5b6030102835da11f738fea4d799edaaaa7674972533c866e1d6ef3e6728c2d3

Resubmissions

03/07/2026, 16:45

260703-t9hkgshy2p3

02/07/2026, 21:48

260702-1n65aafv3z3

02/07/2026, 21:47

260702-1nmqmsfv3y5

02/07/2026, 21:44

260702-1ltfeact2r5

Analysis

user interaction
yes
max time kernel
155s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/07/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
documento_9801312.pdf
Size 1.2MB
Sample260702-1ltfeact2r
SHA256 5b6030102835da11f738fea4d799edaaaa7674972533c866e1d6ef3e6728c2d3
MD5 11d98d7f9a633a116fc782d496b5334c
SHA1 4cc72c19800ddd02c0b4684f8b7e4b2e876e484d
SHA512 c90cb40d95f7a0b6377fbadbc6d7d32b25fa646ac07291157c2eb4026d2224dbdeb3e9502687a428ad5626da876cfcfc3b2fcb08d1ad52b525e08654bfdd4bed
SSDEEP 24576:8F2WcFOS8U+3ZekmSyN5qhNeEphiSeaof:s2lFOS8B3ZekmSOq6aof
TLSH
T10D55E081D58AC10CEC4A88795938342B4BBCB73A2590955F4D1CAFC1FFD838AED5F58A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery persistence spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	firefox.exe
Token: SeDebugPrivilege	3152	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4728	AcroRd32.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe
3152	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
4728	AcroRd32.exe
3152	firefox.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4180	4728	AcroRd32.exe	83
PID 4180 wrote to memory of 4568	4180	RdrCEF.exe	84
PID 4180 wrote to memory of 1244	4180	RdrCEF.exe	85
PID 4180 wrote to memory of 1244	4180	RdrCEF.exe	85
PID 4180 wrote to memory of 2984	4180	RdrCEF.exe	87
PID 4180 wrote to memory of 2784	4180	RdrCEF.exe	88
PID 4180 wrote to memory of 2784	4180	RdrCEF.exe	88
PID 4180 wrote to memory of 620	4180	RdrCEF.exe	89
PID 4180 wrote to memory of 5028	4180	RdrCEF.exe	90
PID 4008 wrote to memory of 3152	4008	firefox.exe	102
PID 4008 wrote to memory of 3152	4008	firefox.exe	102
PID 3152 wrote to memory of 1284	3152	firefox.exe	103
PID 3152 wrote to memory of 1284	3152	firefox.exe	103
PID 3152 wrote to memory of 1284	3152	firefox.exe	103
PID 3152 wrote to memory of 3360	3152	firefox.exe	104
PID 3152 wrote to memory of 3360	3152	firefox.exe	104
PID 3152 wrote to memory of 3360	3152	firefox.exe	104
PID 3152 wrote to memory of 3360	3152	firefox.exe	104
PID 3152 wrote to memory of 2160	3152	firefox.exe	105
PID 3152 wrote to memory of 2160	3152	firefox.exe	105
PID 3152 wrote to memory of 2160	3152	firefox.exe	105
PID 3152 wrote to memory of 2160	3152	firefox.exe	105
PID 3152 wrote to memory of 4512	3152	firefox.exe	106
PID 3152 wrote to memory of 4512	3152	firefox.exe	106
PID 3152 wrote to memory of 4512	3152	firefox.exe	106
PID 3152 wrote to memory of 1040	3152	firefox.exe	107
PID 3152 wrote to memory of 1040	3152	firefox.exe	107
PID 3152 wrote to memory of 1040	3152	firefox.exe	107
PID 3152 wrote to memory of 1040	3152	firefox.exe	107
PID 3152 wrote to memory of 5728	3152	firefox.exe	108
PID 3152 wrote to memory of 5728	3152	firefox.exe	108
PID 3152 wrote to memory of 5728	3152	firefox.exe	108
PID 3152 wrote to memory of 5728	3152	firefox.exe	108
PID 3152 wrote to memory of 5788	3152	firefox.exe	109
PID 3152 wrote to memory of 5788	3152	firefox.exe	109
PID 3152 wrote to memory of 5788	3152	firefox.exe	109
PID 3152 wrote to memory of 5788	3152	firefox.exe	109
PID 3152 wrote to memory of 5808	3152	firefox.exe	110
PID 3152 wrote to memory of 5808	3152	firefox.exe	110
PID 3152 wrote to memory of 5808	3152	firefox.exe	110
PID 3152 wrote to memory of 5808	3152	firefox.exe	110
PID 3152 wrote to memory of 5920	3152	firefox.exe	111
PID 3152 wrote to memory of 5920	3152	firefox.exe	111
PID 3152 wrote to memory of 5920	3152	firefox.exe	111
PID 3152 wrote to memory of 5920	3152	firefox.exe	111
