Overview
overview
3Static
static
3BootstrapperNew.exe
windows10-2004-x64
1BootstrapperNew.exe
windows11-ltsc_2024-x64
1costura.dll
windows10-2004-x64
1costura.dll
windows11-ltsc_2024-x64
1costura.pdb
windows10-2004-x64
3costura.pdb
windows11-ltsc_2024-x64
3microsoft....rs.dll
windows10-2004-x64
1microsoft....rs.dll
windows11-ltsc_2024-x64
1microsoft....rs.pdb
windows10-2004-x64
3microsoft....rs.pdb
windows11-ltsc_2024-x64
3microsoft....es.dll
windows10-2004-x64
1microsoft....es.dll
windows11-ltsc_2024-x64
1microsoft....ck.dll
windows10-2004-x64
1microsoft....ck.dll
windows11-ltsc_2024-x64
1microsoft....ll.dll
windows10-2004-x64
1microsoft....ll.dll
windows11-ltsc_2024-x64
1newtonsoft.json.dll
windows10-2004-x64
1newtonsoft.json.dll
windows11-ltsc_2024-x64
1presentationcore.dll
windows10-2004-x64
1presentationcore.dll
windows11-ltsc_2024-x64
1presentati...rk.dll
windows10-2004-x64
1presentati...rk.dll
windows11-ltsc_2024-x64
1system.buffers.dll
windows10-2004-x64
1system.buffers.dll
windows11-ltsc_2024-x64
1system.codedom.dll
windows10-2004-x64
1system.codedom.dll
windows11-ltsc_2024-x64
1system.data.dll
windows10-2004-x64
1system.data.dll
windows11-ltsc_2024-x64
1system.io....em.dll
windows10-2004-x64
1system.io....em.dll
windows11-ltsc_2024-x64
1system.io....es.dll
windows10-2004-x64
1system.io....es.dll
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BootstrapperNew.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
BootstrapperNew.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
costura.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
costura.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
costura.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
costura.pdb
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
microsoft.aspnetcore.systemwebadapters.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
microsoft.aspnetcore.systemwebadapters.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
microsoft.aspnetcore.systemwebadapters.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
microsoft.aspnetcore.systemwebadapters.pdb
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral11
Sample
microsoft.bcl.asyncinterfaces.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
microsoft.bcl.asyncinterfaces.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
microsoft.windowsapicodepack.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
microsoft.windowsapicodepack.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
microsoft.windowsapicodepack.shell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
microsoft.windowsapicodepack.shell.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
newtonsoft.json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
newtonsoft.json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
presentationcore.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
presentationcore.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
presentationframework.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
presentationframework.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
system.buffers.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
system.buffers.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
system.codedom.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
system.codedom.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
system.data.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
system.data.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
system.io.compression.filesystem.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
system.io.compression.filesystem.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
system.io.pipelines.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
