ac42b3f951ccf10f3d7a3d7e57b5eda06933c011b659ba8d3085b05ab4327096

Analysis

user interaction
yes
max time kernel
141s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
21/07/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DAS SIMPLES NACIONAL_590029.pdf
Size 187KB
Sample260721-ra8xaaxejf
SHA256 ac42b3f951ccf10f3d7a3d7e57b5eda06933c011b659ba8d3085b05ab4327096
MD5 de3d0882b446c8414ec572cc0265b1a9
SHA1 9575b911e331736fa8d1bbbaec9577bff778f491
SHA512 25c71b9c1834fd0db08286c7d8df46763e0e26bda5175f84a63f258996691b8c589836ee52d6029f18e8bf2dc1eea1b82a6aebfa34c93ddfe6aafd32af6f0e69
SSDEEP 3072:VXWcHOBIoc7rKs50rMRFHzJIxv7e+irV+irwVa5MYBIKPE/qTbtqS5fy:VxHOBIoc50WzwDejrVjrIaiYBRPE/qTs
TLSH
T13414F168DA2E5CDCF896925A2234341C074DB33336C8A8922C7C6B9367B1C04D7779EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery persistence spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	firefox.exe
Token: SeDebugPrivilege	2344	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
824	AcroRd32.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
824	AcroRd32.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe
2344	firefox.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 4104	824	AcroRd32.exe	84
PID 4104 wrote to memory of 3872	4104	RdrCEF.exe	85
PID 4104 wrote to memory of 3556	4104	RdrCEF.exe	86
PID 4104 wrote to memory of 3556	4104	RdrCEF.exe	86
PID 4104 wrote to memory of 2116	4104	RdrCEF.exe	87
PID 4104 wrote to memory of 2724	4104	RdrCEF.exe	88
PID 4104 wrote to memory of 2724	4104	RdrCEF.exe	88
PID 4104 wrote to memory of 4924	4104	RdrCEF.exe	91
PID 4104 wrote to memory of 2344	4104	RdrCEF.exe	92
PID 5084 wrote to memory of 2344	5084	firefox.exe	102
PID 5084 wrote to memory of 2344	5084	firefox.exe	102
PID 2344 wrote to memory of 4204	2344	firefox.exe	103
PID 2344 wrote to memory of 4204	2344	firefox.exe	103
PID 2344 wrote to memory of 4204	2344	firefox.exe	103
PID 2344 wrote to memory of 3896	2344	firefox.exe	104
PID 2344 wrote to memory of 3896	2344	firefox.exe	104
PID 2344 wrote to memory of 3896	2344	firefox.exe	104
PID 2344 wrote to memory of 3896	2344	firefox.exe	104
PID 2344 wrote to memory of 1296	2344	firefox.exe	105
PID 2344 wrote to memory of 1296	2344	firefox.exe	105
PID 2344 wrote to memory of 1296	2344	firefox.exe	105
PID 2344 wrote to memory of 1296	2344	firefox.exe	105
PID 2344 wrote to memory of 916	2344	firefox.exe	106
PID 2344 wrote to memory of 916	2344	firefox.exe	106
PID 2344 wrote to memory of 916	2344	firefox.exe	106
PID 2344 wrote to memory of 4060	2344	firefox.exe	107
PID 2344 wrote to memory of 4060	2344	firefox.exe	107
PID 2344 wrote to memory of 4060	2344	firefox.exe	107
PID 2344 wrote to memory of 4060	2344	firefox.exe	107
PID 2344 wrote to memory of 5740	2344	firefox.exe	108
PID 2344 wrote to memory of 5740	2344	firefox.exe	108
PID 2344 wrote to memory of 5740	2344	firefox.exe	108
PID 2344 wrote to memory of 5740	2344	firefox.exe	108
PID 2344 wrote to memory of 5876	2344	firefox.exe	109
PID 2344 wrote to memory of 5876	2344	firefox.exe	109
PID 2344 wrote to memory of 5876	2344	firefox.exe	109
PID 2344 wrote to memory of 5876	2344	firefox.exe	109
PID 2344 wrote to memory of 5884	2344	firefox.exe	110
PID 2344 wrote to memory of 5884	2344	firefox.exe	110
PID 2344 wrote to memory of 5884	2344	firefox.exe	110
PID 2344 wrote to memory of 5884	2344	firefox.exe	110
PID 2344 wrote to memory of 5960	2344	firefox.exe	111
PID 2344 wrote to memory of 5960	2344	firefox.exe	111
PID 2344 wrote to memory of 5960	2344	firefox.exe	111
PID 2344 wrote to memory of 5960	2344	firefox.exe	111
PID 2344 wrote to memory of 1188	2344	firefox.exe	112
PID 2344 wrote to memory of 1188	2344	firefox.exe	112
PID 2344 wrote to memory of 1188	2344	firefox.exe	112
PID 2344 wrote to memory of 1188	2344	firefox.exe	112
PID 2344 wrote to memory of 5716	2344	firefox.exe	113
PID 2344 wrote to memory of 5716	2344	firefox.exe	113
PID 2344 wrote to memory of 5716	2344	firefox.exe	113
