41008ed5bbe29ab369256264b80bc28b77b3f2abe28ffc2d6c084b2aa03ed7c2

Resubmissions

09/07/2026, 16:08

260709-tk987sc17m8

09/07/2026, 16:07

260709-tkvhrac15r3

Analysis

user interaction
yes
max time kernel
33s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
explainthisnoodle.gif
Size 4.4MB
Sample260709-tk987sc17m
SHA256 41008ed5bbe29ab369256264b80bc28b77b3f2abe28ffc2d6c084b2aa03ed7c2
MD5 c004f0cb934f4b06f8e939ac3a7a0d20
SHA1 b9bf5bd04b35b1f13ac83fa815448566a529c937
SHA512 104be8c2ba478bff00742bd85df8f25b55248068232efdcafca17da50f98ee6d99621856778641a028c70b9f8616703afe65dfebc9d3725fb53729890665c3df
SSDEEP 98304:kRaULrs6YIAKLTnLtfdgXtsrhk2eTDXVJygUAFZToxCRCg:WM9wDtdgdQhfe3XLygfeCRCg
TLSH
T1EF263380ED6EC4C35BB9365A3A52ABB07E5D2C1DC5A50F6072D2ED2EA2001D5D7E87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
432	chrome.exe

Checks SCSI registry key(s) 3 TTPs 50 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{F63CE961-6F4B-420A-BA18-AC9AFF9004ED}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{E6DD5C13-DDA5-49BC-A917-CE0FD851FC48}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2884	mspaint.exe
2884	mspaint.exe
984	chrome.exe
984	chrome.exe
260	explorer.exe
260	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeShutdownPrivilege	984	chrome.exe
Token: SeCreatePagefilePrivilege	984	chrome.exe
Token: SeDebugPrivilege	6096	firefox.exe
Token: SeDebugPrivilege	6096	firefox.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe
Token: SeShutdownPrivilege	260	explorer.exe
Token: SeCreatePagefilePrivilege	260	explorer.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
6096	firefox.exe
6096	firefox.exe
6096	firefox.exe
6096	firefox.exe
6096	firefox.exe
5456	sihost.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
260	explorer.exe
6096	firefox.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
984	chrome.exe
260	explorer.exe
260	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2884	mspaint.exe
2884	mspaint.exe
2884	mspaint.exe
2884	mspaint.exe
6096	firefox.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 6056	984	chrome.exe	93
PID 984 wrote to memory of 4960	984	chrome.exe	94
PID 984 wrote to memory of 432	984	chrome.exe	95
PID 984 wrote to memory of 4960	984	chrome.exe	94
PID 984 wrote to memory of 4184	984	chrome.exe	97
PID 984 wrote to memory of 4184	984	chrome.exe	97
PID 984 wrote to memory of 6132	984	chrome.exe	98
PID 984 wrote to memory of 6132	984	chrome.exe	98
PID 984 wrote to memory of 1420	984	chrome.exe	99
PID 984 wrote to memory of 1420	984	chrome.exe	99
PID 984 wrote to memory of 3044	984	chrome.exe	100
PID 984 wrote to memory of 3044	984	chrome.exe	100
PID 984 wrote to memory of 3964	984	chrome.exe	101
PID 984 wrote to memory of 3964	984	chrome.exe	101
PID 984 wrote to memory of 4908	984	chrome.exe	102
PID 984 wrote to memory of 4908	984	chrome.exe	102
PID 984 wrote to memory of 2568	984	chrome.exe	103
PID 984 wrote to memory of 2568	984	chrome.exe	103
PID 1892 wrote to memory of 6096	1892	firefox.exe	105
PID 1892 wrote to memory of 6096	1892	firefox.exe	105
PID 6096 wrote to memory of 2184	6096	firefox.exe	106
PID 6096 wrote to memory of 2184	6096	firefox.exe	106
PID 6096 wrote to memory of 2184	6096	firefox.exe	106
PID 6096 wrote to memory of 5320	6096	firefox.exe	107
PID 6096 wrote to memory of 5320	6096	firefox.exe	107
PID 6096 wrote to memory of 5320	6096	firefox.exe	107
PID 6096 wrote to memory of 5320	6096	firefox.exe	107
PID 6096 wrote to memory of 4408	6096	firefox.exe	108
PID 6096 wrote to memory of 4408	6096	firefox.exe	108
PID 6096 wrote to memory of 4408	6096	firefox.exe	108
PID 6096 wrote to memory of 4408	6096	firefox.exe	108
PID 6096 wrote to memory of 1984	6096	firefox.exe	109
PID 6096 wrote to memory of 1984	6096	firefox.exe	109
PID 6096 wrote to memory of 1984	6096	firefox.exe	109
PID 6096 wrote to memory of 6008	6096	firefox.exe	110
PID 6096 wrote to memory of 6008	6096	firefox.exe	110
PID 6096 wrote to memory of 6008	6096	firefox.exe	110
PID 6096 wrote to memory of 6008	6096	firefox.exe	110
PID 6096 wrote to memory of 1332	6096	firefox.exe	111
PID 6096 wrote to memory of 1332	6096	firefox.exe	111
PID 6096 wrote to memory of 1332	6096	firefox.exe	111
PID 6096 wrote to memory of 1332	6096	firefox.exe	111
PID 6096 wrote to memory of 1692	6096	firefox.exe	112
PID 6096 wrote to memory of 1692	6096	firefox.exe	112
PID 6096 wrote to memory of 1692	6096	firefox.exe	112
PID 6096 wrote to memory of 1692	6096	firefox.exe	112
PID 6096 wrote to memory of 556	6096	firefox.exe	113
PID 6096 wrote to memory of 556	6096	firefox.exe	113
PID 6096 wrote to memory of 556	6096	firefox.exe	113
PID 6096 wrote to memory of 556	6096	firefox.exe	113
PID 6096 wrote to memory of 3716	6096	firefox.exe	114
PID 6096 wrote to memory of 3716	6096	firefox.exe	114
PID 6096 wrote to memory of 3716	6096	firefox.exe	114
PID 6096 wrote to memory of 3716	6096	firefox.exe	114
PID 5456 wrote to memory of 260	5456	sihost.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\explainthisnoodle.gif"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb8,0x134,0x7ffa7a42c728,0x7ffa7a42c734,0x7ffa7a42c740
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11780138235241499790,17367125367537023898,262144 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,12893188594003485839,13066268933622643973,524288 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,6696085377954121363,17300700921831341676,524288 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,2395807067095040272,1206352752371456961,2097152 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,7513304417417726011,1940526202185370502,2097152 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,4624241574478459265,4636841412802051424,2097152 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,11798029229301810847,5366653246322598920,524288 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,5564040841083897772,17236603775231375633,524288 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,9242460647553481596,11488489481741210232,524288 --field-trial-handle=1892,i,8971955543415904434,11302462449273750788,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:2568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:788