system.io.pipelines.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target microsoft.aspnetcore.systemwebadapters.pdb
- Size 5KB
- Sample260710-ejt39sd151
- SHA256 4c4510b5bdc29ead617fe65bc8283b32aae3a6d9208ce20116d1130a7aa15f98
- MD5 1e6596d82ca27fcb03bda5e27269fe94
- SHA1 8d05d0b0641d9d639d305a05f7f5618ff5ad3ba3
- SHA512 40774af04a35252073125a4be3956ce7d142e1032c8db1668b89ea4680daa2c73da55f9f5437bded3dcbc75f4fd67ebc4c2cb1604469c3d6c0150cb85613fd3e
- SSDEEP 96:/N7MZKULVNsNyo5njcEbtugtmMY2Us2MMTJr/a5U3J3V3AMe9NRZhhlWGrSojd0u:JMZwNyotjcEggZ8MK52MeJxdKtho
- TLSH T1CAC109AF9A88E329D2433039792985C4A7B1D16567F1EC72F582079CDC8B2CF87391E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.pdb OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ firefox.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\pdb_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\.pdb\ = "pdb_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\pdb_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\pdb_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\pdb_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\pdb_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"" OpenWith.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4916 firefox.exe Token: SeDebugPrivilege 4916 firefox.exe Token: SeDebugPrivilege 4916 firefox.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5052 OpenWith.exe 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe 4916 firefox.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 5052 wrote to memory of 800 5052 OpenWith.exe 88 PID 800 wrote to memory of 4916 800 firefox.exe 89 PID 800 wrote to memory of 4916 800 firefox.exe 89 PID 4916 wrote to memory of 4336 4916 firefox.exe 90 PID 4916 wrote to memory of 4336 4916 firefox.exe 90 PID 4916 wrote to memory of 4336 4916 firefox.exe 90 PID 4916 wrote to memory of 1104 4916 firefox.exe 92 PID 4916 wrote to memory of 1104 4916 firefox.exe 92 PID 4916 wrote to memory of 1104 4916 firefox.exe 92 PID 4916 wrote to memory of 1104 4916 firefox.exe 92 PID 4916 wrote to memory of 5484 4916 firefox.exe 93 PID 4916 wrote to memory of 5484 4916 firefox.exe 93 PID 4916 wrote to memory of 5484 4916 firefox.exe 93 PID 4916 wrote to memory of 5484 4916 firefox.exe 93 PID 4916 wrote to memory of 5556 4916 firefox.exe 94 PID 4916 wrote to memory of 5556 4916 firefox.exe 94 PID 4916 wrote to memory of 5556 4916 firefox.exe 94 PID 4916 wrote to memory of 440 4916 firefox.exe 95 PID 4916 wrote to memory of 440 4916 firefox.exe 95 PID 4916 wrote to memory of 440 4916 firefox.exe 95 PID 4916 wrote to memory of 440 4916 firefox.exe 95 PID 4916 wrote to memory of 2748 4916 firefox.exe 96 PID 4916 wrote to memory of 2748 4916 firefox.exe 96 PID 4916 wrote to memory of 2748 4916 firefox.exe 96 PID 4916 wrote to memory of 2748 4916 firefox.exe 96 PID 4916 wrote to memory of 1744 4916 firefox.exe 97 PID 4916 wrote to memory of 1744 4916 firefox.exe 97 PID 4916 wrote to memory of 1744 4916 firefox.exe 97 PID 4916 wrote to memory of 1744 4916 firefox.exe 97 PID 4916 wrote to memory of 4648 4916 firefox.exe 98 PID 4916 wrote to memory of 4648 4916 firefox.exe 98 PID 4916 wrote to memory of 4648 4916 firefox.exe 98 PID 4916 wrote to memory of 4648 4916 firefox.exe 98 PID 4916 wrote to memory of 3336 4916 firefox.exe 99 PID 4916 wrote to memory of 3336 4916 firefox.exe 99 PID 4916 wrote to memory of 3336 4916 firefox.exe 99 PID 4916 wrote to memory of 3336 4916 firefox.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\microsoft.aspnetcore.systemwebadapters.pdb1⤵
- Modifies registry class
PID:4588
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\microsoft.aspnetcore.systemwebadapters.pdb"2⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\microsoft.aspnetcore.systemwebadapters.pdb3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {81f7b714-7258-443d-8a27-fcdf2acd3ae5} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4336
