c80f066f0965918c5b9071ee9779971c5b8043282071b7b8cc30818ad5c53070

Analysis

user interaction
yes
max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
original_message.eml
Size 30KB
Sample260709-pyg3csby2z
SHA256 c80f066f0965918c5b9071ee9779971c5b8043282071b7b8cc30818ad5c53070
MD5 7818f743ed9c5f576915f2d5353889a0
SHA1 386ffea3bd9471e730668c1a41600f06bf78cac5
SHA512 67cc9ddf68a1eb59cb53d2c4514f4406ada88c130e4788c4f21ce64aaf3b5929ea1374c8050d364079168e179e61b669f1e96067b46a69e1bda1e889cbd585ed
SSDEEP 384:Jx8Q/AXJt7DiigYB//VfTJzIvzIbq9XlKNItbvG6m/qCl5+l8vH2iHbfFI:n8yAXXDiigI/NLuvzIbq91K8vM/R5NLW
TLSH
T137D20409AF2D5E908B8813F48E0E2BC54522E7DD5E1E5A4B20EF13A10FEF1875A4B7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery persistence spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	AcroRd32.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	AcroRd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AcroRd32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	AcroRd32.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Z9HS5TFU\RolledAlloysStreamwoodPickup_005440 (002).pdf\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Z9HS5TFU\RolledAlloysStreamwoodPickup_005440.pdf:Zone.Identifier	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	firefox.exe
Token: SeDebugPrivilege	4924	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
2532	AcroRd32.exe
4924	firefox.exe
4924	firefox.exe
4924	firefox.exe
4924	firefox.exe
4924	firefox.exe
4924	firefox.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5428	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 52 IoCs