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {fbc429ce-f3d7-4629-8e19-65794ce2782d} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {9a5bff39-ee67-49f3-b8f3-13d22ac0055d} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3812 -prefsLen 27274 -prefMapHandle 3816 -prefMapSize 270279 -jsInitHandle 3820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3828 -initialChannelId {066a08b0-9292-49aa-af68-d357e71a1e97} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27274 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {0e4060b7-8731-4ee5-a0bd-d975c8fb2f1d} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2572 -prefsLen 34773 -prefMapHandle 1172 -prefMapSize 270279 -jsInitHandle 3404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2812 -initialChannelId {9731b7b6-c9af-45a6-91dc-71e0268be4e6} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:6008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4976 -prefsLen 35010 -prefMapHandle 4980 -prefMapSize 270279 -ipcHandle 4864 -initialChannelId {f13b2703-19d2-46f6-b779-6c5487395735} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32952 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1628 -initialChannelId {59e84a68-d447-492d-b3f3-0001c503529e} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32952 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {ac66c6b3-08b9-48fd-8f77-49e3fb20960b} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5428 -prefsLen 32952 -prefMapHandle 5416 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {edc7bde8-daf2-49e6-925f-1d86fc7a7e96} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4912 -prefsLen 33071 -prefMapHandle 4916 -prefMapSize 270279 -jsInitHandle 6420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2724 -initialChannelId {b7da7b30-5646-46e8-9bd8-b82ac00a688f} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    PID:1280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6304 -prefsLen 33071 -prefMapHandle 6360 -prefMapSize 270279 -jsInitHandle 6256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {38998340-b44e-46cc-b967-089be1e29d98} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    PID:6604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6960 -prefsLen 34776 -prefMapHandle 6964 -prefMapSize 270279 -jsInitHandle 6968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3160 -initialChannelId {9e61aff1-e6ef-4107-a9e6-179fec0ce5be} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    PID:6252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6428 -prefsLen 40022 -prefMapHandle 5744 -prefMapSize 270279 -ipcHandle 7116 -initialChannelId {ecbbcbc2-f37f-4655-a396-9a3491202025} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    PID:7140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 3056 -prefsLen 40022 -prefMapHandle 2676 -prefMapSize 270279 -ipcHandle 5524 -initialChannelId {ecbef60e-1d86-4a73-b5f2-e7e5d1269d20} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    PID:6284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7504 -prefsLen 36885 -prefMapHandle 7508 -prefMapSize 270279 -jsInitHandle 7372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7356 -initialChannelId {e6775ea5-59e3-4dcb-9ab8-ad320f1a7678} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    PID:5984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7808 -prefsLen 36885 -prefMapHandle 7784 -prefMapSize 270279 -jsInitHandle 7776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7796 -initialChannelId {fd71c206-6a21-4a01-acbf-11e092545eaa} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7924 -prefsLen 36885 -prefMapHandle 7932 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {eb1f3218-a78c-447a-bc33-47f631f58fe8} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7924 -prefsLen 36885 -prefMapHandle 7932 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8132 -initialChannelId {34a8629f-048d-4be7-8273-140f4516dc15} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    PID:6216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7352 -prefsLen 36885 -prefMapHandle 6928 -prefMapSize 270279 -jsInitHandle 7160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6496 -initialChannelId {bba3b6bb-c077-46c0-885c-29e1dcc27fde} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    PID:6180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6648 -prefsLen 36885 -prefMapHandle 6660 -prefMapSize 270279 -jsInitHandle 6656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6644 -initialChannelId {4cb0f42b-7a61-4be0-8501-06111da3ec20} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    PID:6660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8172 -prefsLen 36885 -prefMapHandle 8168 -prefMapSize 270279 -jsInitHandle 8188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8160 -initialChannelId {6e6d62ae-b16a-4185-80f6-a0d2c8aaab60} -parentPid 6096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    PID:980

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:260

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2516

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 b457d3c7f29ca2dd6d55939f23a6f03a23fcb34c89541a71509593481479fa31
MD5 213a66da4c49ae6eb149c83244c9e930
SHA1 63071385783192b58845b31de20c7ac65230fc7e
SHA512 d16eb1933f226d09b4426e48e9d7cd8cb9b6b8842e49111760d66738a69219d4bd551dd3d03237c06cdb3aa3addb3c55c9fa98199b52ced7d6f1da8f2063bd63
TLSH
T101F059A7F26EF5A3107D957F1E04BC095D75A4350242ADF8CE9B427EB08A0BB1F0244B
MD5 SHA1 SHA512 TLSH

Submit Download

ad1d3aa7-9dab-4418-bee7-30d32dd92a6c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ad1d3aa7-9dab-4418-bee7-30d32dd92a6c.tmp
Size 1KB
SHA256 9f1d46dbc77a6722b77e772a2f3202d7bab3fe21d78ac0b303e58ce88eb1bf1a
MD5 0ccab304a7fb4c7c695a986b876b4322
SHA1 4259e6f5ebab889ad0fd1146ff69920efb737273
SHA512 87da0e69a25cef796ee71bae06b927364b95471e680653ee24c7b8c14ca4a0a2ebb6d55d416314d9a8d39578507b0e730e729a511489a4a9144c287ac43e87a0
TLSH
T112319CF7C7D4957E890092F8A7156F1FCE290A54531C3C27C8E4AE1F57E18B1E24054E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 ca09f3ecda6ab9fdebc28024869c93fc021bc5d804bfc746bf88440486119ecb
MD5 da08f59818fe8e18847b4ef7b5846211
SHA1 2f63e9cc3561b7dc944b5ae7097a52fe9715aee7
SHA512 cd3e2813df6024fcd0bcdb27cda8fd1e3b5ad8312424a3c4c987fd4621c65ed463b666a092fe1783ef1ba5e19fdf351097ef5c85cf2dc62981ab2cd2a4e2ff6c
SSDEEP 192:LRrdIYqmv7DDAPRp2q99Hsb+WNnYJdDA3HPyIsnAUgR:LRrdvqSmXd/wEdyDR
TLSH
T10F22642EAD24A53B5CCBD229FA757753D6F5102126E02E44E6FC8E2C12EB6CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 5d419091364e950e1f726ac0282fe90b1b2082f733ecaff3bf597aee94b21a8c
MD5 60a211c98142e082adc1fc2c563f0a47
SHA1 6f1aa8ca27b53c06e4238affd4065a144ca3ea43
SHA512 10f288e985977ef88e15d052616dc6930d2fafe655877984b28a25624ca82e8d44f60f87d044d6ff0a461474f140dd2be52c074dd05a7b23146af870a08a114c
SSDEEP 192:eGZ4K6tV7KxkXqK4I40pUZNCgVLHrKHfFKslEFPdXzKD/K1+ErUkKN9NlwLBHxCo:3ZjyV7KxkXqKf/pUZNCgVLH2Hfgslwd3
TLSH
T1FD32EA27998DAA7F4FD8D51CCC566F4B6DB5029633280C2452FFAD0803A97CE114E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 514429b907b8ed116ee5583c7cdf3bcdcd9747d0bb4bdfcb3eea9e04a9d7d2bf
MD5 2cd44c81008537a67a0b957d20d690e8
SHA1 370a9fbbf9bbb469ace1068968c9e51fa2189218
SHA512 f7d363d54a5a242cbeb0e6470ce52e32a89902a5474e6c79df6ea5240ea6164ebf825da327714166b2163785d45748683d7978c5c2ee6e1cb275da1dfeed81c5
SSDEEP 96:FuC6Cd+T5Kj8OfQo1LrQRDotok5usDmB64GyvbNsbFYbcLDqv4a:8ClTjVWDUDh2gosbFYbcLo
TLSH
T11AA1FA71A4795C7764BAC488B5417B43CFBC70ABA591AFC4A9ED1F0C01F74AD1302A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ea477076669ccd80c226d6d046a4b053bdfeb45be5108d11bfb173843b7abf25
MD5 b786f9649040a960e5af591d0b86443e
SHA1 a639b3f08b293d2b76c5a276b700b21ff0184839
SHA512 d374bf99d643be97ec7395c1567811686684339fdf7a385c190c97a88323566f8cba8a1c3509c1d1c1b5302606f66c08e041dd6d67d37248c42d409b35f09982
SSDEEP 96:FuC65d+T5Kj8OfQo1WryySl8h4otok5ukDmB66Gyvba7FxwzzlYKII5qMB0j9ISq:8CGTjVGiUDV2K/7FxhKII5qMBUC
TLSH
T118C12B71B47DAC7765F79444F1023A83CEF860ABAA01AF94DAEA0F0E01D34BD1707526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

