e03c4c55c26889dde0c75abae1d9b6efb8a9b26912e5791d0c31dd2150f4ecef

Resubmissions

21/07/2026, 14:09

260721-rgel1sxerh3

21/07/2026, 14:03

260721-rcvsfavyg13

Analysis

user interaction
yes
max time kernel
210s
max time network
212s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
21/07/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 12KB
Sample260721-rcvsfavyg1
SHA256 e03c4c55c26889dde0c75abae1d9b6efb8a9b26912e5791d0c31dd2150f4ecef
MD5 fe7011dc9af736ff4db557705220288b
SHA1 a1843f372c546bca46cf4921f071dc9bca6061e4
SHA512 f2a5a168d1f5cb27d90df692da9bd97a0d5917d1f1d48ea100d8fad6bdd5b4aa00f1a80ebac9933ab29844faeb97adb9b5ab0c33cfcd5ddbcb2722897b04c7c8
SSDEEP 192:dM8EKRDRqAQqcUE9CG3pl8OmW32AtZJRpk/7Poi1MWTulwkb:+XKRDRVRwCiSOmW32AtZJRpQ7oiCWT+
TLSH
T10B429422D7581202C07790DDF0323BDD5880954ED7A7ACB4B5BA7DBCBDCE4A226913AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3852	chrome.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291163482028148"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
648	chrome.exe
648	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe
Token: SeShutdownPrivilege	3308	chrome.exe
Token: SeCreatePagefilePrivilege	3308	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
1016	firefox.exe
1016	firefox.exe
1016	firefox.exe
1016	firefox.exe
1016	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe
3308	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1016	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4772	3308	chrome.exe	83
PID 3308 wrote to memory of 3064	3308	chrome.exe	84
PID 3308 wrote to memory of 3064	3308	chrome.exe	84
PID 3308 wrote to memory of 3852	3308	chrome.exe	85
PID 3308 wrote to memory of 4904	3308	chrome.exe	86
PID 3308 wrote to memory of 4904	3308	chrome.exe	86
PID 3308 wrote to memory of 3380	3308	chrome.exe	87
PID 3308 wrote to memory of 3380	3308	chrome.exe	87
PID 3308 wrote to memory of 3416	3308	chrome.exe	88
PID 3308 wrote to memory of 3416	3308	chrome.exe	88
PID 3308 wrote to memory of 2284	3308	chrome.exe	90
PID 3308 wrote to memory of 2284	3308	chrome.exe	90
PID 3308 wrote to memory of 4196	3308	chrome.exe	96
PID 3308 wrote to memory of 5096	3308	chrome.exe	102
PID 3308 wrote to memory of 4424	3308	chrome.exe	103
PID 3308 wrote to memory of 3172	3308	chrome.exe	104
PID 3308 wrote to memory of 648	3308	chrome.exe	105
PID 4040 wrote to memory of 1016	4040	firefox.exe	109
PID 4040 wrote to memory of 1016	4040	firefox.exe	109
PID 1016 wrote to memory of 3544	1016	firefox.exe	110
PID 1016 wrote to memory of 3544	1016	firefox.exe	110
PID 1016 wrote to memory of 3544	1016	firefox.exe	110
PID 1016 wrote to memory of 4196	1016	firefox.exe	111
PID 1016 wrote to memory of 4196	1016	firefox.exe	111
PID 1016 wrote to memory of 4196	1016	firefox.exe	111
PID 1016 wrote to memory of 4196	1016	firefox.exe	111
PID 1016 wrote to memory of 2096	1016	firefox.exe	112
PID 1016 wrote to memory of 2096	1016	firefox.exe	112
PID 1016 wrote to memory of 2096	1016	firefox.exe	112
PID 1016 wrote to memory of 2096	1016	firefox.exe	112
PID 1016 wrote to memory of 2016	1016	firefox.exe	113
PID 1016 wrote to memory of 2016	1016	firefox.exe	113
PID 1016 wrote to memory of 2016	1016	firefox.exe	113
PID 1016 wrote to memory of 4424	1016	firefox.exe	114
PID 1016 wrote to memory of 4424	1016	firefox.exe	114
PID 1016 wrote to memory of 4424	1016	firefox.exe	114
PID 1016 wrote to memory of 4424	1016	firefox.exe	114
PID 1016 wrote to memory of 5944	1016	firefox.exe	115
PID 1016 wrote to memory of 5944	1016	firefox.exe	115
PID 1016 wrote to memory of 5944	1016	firefox.exe	115
PID 1016 wrote to memory of 5944	1016	firefox.exe	115
PID 1016 wrote to memory of 5980	1016	firefox.exe	116
PID 1016 wrote to memory of 5980	1016	firefox.exe	116
PID 1016 wrote to memory of 5980	1016	firefox.exe	116
PID 1016 wrote to memory of 5980	1016	firefox.exe	116
PID 1016 wrote to memory of 5996	1016	firefox.exe	117
PID 1016 wrote to memory of 5996	1016	firefox.exe	117
PID 1016 wrote to memory of 5996	1016	firefox.exe	117
PID 1016 wrote to memory of 5996	1016	firefox.exe	117
PID 1016 wrote to memory of 1184	1016	firefox.exe	118
PID 1016 wrote to memory of 1184	1016	firefox.exe	118
PID 1016 wrote to memory of 1184	1016	firefox.exe	118
PID 1016 wrote to memory of 1184	1016	firefox.exe	118
PID 1016 wrote to memory of 2004	1016	firefox.exe	119
PID 1016 wrote to memory of 2004	1016	firefox.exe	119
PID 1016 wrote to memory of 2004	1016	firefox.exe	119
PID 1016 wrote to memory of 2004	1016	firefox.exe	119
PID 1016 wrote to memory of 4692	1016	firefox.exe	120
PID 1016 wrote to memory of 4692	1016	firefox.exe	120
PID 1016 wrote to memory of 4692	1016	firefox.exe	120
PID 1016 wrote to memory of 4692	1016	firefox.exe	120
PID 1016 wrote to memory of 676	1016	firefox.exe	121
PID 1016 wrote to memory of 676	1016	firefox.exe	121
PID 1016 wrote to memory of 676	1016	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff961d6c728,0x7ff961d6c734,0x7ff961d6c740
