmp

Download

memory/1556-2-0x000001DDD4090000-0x000001DDD4300000-memory.dmp

Download

memory/1556-12-0x000001DDD4090000-0x000001DDD4300000-memory.dmp

Download

memory/1556-11-0x000001DDD2810000-0x000001DDD2811000-memory.dmp

Download