0FD35C24C6946E67074C4EF246DC212470D0D7BE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\0FD35C24C6946E67074C4EF246DC212470D0D7BE
Size 248KB
SHA256 7096377c50c53c49066131579c361c261c71419a62db0947fdcec18985151288
MD5 fa889e8098642970086ad25669d9dabd
SHA1 53ec1a036ac3020fecc51ce38cdd0afd3ba30fca
SHA512 14f6681eef29877b47c606bef8874f1b950a6e11155bd2578f582cf5640014d3cd4ca405a967c1629ee9a8f659c4fa20ebf7262a4a160ab09322a25a3b254be1
SSDEEP 3072:z+MQ+zywCmxaWcE8BI9YRSivbEpeePb+Mdmf6HgqAphoiHjJo2Xs8L8WDgC0R4rZ:zpQaDcEfzivbEEei/JljXs8L8WDgVSrZ
TLSH
T11544F826EE061613D92007F040AB27363A75E442AFA2F33B5ECFB112BC6D7790D655AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

145E8BDE918966231E7DA95A0B03EA7FAF90A9AB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\145E8BDE918966231E7DA95A0B03EA7FAF90A9AB
Size 13KB
SHA256 715ed24c58843512acf217d597aa50c3fa48e0dd5727eef91e924a498fa106f4
MD5 4dd0ed9fb3f3bd4fb141f1b14be215d1
SHA1 88e73a78b4577ccbf7065f478ac4f919557c8197
SHA512 7340dc9fd3e85e8e16539b44154db22298acace0c4b8d71bca5ace078973df0d80349c66b53ddc07dedbe7f1dcdd338f71b27b1f6eb325499d14e007126c4aaa
SSDEEP 384:dVEqaVfO78YfuD3c5vGEbEpugNuM87Nk4P:dVSVf88Yq3c5eEbEpugNuM87i4P
TLSH
T1C952BF3BAC5128B0D71059B1C39477272DC4AB93AADBE0F5F1A07AE65CC2792D0574CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3991D931A6191295A0F0904FB024C3A4B4A86E46

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\3991D931A6191295A0F0904FB024C3A4B4A86E46
Size 153KB
SHA256 6fcd6f5af013df29ab53df0ace75fc88f1d26ae5487ba4d48a00db2cb27033a3
MD5 7c2c990cdf4096731966258e2f861dd5
SHA1 25b65fc3bf57aa5d77ec6bbf3034b12476ced06c
SHA512 0f2cceb1c1ecfbeeec36e60b9b6365af1b0f004487ee0d1d1bfad4e5e63a67e058294986929c20dc86738f9066c0b281fd5165a7f53d4b30d98cf9404a33c8f1
SSDEEP 1536:nYgqv3yIg73zhq0GvbJ3ZK/K3d6AcGALWasPak4Ce9cvNHWzaPa+Qda/7xwyyH1n:5W3YY0G6/K3d7hX54kf9V3IiMnzNrV
TLSH
T122E3EA15ED261A21C46501F640AB533A3634D096A7D2F33B3FCF35A6BC79A381E52E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3DC8F6E625201770F6E5E6872DEDBCA72EBBDA76

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\3DC8F6E625201770F6E5E6872DEDBCA72EBBDA76
Size 56KB
SHA256 ab4b6d892f2fb81a803f9054fc13967b48487f066f19b3000a918dbac671c1e4
MD5 4ef6b864b6aa399272f9d07ae7263f2f
SHA1 48f284c7b398fa586bf7c257840175f063c2ba99
SHA512 de5b83432827bf419ca0aaf114ff6e261681af2ad6175a38ff6d2f9f2ead9f79aa0aa9253e3d6a48aff5aca733b3e13e7c342d721da3d11cf6a238004df6f8b7
SSDEEP 1536:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpOm:9V4VA7oGR42dmadED
TLSH
T1E1430239E68035B35CE999D404D28DB1BE74349382F2A7ED067C4118926CBD17B726AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3F69A1380598E0AB3E1B85FBD2DAC69AA262FB76

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\3F69A1380598E0AB3E1B85FBD2DAC69AA262FB76
Size 1.9MB
SHA256 c9128537542ff2344e5338ce9e65f2e66410991d4e6465acff0b985c26a50a97
MD5 eedac8347c6deee10c8b269b7db0087d
SHA1 a4180ba0a27172281e5465fb2797119819d9ad69
SHA512 140a8b81b0a4dea720d8327a142b9b924063270b076d63fb3b43c855059cc5c25207f55b1f142c64d978702bd6b18be6b37750db8af9e32b4d5fd70e903e1af8
SSDEEP 24576:qV2WtOfupoNfA8lgpo0pxHsWbNZcGLK/+G8TkVjnqbQKXR88IRb:qV2WtOGo3de7k
TLSH
T13695F82BEE855F57C86142B440BF23353B34D4866B92F32B1ACFB061BC1A3795D616AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54DE31020347A277D7FF44DC396B09766229511E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\54DE31020347A277D7FF44DC396B09766229511E
Size 11KB
SHA256 e6b1c70439d52c2551ef26068cca940579db9e900e52fdd4afb9118c9a2fcb84
MD5 e6797a761098fc00c08ce112415b4cb3
SHA1 4158f1b610ec3e09ee92ae5aad6287e966b6b71c
SHA512 5c058dceb80f24e18cd9a645ebe09f5feba8df1d86253ec3ce757f681dbf2d567121f7e386794c3e7184447f64baf9b4a9199b6784156e15bb44552ec46ea9ba
SSDEEP 192:0hP3IRhdzmHvYOC+zU5EGXtj0C/dqWLsgAopKhPuUvT1RpAmqxvkobKjabKjaw:0hWhdCvYOC+zU5HXpjxLgtuirpASojJw
TLSH
T1FC32AF3B8F086D3B16B2F190BB4DCBE61C81F6439BD4EAFD150423454EC23B595A9A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6326AFE0ADCDA54FE7319BADECDBE5161B56C60A