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,17597989814170141112,12592994274465280013,262144 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,1298919977963689514,17433446320558305292,524288 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,14631130000927813471,1291501779413677134,524288 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,18033689362547499759,3415051784256091728,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,8652164072869218160,9001425327509429170,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,1881872999268380116,10666513413803097980,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,10151495098769862430,18351438030333635274,524288 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,15598381795658679059,17493133738800648090,524288 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,14826710294883461247,1706257357513296462,524288 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,15762840111085512505,2277746300780016895,524288 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5184,i,11759523099019510395,10234165505459431362,262144 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5260,i,7693787037055066446,3689029924494479996,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4428,i,7353017980181641637,12403728963321342920,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4556,i,18262198076482183092,9454904896226902721,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:7048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3336,i,7385957888142592268,1454354735063413462,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4484,i,17212211136707637579,7597330701946415077,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,1557465231812659948,11200216655639005783,524288 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:7036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3384,i,328238590497876749,5486487955135161853,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1180 /prefetch:1
  2⤵
  PID:6160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5728,i,10319383307980886996,12127563084118767272,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4760,i,80120396714319523,13126655332422046088,2097152 --field-trial-handle=2000,i,3824582412340691732,6789161741995708075,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27100 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {c6950dc6-3e30-4661-871d-16cf381f2748} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27136 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {61f98acc-8f13-4065-ac77-f75b94264afe} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 27277 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {204272f9-2b51-43e9-8bf6-c28fba32e21f} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4044 -prefsLen 27277 -prefMapHandle 4048 -prefMapSize 270279 -ipcHandle 4152 -initialChannelId {0051f848-1805-4689-ba43-5d26a755527c} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4352 -prefsLen 34776 -prefMapHandle 4356 -prefMapSize 270279 -jsInitHandle 4360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4368 -initialChannelId {3250047f-5c79-465e-819c-499122cb66b3} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4784 -prefsLen 35013 -prefMapHandle 4848 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {6634b694-5456-442e-8298-bdcc604aee32} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32900 -prefMapHandle 5092 -prefMapSize 270279 -jsInitHandle 5096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {6095b1b9-2892-42bc-9d56-27a47fdd3a5d} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32900 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {2a361554-592c-4dc7-b2c2-36c76cc1bb7d} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32952 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 4400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {376ebc3f-3b92-4ca8-939f-26198f42af02} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32952 -prefMapHandle 5360 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5332 -initialChannelId {083ac446-dd82-480c-b2ff-5293d70b6a80} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {abdb1b57-150a-49f7-8427-d3ad89ff72a4} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5772 -initialChannelId {7df9529d-31c9-4902-9127-2d2d83475140} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 32952 -prefMapHandle 5792 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {f5c4f7b6-6a88-4a93-a299-cf3824d40d52} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:1868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {600b4b8c-15a1-41a5-b0a8-42e2ee82e747} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:4612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6060 -prefsLen 32952 -prefMapHandle 6064 -prefMapSize 270279 -jsInitHandle 6068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6076 -initialChannelId {9099cb47-88dd-49f8-8ad4-c8feb4c88447} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:2976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6200 -prefsLen 32952 -prefMapHandle 6204 -prefMapSize 270279 -jsInitHandle 6208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6228 -initialChannelId {2f943c6e-0e23-4943-abee-301cda2121b3} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    PID:2480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6236 -prefsLen 32952 -prefMapHandle 6240 -prefMapSize 270279 -jsInitHandle 6244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6252 -initialChannelId {f5238f69-2e06-46bb-98b1-3fe70d289206} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6236 -prefsLen 32952 -prefMapHandle 6208 -prefMapSize 270279 -jsInitHandle 6204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6784 -initialChannelId {cc78646e-e72a-47a3-9ca7-33f8e354382d} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 