PID 2344 wrote to memory of 5716	2344	firefox.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DAS SIMPLES NACIONAL_590029.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8154E94D70965668C385B60716E1E6C3 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3872
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EEC9FC5D05DADB2CDBA56F52F6F441D0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EEC9FC5D05DADB2CDBA56F52F6F441D0 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3556
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3DC4CF99A494558C48FF2A3634FC73CE --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2116
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7A0466E278EAAB988589C36C876573D8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7A0466E278EAAB988589C36C876573D8 --renderer-client-id=5 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=60AF1189938085425608556541B95082 --mojo-platform-channel-handle=2804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4924
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E5CF68C912196A94495597FF22464325 --mojo-platform-channel-handle=2732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {bf471273-b7f3-4c29-83e2-7123acadfbfc} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27136 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {22704ac7-3ff6-4d8f-9408-ec33850a88e5} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752 -prefsLen 27277 -prefMapHandle 3756 -prefMapSize 270279 -jsInitHandle 3760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3768 -initialChannelId {61c00dd6-ecce-43e4-a2a1-95f85684b923} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27277 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {dda669b6-d67a-406d-8782-b39e2e5e28b7} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 34776 -prefMapHandle 4440 -prefMapSize 270279 -jsInitHandle 4444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4452 -initialChannelId {02761107-465a-4e5c-93fd-e259c0d9a279} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3104 -prefsLen 35013 -prefMapHandle 4952 -prefMapSize 270279 -ipcHandle 2724 -initialChannelId {8efcc652-fb7c-4451-9935-775301e57d2b} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32900 -prefMapHandle 2840 -prefMapSize 270279 -jsInitHandle 2836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3352 -initialChannelId {f473546c-714b-48f3-b853-679626f6db5b} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32900 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {36514784-6849-4ac5-ae9a-ded3135ca653} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476 -prefsLen 32952 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 5468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {1e8eaeeb-c009-4482-a34b-d9a4a6f99ba6} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6328 -prefsLen 33071 -prefMapHandle 6304 -prefMapSize 270279 -jsInitHandle 6340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6316 -initialChannelId {fc273353-0f7c-4d6a-9dc0-2c2279e1eb39} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6032 -prefsLen 33071 -prefMapHandle 6012 -prefMapSize 270279 -jsInitHandle 5984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3096 -initialChannelId {080d1c08-b551-430e-8736-2f24a608b5e6} -parentPid 2344 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2344" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 965ef46a8abe7fc160f8c5219e564f3cd9d0e0810bdeae383eb80d07557252b8
MD5 c97e120d748b70ccdfbcf31768ab61c4
SHA1 d5c64416615c0c22d034a76ca83fe2bfd249c189
SHA512 e8e0d0bcd0c81f93a2f470ddaad8d946aab2c1967f9db8cec313e92138203be43073b0d8c4f24fda3f7191aad0236e3c6b96f6be90069a3ef874911584d24741
SSDEEP 384:yepdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:I+eUZsLQCZsL3hUS4
TLSH
T16653CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 6fef8ba14c38ce58193383aa3bdc0424dbba6bcb972efa1c39e2897c07efc2d8