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\6326AFE0ADCDA54FE7319BADECDBE5161B56C60A
Size 46KB
SHA256 111746c9a9ea654141a16a433688164604501943a5b5b356c9790d823dac359b
MD5 ef21142221f42628d1e318cf4f87902b
SHA1 d60a5caaa3d867a8d97c5a869ef60072713ee50c
SHA512 6113b169566483501e1d518d469122479ddb4af32d103990052aae286ea4d5ea41779d76b02d277916db314d603ef4c293bae00a12722c9475a5725202c9f154
SSDEEP 768:tV63xzxH6qrLOo2SHU2iw2bKEIjO5IVFpIR1g6xmzTwZyilEMZyilrsjBkaBxh1Q:G3xh6qrIYji3bKEIj/VbI3/lESlI1oUy
TLSH
T18823F1B304512D3C18E539BB4733B7E59C50CE5FA9BAE6AB6E417C4C81470E5E0AE49C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71A3D373CFCB699D98670AA0DB5C599422488F32

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\71A3D373CFCB699D98670AA0DB5C599422488F32
Size 271KB
SHA256 47dc365219f2a33cfc59105fef41f357a3afb5b460ae0989a3e1223f62934b11
MD5 b6935f82cf8e1196c4a678551eaa24fa
SHA1 9f5c7a599061c23bf01095e5b7a4c28d9e8e2630
SHA512 32250ad06802ad469923dc0a22a9d85539662871189fe00f30a9c997fa24852d68cb8fab4f01ffc17b20a7b7972eddd906c675a82b268dddaff385b792240073
SSDEEP 6144:AcFZsEcITeFMhCmi1PLcsTJv9bfbpW+4QU1:feEcITeFei+kYV1
TLSH
T18644192AEE565A23D52003F080BB27363B25E44257D6F32B6ECFB022BC5DB794D515AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8194943F025DA6783A5FB9387196019E89F8ECFE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\8194943F025DA6783A5FB9387196019E89F8ECFE
Size 2.0MB
SHA256 8055fbe4c2623ab5c7fe13c31f4456330fed1e553dbd2b1e777a8b31d6a3ca52
MD5 ecd80b460ffb740408f7e54444747370
SHA1 7b1bb4c4907042c09c09326dce88b1c03380e823
SHA512 5bd9cde65274fb57b8ce6a55bbdecd5bb642efabca16df5d4aeb43930aa7c074ef286ef1201a852039a44dca6a6bc26b8d02a5d8e9df5b94df89abc861395321
SSDEEP 24576:tJl1rwjJY0pazBX59Zq0UP2u4rim9UpQ3QhNXb4+OVZFZbyAD4s:t5rr2iLmGPDl
TLSH
T145A50827EE855F57C86142B480AF23353B74D4826BD2F32B1ACFB021BC5A3795D616AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 4284a15eb716760215cf2445f7ba92023501337f46fb8d5b0c169bf279529216
MD5 b4a3deba4c1b8a38c8a96e90fd42f743
SHA1 3a03c0d3f563e6370e222139f34cc0d2d3a1036f
SHA512 567ef548acfe29264ef0fd06bea8af55aace6f44d8b82b6b7144daabbdd3bfafc2e803f40ce8df432b42225ec050dc40960a776bdc0f62981f5ab5e0f70a0e9b
SSDEEP 384:H9XghOiO024Yxdcs3hk2nhfdDE2Ba/rIVy8eaVaG:dX+ZYxdv3hk2nhfS2sDIVy8cG
TLSH
T1D3728CBB9F116C5D1A67D585C8AD8369DD04F9BBCBF690B608243449CB8432AB0F608E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96F6DEFEAA30969BA7C2F28B08BEAE9393336998

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\96F6DEFEAA30969BA7C2F28B08BEAE9393336998
Size 261KB
SHA256 d0fab3ffa9246d38f3198680a4a76fac202a9b5d525c5ca38b374ba85fa617fd
MD5 cb9170d975865208f430b4af667df81b
SHA1 0b48cd82326362844ab1347d0f545faca416e6ed
SHA512 3eac2bd137346bfde4035a0bb3f0295089d10ed09a25813b58d628c3ba413805ea899327e980653b01a153bb516c5849e01ff54183e2525a6f63da31956c354a
SSDEEP 6144:2cdvtSPJMj7R/idMRKBA8YpvrgrfVib9T7iukwALk3RVqtuLKejSOM2TToLDB:zSPiPALa+Jt
TLSH
T109441866EF446A13D82607B484E323393B30D4475BD7EB5BA9CE7522BC5ABBC0E0159C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98F15692A5B0F01DAD813D4412E2E8287350DE78

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\98F15692A5B0F01DAD813D4412E2E8287350DE78
Size 148KB
SHA256 0e7833a2ff8ae0ca8ec832e8b6c76c243bb25980a812b4def9aa9afe6e520729
MD5 8995aada08aafa05b06eaea1b3e43d65
SHA1 648548224e5085f8abc2776f3c518c0dd57c17e7
SHA512 d3eb68c1efee485201990acb291eb8bc53902e8d746af7c9a9fad3ed6253a4977f662aa46d3c743bbbafad2589ae9af83fb070433c98ed95f2a0c4d1b8e25a06
SSDEEP 1536:FVQobuMHEelgvZnAVQQiEoaeutgVu4n+LKT8/fWv5OEkFlk1S0hjqsd7JE5sY0W:FVQopZuv1AVmS9tguOEfWBOEnS8y5d0W
TLSH
T1DBE3182BE9641E13C2D9C2BC956722603E35D4078FC7F3973A8E3021BE893758E5666C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B492C16D6266C22FBBBE4057774A8244BF2B6EA9