32952 -prefMapHandle 4380 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6792 -initialChannelId {627b4864-5dd6-4401-82ef-971ab3e3cc73} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4456 -prefsLen 32952 -prefMapHandle 4440 -prefMapSize 270279 -jsInitHandle 4444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6800 -initialChannelId {47359a4b-e573-40ec-9478-fd24484878a9} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:5132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7252 -prefsLen 32952 -prefMapHandle 7256 -prefMapSize 270279 -jsInitHandle 7260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7264 -initialChannelId {40a1558d-363b-4ce2-9abb-95d4002b9615} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7284 -prefsLen 32952 -prefMapHandle 7288 -prefMapSize 270279 -jsInitHandle 7292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7296 -initialChannelId {15521040-079b-4820-b5b6-2547e47047ca} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7316 -prefsLen 32952 -prefMapHandle 7320 -prefMapSize 270279 -jsInitHandle 7324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7328 -initialChannelId {a1e785ff-bb80-446c-a494-0aa4e6fb9723} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5648 -prefsLen 32952 -prefMapHandle 5644 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {d3d0a9ad-2271-46b6-a03a-ef725890fd5f} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 7744 -prefMapSize 270279 -jsInitHandle 7748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7752 -initialChannelId {c8af61be-1255-4b5a-a40c-9cd47c02520f} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:5188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7772 -prefsLen 32952 -prefMapHandle 7776 -prefMapSize 270279 -jsInitHandle 7780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7784 -initialChannelId {76275677-ff2d-4a90-8d06-29ce4c28d1b1} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    PID:5196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8272 -prefsLen 32952 -prefMapHandle 8276 -prefMapSize 270279 -jsInitHandle 8280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8288 -initialChannelId {fba291f6-078a-4ba5-bf80-6b9ad9247b30} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:5204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8304 -prefsLen 32952 -prefMapHandle 8308 -prefMapSize 270279 -jsInitHandle 8312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8320 -initialChannelId {01b6face-2a58-4766-a0e2-fd15bccbade0} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8336 -prefsLen 32952 -prefMapHandle 8340 -prefMapSize 270279 -jsInitHandle 8344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8352 -initialChannelId {aa1a5cc7-d219-47d5-8559-be438eff972e} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:5228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8668 -prefsLen 32952 -prefMapHandle 8672 -prefMapSize 270279 -jsInitHandle 8676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8684 -initialChannelId {28f57b33-45f5-4251-abb5-2dfa3cb5b329} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8804 -prefsLen 32952 -prefMapHandle 8808 -prefMapSize 270279 -jsInitHandle 8812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8824 -initialChannelId {ac7f8736-f88c-4404-ab58-22775b54c1fb} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:5244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8836 -prefsLen 32952 -prefMapHandle 8840 -prefMapSize 270279 -jsInitHandle 8844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8852 -initialChannelId {75854761-5b2f-44e9-9ea8-26d8fa9e571b} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    - Checks processor information in registry
    PID:5252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9340 -prefsLen 32952 -prefMapHandle 9344 -prefMapSize 270279 -jsInitHandle 9348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9356 -initialChannelId {fdd7dc7d-c623-478d-93db-78f1f589f16a} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    PID:5260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9372 -prefsLen 32952 -prefMapHandle 9376 -prefMapSize 270279 -jsInitHandle 9380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9388 -initialChannelId {c68875dc-b0ec-4157-ae56-3d949c94a6c5} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    - Checks processor information in registry
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9404 -prefsLen 32952 -prefMapHandle 9408 -prefMapSize 270279 -jsInitHandle 9412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9420 -initialChannelId {1d129501-dd48-46be-8e61-330f1c21bd3e} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
    3⤵
    - Checks processor information in registry
    PID:5276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9904 -prefsLen 32952 -prefMapHandle 9908 -prefMapSize 270279 -jsInitHandle 9912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9920 -initialChannelId {11b257ab-c6ee-4455-9acd-96488673db33} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
    3⤵
    - Checks processor information in registry
    PID:5288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6168 -prefsLen 32952 -prefMapHandle 6164 -prefMapSize 270279 -jsInitHandle 6160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6152 -initialChannelId {449b6ac9-135f-42a3-930c-0ce94df6cb71} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