pid	Process
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
2532	AcroRd32.exe
2532	AcroRd32.exe
5428	OUTLOOK.EXE
2532	AcroRd32.exe
2532	AcroRd32.exe
5428	OUTLOOK.EXE
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
1256	AcroRd32.exe
2532	AcroRd32.exe
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
5428	OUTLOOK.EXE
4924	firefox.exe
4924	firefox.exe
4924	firefox.exe
4924	firefox.exe
5428	OUTLOOK.EXE
4400	AcroRd32.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 2532	5428	OUTLOOK.EXE	91
PID 2532 wrote to memory of 3496	2532	AcroRd32.exe	99
PID 3496 wrote to memory of 2084	3496	RdrCEF.exe	100
PID 3496 wrote to memory of 2084	3496	RdrCEF.exe	100
PID 3496 wrote to memory of 1460	3496	RdrCEF.exe	101
PID 3496 wrote to memory of 1728	3496	RdrCEF.exe	103
PID 3496 wrote to memory of 884	3496	RdrCEF.exe	104
PID 3496 wrote to memory of 884	3496	RdrCEF.exe	104
PID 3496 wrote to memory of 5384	3496	RdrCEF.exe	105
PID 3496 wrote to memory of 5384	3496	RdrCEF.exe	105
PID 3496 wrote to memory of 4328	3496	RdrCEF.exe	106
PID 3496 wrote to memory of 5588	3496	RdrCEF.exe	107
PID 2100 wrote to memory of 4924	2100	firefox.exe	119
PID 2100 wrote to memory of 4924	2100	firefox.exe	119
PID 4924 wrote to memory of 4460	4924	firefox.exe	121
PID 4924 wrote to memory of 4460	4924	firefox.exe	121
PID 4924 wrote to memory of 4460	4924	firefox.exe	121
PID 4924 wrote to memory of 4212	4924	firefox.exe	122
PID 4924 wrote to memory of 4212	4924	firefox.exe	122
PID 4924 wrote to memory of 4212	4924	firefox.exe	122
PID 4924 wrote to memory of 4212	4924	firefox.exe	122
PID 4924 wrote to memory of 2124	4924	firefox.exe	123
PID 4924 wrote to memory of 2124	4924	firefox.exe	123
PID 4924 wrote to memory of 2124	4924	firefox.exe	123
PID 4924 wrote to memory of 2124	4924	firefox.exe	123
PID 4924 wrote to memory of 5612	4924	firefox.exe	124
PID 4924 wrote to memory of 5612	4924	firefox.exe	124
PID 4924 wrote to memory of 5612	4924	firefox.exe	124
PID 4924 wrote to memory of 5792	4924	firefox.exe	125
PID 4924 wrote to memory of 5792	4924	firefox.exe	125
PID 4924 wrote to memory of 5792	4924	firefox.exe	125
PID 4924 wrote to memory of 5792	4924	firefox.exe	125
PID 4924 wrote to memory of 5808	4924	firefox.exe	126
PID 4924 wrote to memory of 5808	4924	firefox.exe	126
PID 4924 wrote to memory of 5808	4924	firefox.exe	126
PID 4924 wrote to memory of 5808	4924	firefox.exe	126
PID 4924 wrote to memory of 2616	4924	firefox.exe	127
PID 4924 wrote to memory of 2616	4924	firefox.exe	127
PID 4924 wrote to memory of 2616	4924	firefox.exe	127
PID 4924 wrote to memory of 2616	4924	firefox.exe	127
PID 4924 wrote to memory of 1880	4924	firefox.exe	128
PID 4924 wrote to memory of 1880	4924	firefox.exe	128
PID 4924 wrote to memory of 1880	4924	firefox.exe	128
PID 4924 wrote to memory of 1880	4924	firefox.exe	128
PID 4924 wrote to memory of 1448	4924	firefox.exe	129
PID 4924 wrote to memory of 1448	4924	firefox.exe	129
PID 4924 wrote to memory of 1448	4924	firefox.exe	129
PID 4924 wrote to memory of 1448	4924	firefox.exe	129
PID 4924 wrote to memory of 3720	4924	firefox.exe	130
PID 4924 wrote to memory of 3720	4924	firefox.exe	130
PID 4924 wrote to memory of 3720	4924	firefox.exe	130
PID 4924 wrote to memory of 3720	4924	firefox.exe	130
PID 4924 wrote to memory of 5852	4924	firefox.exe	131
PID 4924 wrote to memory of 5852	4924	firefox.exe	131
PID 4924 wrote to memory of 5852	4924	firefox.exe	131
PID 4924 wrote to memory of 5852	4924	firefox.exe	131
PID 4080 wrote to memory of 1820	4080	prevhost.exe	136
PID 1820 wrote to memory of 4400	1820	AcroRd32.exe	137
PID 1820 wrote to memory of 4400	1820	AcroRd32.exe	137
PID 1820 wrote to memory of 4400	1820	AcroRd32.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\original_message.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Z9HS5TFU\RolledAlloysStreamwoodPickup_005440.pdf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0AA4F600A74642B02690B904D39660E3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0AA4F600A74642B02690B904D39660E3 --renderer-client-id=2 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2084
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=30F8F4A21DF589B5F15B11B67AFF2F58 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1460
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C7C680F499FFC3491B977AB0ACA82EF3 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1728
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=23AEC9362FC3AF8E3043873439D5A03A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=23AEC9362FC3AF8E3043873439D5A03A --renderer-client-id=5 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:884
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B741B52DD249F5F673842E5BAC7AF4F6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B741B52DD249F5F673842E5BAC7AF4F6 --renderer-client-id=6 --mojo-platform-channel-handle=2656 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5384
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0342ABACC9809A71D1D6025F948445D2 --mojo-platform-channel-handle=2884 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4328
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4D2C92983C45AA89B8AA0F0377442D7E --mojo-platform-channel-handle=3084 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\RolledAlloysStreamwoodPickup_005440.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1256