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\B492C16D6266C22FBBBE4057774A8244BF2B6EA9
Size 413KB
SHA256 c2fec221c6780d3c75d9984099af193520c70c474b085ac687ba6eff8d986df2
MD5 bcc166e2d9342560bfe75105da3ded5d
SHA1 e697876a56d2e5ab5ae633f0c2cc49ab244cc5b2
SHA512 122bcf8aa6f0933c2e9d5f655922314b31cf28957d8ff8ef6f6dcfdba3a574f06b13fe7d8d7e490fc796c7221b2b3265e557db8db0153f50cc3ea90410553a67
SSDEEP 6144:yguo7rHkY5Qk6oxeeuPU7rp02eqpFazdOQkhRQT4aF3zokChrKPsYMvRGiEFACIs:yIHNFx5uPKVVo3grXbvyjRIw
TLSH
T156940966FE866E63C92503F140A733363B70D4856BE6F3272ACF7125BC1A3690D519AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CC66D0E285A924438E4662197816E5355D55797D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\CC66D0E285A924438E4662197816E5355D55797D
Size 146KB
SHA256 13341adf5cc25d70f2b5fcffdcdea92a855dccb62046c937c9cf2949e99062fc
MD5 aff52dcfc2b7778498dc5df5d5225ee0
SHA1 83541aca54460b8c42755b0425befc80cd5c6dd9
SHA512 e927589c1cfbdcc74bdb53ccb945b2cae5c3b271ca883f6e112d5c3c0f1dbcac856361c7884b99c6bf3e1e8bfe60bf0131a5b9cf14d9e47b9cb50a685c76fddb
SSDEEP 3072:UvpL4rHLZmZ8ob3OGJS+q7JcAtstmGBEE9XK/q2RV5/OOMyjzxUutRqqLtRn:jGJS+q7Jtw8tRn
TLSH
T17BE30901FB1A0732C97351B45C6A22692F70C467ABC5EB1BBFDE1501BE5CB3A0E46E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DBCC6DBEEE8072AA3B6F3A274605431340848360

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\DBCC6DBEEE8072AA3B6F3A274605431340848360
Size 406KB
SHA256 a04cb6af2b643c56702725021be162c7ac619a02162a55e7bc61d453ff5a09cd
MD5 11e85dfb6f95d0ee92306ade865a4da9
SHA1 4436aafd7322acad5dba57fbfd253c1d261bef00
SHA512 2e2a9a2a802c4ef3950543b20d9ec54648943433a13d40714a35c7ddd7ee6e5d4d7d7d8b6c9ba292924ec667a7b4dd7921afaf2d0c8013d08b4fc2e32cecd7fd
SSDEEP 6144:CghKrY8cJ2J3KEEvgs6yQO/DH+rJ2zy6YyWK3EQmWxAFhrhtRu:/8c7oPO/DBl3qeY1tk
TLSH
T1EF940622FD521A52C82106B040AB63323E70E485AFD1F73B7BCFB555FC5A6B90C959AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E68966039365B4BE862CD1823AA8233FA4E63620