    3⤵
    - Checks processor information in registry
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6136 -prefsLen 32952 -prefMapHandle 6132 -prefMapSize 270279 -jsInitHandle 6128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5816 -initialChannelId {c315b20d-fe3f-412a-931e-678d3b11d798} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
    3⤵
    - Checks processor information in registry
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10408 -prefsLen 32952 -prefMapHandle 10412 -prefMapSize 270279 -jsInitHandle 10416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10432 -initialChannelId {672412ff-a085-471f-b398-c2e5651025d8} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
    3⤵
    - Checks processor information in registry
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10440 -prefsLen 32952 -prefMapHandle 10444 -prefMapSize 270279 -jsInitHandle 10448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10456 -initialChannelId {6bbe943c-a3bd-46ed-a13a-fe2d81002a75} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
    3⤵
    - Checks processor information in registry
    PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10472 -prefsLen 32952 -prefMapHandle 10476 -prefMapSize 270279 -jsInitHandle 10480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10488 -initialChannelId {9ed1d158-7256-4662-899f-67e31ca05c1f} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
    3⤵
    - Checks processor information in registry
    PID:5328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10972 -prefsLen 32952 -prefMapHandle 10976 -prefMapSize 270279 -jsInitHandle 10980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10988 -initialChannelId {77ec1b5f-3225-424f-8f27-8a9068e2a55a} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
    3⤵
    - Checks processor information in registry
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11004 -prefsLen 32952 -prefMapHandle 11008 -prefMapSize 270279 -jsInitHandle 11012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11020 -initialChannelId {44c75e30-c601-4435-b089-9fc06754e420} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
    3⤵
    - Checks processor information in registry
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11036 -prefsLen 32952 -prefMapHandle 11040 -prefMapSize 270279 -jsInitHandle 11044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11052 -initialChannelId {0f28bdf3-1499-4ee6-8b67-98894de32348} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
    3⤵
    - Checks processor information in registry
    PID:5356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11476 -prefsLen 32952 -prefMapHandle 11480 -prefMapSize 270279 -jsInitHandle 11484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11504 -initialChannelId {bd0c7f10-c9ff-47f7-87c8-c43891607933} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
    3⤵
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11508 -prefsLen 32952 -prefMapHandle 11512 -prefMapSize 270279 -jsInitHandle 11516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11524 -initialChannelId {996452b4-eaa8-4699-a00a-041b060fe579} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
    3⤵
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11544 -prefsLen 32952 -prefMapHandle 11548 -prefMapSize 270279 -jsInitHandle 11552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11560 -initialChannelId {a2c48d61-8c19-4c9f-a649-5a2a8ba19485} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab
    3⤵
    - Checks processor information in registry
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12044 -prefsLen 32952 -prefMapHandle 12048 -prefMapSize 270279 -jsInitHandle 12052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12060 -initialChannelId {a6dc8eb0-61eb-408e-923d-3767937d5fee} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab
    3⤵
    - Checks processor information in registry
    PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12072 -prefsLen 32952 -prefMapHandle 12076 -prefMapSize 270279 -jsInitHandle 12080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12088 -initialChannelId {29e82ab0-0d06-49ab-b80b-4588ac2e8bc9} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab
    3⤵
    - Checks processor information in registry
    PID:5396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12104 -prefsLen 32952 -prefMapHandle 12108 -prefMapSize 270279 -jsInitHandle 12112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12120 -initialChannelId {981ba18e-46d6-440e-bd84-6fece599951f} -parentPid 1016 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1016" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab
    3⤵
    - Checks processor information in registry
    PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1604904ed235010850ef93143b9b96933febf3ea5f21e7fa06597c917ce43e7a
MD5 d23df55cc7611a739bc1cacd0c5992b9
SHA1 c580d0c80cc64728b6d0f6e93e3dd96273d7e5f0
SHA512 d17b1d6813e3fc703393789f236c90bc38c0c1b6b22a7dfab721a751d1bebed69ce25ee2c27c39824529fa5b36d2a1ab109751dd994df09ffc7b9db401225cdd
TLSH
T1A1E02BAEC911DC2704FE0729A4846746E794175B2B40591F7A3CD10D4F7077A464681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 dc8d6feb4d4ef6c07544285c8f4e54c6d5e85395cd7be5d6094effb44f51b2cc
MD5 7eab6650487be4094c8636f12af8b9a1
SHA1 58e9ad40e5750241c645fe08b126aa9ecdb00c53