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {fdbeaef4-054d-43f2-adc3-675dba271ce2} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27135 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {176f60c8-cb0f-4cb8-9a95-5e844fd1ebc7} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3932 -prefsLen 27325 -prefMapHandle 3936 -prefMapSize 270279 -jsInitHandle 3940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {ddf2ebf7-1c30-4cc7-bb63-45bd395c0cd2} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4112 -prefsLen 27325 -prefMapHandle 4116 -prefMapSize 270279 -ipcHandle 4192 -initialChannelId {4da1a17a-8033-4664-86fb-8983368f244a} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3872 -prefsLen 34824 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2944 -initialChannelId {ff01b8ef-ce45-499e-8bd4-d7b89ca49533} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5116 -prefsLen 35091 -prefMapHandle 4980 -prefMapSize 270279 -ipcHandle 5124 -initialChannelId {fa7ce538-97ae-4825-84cf-c46091df881b} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 33031 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {13e56a7e-7e33-45ef-bec5-73cb884c4986} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 33031 -prefMapHandle 5396 -prefMapSize 270279 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {d7085b17-64de-444a-a155-8cabf841efa6} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5808 -prefsLen 33031 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {ce9356e3-f713-49ef-8ddf-2ee2b3fec21a} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6228 -prefsLen 33071 -prefMapHandle 6232 -prefMapSize 270279 -jsInitHandle 6236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6244 -initialChannelId {19d928c9-a3b9-47c0-b216-06e0d67110b8} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6152 -prefsLen 33071 -prefMapHandle 6368 -prefMapSize 270279 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6520 -initialChannelId {4421025d-ac4a-4e7b-88e7-f11bed044266} -parentPid 4924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5852

C:\Windows\SysWOW64\prevhost.exe
C:\Windows\SysWOW64\prevhost.exe {DC6EFB56-9CFA-464D-8880-44885D7DC193} -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /b /id 4080_469596802 /if pdfshell_prevc59d5fa1-db79-402a-b1b4-fff497f402c4
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 /b /id 4080_469596802 /if pdfshell_prevc59d5fa1-db79-402a-b1b4-fff497f402c4
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 988e86303378c48378f6b2f3c5b1e77032d2d9a88f08b0057713148dcfb1f226
MD5 dc92996ef141460f1982ddea719dee36
SHA1 f198463e3529ce8a8199f8786ce37311a9fbd23a
SHA512 ffbceaf91d6ef1792b8eadc08e5ac141737f6971e317e88aeb8a00fed86e9037372288ce95cf0ed8900c4860e45ce8b3b59e392cc317b1525af270bca3996f2a
SSDEEP 384:yebdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:W+eUZsLQCZsL3hUS4
TLSH
T1D653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IconCacheRdr65536.dat

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat
Size 367KB
SHA256 645019a7ea2dec6ab50c260c9e8fa89d3daeaea6911983d5edee758baee75930
MD5 815a35c7c5d4edac7dd8c13670d08517
SHA1 ee0b524249b470bf23372433e5d01b561f353ed4
SHA512 018530bb6fc24c0360eabeab6b88968df9bcf4a0639b0d84b19e5909b9e82d99c3b3b53abfce896cfc1ae0f79ae49691b05e4359dee2ba1b89f332887cc95bb9
SSDEEP 1536:rjKNTBeJFFFFFFpXvDyW3bioBgpPArtpyxxxxxxVzS:fbDy4bioBgpP
TLSH
T1E484664D8A5F8AC2DBD80E7B459D9764D0A8ED2AE2D3ED666184730503713E710BF22F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserCache.bin

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
Size 39KB
SHA256 6e6235e674dd217d26ac297d4183ff65f757b348016646175f1331eb5b15c99c
MD5 59087bb4d8db091e46749649e44c839d
SHA1 0859a1cacb8905acc6e0935f633fc75e1cb6e9e6
SHA512 d144773836ecc78a6048e1fb3a4ec2c006db7a8166d71048a65365f4830e4b113e956972272efdc387db427670b9fb0e0cb3934bb28a9513d4c20e239a638cee
SSDEEP 384:K7X4uyVFd3nBbb6sLrext5qA9kg7bmYNg7y:KT4uyVFd3BHbnEqA9kg7bmYyu
TLSH
T14903D44CBCBC5713D5565EB6724CDFA0AF3499336AA94F0E81B836255E523E8BF28007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RolledAlloysStreamwoodPickup_005440.pdf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Z9HS5TFU\RolledAlloysStreamwoodPickup_005440.pdf
Size 15KB
SHA256 6b26cfb685c6b9d0af943c42a2fb622fbfe055481a8ab57b48f082556ef2372f
MD5 619f537c48a76aa52acff79c70e0f9c9
SHA1 fa7adcd52cbd7d8ed64c89b02b572ccd5cb8048c
SHA512 97131bb4062248ecae11adc6d94c6e40eb898938f526e87e17dd2f882ed7a8795d8c68abd11eb87573cbc224de02623eb438c3f170942bfcac73f0abca980de0
SSDEEP 192:INRK3okMXMdQs272uf7EdfxldfqC7Ku/DpqEIEzWnYGfhHGY/x9t:I7K32XMC7lWlBqClsEDTGfhHh/x9t
TLSH
T14A72C62D289F7BB9E8721A0C4F563434E51F326BCDC0A6403FE98707C6A8F499A96543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 12B
SHA256 e7bcd23ba708556ee69f96050dc7e74f9dab95825bfab48bcea7fd8fac482fd1
MD5 f6f801e5b0502f5e803ed826dd37ae44
SHA1 273e87aa518397186653443c0c3e81d574361708
SHA512 8fe0217b9c7f9331664dc4259c7924b9c7e5e145f0b795ec98d713e41a2e3d001014b3ac41071fe41447632ddbfbbefc8c7d6de8fa9faeca455a0a78575e5584
MD5 SHA1 SHA512