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\E68966039365B4BE862CD1823AA8233FA4E63620
Size 1.1MB
SHA256 1a39c35f63bdfa98ed386cb04d008f589b9c8ea329372982dec5467b0afc99ab
MD5 ded33ce50e8cc88b77e85dbc08f99605
SHA1 e1ab7318772050061d908a896f8c750eb761bdf5
SHA512 041ea9401b44c0e22923c27fb28cd45f172d687265d867f84bb0e51eacd4e3db6b3c7885deea40f34463abafc7dfd3645804e0ae5db107b8140e855af725db3b
SSDEEP 24576:8q3oYgT+tj5x5e5x53Bb1F3EjhBn6bMxkT8baCQ:8NnT+tj5x5e5x53Bb1F3EjhBnSp
TLSH
T1BE35E744EF4E1A26C035127A08BB11B9363CC06697D1F66F7D8F3598B86D6380E96E7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E8343093AD3E9DACEA62D7B91CC0D59161E175B4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\E8343093AD3E9DACEA62D7B91CC0D59161E175B4
Size 250KB
SHA256 91add2e1eeeb078824f541d7242ad832202c479941b297dd692531231af6b397
MD5 a67da9cbec4dc15cd7cce80f9c3d9e49
SHA1 397699a3061c4ca0fe1aad50306b5999c2be8e65
SHA512 22a26bbf823fff3434e59cd85895113cace90cc888c26d9a6775445317ae319dd4e658f205c327b38b5666dd2089cb7c16936af0eb60248110e909d1fcd07e84
SSDEEP 3072:htiOgW/GoLG7XVVgDIQpc0XzTxp5F6Nj7OlFF5MMlsdoaTkLDj:htiP/oyErTXzX5F6NvOlFf3spoLDj
TLSH
T12E44176A9E125B23C42502B540A7333A3B35D44357C6FB1B6ECF7422BC6EBB94E1199C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EA4263874DE0B02DF07B7516C06F6B8EF19987E8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\EA4263874DE0B02DF07B7516C06F6B8EF19987E8
Size 108KB
SHA256 2ddeedaa70c130812c1dcd3c5e5d5acccc662072756997125456d69a07bc7760
MD5 5bbb6f3582d965330585def40dfa3a40
SHA1 5ac33afbdfc144b5f3cc6db297a1e0fd4ae5dd77
SHA512 71ec80e2410acc75b70761fa49b3e6bb99e38fbe694a3af02f857ccfc4a054040c221241f9c385e2587a0ca350249ccaf8db362d22a230d6f8d86f9da8b080a1
SSDEEP 3072:9ekzA2Nu93cIvsL+JEvNZpO9AWbqXduaNp7quob5P:57mJEvlO98Xguw
TLSH
T181B3127DDE142E6CAAC22E64080F1E9E6C4A179FDD5C20CC2C881755ECFD876F19A887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F5C5A41A0EAD7033FEDA2A56D8F6972D34A3F21E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\cache2\entries\F5C5A41A0EAD7033FEDA2A56D8F6972D34A3F21E
Size 1.6MB
SHA256 921e64c66ad0cc313d019a37d77ea1dbf4df0eddd27c6c1c19ba1bae15a9b740
MD5 8c4d50dab1a740958b565a232f9a3bd2
SHA1 636e9c39579e687ba4f47aa373bf594efdb13145
SHA512 28ee76e392f4f84ac68875e2558d8378308c68f1dff082e9ed93cf4611ec23071f84ae636d719e53989644ad8a4d04db1a804a78394c0bdadc98a0873f001b96
SSDEEP 24576:3fbU6BE6CAC7mVFoJbYIB6q2y7pF34mZw+Wuj1ijWdF/Fn5YVw:vwdTTP3PHTFn5Yi
TLSH
T1A885F827EE855E53C92103B440BF23363B34D485AB92F32B6ACF7161BC5A3794D616AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\AlternateServices.bin
Size 33KB
SHA256 03c250709673be0b01eb1c19cf7d6c75721e7c35ac39d7578b6236b508b08460
MD5 2b7c06fdda7570eee81477eb223ae56b
SHA1 62baccf69ad0ab0105964c89855d0095d8830a93
SHA512 c7ef8352e158485f66318c81854e2515fdbde9dbd397f7020724f2f2c0bab42b0469a596d175a908333ce2f859368aa5fb7e0202bc46552bba3ab6554d0921b4
SSDEEP 96:JM/pBpyx25RyuZ5bEy8tke4uAUUQziVU+7708Uazb+QEE8GUYGbGX/GUEGjGOn/:JQd22DZZJEFt
TLSH
T16EF2B7FB6BB56422F4B28FB960BC74CC9C3716265C54D98CC604E19A4782698E07FF9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\AlternateServices.bin
Size 7KB
SHA256 a5c9bd14117b5a73989b3c28ab3591a9bf72fe26269257bdefea82036ff0f2e1
MD5 ef37e25e68c28ce263706416ece2f518
SHA1 6c02d362cd42a6c33dbaef7b24cda5998db4bcaa
SHA512 da5d6b7f8ae5614e7c00010d9af38da5963e7f6d444c001cefaf980269bfd88fccaddca773e401f2ef31497c09f1c79ede01b8d38fd273287477a2844957a1b5
SSDEEP 24:0uhMZV29Vve9D9BZ9L9xIC94918915q9F55A5Z9:hBkxJpqwys7I567
TLSH
T1C2F132E76772E532F492CFB84069318C9C3317261969D5C8C74491F346C6AAD903EBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\AlternateServices.bin
Size 26KB
SHA256 b8b1ee890707404f2d01b443f8ac0ff8f15f21d28eb557c0c581d6a511288222
MD5 07a2fc3313ae683398f4859eefa1161b
SHA1 d673ea423ca9b098bbceedf28009ac0ec8c1e6d6
SHA512 848cec1c1dd69d90fce46e5e1dd43a06461496a25ac1b298c7bba480c8a63f189d993e4f6549d10af1a86ce92ed17e67d90750b613b377def1f6348f99914e79
SSDEEP 96:dBkxJpqwQW7I567w6XEjwUM/pBpyx25RyuZ5bEy8tke4+cUUQziVU+77dmOezGOa:pQd22DZZJEFtiw
TLSH
T15BC2A5F76BB5A562F4A2CFB840B874CC8C3312261C59D9C8C644D1A74782A9DE03FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 20e21e6bf2724cd53fc58fad4e8966da4d50ac393e873829f165f8edf3d16ace
MD5 d766eea342f85296103ae80acacf9af0
SHA1 c00274bd605da0d3ee532f1104275a81c3224969
SHA512 d50104792c5a453035614837adf1de04d40143b9c2d790e536a2d6482359424b4c9f9096be0e5a3f83de15f5638bb2e6465b36ec95a703f6fc739b9fb9d3af17
SSDEEP 192:tOv5zbouCye8EbW51d66JoztdzgCl6mc0d1VibW51d66JoztdzgCl6mc0d:CbouCyzd66Joz/zgC1jNd66Joz/zgC1j
TLSH
T12AE12E69F529863FE405423ACC961F405F34744A986E3F2A35EC614D1E9B2CE778E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 160eeffb7140f30799b30d9326b34e7034b49e9c16034d945a7c3b98113f95b1
MD5 9e4a14954c591ba6cda6b475da9da8ee
SHA1 c28d0e8c0d27a485cd30ae4d144751bbf76704f7
SHA512 a79fd7d507806ecd512c1831de65c803ad69f680c82ed51604b32fcfc6387a7c5b1cc250e8b16cc3945bfbe59ddae6128165cec1dbe4b4a275a1f2aecef687f8
SSDEEP 192:l/tOv5zbo7z7Z+FJyj2vMEVibW51d66JoztdzgCl6mc0d:l/CborZ+FJyj2Hd66Joz/zgC1j
TLSH
T1C4E10E64EA28863FD408137BCCA61B444F39388AE84E3F18359D61582D5B2DE7B8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d36e10985ca827d511ae11985db2df6ed7e374d2ff252799ea851b9b0acc8f39
MD5 aa19e6bb2527c6496e422a4c936e028e
SHA1 42b4a5b6429da92f44debab5f9043cbb3cd9858c
SHA512 49a26829e41892dab0bef9eaf869dee54eb058a4e3c4a326c797017216553d47121eb9b89224f3221c3f2411c021bc82e0e7b6ad37fd6c1b16c94ee2b4eefffd
SSDEEP 192:C/tOv5zbo7zY+FJyj2vMavj691/66JoztdzgCl6mc0dz:C/CboI+FJyj2w/66Joz/zgC1jd
TLSH
T1D5E121A4EA28863BD008537BCCA61F444F39388AE84E3F18359D655C2D5B2DE778E07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\events\events
Size 4KB
SHA256 8f026244b32867866a222cdaeaf438b95fd3b227d81815f94b7bae7a55217fb7
MD5 620324381f3e959f43c26a8187e70916
SHA1 d60bf8f33d7df456a9202dbeec561cfa67e14920
SHA512 5c048279880bcb340dc39cc820ff0d86194964da2be5db9b7400bca34b3e09a51a2e871dc8c07ff36a13aedad20916d44dad0c5135841ad3ab40b60b867938ed
SSDEEP 48:Yoe2HYsOEQrEOIoc5rr/8bPZjhVFoYUQ3K4AYo4fTH2f5MfTrcdhi62jTJm8dhg0:ArNrFoE+t4f72Gkdh6jBd7XmXyEAzfF
TLSH
T134A12F1DB5A94DBF6CCBD29CB88102CD82985B0398875D470D87FE48CD86A9E321F42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d637faa-5111-4358-8446-5699a3c5013b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\pending_pings\0d637faa-5111-4358-8446-5699a3c5013b
Size 2KB
SHA256 09c0924ed55ba2e76b88c9cfd374e8807ad4c0fb0c376f7750af0f9e7a8923e5
MD5 311ec8160b708dd73d4c946c911d98b9
SHA1 5f7c41bcee93db1bdf358324faad2a80bdf61c30
SHA512 9379e1a778c925c56768c93abfb96423bc3de8b4c11d8d0ab19c2aabc451b2a88f7d4dd1da0eedc335641ec564e5d69beb63c2870a606ea1e25d8db920fd259c
TLSH
T1F941215C35789C76DC8AF65D9042378ED3A0990350861D833E52DF4DCE967DE336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

22de664b-32b1-45da-8044-9b6431bf3c43

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\pending_pings\22de664b-32b1-45da-8044-9b6431bf3c43
Size 886B
SHA256 d6b39ef75a45a3ec90f35e850787e827c6efa914e5ca3b4caefe088f878e157d
MD5 0a61871f834ac4ed698d52a90e8c6040
SHA1 4ccfa5a3922177741be019f0f4f0c8c61fb71992
SHA512 610c8f5f4e9a54cc62004ab109ad7df0e0422098eb5962b6d80621c0b4abb952ee35629b43bece2c0da62a04de860095a9cfa7fb7d7d3c0fbd95e5c131cb1521
TLSH
T1BA1104818A68B5B2EC5C935B85A637028BE47013C0CA4C147E615B184EBE55BA75B207
MD5 SHA1 SHA512 TLSH

Submit Download

4a863b4d-f293-4035-95d8-8c746759376f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\pending_pings\4a863b4d-f293-4035-95d8-8c746759376f
Size 235B
SHA256 f1075050979a51c648ea1f0614e43739e3e5038b79a6c77cbcba5957c07cd787
MD5 8e872ebebf8e936f7ca4d022237ccc56
SHA1 effef598676c5c1cc2866f376effc9cb55c3aa59
SHA512 73a2f7964246b95dfd1ae0738042bc740956ac0197d0e1cdb2ea19f1750fd9037590d475995ab3a7a0196230a1d80e840fa4f6aa52f04f993571d4e27fc0c861
TLSH
T100D0A79114A867AD18155F1BF1B0AACA71858C376864AC10D96185B8BEFADCC5261817
MD5 SHA1 SHA512 TLSH