SHA512 d8cce162f5bff3eece3090f0b9efef275c10f0fc73ef72bf09487885d3b9559f1293d3910ecdd847fa11764a2059dea8f02fee99da3a2faf5068861b2cdac3ba
TLSH
T14011474DA48292A5CFA8557515A12C367CD10D6D542A1B330DE844F06E46FBB048E2F9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 48fa80e155f1c3f9af2c392108f45fbfc038a49712b5a28b9d1027470e8fc2dc
MD5 bc83fac6caf4ee13fe99503114064000
SHA1 4c785109e289ea66665b89d5eb2837e726d266a0
SHA512 5b2384a9656b3efdb9c26e338de1fe9f84506cec4d7b27c728af7be7d82e38fc143106a58ad2b74cde48733c0d66df2dde41618fb6059876b56cd8c520db79d9
TLSH
T1EB517CF7C3E4867D8A1196F4EB156E2FCE690925032C7C6689E4AE1B53F2872D10068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4ee2daf56670ed66c8fe0988819b810a57d067101a0863f7b6d7aa89f9af2577
MD5 0bee27330dee2aa5d8f03ea88688e323
SHA1 a42a41cef4c4c73f477c30f088577b828e8f10e4
SHA512 28e94ff1c08350e6bf3b3790a70f50dc3f9068a47749cd8cdb0f8cbe7a6b5a54dcabb9ec77cd3852fab36bdb65655e4cde1a655739091263566d28cdb7b3982c
TLSH
T18A418DF793E4857E8A1192E4EB156E1FCE690924032C7C6688E46E1B53F2872D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ed52a16b15fe4e0b98e498793ef1a8c8ec03f9b83fa0f23ce454565b1fb52762
MD5 55d05df3f6f8d3709fdb43ec09700153
SHA1 9b89a430dcdc558fa52a717c349b3ffd8e740708
SHA512 0f1921086550bef7224039ec55aeb38831a976c45764a0b122133b044423ea91dcc7fee934a63f9f3eb0fa223cc0443efaab2147db028c291665ed43f1a8266d
SSDEEP 192:mRQgJZEv7XJv7TpLPRpjju99Hsb+WNns60Bc2SuouVyIsnAUgE:mRQgqJ31XujwT0C2SeE
TLSH
T15752C62EB910397B6CDBC21AF9667B17E7F5103166901E88E6FCCA2C16E76DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a7f04e7b89d8f2b0fb3b5cc82b561937dc38af88dd8cca683b6b67c220979e59
MD5 22d9e8547a0166f6898ea39a49841db9
SHA1 8102bb2c9c746fa9b6e36da1338a2748c48ca9c0
SHA512 74bd25ff57f6d462d731a11e6018dbc1ec11766ce91c5e04e75a7a576bf93c236873f4bd95faa8b5b9418714f3c5024e6c49c495d31cae16dc6682047c01388b
SSDEEP 192:ERQg/IZ7b3v7TpAPRp2ju99Hsb+WNnEQPMc2SuoPVyIsnAUge:ERQgwpf3UXVjwnPZ2Sxe
TLSH
T10442C52EAE107A3B5CDBC22AF9617B17E7F5103125901E88E6FCCA2C15E76DC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fd2268c0e8e7578d662002b9d6b03632b41a2e6db6bc300ba6c9334f5193176c
MD5 5c2e3f9960eb0cb82d913a9bd95a2f04
SHA1 117070ce1732177c055dea4ef7ca51b14511b9e5
SHA512 26d3019046e8b7b0007c013473afe192915fc5f22cacb298ee4e4b6e3cc1f4cee1b0acd51a111d1984682f0f9825a0c44e5f53cae749d04113f9751680af9e0a
SSDEEP 192:ERQgJZEv7b3v7TpLPRpjju99Hsb+WNnEQP2c2SuouVyIsnAUgE:ERQgEf31XujwnPP2SeE
TLSH
T14052C62EB910393B6CDBC22AF9627B57E7F5103165901E88E6FCCA2C16E76DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 138978cb735aa5f222bdc967fa1a281fb5b6f0e28488ce9a77638ff6ebc362ff
MD5 688b65592d92adf7aa32a79ab0b21453
SHA1 bd49fcf5853290c055a7691799b537704a7e1962
SHA512 36b2c5cb0dd29228e9f85948aab599584afd132e4cfa47ba776ff639707c9b1a419263034262110fecbd1cdcc7b4a91462db06f1f90ad11fe5c9cec5f68ec046
SSDEEP 192:ERQgjZEv7b3v7TpAPRp2ju99Hsb+WNnEQPkc2SuoKVyIsnAUgE:ERQg+f3UXVjwnPx2SSE
TLSH
T17B42B62EB911393B6CDAC21AF9627757E7F5103165901E88E6FCCA2C16E75DC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8086dfa1d4fb68c12d04dba924f1e473566dd8345aec41740829073611ccc245
MD5 3e89c6de3896ada8467a9e89e3059f03
SHA1 50728a88381a4d6d563c2a9e19812f2c92b929b8
SHA512 bf2b9c24944f98357bf333ee0ba2aa65ca68c614446e3514974e92c8876044bc586ada3094f9afae89fa39faea06bedf0caf85dfd3ce1b4d256ece6549ebc449
SSDEEP 192:mR4cBzgJZEv7XJv7TpLPRpjcRkMl999Hsb+WN3lDALs64bH2Cc2Suou8yIsnAUgE:mR4mzgqJ31X2jw3FAHi2r2ShE
TLSH
T10652B62FB9102A7B6CDBC22AF9657B17D7F51031A5905E88E6FCCA2C16E76DC2207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 347d73ba7d38af83ac3d460ce8c2dd97cabdd4c55b65412cd8b887fb45b65b38
MD5 871109c95d991c94717364d65631baf0
SHA1 fc56f3d2f1b22d07cb19c827684bb9fb264712aa
SHA512 3ade27ac0b79ef313d66bfd054d6fd2751cb9827493acd598ed9e782f0d4fcd111331893c5c70bec25cf3d8785027f9de5a781447cdf6e3bd8e08cdce6002844
SSDEEP 384:IijUn7KxkXqKf/pUZNCgVLH2Hfgslk+n7pLuLcSjijXODUL+ErU3gRnHGmvcrBv0:IiUn7KxkXqKf/pUZNCgVLH2HfgsK+n7D
TLSH
T1A27219776C4C9E370F94C68CD8277B4FADB5025B65E9886843FA982903D5ADF010A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cd58f79afec7a3d18d510d2e6a985fdd8bc08030a6c125ad236aa660e45ae6f9
MD5 e3e073be2856b29306b84ec9f0ee59fb
SHA1 22324072d1a8293a95f0304a1acb0ce6248b513c
SHA512 0f5edb908bd2afcfefc52bf83ea49d3a289ab98821f523118688cb1eca56f21560bab47746eca1adf099baf13382d780bca5fb3cc55df92179a3fa5726a2fa3e
TLSH
T194B0125080015241C4A306F4314218C871159F11960A174143E06972C82A2A18414051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5868a8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5868a8.TMP
Size 96B
SHA256 0a69e759b02af3a0bfc62e5080aec456732df5ab484d8f024d41bb1701856eca
MD5 2e0136a72ff08c8714f87374f392a551
SHA1 353f6bbc5751766661a961344d0e652bcaeb68a8
SHA512 2b8e7beceffe25d028bde3a7d7f183e551e04725f43b96426385a924f72a87225f55a7960ab9d739a1c604bd27fa50f2efc41273b4e713abdf70d3bc41dada62
TLSH
T158B02220CA02B303C00203B0308888CA3020CF20C20302228BE00AAFCC20E30002A220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f33a4f084dbec3a13f510eb6995d4576fd541f677109ac7afb07149d76ce4567
MD5 c2613527b22d000f18c32dc70ad0f662
SHA1 38ccce6878628b6b30eedd1f144e0e58731374e6
SHA512 ef1b3dfb45b5bd257f0e8416b198dfc3e5773d8eec759abb432eb97d65aeca5d6b7eddb12891df90b8aa3d72bee01e907abe18b986b82628f9d7232f6a37c3a8
TLSH
T170A002D152406432C54C127592C601453314482E418D164590F010C4DD6058045E2811
MD5 SHA1 SHA512 TLSH