PID 3152 wrote to memory of 1220	3152	firefox.exe	112
PID 3152 wrote to memory of 1220	3152	firefox.exe	112
PID 3152 wrote to memory of 1220	3152	firefox.exe	112
PID 3152 wrote to memory of 1220	3152	firefox.exe	112
PID 3152 wrote to memory of 5660	3152	firefox.exe	113
PID 3152 wrote to memory of 5660	3152	firefox.exe	113
PID 3152 wrote to memory of 5660	3152	firefox.exe	113
PID 3152 wrote to memory of 5660	3152	firefox.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\documento_9801312.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CBE71CA4950BBA8BCC41A68CE8B47CE1 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4568
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=88E673C1D8203EF06C8E46080BC24E9C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=88E673C1D8203EF06C8E46080BC24E9C --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1244
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7508F4341DF7DEF002388EA5DF485951 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2984
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=77316D92A0988CCCB2A23CC09A788768 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=77316D92A0988CCCB2A23CC09A788768 --renderer-client-id=5 --mojo-platform-channel-handle=2444 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2784
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DACCD13454313851C691FD0059EBAE14 --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:620
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3F3279051A9C90F0237BF3914D04F5E9 --mojo-platform-channel-handle=2416 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {0e9d133d-2b97-4456-8dac-6e3030f84fde} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27136 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {9b98e55f-0dba-41b1-a98d-af9d9fdab443} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3648 -prefsLen 27277 -prefMapHandle 3652 -prefMapSize 270279 -jsInitHandle 3656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3664 -initialChannelId {e885438a-8417-4aad-912a-e65c57c24744} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3816 -prefsLen 27277 -prefMapHandle 3820 -prefMapSize 270279 -ipcHandle 3904 -initialChannelId {abd779a6-5cc9-4845-80e0-b86edbf9dd7c} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4376 -prefsLen 34776 -prefMapHandle 4380 -prefMapSize 270279 -jsInitHandle 4384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {4eff05d4-f6d4-4005-bf59-ac831866e5dc} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4868 -prefsLen 35013 -prefMapHandle 4964 -prefMapSize 270279 -ipcHandle 4956 -initialChannelId {fad5c8b4-c501-43bd-b0c9-25839ca3d93d} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32900 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {e5232fcd-e33c-47a6-905e-9b56ba5e656f} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32900 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {2188e2bc-6704-4df8-a838-1444442f3f0b} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32952 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {5e18d39a-bb2a-42f1-a99c-ff223f51b7e6} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6128 -prefsLen 33071 -prefMapHandle 6132 -prefMapSize 270279 -jsInitHandle 6136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6140 -initialChannelId {34813655-68c3-47a5-ae7b-fff9b80fac9d} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6420 -prefsLen 33071 -prefMapHandle 6416 -prefMapSize 270279 -jsInitHandle 6408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6504 -initialChannelId {87175f9c-1429-4ed8-8a18-06fdd45f5011} -parentPid 3152 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3152" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 b060e97fd13c58151ba3c91b1bc4b4e86325d264c4615e35807958a4b94462d6