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {3748756b-c5a0-4f5d-a80b-55a1bca056ce} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
- Checks processor information in registry
PID:1104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 27274 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {56fbcc47-fdab-4338-b49a-7867ca76408d} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:5484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27274 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 3856 -initialChannelId {e5e38552-3677-47c9-a6b3-646cf201daf0} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:5556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4620 -prefsLen 34773 -prefMapHandle 4624 -prefMapSize 270279 -jsInitHandle 4628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4636 -initialChannelId {8f8cfa55-71a8-410f-a775-113b7e9bd575} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5124 -prefsLen 34822 -prefMapHandle 4624 -prefMapSize 270279 -ipcHandle 5244 -initialChannelId {f66e7d80-fa05-4a5a-8a8b-77c8f74fe078} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:2748
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5792 -prefsLen 32952 -prefMapHandle 5812 -prefMapSize 270279 -jsInitHandle 5816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {5f9e670d-c40d-4dda-b59e-6140a5c660b9} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:1744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 32952 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5952 -initialChannelId {f62190c7-60e4-485c-93a8-1998dfae325e} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:4648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6172 -prefsLen 32952 -prefMapHandle 6176 -prefMapSize 270279 -jsInitHandle 6180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6188 -initialChannelId {6055765e-5193-43b3-b679-6c7cd3214934} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:3336
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
- Size 28KB
- SHA256 a7307b7fff87ede5706e3f06dd5d89241b3ecd783ac8da055d21e533c2beb3fa
- MD5 cc39a3a37ad62d7abb0884613be620d0
- SHA1 ae182ad943d315a845cf36fc503227d3aebaa695
- SHA512 52d0dc2308ae23b4ab616ad43629192674e173c4159faff5d1ed0da42345f7a3076e7d363c4384f0b162b85d8f9bcbf409f8b3b33d76eca29695c23efdfff2bc
- SSDEEP 768:bnr1LQFjEZrEGcm+uYooGRMIPi+UTbZbhbZbg:BQFjEZ29GH
- TLSH T1CAD21144EB2E953FD41912BBDCA55B002F79B88A58092F673A4C646C6C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 fb2d4ed0067ac4d800c9c9ad54385ffaeef94b0984311fac065f1629e96591a5
- MD5 cc1a9c3c0f1f26dc43de211fa939c7c6
- SHA1 953ebcd3f68710ca5d9807810915d866d88bb663
- SHA512 2ddf80d7510a52216cb5912965c1b5b500a539f36d418ab4b4196d3c695450d658e2ab8cc5ab037a05ddef3d5507ea500fc6a1a213247b4ba7ef7de62089973a
- TLSH T13121799C3AF84D6B5C8BE29C7541028E93958E470E871D471D42EE8DCED2ADD326E43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\05b0e93e-e49f-4dae-ad71-c52d92030c36
- Size 886B
- SHA256 d5d4563485ad8b322199c1958b1028f3139b6ce64edd8798ebe4e7b192bcdb65
- MD5 cc9cc1fa82b1011cc2238643e44f4e4c
- SHA1 3bf27ec6988de599a3999079d67b51aa32a8fa2c
- SHA512 17953357b261958caad3b8fe3ffc161a67549e6d28cf1b609925a495a91b3608b938e54d93f26a4f03b4c629835d4210d226269e5e9f088599bda08bf4659e32
- TLSH T1AB1104804A34B6F1DC78D28B85A57B4287E4B52350C61E1C7E659E080EEF52BD75A30B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\2bb2ee4d-dbd0-4c65-b8cb-2b8a35634b83
- Size 235B
- SHA256 3ab61a6f70fe942e42bc07c36461d969251aa98e936678b9c1212bdc57ca0e1e
- MD5 06580ee56ea12d3a65d26a018d0ad18e
- SHA1 e3aa6cc0fdec3d142ded44a2f871823ea74f9d35
- SHA512 27e8d1733544c8094045b14b373bf73d015ef0a0af548e94e4c7d41da4a6aa5a031a0d677df2a2dfdb91a2d0efb44b0cc500825c9fa15fbbe7d21d9de46b57c1