Submit Download

d5096765-1e72-4258-a863-56097fd5b143.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d5096765-1e72-4258-a863-56097fd5b143.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c6eaa169ec126b996602a5e89b78c65349bee46be114e3a422fba53176282e3c
MD5 c3a2a2826d97f4e1e7a3306aaf4cbf3e
SHA1 1c886470a7acb1d0acf0fe16b4e0012047237d98
SHA512 1a8ee473988dcfc3736cc1488fe0248642e0da2d1a40ac67f3c92adb570a294a5a97a162f5005940878c81c317ee7aa849fa71dc055a5632784ebf31cdb07542
SSDEEP 3072:3xamcw3LffUnBKU/F8enCW3iyVEXGey0cB12:3x9P3LfqBZqenbyyVEd1cB12
TLSH
T16EC31231E4AAFE6B52B5563A750B97195CD108FB94E1B748443C2F1890CA3CCEFA5C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6ce5c793694088dbe5bf7f958930a372f1a2860a154125d02bae62726e82a6cd
MD5 244d155ccb4b29837fbfa0550a3d943c
SHA1 7af7ff500e36a3c357b0e8676fcce8d56f872067
SHA512 b0f042b8432f8dd01d84734f522b0d196451341ab677232780c366110d22bb98d74aa1005bb65b3d1cb4cd9aca6bf377ca9757e0e21f32fd0bc4bff49b7c3162
SSDEEP 3072:3xfw3LffUnBKU/F8enCW3iyVEXGey0cB12:3xo3LfqBZqenbyyVEd1cB12
TLSH
T133C31231E4AAFE7762A55737B50B931A5CD148FB94E1A788443C2F1990CA388EFA9C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 415a3d6b2eba92f7e5ce240d9a8c71e75c8d0a1ac8106d5a4130244bd7a641a4
MD5 3cfe6b7c3c067d4add8900d753a7c4ac
SHA1 0aa1d63cac85c625009b1715fa4d0b69136319b1
SHA512 5826b20a9146001aee3400428c5255902c563d47ad5706f031867ca2790784a201bd0faf76812acee138f9c12188b932c99b58a83d6f2461654c7c9583a34abb
SSDEEP 3072:IxLw3LffUnBKU/F8enCW3iyVEXGey0cB12:IxE3LfqBZqenbyyVEd1cB12
TLSH
T1F6B31221E5A6FF7B9275472AB50F93295CD148FB44E1E788443C2F19E0CA388EFA8D44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f53b9a25dcc4ee8086339525fb23f65352d01952e637d83e08086b28b940193a
MD5 7d43734a2e6129b7b71176fb4b33a661
SHA1 8ca47a377a2c94494be24ee77ca3e1380c7ce5f7
SHA512 43d95dee487f18804b27b3f2c73425552b277ddb627502c8594ee8c3ae44804936adadfda7056461c5a6cd8a9d132efe4dc9c1ec3a725bdb141dc30a5d21a994
SSDEEP 3072:cxfw3LffUnBKU/F8enCW3iyVEXGey0cB12:cxo3LfqBZqenbyyVEd1cB12
TLSH
T151C31231E4AAFE7762A55737B50B931A5CD148FB94E1A788443C2F1990CA388EFA9C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 1af635ccdbeccdc52462eaa96d21107393cceec546e206cee0c021ff0dd82235
MD5 df313a9d5095ba06cf4f019070806bf2
SHA1 48cf4e9f5477ddb7f416150788ac80c795a7fa50
SHA512 3a26cbcce1bc8e988a7bfaebd71de0da619796b67edf1424cb4c2373eaf1df55e39610db189a5a22ec64b8b9caba2ed0f0c05675677e34c43ba08612f8265be0
SSDEEP 3072:3xBmcw3LffUnBKU/F8enCW3iyVEXGey0cB12:3xAP3LfqBZqenbyyVEd1cB12
TLSH
T1A3C31231E4AAFE7B62B5563AB50B97195CD108FB94E1B748483C2F1890C63CCEFA5C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8b1c6c630de1fd436b8ec574c4d44c1e5ffb4672ddee99965d67f0c9e3d6a27f