MD5 2fbfb11cc011d8f5febe2d5456eb6c8d
SHA1 e5cba7da34da70ae672ba01735446bb785f1a996
SHA512 e60a191008e98d446e10437527e928302026a8c649e40229136bd4e3a0dbc563863872e043ee426806f41ee4233aad602103a7ceedc593ce43f59fb3bdadb2cb
SSDEEP 384:yezWdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:h+eUZsLQCZsL3hUS4
TLSH
T12853CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 10KB
SHA256 6421d94633174d8a6c444cdd98472ad1c6e270565c9a15655d9f4c5c73b35037
MD5 97599a61b39414586f9434076e9388ff
SHA1 cf854ddbbf434ad91be2ee32538749099077d104
SHA512 ca06255b0491384b3aeab1e8788a31267c478416b06baad056f890b0bc1bbdc758c8aeaded468b2f954879a498def57eeb6a74f61c8625bc4bb80ade22821d9b
SSDEEP 96:uarOkW21jWZwPWc1B7W6OI562WWHxWLFCW:uarJ5RWKzb9RpRIo
TLSH
T1432233F76BB67462F0628FF48059B15C9C32132A596C9684CA4490F702D2A9D907FBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 17KB
SHA256 234e5c9ef029ec00492d2da6400df62dd5444f0bd25bd225db86e6c5a631cea7
MD5 7dfc4cb534deedb693ea6105ac3ddfef
SHA1 276b8a4fec41b77920b22ed7e8c7bf085944e962
SHA512 022b0b92258529b816e2f5f2cc1d60e3e7c93490507d988e0d24563f227b8bc485ded681854ea58cc4d1c4a72bf6b8f42f348f0d66d3ca0b548a53e2423a8f5e
SSDEEP 192:MpeuhenaekFexAeDaeXae/Ge1CQKeZ822zemzZZzeuzFtzeAcTfuer2e:M94Eqx3fJCQp822vzZZHVQ
TLSH
T18E822EFB6BB97463F0638FF48058B19C9C331325586CA6C4CA8491B306D1B9D917FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 8ffa8e3ae6a855987718e7ec7bb22f68d9802fec02723b112a7dc2e1b2304060
MD5 3c193a1de711117eb682fc9adb6692dd
SHA1 02cbb33085509adca6bc4ace41346d434e8def10
SHA512 da321bd1f648c62b887123c053a4f344327f4c04f4654f279188d643f25930a1f217fd1bf83e3e49a2a188da512dcdb7303690ae301396ee547162e913a070e3
TLSH
T12761B85CF228863FE044413ACC861F411F347456A8AF7F2A39AC614D5E5B2CEB68D57D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6de27666de95a29c8d511d4149229d0598d5b535678ca94c1ce6542182009b59
MD5 07cdc96e842ddc7d4c98d9e231d77f7d
SHA1 6ff21c6b4eddc208e40437135ce7af225e573696
SHA512 9038ff833d835945a50183be3e082a61b5a603015a9f87ea55ab95d599222a3d6d2070251ce314c50fdf0cfcc48f1043c638f4f6a52931f3681ad735bf515949
SSDEEP 192:FOv5zboAz+Jmyjs+QrKckJkW21d66Joz1zgCl6mc0dz:aboBJmyjD+Xd66Joz1zgC1jd
TLSH
T157F12158E628867BC408027BCCA51F504F36389BD84E7F1935DC641C2D972DEB68E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 2c169e321df8927e76886e24eb08b43ba811b18efaf2b0b111e54034a9464412
MD5 db5689ad3553a8192d0ae33b0cda7882
SHA1 57e053b4399e08e21149798f7791fdbd9455185e
SHA512 fcabf9dc4ff6a7d9c0d7ce1866afe86b7ec08eb5ce1bfbc2a1b80ea335d1882af20986d0dfb167e0b2199c6363d4a26fe119381d30fdab38495b155646eb850d
SSDEEP 96:3SdF95/7bkW6BrcEJmyUR6Ox2WZdZuFZ2FR6FR4FRkVFRkC/dd66Joz1zgClKtm5:3Ov5zboBbJmyjYxdrKckJkC1d66Joz1H
TLSH
T1FFC1E018F639863BC444023BCCA51F500F76395BD84E7F2931EC64192D962DEBA8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ee555b3a08c02f312b09dcb2c9be9e770b3485a05eb4e766011a5bca72a16ce2
MD5 831a54b14b3f31619b27fb0e7419ec40
SHA1 781ef063f3b2504d60282c654494d508be79400a
SHA512 625cf74f8f8da0c26065c53ffe78d8d06d57423b5e3e0d734f1eae00c9eb99b536fa13db5b4ca9d038247d7c7518a628f76278da9be04b725b5696f935691dd8
SSDEEP 192:wrKckJkC1d66Joz1zgCl6mc0dyOv5zboAzEZJmyjs+:D+Md66Joz1zgC1jnboxZJmyj
TLSH
T102E11068E628867FC408027BCCA51F500F3A389AD84E7F1935DD651C2D972DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3018cda0a72347b08234c73750e9b23d6ccbbbdb6e1591471c8159e991785bae
MD5 0b5a11fa68362cbaf7a2a83892a22fec
SHA1 e0056abacef9dde77469e71f6f00228ccbeb9b81
SHA512 de19ae01f87945d15e8cab776a5110de4b8b313059dd3a917d45f7d1a5ef2020bfe5afc1849c43474b0b4de91072d1220ae162bbfb8d3dfe9fe24e5e8f8af146
TLSH
T106219B5C39BC5D6A5D87E29CB881158E93658A0305871C474D03EF8DCED1ADD327F639
MD5 SHA1 SHA512 TLSH