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\AlternateServices.bin
Size 10KB
SHA256 8e8ace16f19f06bb28b4c99b59f46606654bff0673aac8b30c1769ff4aa5808c
MD5 b212d18002ca11ecc8d11559354dadc3
SHA1 6ba93888cbd918130c5bd95077d7eb3ee6ed8d04
SHA512 c335d0546e9079b3081a4c5d3cddd4a1bcfdc6bd8c7394ba955c6739bb47cb41d30a815e996a9b9b82a95a9ad9ca311d9580c0179ac9b43a7f1fce6b43ba3b7c
SSDEEP 24:3uhMZimY91SKd9x2KJ9BaKD9VvUK49lLK75q9F55A5CKv9Bb0GKK:s/nXHrbxB/yU1I56tV9D
TLSH
T1C2225AE76B72A472F0A6CFB480A9719CDC331335196C9585CB4480E307D2AA9D17EBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\AlternateServices.bin
Size 18KB
SHA256 dc2b7d21a4c735fb7c4c4fe10f866cbac2be2c3fa92236d757f007d054289049
MD5 7f6efc9da0f961144006941fe987eb8f
SHA1 ec0668d27620f1d265bf4362c36f8b14feea1924
SHA512 21e764a509d7adfa0a9d1a0174d1a34cc6e4ea56ce89ed8798d573827f08a54071ee264fbfa288aae6ac67971bfb3976995bf767ca7416725b1dc0ac320d14d2
SSDEEP 96:ROKueaKBmC0VI56d6KhM/pmcaa0guHyx2TXyuZT/y8tT:YQK22jZZrFt
TLSH
T1058276E73FB164A2F056CFB884BD709CDC7317291C6C95D8CA0491E74385AA8D17EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a1df375b78a5e2f0641528f89454630ff6ebfea3e4dd3343bcc33e18a686b478
MD5 024159618dd616753e27a1097fe1f773
SHA1 51d8b4ff049008042a21996262c233d5dfdf45ff
SHA512 83f7fdb7b41f2830812d7768f94c8c30184de500bb478082002dcc1e72ee89fac1f8ebe33bdc1868ae8c3cb8fabaa31d1c84b3fc8a0ebcaee6c38b09090d61a5
SSDEEP 192:oc5EpTFwy1d66JozGzgCl6mc0dfOv5zboPzjVTyjD8r:47d66JozGzgC1juboHVTyjQ
TLSH
T186F1FC64F629867FD418027BCCA62B444F35388A984E3F59359C601C2D973DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8df283be15d7b3e43acd2769fb96fd060e3102bb7a52bced4a305fe3e7433f6f
MD5 dc272e1e585c7d7dde50e78c9856a4a1
SHA1 6cb3d7011e52269f22852b5cd9785f7b431cf9e1
SHA512 54012ef4a62a6b217abd000ae9257b1b93bb79cc59653994ab48500e6fff6d95e928e0864c2f5d87896ece44e47f3387dcdd743bf9da8937eb93d5b1544cc361
SSDEEP 192:mOv5zbowbVTyjD87c5EpTFs1d66JozGzgCl6mc0dz:dbowbVTyj8Qd66JozGzgC1jd
TLSH
T14CD1FC64F638863FC418023BCCA62B414E76395B984E3F69359D640C2D963EE7B8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4d890d8cc23c0f9934962e0607d47a0f975b4c66677cf6759600db88565a9515
MD5 e622caf70c6fab684fc791d8529e696e
SHA1 ac6886365aa4bc720c3b1e685c79976616da9fbb
SHA512 a3484997f9bcded63f062307777970d6e995e6d21caf320610c9803c6104e7575c435ddd2ab61be9f13099e3c7793d4cd6edd18f57166586d537339a72f9b61b
SSDEEP 192:tOv5zboPzRZVTyjD82c5EpTFs1d66JozGzgCl6mc0d:CboFZVTyjTQd66JozGzgC1j
TLSH
T159E10D64E639867FC418027BCCA62B404F35388A984E3F69359C601C2D973DE7B8E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 545d9619e97dc80af59ee09c1991690e46574f498121b143a73c5809ea4a0524
MD5 bcd509d336d4da9c82e413eb161cc1e1
SHA1 24e18aa02a9ca23c565f6754eb29adb5ba0ebf83
SHA512 af6746b6f49b041e6d8f2667f40a0dc4fdd6eb1736e7f2580a5f95ab838379b1bbe138d6ec28861f6dfe640256f01f3872308d8f96ed21d59dc491fec02f5fd2
TLSH
T15E81DA18F629863FE449013ECD961B905F307496A86E3F1A31AC644D2E9B3CD7B8D07E
MD5 SHA1 SHA512 TLSH