MD5 af8eab20e18e0d26378d706d4b9ac83b
SHA1 cecd1412d671835044bb35e2f607e216b2e1cbaf
SHA512 087fe7ce35a9bf987b73e192c02066304b2a2e32ca92db7ef368f7999a3d6a60698bf95e9929e40cfdcda6fc70f885ebba10c4f9b5835729fe90d3bc6f878235
SSDEEP 3072:zxBmcw3LffUnBKU/F8enCW3iyVEXGey0cB12:zxAP3LfqBZqenbyyVEd1cB12
TLSH
T1BDC31231E4AAFE7BA2B5563A750B97195CD108FB94E1B748883C2F1890C63CCEFA5C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 dadd64fcece9ece9579d267335ced6046fae1681927b0113327245ad2153927a
MD5 da1c78625b34392bd17663204daeb563
SHA1 6bcf60fd3c1341837c74e071367ebaaa5f80290f
SHA512 dcf8813118713824e28de37c2b3fee7983cead34aa3f12e9bec8b3c657eac40524d91ba9cba0ce7dc5fe73da0986e15d1e1423d31d78cfd3d66c5ff1e5e9e7ef
SSDEEP 3072:zx4mcw3LffUnBKU/F8enCW3iyVEXGey0cB12:zxLP3LfqBZqenbyyVEd1cB12
TLSH
T1D5C31231E4AAFE7BA2B5563A750B97195CD108FB94E1B748883C2F1890C63CCEFA5C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 cff93eb384ffa503e6e1c70b86ad149df664aac76c86416fd5ccfb605440e5f9
MD5 e9726fccb029c11683a473d02cf5f061
SHA1 2fcdbbf6f2e7dc6850ccb302721d9b28905558eb
SHA512 16af56250f2a6ebe2ea363446d2f565f1da942819438f42afa8d057e6143fad054abe5fd1203108d0b9e1668faae64a9ccae791ec0cefd0191c52398c57a1a91
TLSH
T11B61CA58F229863FE4454139CD821B415F347456A8AF7F2A38AC614C1E5B3CE76CE13D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 835aff30ea6f4e778e97d4639b1c6472cef097b4a589e4b22ea8414dd7c26b64
MD5 079a0f765568611bd9285fc45a2a3105
SHA1 9be9c8350ae6004910e778dd12436938234bc59f
SHA512 cfd5834cbc759016b64e3395135066e749a85d38b35e9256d90c68bfcb52e8f1947028ed80fa07cbbf60290c8a36a216e684ab7c8e0ce62a93c1289fd2dbfd5f
SSDEEP 192:MOv5zboBbHoyj4yig1d66Joz1zgCl6mc0d:vboBbHoyjrJd66Joz1zgC1j
TLSH
T10FD11DA8F628863FC404027BCDA51B410F36385B9C4E3F1A35EC64482D5B29E368E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 34e4d5a4b47eba96bd16aa9da32fdd5941b8769164bf63d0a00f98e5d6093dee
MD5 91675fea9db22889489d985e71de53fb
SHA1 d6816b52638e27f2983d6328ffc4f326c79194b6
SHA512 b5d2fd0bc75aaa971ce4e14d0c62ab22027370d5c29fadcf8d899f7e2de3f75dc3fd3b3f4227d5857f6d53fcfef0d88ea68ee5e603fc6ab707da9b0a33caf8db
SSDEEP 192:yOv5zboA2ZHoyj4yig1d66Joz1zgCl6mc0dz:xboDZHoyjrJd66Joz1zgC1jd
TLSH
T17BE11DA8E628863FC404027BCDA51F450F36389A9C4E3F1A35EC645C2D572DE369E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\events\events
Size 1KB
SHA256 75a48218d5d6e972464af3473eb675ceef6010c68a745ab659f3136109db9678
MD5 1ce230a27780ea7996cc1800f3cf149d
SHA1 547e23ed65a256e81f1cb36afb36fd1ad3405351
SHA512 88b3a53de1bbe44a7fd634b3274e18ab04c2240debce62a10e5050ab4629cac554448c1147be40a5ae9ebec627ff8e62adff54a3485531e7900a534fce72b138
TLSH
T19D21975C79B88DAE9ECAF69C744112CE53914E0748C71C430D22FE8CCE81AD9326A43D
MD5 SHA1 SHA512 TLSH