Submit Download

4c1eb134-1eb4-461a-bd7d-4a39dd52e62d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\pending_pings\4c1eb134-1eb4-461a-bd7d-4a39dd52e62d
Size 235B
SHA256 d6f27bd888e2d7b5d14978e69039f2a1c0f17ab9fc1606071dfe88c8fd348bcc
MD5 46a31bc271ce70b17125c6e8493bbc95
SHA1 e446692fb9fc800818667e366897006f41880ed6
SHA512 1e7c71e236ff9b901f682fa8f65d0c36f9977eb6aaa28a1dc9518d159a67fe70d4138fc84cd9c4273711e2735cedd6154d3342f9c9b60fd24bf0fc17cb7c6513
TLSH
T1A1D0A7C42898776D48141F16F0B169D770498C3328F4A8A0AE6145749DBDDC99171967
MD5 SHA1 SHA512 TLSH

Submit Download

6fe8e594-744d-4358-8c8d-75c652f1dd11

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\pending_pings\6fe8e594-744d-4358-8c8d-75c652f1dd11
Size 16KB
SHA256 22fcc35c4ebab7e7a8e9b8f6f173de07464d147cf0415fdd7e5337d69bc0a31e
MD5 439b75b6c01dd176a693253545ff2526
SHA1 afa64da7ca53a3fd38871986110731c12868d602
SHA512 a67a36ad66d95c5aa38bee6bd371aa12480a9c54eea67a56e3cd379c5c88bec5732536b63f9fac868c216cd8977d6404bc747a598050594e9ce35571b0c41ca0
SSDEEP 192:sUQCH1Ub7XSzi7yW+DUpzoBorB1EIOFtanZHDbJEJA6Gyi/HVFn2uMvgU1LE19SN:n1Ub7XS2yWAUm2p76TuMvN1LQM/
TLSH
T19472DA56686055BAC691E3A894FC7FC3E2F538CF4C419FCA8BE47E086DDA05E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db434c21-435d-47eb-9f22-bcfa1d65d9eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\datareporting\glean\pending_pings\db434c21-435d-47eb-9f22-bcfa1d65d9eb
Size 883B
SHA256 a288f783078746f139857151d313995f5a429abd91da401f51ec00da78dbff84
MD5 ceadeb4db34a51bc74d88ac1bea06d7b
SHA1 5983b4f03f2e1b0fc57eb8c8b29ff49d57f4ab3b
SHA512 d5de88eb23ec3e7b328ef499656e52af1276dd295187ed804907585bedcc556fb71c9eb6c1037686f61b12ba0fd3665839ac13d2e338e1a72249cf4efee214c0
TLSH
T1F2110441D63875B2DC2CC24B84553B1187E8A413C0C644143DA55B184E7E55F935B547
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\extensions.json
Size 16KB
SHA256 75a91fa05a0c817d5835a74021407e707d80ed1d915755a5486ea6df9a004cc7
MD5 004768b9eea0ca4a21cf1a84c7d0addf
SHA1 ee0c0a13b725bdc8cca80f856089b6277279a530
SHA512 00fbe477c8f24f02a85f11b54a51e3d0e168d3a5a163dd7e2762e8e16c91f0dbcdb1568d51c65813f7bcbc1336a0018b6db53413c09c31b468025882a06d77dd
SSDEEP 384:0kI4vkUmldvf8dhWr94zsq96okL4HCL4P2L4HSBL4HhAL4HuN4hk:bI4MRf8X24T6x4Q4k4i4Bi4+4i
TLSH
T1B172431545148EB8298FA78BAA367E01C37D433B60855C78F4DD8FC842FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\prefs-1.js
Size 8KB
SHA256 a14030533e9015c1c7c0509463285d4f49e486c270b6ff7c8a07f74571f340d4
MD5 6efe488f8cca1e0f61931693107845e4
SHA1 5bceab6d158d0ef01c5ccd8270fb7e58af5dce33
SHA512 cc65c0f14d41ba7e9d5daeac6f4bc5a34b526fac085906f036dc597b22bb48b5f282022e9326e8d2882e9994688a080b94ddd54716428154fc679d11b000418e
SSDEEP 96:xHkFTU/qGqvJf5/1NbzSnSSlYdv9jGnbWRiDQPBw88k0MwTtC8L4cnRlIDGS:qPRBf5/12SSCR86Bw88IwTtyZ
TLSH
T1EF02EE78A004CF7F68B6766CAC6449705AB2023B7BBF6CD710B95485051CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\prefs-1.js
Size 7KB
SHA256 24854f101e74113b40fcd5c476f1f53a0657549dfcf80984fd8a9c219c2e1021
MD5 4cf50e882b819cc69dbd20bee08caa5b
SHA1 d22cfd932629d79d7755cd1c8a1c5b473ee10b6f
SHA512 728ec90cb087097f6dea1f17ad963d69a71c7a2205ace797ec276972e9b2292f88dac6d26aa869cc8bd92371217d0367f2f28791388f277c2507870fb56c38f3
SSDEEP 96:xHkUTU/qGqvJf9/1NbzSnSSlYdv9jGnbHnQZBw88u8L4cnRlIDGS:qiRBf9/12SSLnUBw88+Z
TLSH
T1E1E120789018CB7F68B677AC6C6888719AB2013BB7BF68D350B554C4051CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\prefs.js
Size 6KB
SHA256 058214ae4c7bdb7bd93b1336ff1651e0c0a762cb548d3901163ea36608025247
MD5 a7c6258fbed675ac236ae19dfa32bb14
SHA1 1a1721064931cf7f22d72df8a9a7bc18acbfa0bc
SHA512 f59e3278bdf5c28451d868a4b2e628975b8b876ad34203c75525fd06c2f69228b742816db63bcddab8c3cfe2320473b48b01c3bf9fa1eb831dfc7a850d945946
SSDEEP 96:xHkUTU/qGqvJf9dM1zSGSSlYdv9jP7nbHnQZBw88u8L4cnRlIq:qiRBf9dMPSSunUBw88+q
TLSH
T16DE130789008CB7F64B6776CAC6888319AB2013BB7BF28D750B554C9050CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\prefs.js
Size 7KB
SHA256 42d88677ec3efb6cbe88136e1f7f007aa872d390032ee51d5c678ce18bdb6841
MD5 16de113fa13b3733ce1cbc0ff3114e49
SHA1 ef27ae0cfe5fb6282760c8af9a3170024805bf7d
SHA512 ca751060f11e9e463f056bd0c92d50fc9c1763e632e05ffd28720a7136b5932f834697825c57425e1ab6ade15e671652dbb9a5ca7769bd13eb983b3e80248ea5
SSDEEP 96:xHkUTU/qGqvJf9/1ObzSnSSlYdv9jGnbHnQZBw88u8L4cnRlIDGS:qiRBf9/1NSSLnUBw88+Z
TLSH
T1DBE120789018CB7F64B677ACAC6888319AB2013BB7BF68D350B554C4051CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\prefs.js
Size 6KB