MD5 e411ca88cfa6eaf6e4a72e5acb437177
SHA1 0cbcb942bb57282dc07fe394f8fe9f9e160bf3f8
SHA512 5f91070871e037e236cda418f6c809bda7694bde3cdf6a47aae7fa06de1835a0b8509d89f1186b0a6f5a0b16924f9d85b978c834e2674d1eb94425ebf477531e
SSDEEP 768:syRdPHXKCX1jVGkIDYELfY3lY0aO0OH+FsUXfZJgGrX6ZVBFlCKhp9Su2/3+t0BX:3ieaKYzFsUPZJgMXo5iuGMWX
TLSH
T1E973F9A396A9B1BB1B9127CB2C0B759B52F70245F38505C8ECADCA1C81DD754033AAFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 10KB
SHA256 34fdad9179465ea19d52635b88bb9a2ad8e3c11c5fee481440e8226e7034669f
MD5 a51023688bf5d2c4269f153d1a1840bd
SHA1 c72870c9dfffd2b63307a22d740b69c47a9ac7d5
SHA512 224b8bae297a5c0e2bf15ee7b0cf9af182d022409a5f3ce313f840caeb0c260d7be5a5ade6999a3e4d9ae5a3d964391660130a0190ba43829ecf8c8576e26cfc
SSDEEP 24:4iuhMZ4dA91jDiV9x5wiF9BdwiP9VvLwivN85q9F55A5uwiT9lTwid9BbQji:48M/Lv/1Bzv8I56oB9X9Q2
TLSH
T1FE2265F76BB264A3F0A28FB04099B55CDC33132559AD9685D744E0F312D2A99D03EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 15KB
SHA256 0f19b0ff8b44150878f99e81619a97e6f34ce57771155749a3d0264b713f72a4
MD5 17d0a7bad61f315a0e8bc63541225ac7
SHA1 20895b49e8f1f25c1b649d5b44532e3e597403a8
SHA512 48a49613ee162884db6c898ae32bd413baba793851f381626d102212c176176b6b1f9edf868284865e0ffb5e26d0b63e5ed9c463654caeb3de83ff2e4ce24f3d
SSDEEP 96:Bai6S+GBiBI569eYuulM/pivyx2LryuZLzy8tL:oQy223ZZ/Ft
TLSH
T188624CF73AB164A2E4668FB44098749C9C33132698EDD684C744E4E342D5EA8D13EBF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 0e4901d134a8dbf05d8db15fa92ca8384b604601d81e5ff1658354e0eb6238a7
MD5 6325f497fdc51576cbc607238381ff88
SHA1 51b97b0a0e5c9a4e14a642dc4a4b4501017be8d9
SHA512 75323058c4a448b05196ab28452ccd435e497122e20bab957a6c10cf1e9d1a5657bc4c5581dc6121c71e3eacf390ce70740a1ac6a6c467cb0e7570f2bffbbb16
SSDEEP 96:/SdF95/7bkW6BrcPyUR6rWZmZuFkQFaFcF5FO/dd66Joz1zgClKtmc0d/UK:/Ov5zboBCyjCy91d66Joz1zgCl6mc0dz
TLSH
T13FB1DB28F229463FC458423ECCA21B500E76385B989E7F1A35EC745C2DA72CD7A8D07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 60d8f8aa6b3bfa314d002acef912b45dbd98c6bfce11a51c6e554df406a7d904
MD5 05d765d6691ad72a92865cdbe76c7c03
SHA1 7d146ef62082dd115015e39e2ca4db8a65aff3a7
SHA512 262b2290fdb91dd0a3c1eab4153f943b194ea8196c505ff178dea4f9755bed4945d2d63f58c356ecaea9a1febb9d9b10a0f4769c9a3cbc1aec16e60ceae34a53
SSDEEP 96:mZuFZ2FhFcF5FO/dd66Joz1zgClKtmc0d/UvSdF95/7bkW6BrcEJmyUR6Ox2WZ:wf1d66Joz1zgCl6mc0dqOv5zboBbJmy8
TLSH
T10AC1EF58E639463BC844023BCCB51F900F76395B988E7F2931EC60192DA62CE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 fdce06c4d4c9f8c58b4f7ea0187627b11126dfac56f7fa26ca197fdd5bde3ff7
MD5 7c160a13232153ae06bdda952cd05e72
SHA1 e14d49ff5c89aeca8f21a96505cdabbc71b334bc
SHA512 c93d633ee0b43d0464f884011d7972aa789a34f88de017ccfb01e2bf27db03f0a81dffc82ec60a40f9f219948364e334b18cfcddbf1c21abbae98d612f22f914
SSDEEP 192:wf1d66Joz1zgCl6mc0d5Ov5zboAaZJmyjsyir:kd66Joz1zgC1jobojZJmyjPc
TLSH
T13FE10098E629867FC404027BCCA51B810F75389B984E7F1935DDA01C2D972DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 69KB
SHA256 e07c21e6552e16810215250a6ded9bf70ff07b84e8cf521966cda39fce566e14
MD5 373dd8d98c163ee78eb31582bc16f53c
SHA1 820367764ffd9dbca22a068fbc7c779b2fd361dd
SHA512 dfa8c8323978e8471e4e81f174e8f2477b35aaa2adacf06839101247fd04dae73d5d11dd8db0b456d8b3437b4703e9a99a75e4f50df46cdea6413d5c8d4d9852
SSDEEP 1536:Uoe1kapC5M23zx7nm7z3ueNZkub7AjswjBkjH5JD:UoQpCKMdnmP3PACUIYkj5JD
TLSH
T1D4631080EB1A403FE82442BBA89117283B39F8554A496B5B3A5C10791DCB3FF3D5E57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 03a50c37db4caebd4632222dfc7b643d7744a831784838bba0c82ef76962ec1d
MD5 55476c277258dc0928fd55199742c56a
SHA1 d03c1f435cb5153f8bd91d947b4fad536c3b531e
SHA512 c71f57b0376d79d2520097ef110ffbab1cd5173712105c9ee7aff135e35ac1f6987e605e8a9e929665f3c56b4de72bddaa1128f477d22c094d11919917e0cc44
SSDEEP 768:CPa4/fBQXcGcmhuDyXK+xc2CJ8bGbRb5UbVC1WR:BofB/yXwav
TLSH
T1CDF20044EB2E953FD41412BADCA50B102F79F88658192FAB3A4C656C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