Submit Download

05d226be-d038-449c-b785-c8773d858d62

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\05d226be-d038-449c-b785-c8773d858d62
Size 235B
SHA256 d605fafebc4f2cea5b4f38cb48685540559bf6fb8bf31c9d12619a9ea7621581
MD5 7adb3c9b563f9f8bc35e1584cd46e1d6
SHA1 84644cdad81503a2cc06e0d3ffe8063efd154553
SHA512 9f4a04d58519b3c6db46944df48ea8f132046c47a18bc64b90c4333bd541435b97ef0578d2ea415d1402ca7ee71ecc433d2c0e4742ff4a5b494702e7516aa6db
TLSH
T1ADD097C924D8BB6D08001F07F0A038C630A98C331478AC14E9520234B9F9DC8829281A
MD5 SHA1 SHA512 TLSH

Submit Download

09b991aa-4966-4d7c-9a78-f49508c4924e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\09b991aa-4966-4d7c-9a78-f49508c4924e
Size 8KB
SHA256 a074cf53ce4da7f480f1cda927724becb7dc60e1757149e30f0ddb4f73b62ac8
MD5 511abe0d973e6d53bb17a6e967308ac9
SHA1 c80f32cde8b1d170f02477d626b4c7f4313ba187
SHA512 766cb3a8ce87f9375585b1c73fc371fba1e88c3bbb1a72d2852eabdc1f127fc2e15de2ea3e35fc0659305d77088dba2f3491195c2984f170c045ac4ee0357dcd
SSDEEP 96:CorvBLNfU9w6hsaljkzhSkiOJ8D/GOemN15D3/sV4gvKcKABXMMeMBmhcB8ezU/O:CorvBptuZcB5S+tpt2u
TLSH
T17A02BAFEDD1240433A69F62DF1A9BEAB005A29314AC8879C6BFC483A32D29B75117345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

278ead78-887a-4efc-adf4-4d30d4e68398

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\278ead78-887a-4efc-adf4-4d30d4e68398
Size 886B
SHA256 9a83e97796693be773a5891045ed6541d15071eabfd3831c60007272f87a0e06
MD5 3809ec057b1f5e85a5c7ffc40f7ecf50
SHA1 aa4d28bb9013eab71e160028f6b5d186ad492e68
SHA512 ef488007842d9d3e5f292c49e5c345f815f0253c5d72e20be4a196310b3a232129a03c8fdfcfd53b5007a8352b794b0879b83b3eeb88249b141ad6cccfe57eff
TLSH
T1E4116340D638B6B2DC7C914BC9E177438BD46423C0C619947F600A1C4EFE22EA36B20B
MD5 SHA1 SHA512 TLSH