- TLSH T1DDD097C024882B6D28002F06F4E8BBC630884C3354B86960CB918978AABDDC8419192B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\40c8da82-4fa5-4d87-ac21-2f35caca52e8
- Size 2KB
- SHA256 57649759a76081fbd312354ee645b4adfcd99f20627366b838c3441147bedc4d
- MD5 017eea7151f73a6ff78ca12a6442c8fe
- SHA1 b24e5e28a07ea17986a346c09f1e53aa5c33a23b
- SHA512 90ce4e127b0fa4359f5c7afb8c0d1d678678150ce09fbbab9c25b0ae8a069d7db887e598f65d7d20e8980709d5350fa00bca322603963f9c97784bdd69153ed9
- TLSH T10341545C35789DBA5CD6E24CD491338EA760AA0344822C872E51EF0CCED66AE336F41B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\843e4454-6022-4814-b555-6f311053a187
- Size 235B
- SHA256 3cd7a4c9a5b92a90b9ba99a160dd5b5c7f5d98d54bcb5f7afed17b230454fed5
- MD5 f03ee4a62eb67b544c60c5a29106522d
- SHA1 66f711f5aa82156aa174b972db41ebbbdff02448
- SHA512 01a7c8619d6b9bb0ed3ba2298770f794b3a6a3709316a00fa4bc4819b88efdf8a2b01494778ba3016bb30ec118627001da816ed9c122c2946ac24c970b8643ee
- TLSH T177D0A7D154D8776D48145F07F0A07DC770858C3754F5D820AA7145B89EFEDC441A991B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\b38192ad-748f-4d5e-928e-06c2c90e11a1
- Size 871B
- SHA256 def1867e1731ec4fd37fbba31722db611e56b904c0fa617719e75d438c6f8141
- MD5 6c5eb7ce23d66db92c56990ae6caedcb
- SHA1 24755d2154d24ba6c9eed2f792bb6c64892bce3b
- SHA512 9bafb10d815e1d8cf178aac6f7e54351f8eef0512fb789809c406d7b6a9c3dce609afcfa71e1791e7236b9c78923c6f4c8cfeda2373d940df28ed6c365017624
- TLSH T1541123908634BAF1DC78D20FC5997B11C7E4741380C695083DA59E084EAF52FD7AA20B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
- Size 6KB
- SHA256 308036a36b850eb308ea071c48f77a6468eaea28e1ed8d3f0124102182f624fd
- MD5 ec9bebd9ff0da2ac1d66dd377a695656
- SHA1 4883760cf44291070ed6c2f5ca79331dc3a4618f
- SHA512 644ea87f2c51864f98b7e986cb5e58153fb60653f606a8a8eaca554812bf0d7cde78599506261d24a0b7ca26438d2c453e7633c80833898df27e7a9fd92d8e16
- SSDEEP 96:xHSUTU4PqGq1DfGV51zSJSSlvdv9jbnNeRHIcSqZJghBw88u8L4cn1VnAx:cICR1DfGV54SS29IjzBw88jI
- TLSH T1F8E10F7890088F7F64B6766CAC688C316AB2413BBBBF68D650B55484054CF3841F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
- Size 6KB
- SHA256 1fcbee23e4f0713d243162e6a94188e18f6e1601a1b1ef287928c0effc3f31c0
- MD5 e07e3be64a1ff1535f2febd8d978a2b3
- SHA1 9d27dd1b948c54e90e10397a90467ccf43fe8b54
- SHA512 9fda3a3940290b6664faed6c91eb22e212b87be9b3b8828dd53c61825f4962a62f95c747a0b25fbb9530b29f2a9b82708fddc8cdaa3044f5d2b5e038e9ea3da3
- SSDEEP 96:xHSUTUNqGq1DfGV51zSJSSlvdv9jbnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGV54SS29IjzBw88jM
- TLSH T1B2E11F7890088F7F74B6776CAC6888316AB2413BBBBF68D650B55484054CF3841F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
- Size 6KB
- SHA256 36fb69dd632b64a64f9d420e4440d4721761a922168522a431c0cfdff7165a1d
- MD5 f32c273b4d1faf2f665558f2142ddbf0
- SHA1 50affc405dffe9b6144702e64cdd1a92df6d1191
- SHA512 afebf02cf8b72fa6587e84a8d4236aea7b6d2ab5af61c23f49a641b95ac49502d926147f23bf3de35f9a9785739315ce6e6b2df8bc7f053832d1d6bb25c49895
- SSDEEP 96:xHSUTUNqGq1DfG45G1zSD2SSlvdv9j8BnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45Ge2SSC29IjzBw88jM
- TLSH T164E11F7890088F6F74B6776CAC688C316AB2013BBBBF68D650B554C5054CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\e63DQxvQ.pdb.part
- Size 5KB
- SHA256 4c4510b5bdc29ead617fe65bc8283b32aae3a6d9208ce20116d1130a7aa15f98
- MD5 1e6596d82ca27fcb03bda5e27269fe94
- SHA1 8d05d0b0641d9d639d305a05f7f5618ff5ad3ba3
- SHA512 40774af04a35252073125a4be3956ce7d142e1032c8db1668b89ea4680daa2c73da55f9f5437bded3dcbc75f4fd67ebc4c2cb1604469c3d6c0150cb85613fd3e
- SSDEEP 96:/N7MZKULVNsNyo5njcEbtugtmMY2Us2MMTJr/a5U3J3V3AMe9NRZhhlWGrSojd0u:JMZwNyotjcEggZ8MK52MeJxdKtho
- TLSH T1CAC109AF9A88E329D2433039792985C4A7B1D16567F1EC72F582079CDC8B2CF87391E1
- MD5 SHA1 SHA512 SSDEEP TLSH