SHA256 45251bb6bf69e25869dfb037ef227d3e61aaa2c4229b50f2301e8c35e85c9edc
MD5 f955856b1235391254e50c911876287a
SHA1 b57f35148a68f88c5e8222f2392e97c179d5012a
SHA512 fd7d56c47b1380653c441b25860041cf14942737bebcbfb5bad8738dff184e3f0d223fb5d01b0616833232e74b651320ad608a52b7d54db49041398ee3f3299f
SSDEEP 96:xHkUTU/qGqvJf9/11zSnSSlYdv9jGnbHnQZBw88u8L4cnRlIq:qiRBf9/1aSSLnUBw88+q
TLSH
T1BFE120789008CB7F64B677ACAC6888719AB2013BB7BF68D750B554C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 49c6037e823b72cd56dc15b95f96ddb45ac73e7f9a3deb94ae71daca1bdc5884
MD5 fc9f7c829d04cad86c4c85f7390957b6
SHA1 db2880eec5073e984c8652b607fa04c2c7c954f8
SHA512 cf3011ed723b09b79b33dcf9ef52dcf12ea7eff433a4304cd96ff9446076cb3b4fa2d6f999c5de38cb4e9f99226b43fd8778250984f7c7e1490c36ecbf58d769
SSDEEP 96:6nCHj69AyyklmxjtJJrwZ4s76DjkvfQlUCd01VrqM4EcZZi6rLKJyV0NUETmvzVV:7Hu9lyimx57sGgwUi0v/4z1ETmr
TLSH
T13FC19E777C337ABBB160C565849A0F1506D13048A4FF05295A2CEA7500A8E9ED629D2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\sessionstore-backups\recovery.baklz4
Size 28KB
SHA256 c840558812edbdab9a6b7cdc9a6039b98100e5032935e4470068c6cd2bf51568
MD5 944d5f6c721190092eac10bc50e6ac11
SHA1 72a2f035bb6285915c75d84c552507e17eedc271
SHA512 26e3ef1421e18c5e992e5a6d594438f8906a83c5db7f4584b11241718aac1418b5ba1bf6247e2ff9c908c94e5bc9c7b05fb0bcd98a8eba18639d8f7ed946b657
SSDEEP 768:imRSC7ddEnGywvRSdLeK9Iw+oahV5JMlBZPS0th2W8:iB/GywMdLD9VuhVwRzv2z
TLSH
T118D2D06BE54289A1CBB48019C1E40D4DE2F33C06C4FC98614155F56A3D79F72E8AAB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 cec2d2d390a077f293ff64dda47384c11fed1855995b41c1478aca9022bc0a43
MD5 cfe0afe2aaa79438f7f8ec4019198eb2
SHA1 75c9d8e86fd04c9681e3dd3edb065e2084c42c75
SHA512 d01c252932c55576512ef6fee78627645d57d1ce8051ce06835f0cf7d8dfe7a50e34dca55934fc495858ea235177a5f300056ebf3484bfffe637a340255f52ed
TLSH
T1BA516CF71C0BB6BB7565C026F86F0FD14DC2105068FB612ABA6D9B2240BC20FD46699F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\sessionstore-backups\recovery.baklz4
Size 905B
SHA256 34a39346bf57345e7c8c69bc974d7a311830cae3fcbd8009242bb47b1c0d44c8
MD5 86fb3e990eccec044b1c60c35e057dbb
SHA1 ce2c61b5b103fa6fde3d00f7728f1c1ad3b15f31
SHA512 493a3c84e86ecac84c5bcb7c0f06b19ba467e6a883398d0b005a984b843777b35386298566083619e9e01e154f5a3bfe6ebfda6d6d6cce53e970ebb51ecafdc2
TLSH
T168116741FD0AA5B65BA0703FC444AFF74F89741397BA2440D2CF664045482CF71AF58E
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 42ad0247e68c4b22676bd12833341834963424dfaaba803bfbce629d0328f41a
MD5 99a8c48dc264c96a10d3e534a2693c35
SHA1 6909c35ee5c4648ca1b3e8ca8aa8a95238cafb40
SHA512 7169a4f61aab5e73d95ee66898dbc34cc74b4fce4aa5b2c2e4dae04887e4325b118afe96d8a92966907c0c392d10eb62fa34e4b3c34a2bf80fb233f531347ce0
TLSH
T16811B9869E4811B7AA41901EE0895FFECFF820378AF6142CD689A740052878E71FF5CD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 fd91c887d2f9f75e3709a8f645a9b0b562d8068a08eb83332ed65ca6b81ad731
MD5 a34154ddea190437e24e07d9589f8e8d
SHA1 301eea3f2993b92a5f3e694aa68de2cb8b9223f4
SHA512 5bb8f75f4f339c59548154de832660a3a37503e5e0e1a9efea3a7272eaec7a76e3d6a329ba1969f823f4952c9f5b0897370c82367d3951aee6c8b8012a591f4b
SSDEEP 192:1Hu9lyimx57sG/X/4QqKKIcicOM7/3IbQeZf1FTTC7:1Hu3yimj1/P4jKKIcict7mfDTTC7
TLSH
T1B6129E6BF82A7A65E281E396C0DB2E6599F75184DAFF0C14861CE23B44B0EE5FF25400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ns9vi5q1.default-release\sessionstore-backups\recovery.jsonlz4
Size 36KB
SHA256 b2cb6b8adefcc42bbb47d55be3801856b714cc19298b1231b18560cd89cd5750
MD5 1a4387884ac9ead077e778cb45014671
SHA1 ed910db8c9b707f73637d3fda605e97ff38cd5cf
SHA512 99838454e3046b25e34e37a1f894ae4e8db9d2d3cd54adb10d60abfa734021cccf92c9dca2aec95d2c5370302792601f9553a83dd9806c6cc32d7e45787c267f
SSDEEP 768:St+jGtbdDrm/HJGDEvpVlSqmXMGywBRSdLeK9Iw+oahV5JMlBZPS0th2af:St+jS5XIHJGD+G7Xhyw2dLD9VuhVwRzx
TLSH
T19BF2E1BB9601A5A487E4E09CC0A0184CA9F32E53C5ED19748154B86B6A74FB3D976FCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-648-0x000000000D860000-0x000000000E0DB000-memory.dmp

Download

memory/260-782-0x000000000D860000-0x000000000E0DB000-memory.dmp

Download

memory/5404-481-0x000001F501E20000-0x000001F501E40000-memory.dmp

Download

memory/5404-434-0x000001F5001E0000-0x000001F5002E0000-memory.dmp

Download

memory/5404-513-0x000001F514280000-0x000001F5142A0000-memory.dmp

Download

memory/5404-477-0x000001F501EA0000-0x000001F501FA0000-memory.dmp

Download

memory/5404-476-0x000001F501CA0000-0x000001F501CC0000-memory.dmp

Download