Submit Download

8ee449bb-5635-4b48-8ce7-74c1c2d52e08

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\8ee449bb-5635-4b48-8ce7-74c1c2d52e08
Size 235B
SHA256 e3f15e04da184c956e5c3cc8641472dbdf8add04c1431f2434eb8c5f9e8436f5
MD5 d07fb4fac51c2e86605db84d60ae4618
SHA1 df888046854b71310e2c6b5d54f1c456ae2b9d32
SHA512 6d1659668d6ea7b384b37172543b00fbb1738c02c5cfca070f75ac3e11c39e86aad7432b74cfd96a7c067105199e03a4b09683af21064729617ce3a59017787b
TLSH
T11DD023CC34882B5D08101F03F0F1ACC730948C3354B89C60CA5004B4D9FDEC94193D1B
MD5 SHA1 SHA512 TLSH

Submit Download

9f2c12e3-9319-4e07-9bdf-637d223c9287

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\9f2c12e3-9319-4e07-9bdf-637d223c9287
Size 2KB
SHA256 2dacea382ece16d60b0dc55725edb659414916336d5a35777d6acf265ec2c8af
MD5 2e5132d0a534adbd7654c7977a767fbe
SHA1 bb44fa4cdb87585aa6cea80bfbcd55641a7196f6
SHA512 28114bb8139dc7f3c84b9f1e2551531d840239386243cdae0906d64339299db8d72052b062fdd15fdf586309b0a2912f2b7d796739c91b8fc5189e923b7c11b2
TLSH
T1C541612C76785CBA89AAF19CD5C1374E47A08E0310C22CC32E51DE4CCC9A79D333A67A
MD5 SHA1 SHA512 TLSH

Submit Download

cc749c5a-a064-409f-a7a2-7f6b5b175dbe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\cc749c5a-a064-409f-a7a2-7f6b5b175dbe
Size 16KB
SHA256 be7508f7d7a478bf39f4eb50bcfa8562e5543da6fbd5bc368ddd5c9651fccd6d
MD5 d1705f852b41cca0129c9c6ec852bc77
SHA1 7f0c83badcbe16cd195dfabecae5f82effd9125b
SHA512 68f1c74c251bd4ebcce648bbf6704ea1eaf45a795f156aa57bfe85f22bd4fedbd2633bca4008e66004abf203ed02c4a9de88083cd7ce765b4432c5e5f478e672
SSDEEP 192:hoc99bj241oEz6j2iuNtYs6yBKGXwBTbH1tjaf8khRzh5JR1N2Sik90AkqN2Tf5y:ztGEJyVnGUkhRF5P1NeI0ATN2o+yF
TLSH
T16F72BA162460497A8691E36894F8BFC3E6F538CF4C419FCA9BE47D087AEF06D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1915dd2-5a94-49de-946e-4078f671d990