173835dc-ae9b-454c-a3b4-ed2110dfa502

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\173835dc-ae9b-454c-a3b4-ed2110dfa502
Size 235B
SHA256 b4249a824fcd34053a83e15031743ca12dd29474263d31c7260fc9e5cf4033aa
MD5 0f14a29fb9759e20c47078b6d5009a6d
SHA1 077c5f7f6972742d446f52950bcf377fbdc5ddd9
SHA512 4498cfd77e9e9e2acfba0a54f74e200f93cea22a5994c4004fdbc043dd5382f6d71f365bd13870258791586a330a3865dc648af47b74cce2b075409031e78b57
TLSH
T168D097C428C827AD0810BF0AF0E02DC234948C3720B0A860A5E200F8EDBCBCD0161826
MD5 SHA1 SHA512 TLSH

Submit Download

1e4c139b-912c-4ccd-80c3-15341f14e965

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\1e4c139b-912c-4ccd-80c3-15341f14e965
Size 15KB
SHA256 ba2e2122ac14ad5756fac5d853210a9c5ee00bcbe04cccd7e5cad188551af19b
MD5 578ac3a15a1095fb65b51bbf6c530489
SHA1 1c628e2cc66bd66ebc921ce631a82358f8b93d99
SHA512 12a8bd6b5fe1ed6a4f744ce81eee21c1eefe676c78aec483de6790983e7cf56c0db6e67a6990d3d3fac4ef920089d626a86418329387b892d58975675331c1d0
SSDEEP 192:y7b+1aBDj+T9YbdBu0zZAAJyAxGOLinvy8SidB9ZSnRA1J7aUftyD87SbDycftil:qJaBwdBukAiyAxG5HkDycFi6R7CL
TLSH
T19172DA16287045BA8651E369D4F8BFC3E2F538CB4C419FCE9BE47D0829DE09E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3289efc9-8781-4fad-9d29-8858730d57dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\3289efc9-8781-4fad-9d29-8858730d57dc
Size 2KB
SHA256 995369cfd05600f10b1ff0e478becb1bd3fab372cd487ee2a1f9979ad43430d2
MD5 8e2911e56ab39c9931e15e03166c8923
SHA1 b3463b1acaa4a01b6a68893a69b384aa0726e688
SHA512 b4a8d22901dfd5cd4e949173a7f92e510756974720cd7e2554d26eb98d4b17cd14a752eceb6ab32f68da4895214e7cd4c904ab810fd94fbd427fcde0620dea22
TLSH
T10B41135C79784DB69D9AE24DD883238D57618F1300C618832D51DF0C8DE669A236A93B
MD5 SHA1 SHA512 TLSH