Submit Download

12f006d9-0b17-4f38-83a8-79c70eab6adc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\12f006d9-0b17-4f38-83a8-79c70eab6adc
Size 883B
SHA256 c23525b28f7b894660b444b0bf9f295a1e7ada135206715648391876984829e0
MD5 33a2dd3cf294b1f3e77993e7629f1625
SHA1 dee7bad4742139935ee669087ff229d9adbefdf6
SHA512 d4b9c3ebf07431fc7f6268237827a78a573644290c8c93536e61354424a5e8c455254839687a3bf221538ceb0d30eac561d0074d3d18efb4ce11adc011c97065
TLSH
T1B61123408534B9B3CD68924BCD953B424FF4B623C0CB941C3EB25A140EBA95EE32A35B
MD5 SHA1 SHA512 TLSH

Submit Download

24a2e9b0-5500-4421-8b06-0e38ac4eef03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\24a2e9b0-5500-4421-8b06-0e38ac4eef03
Size 235B
SHA256 0942f2b005df6aa60c506b5979954391042f84a2eab4e3d5230d652a29b1915c
MD5 f394ebe7a785cf70f300bbb951bf18a0
SHA1 013c2ff83e6e6107d95033c0536959bbf32d2d59
SHA512 d2bac51a9270867f031437fa8720b81ef2a968c7e8a5ca03693ba2280948dd1c394e5c1b47dba1cbd4d704d0b28ca2c9c20babda75f9f446205761063df1fd24
TLSH
T1BDD097807888732C08201F06F0A028C230998C33D864B810CAA045F49EBAEC48121816
MD5 SHA1 SHA512 TLSH

Submit Download

2e346f71-728a-417b-a30a-3567b54d5a78

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\2e346f71-728a-417b-a30a-3567b54d5a78
Size 15KB
SHA256 4afd6aa0f3297d3ed3257c2fbfb11c821b73ef81ec0501ace5e9268e36649296
MD5 8caa781c9530142e0e8e139871fc2edb
SHA1 19d748f1ffaee246877423a93b03e9d0e8c4d9d2
SHA512 fa1d7fc5d96dc343e58e01cff4aa3b02537d4cb2ce71bff2645866fbdf46c47e77d107e9bddf937c0f7b70c963e13d9cb2adb732013bd90ea3bedbfefa7db1d1
SSDEEP 192:XOkHpzxfAu9SF2ieQbmhYiraMXCR11c6OW5cHfByR1qJ8Rr7aSs/j16BMT7X1oN/:zJlv9SF2ieQbghr9XCR11YUe8PiT81D
TLSH
T19D72D916286045BA8251E399D8F8BFC3E6F538CF4C419FCE9BE4BD0869DE09D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3793d364-8485-4d60-8d1b-385d8d27cec1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\3793d364-8485-4d60-8d1b-385d8d27cec1
Size 7KB
SHA256 52d370d6c0a0294f1e24d8134683bdfe9c634d2c6610fd8522a460275aa9f16c
MD5 d0a5b5d2053495b56ed25c78a2110b6c
SHA1 8db6d7b9a497f860ff9d38c2f557f2bd7064c5be
SHA512 17762f75fad511fa666255ea9372cf3fa722cc364209843a7d9ac2babc25cb789ff2d9b264380411f027677bdefc4a997b5e360b6eae9d0c26a050029e52d1e2
SSDEEP 96:S0O7KvS85NzOUhKwVvi3fmp/9Br0SczKYjdXKCoFqV/rK/86csVHbn/Q5dEnKTMh:DO7KvTjgYnN7N3SeJlyAZl
TLSH
T1F9F1CCFEDD1240433B69F62EF5A9BEAB005A293149C8879C6BFC4C3A32D29B75157305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66a30d42-865b-4fbc-9050-83d6dca9cb4a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\66a30d42-865b-4fbc-9050-83d6dca9cb4a
Size 2KB
SHA256 b304405df38207813fcbc77a7706a6ce3becfebd79cb3be516476fd47fa4593e
MD5 044a605bb1bb2777b7a8102a0589bc48
SHA1 dfa39132831aa96801c4cdf90b9ae9c4d5e9556c
SHA512 df298dfeb2e9c76b1aa2564114ce8e62ce84cfb8d827f4c0dabe6f5d69cf8f05c879401e5923a0adbc82ce6dba2e19a93ffde18457350ca5ca301b0b5337de08
TLSH
T1DE41315C75788CF689EAE19D948123CE57608A0340C62CC32E53DF0C8D967AE332A56B
MD5 SHA1 SHA512 TLSH