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\f1915dd2-5a94-49de-946e-4078f671d990
Size 883B
SHA256 3cdd01633ae6f6c3b5b891f422052ea8d0b43d76dc505f88c60b7de00da034fc
MD5 e1b6779ecec436db0e1460f7fd53e42f
SHA1 86f8655502020aa2bdb4a78e00302555de502b16
SHA512 6ede7933ef26ebdd0e916de188968a9f00c397b8f4a507ca872ce00b3edd2a1cd89917536ba146c7569671c96e85c06d4ead36c6a5791a16eabe869f7e53e5ef
TLSH
T1F3116741D538B5F6CC7C910B89A137024BE4652380C594543EA10A080DBF62E936634B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 6KB
SHA256 eb3378267abba98019081da611bea8c7c58e4d2949c462a92f1f05c929fc6239
MD5 9fe19462055e92b2934fcb00d5aebbe7
SHA1 6e21ed3f7c210b6c78a4f150eb70241f8c096d21
SHA512 4967eb64ab4e417b383a553a8703044e09d3dc7f38e826fbc34910cedf0eb3ede16934553319dce3080c2259affa98401bdd5ac3ae114f34955e5bc79a1349ba
SSDEEP 96:xHXUTUDqGqd2EfN0QkzSMaNSSlDdv9j2nhHOZYu9fBw88n8L4cnaV2eGS:teRRfN0QjSSm8ZxBw88Dt
TLSH
T1FFE1007890088F7F65B6776CAC6888716AB2413BB7BF68D610B554C5010CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 6KB
SHA256 2e523c7deda10ad67fc1c93c66afa0ef6d9f56c2cc85c56a818a8da30911e2de
MD5 511e2f7e95a92284d191587bc5c89d8b
SHA1 97e77cd6bc095326e362a8f3e59d8e97afdfa002
SHA512 b72d25533af95e40d4a5d1e1298d6770ab45b57b8edd606e6849c7d6ac66e9b447d6758cac64f69012884e75ef9bfd5296abc5cae20214357040f571931a5ea8
SSDEEP 96:xHXUTUDqGqd2EfN0Q1zSMaNSSlDdv9j2nhHOZYu9fBw88n8L4cnaVQeGS:teRRfN0QwSSm8ZxBw88Dj
TLSH
T1C4E10F7890088B7F65B677ACAC6888715AB2413BB7BF68D610B594C5010CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 8488a7fce0a0a4273bf5cfe726980f897781014e86cf0aa57d2907522e601a04
MD5 2d5dbcac9414b0a5d40181fa909f3a02
SHA1 b7d686dce9d2f2036ac4b05419a137feca6d60a0
SHA512 c3869ec60a397523009980d3c592981b6ee3912a5f5e176298d3faa7aad8240a5df23331c936fc7027a000ec161a15657ef515ed0c281c5123d23099e12f1673
SSDEEP 96:xHXUTUDqGqd2EfNt01zSfSSlDdv9jGnhHOZYu9fBw88n8L4cnaVQX:teRRfNt0aSSS8ZxBw88Ds
TLSH
T186E11F789008CF7F75B676ACAC6888716AB2013BB7BF68C610B554C4014CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 d8559956110151fc1618e6cebcafaa907402309d4a798e5bde410b965169ff2a
MD5 1817e72c8013681f4c6de9555572a629
SHA1 b354bc2424c20629a4c8e98e147d945af6ceb58a
SHA512 e023084ef6b63afd4c510b8befb33bdf3eb9638cea5f4d88fbce6ad671df7ae433e49a4eeebd3c0bf9807c38007f42a3db171c46b533c5e3a0666797c85d50e6
SSDEEP 49152:07xefsJyaP6ryMtp6d5C9S8rRz3UghkR0bPGYRpq7:eYfsMaP6ryMtp62Rz3Ughk8q7
TLSH
T1A01639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5428-7-0x00007FFCBA050000-0x00007FFCBA060000-memory.dmp

Download

memory/5428-8-0x00007FFCF9FD0000-0x00007FFCFA1C5000-memory.dmp

Download

memory/5428-3-0x00007FFCFA06D000-0x00007FFCFA06E000-memory.dmp

Download

memory/5428-9-0x00007FFCB76F0000-0x00007FFCB7700000-memory.dmp

Download

memory/5428-4-0x00007FFCF9FD0000-0x00007FFCFA1C5000-memory.dmp

Download

memory/5428-10-0x00007FFCB76F0000-0x00007FFCB7700000-memory.dmp

Download

memory/5428-6-0x00007FFCF9FD0000-0x00007FFCFA1C5000-memory.dmp

Download

memory/5428-49-0x00007FFCF9FD0000-0x00007FFCFA1C5000-memory.dmp

Download

memory/5428-5-0x00007FFCBA050000-0x00007FFCBA060000-memory.dmp

Download

memory/5428-0-0x00007FFCBA050000-0x00007FFCBA060000-memory.dmp

Download

memory/5428-1-0x00007FFCBA050000-0x00007FFCBA060000-memory.dmp

Download

memory/5428-2-0x00007FFCBA050000-0x00007FFCBA060000-memory.dmp

Download