Submit Download

4663486e-24d3-4517-9105-0f7fd5c19975

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\4663486e-24d3-4517-9105-0f7fd5c19975
Size 886B
SHA256 21cb13ce1cf732d613a55c2552ecf0efa9e3db24dbf70fbdad920f78427084cb
MD5 5f7bec6b87890fe337fd3fa339fcf545
SHA1 0c3e9c1e3f885310731b65cfb0c343a9a64a727b
SHA512 75979cd4e2a9816d13cfcea697c69df19c299b2dbfa13d52ee7a9d5a39dd243661f01c1a7418f736f7bc9586f70024536a60898f97267a2be082fecca185d33d
TLSH
T1481127418571B9F2CC68934BD8B1778287D0B023C0CA591C7F9697180DFA55EA7A631B
MD5 SHA1 SHA512 TLSH

Submit Download

832b4d71-093e-4b25-8167-1b5a28b04dbe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\832b4d71-093e-4b25-8167-1b5a28b04dbe
Size 7KB
SHA256 6a21dfba3d15956528afb8b1afabfd47450a4f05ea59ec20067467e7d319e668
MD5 8d8f8c00c4d3d4fc8e268298c7ef8f8f
SHA1 abb55550aec7dfb9ea10de540226cbc537ef39ec
SHA512 98992de77c42cf2989c386d8264d972c255eecb3285beb69b7d564e0404d6796d33d06f49c9b71e047ab3b2c4d2017c27a15ccf1a0332373809edf8d7424bf05
SSDEEP 96:rviNnXrUD/HDzYhi9bV/Gn/wG/3bXUe8/nQwVrqcK56+i9beabKThFp/1BvnGacT:rvaX4NZgqs4w6S4S2
TLSH
T17EF1DDFEDD1200433A69F62EF1A9BEAF005A293149C8879D6BFC4C3A32D29B71157304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f1190c3-99a0-4521-8097-bfb05641ee3e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\8f1190c3-99a0-4521-8097-bfb05641ee3e
Size 235B
SHA256 0171a7455599a1eb952c6adf8e748ce2e2980a2599ff712103d051546722dc3b
MD5 1442e0d54299aa4cda04877dcfe75eed
SHA1 7948bdc1467c37bf39c4dfa80766711f29de9be6
SHA512 4761c3a59288faf52fa8ee41b1dd8b8c1bd472030104bb7d93f29e3814a401848b1787f49fda7a2ed95d047553a691f7b6d8934cc277107e2d494a2687e23ffa
TLSH
T1B3D097A2289823AE0D000F17B0E038D270854C3350B47820DDA10034AEFEEC4125180A
MD5 SHA1 SHA512 TLSH