Submit Download

aff32114-c600-46aa-b020-1e4d4d3fc364

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\aff32114-c600-46aa-b020-1e4d4d3fc364
Size 886B
SHA256 0d0b8152d8d307d70a1c5a05603521c59a01eeff826b00a58e7b0c11084638c5
MD5 4ef12031aa1b682508692da0b36e7f2b
SHA1 48c19efbe15c47a458bf4d738c7e471a3c4cc7b3
SHA512 2ba02e7f026738068112faf4ec8ff028f6fd25d9a3b34ae8d851aec7a64d7438067b85cb128a212e6950cac8eddbbbc74d4ac9c90423cd527604b90a69f09f6b
TLSH
T1821127418535B9F2CD6C82878C94774387D47023C0C6591C7E515B184EF664FE35B707
MD5 SHA1 SHA512 TLSH

Submit Download

dcace8b4-aaa4-4fa9-949f-7d119b4a0589

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\dcace8b4-aaa4-4fa9-949f-7d119b4a0589
Size 235B
SHA256 cf52f3556c8060d176dc2f9c698326798c9f3ef1470d24aaa021e79d2fe12d43
MD5 b6316c72ea4abe27e63c33f9b94e9a27
SHA1 6eec260b68f9873a8a474da4dd14eeb3bc2adecf
SHA512 d9b64bd15668f9f9c7ce0a14b39d4980e30e2783e51d2957a9c195115e0e5d280bfd299408be84f790f72e09abdcc4990eef66d7d0cbb36a0d025fe612b90069
TLSH
T1F2D0978068A8B71C48240F07F0E038C33098CC332960A860EAD71A3499B99CC0151826
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 6KB
SHA256 5fefd3f82d502ee3e4ef54e5226935127f63623e73e092492f3697aaba478b5c
MD5 c16b4ce3830a8782da7e73f53060adb3
SHA1 4bb5795d54a6771cd110c04367274a248c4df149
SHA512 126f629ee0601dec903c438886cc410a8ca6455a0daabc1fa8d869eee82d5970c8b3fde3831d9b539683e6ca9cfa260a397737f0799fdfcd479cd34756eff539
SSDEEP 96:xHltPUTUkqGqFQPfalNkzSy/SSlndv9jjnfyHVd7Bw88P8L4cnsr1zTGS:3tPHR4falNQ/SSl8Vd7Bw88Bhl
TLSH
T169E1207891088B7F64B677ACAC6888715AB2413B77BF68D750B684C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 6KB
SHA256 eabcb4060d57f396aa625ac0098089a58268c70046f3df1274f1d4c8ea905f38
MD5 c60d21112c8470025521a0360762fe80
SHA1 25685145705e01faa9f579b6def6c161e999d3fe
SHA512 496b9bcd34d3bdee52ae822a9ed94d019d64ada9af38697196a0598a6bceaea34be24e67715a20fd051bc8206f8ea5cf17e2080b87dafed31eca825c530bf53c
SSDEEP 96:xHltPUTUkqGqFQPfalN1zSy/SSlndv9jjnfyHVd7Bw88P8L4cnsr1zTGS:3tPHR4falN//SSl8Vd7Bw88Bhl
TLSH
T151E130789108CB7F64B677ACAC6888715AB2413B77BF68D750B684C4015CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 6KB
SHA256 43eb7e3e1ffa7270a465ac3c8aaaace270fb5e472d4ad90eaf13c50ce6cbd2be
MD5 68804d659d800efd1fb209249ef23512
SHA1 718a7a6b5e866d2962f9b2b2f2f6709154fc3551
SHA512 dcfd548396c24a887a05ed6cf787b96c85e0b3e24691957df2ff729051eb0cfe76e0b72efbc4053b4e484aff0e8dd53f5e52da22a948bc1442c51f177e673bae
SSDEEP 96:xHltPUTUkqGqFQPfalNNbzSy/SSlndv9jjnfyHVd7Bw8OP8L4cnsrqTGS:3tPHR4falNr/SSl8Vd7Bw8OBS
TLSH
T107E1327891088F7F64B677ACAC6888715AB2413B77BF68D750B544C4011CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 1a23626ee72ed4a39fd0e1757563a9580fff5782f945355d2a948bf7c636f6fb
MD5 f3390a867b737ccdfb8b3a3277723e83
SHA1 df3fdeef304fa0aa33b4c1a012cae272ee8419db
SHA512 21d3b79b66e7cb4a6e16c705d0da85b5be66e9dafe6cd21c1957468d16a9e239213c7532e45606a3c6681a028cf957c18b0f907354369f6e038d8ac69db22590
SSDEEP 96:xHltPUTUkqGqFQPfaHm1zSyYSSlndv9jypnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faHm/YSS68Vd7Bw88Bh2
TLSH
T1D8E120789508CBBF64B677ACAC688C315AB2013BB7BF68D650B644C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4728-104-0x000000000CBD0000-0x000000000CE7B000-memory.dmp

Download