Submit Download

c8009188-925e-4bfb-bdff-1563dfe2607b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\c8009188-925e-4bfb-bdff-1563dfe2607b
Size 883B
SHA256 8e51435d336c2a7ab9f45c24ee708708517e37b6378f55ba53cd02997d5842d2
MD5 3c5e28e935cd5791d2e39e00e3395f57
SHA1 8aa8afaef9f75db50f0fe310e0f6188206e278af
SHA512 07dbd54cdecdee3d5cf84adc87f7b6439421c90d5ffd32ddec19c35156ad3dfc2628576a3273d8d16f0e8469ccab706fba527430bdd415ef88532195282774b9
TLSH
T1641123819535B9F2CCA8830BCDA53B425BE47623C0CE940C3EA29A144EBA51E936764F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 afdc509df98d0c6181ae0391cb103dbd223e3ca02b3feec41b64c2d7ee1ce3f1
MD5 cbab13b3b39ce68369a1ca2d51e16422
SHA1 4e2b939fda169309071e591d3364d84457c7d48e
SHA512 162d324cd59a9d7dfa4d8e8d1b4886c1c1fe58bce6a347f663843e609f376856bef190cf400c4aecd8331fcf8f6b59870b4f5e6575d6eb4efbbeb94e0399d78a
SSDEEP 96:xHltPUTUkqGqFQPfaHm1zSYSSlndv9jvnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faHmhSS58Vd7Bw88Bh2
TLSH
T199E13F389108CB7F64B677ACAC6488305AB2013BB7BF68D650B644C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 7f9d644ebf7d6d6d379b429280c0f401ac428eea46d32cb89626af633d057ce2
MD5 51bb0c995d9b1656c7f5e32ac62aa0c4
SHA1 a5ade2b095fa291a49bc008bb4cf71022df9e068
SHA512 ec915461e902d6413c268bdec0ecb7eaa82e9c9d55b97164ca18bc50911f816e8c6648415cf57399ab6489a1644d8c0d2e6b29965cdeeff8a2ae47a76a380fa6
SSDEEP 96:xHltPUTUkqGqFQPfaedbZkzS6SSlndv9jaJxnfyHVd7Bw88P8L4cnsr1zTGS:3tPHR4fautMSSWR8Vd7Bw88Bhl
TLSH
T16DE1313895088F7F64B677ACAC6888315AB2013B77BF68D750B654C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 7KB
SHA256 1f970caabb96a4d087cf663b48533f505b8f75945236fa1f4256c31df3695946
MD5 5f8b6c6316b1074197585bf1a881c62f
SHA1 461deec01942d584383106c7fd339f8fef2f329a
SHA512 4e3035e361d3017dec76618463a841bc39b22299810ce812b3bc1dc07cab670df021081093d77d2796161c9908c6cc83af07ab85fbc7c6ae46dd0f90a8ea5106
SSDEEP 96:xHltPUTUkqGqFQPfaedbZNbzS6SSlndv9jaJxnfyHVd7Bw88P8L4cnsr1zTGS:3tPHR4fautfSSWR8Vd7Bw88Bhl
TLSH
T187E1427895088F7F64B677ACAC6888315AB2013B7BBF68D750B694C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 b5d9283abbbb80c72500a91913e6c23fdc31e09ce51fa85fe6b1d24e46c7d2bf
MD5 b3d706891f7720c363b30b146e2783e9
SHA1 4c6c40ce4c4bfc2dfd29008978f050b244b744ca
SHA512 07900454a73e41756905de76820a466363e21885cb60bb3d34091ada6ad0de5c8a3d31dd514fe988315f444a56e3e7c65fcddd782475493ac684289a7819d98d
SSDEEP 96:xHltPUTUkqGqFQPfaedbZ1zS6SSlndv9jaJxnfyHVd7Bw88P8L4cnsr1z6:3tPHR4fautzSSWR8Vd7Bw88Bh2
TLSH
T114E1303895088B7F64B677ACAC6488315AB2013BB7BF68D650B654C5014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 814baf05fb5abe7432fc11c1635e183ae794d1f14803727035b5f4ca2b2afafc
MD5 e7d06014a59295727af63c8fae7ade8f
SHA1 a47e938397124b3a1dfb3267c884561ecac813be
SHA512 acabbf96de7512d65ce38ff0f4296f612c91a7ba035d2b9c8a00aa5a9643ba9c4dfa5133ce567f94eef43dca17dfb5572532ff46b3c131178453e4891b2e2b1e
SSDEEP 49152:h7wufs3yaP6ryMtPHd1C9S8rRz3UghkR0bPAYRpqd:lLfsiaP6ryMtPHSRz3Ughk+qd
TLSH
T1A01639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-396-0x000000000C8D0000-0x000000000CB7B000-memory.dmp

Download