Submit Download

12721e79-37bc-4a89-b581-ecc2390ae353

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\12721e79-37bc-4a89-b581-ecc2390ae353
Size 2KB
SHA256 16824c460a39fc1e65f94dbed7d926350496deecb28a78246836700b80f3eff0
MD5 e49c022172461c56f0ef169243f63565
SHA1 eba98f55edfaad51f2ce0638408f721fa4931f50
SHA512 bf7b6bddf54959bdf4369f861ebd17836702e83bb4436abd6c361f9a22946ea058f49c6b25037d9e5af17d3c18c1c2db97b5362dc6df3178148e35168e4ea125
TLSH
T11041432C36B88D768DDAE14DD482238F67E08A0300C61C477E51CE4CCE9665A327A92A
MD5 SHA1 SHA512 TLSH

Submit Download

233779fd-8c85-4564-b2f7-ce95527d00d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\233779fd-8c85-4564-b2f7-ce95527d00d5
Size 883B
SHA256 a98f7f5c73ce21be83131430051b556fcdb0f62c00d6444e5f822d33a7419074
MD5 2c002a75342405bfb1a8cecf184ab41d
SHA1 53b79a218b767ec61ea3324adc33bbcd23eedd77
SHA512 f8b4a846b328e0c4c2914e8c38d1fcf0f44e8b5494965da8dcc5bc041fe74b485fef1f4e09944b6a77e9eb0ebb24aab1a6ec948a73df29fc1d410d7f1ff2da53
TLSH
T1FC1104419671BAB2CD68C24BCA5537034BA46433C4C98C043DF05A080DBE62E93AA74B
MD5 SHA1 SHA512 TLSH

Submit Download

7611be78-2b05-4e6a-8137-2e3276a483d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\7611be78-2b05-4e6a-8137-2e3276a483d5
Size 886B
SHA256 c65f11cbbea49a8b4575f6c3c29dfdec59585ba04f413da7933cbfc7e0619a27
MD5 407656f1d92c510355859d4ad095b42e
SHA1 1b695de8b0e3ec41da35fd2b359d7c48b749f348
SHA512 70dff6cd0aec81ad695847b491d8b5e3bc80449da2e29fd11f544c6d23aa65145429fe22854a2db6c1812612fced490a0b04f92933b1663d72fdf41d4050021b
TLSH
T1BA11239297B5BAB2CD68829BD59477478BD07033C4CA5C047E914B0C0DAE62EA3F770B
MD5 SHA1 SHA512 TLSH

Submit Download

bdbf7e66-cae1-46c8-b5b1-9f0772aa5bf5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\bdbf7e66-cae1-46c8-b5b1-9f0772aa5bf5
Size 235B
SHA256 8dd3542ed5f13092256164e715682c97f815be90ca30e41971517c63e6711c96
MD5 ebe1939cb6e0fb027807a9ff8fac9b61
SHA1 17fda4ef33bb5edebff6a415c5d2ce16230b8802
SHA512 c10f06e7d191c4a217480db12950219d86547d63af5fd7f213f9e0d901e592dc745d4144d27233be4e40d6af711686eb5d0ffc02e369cd9fe5d3fa26f7825ebb
TLSH
T194D097813488A35D08004F42B0A028E231498C3324B55C20969204348EBCAC442B1957
MD5 SHA1 SHA512 TLSH

Submit Download

f3ff6e92-b0df-45ed-a8da-d5929b6de820

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\f3ff6e92-b0df-45ed-a8da-d5929b6de820
Size 235B
SHA256 ffc28dc4f3eb9fd40040aa78f8ebefda1100ac37a3787a57919fc566232f5541
MD5 732a0fbb3b638bf625700fe4654382bc
SHA1 722e02977768af6e7f3c813e94906bf40ed756ac
SHA512 c39d4a886efb4ed6ae37a4ec2d5be3e9ff63c006e95bad298f7a5714ca09333488be3f2311cd37a5b6b241c8eee4decc0d22adb177288392763e304cc1e6edc0
TLSH
T10ED0A79424A86BAE48145F17F1A179C635554C3314789810DE6185789DFAEC84191926
MD5 SHA1 SHA512 TLSH

Submit Download

fa79bb51-1369-4482-a21f-17a7edff5494

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\fa79bb51-1369-4482-a21f-17a7edff5494
Size 16KB
SHA256 c33e6bff8c11b4ef936b3048a66832da106d6673a798a4ade59cf97415a03c6c
MD5 5c1071ed0ea1ea58e07f043bebdcaef3
SHA1 e569e88b481cc238ec1a96758487bcba1cf45cfa
SHA512 ef4a348acdcc02c63f6d19f499474f9151104c382d74bf4d4af1acfa51ee4459867c1e9168f558c1262ae57622cf648f2990324ebf68154aaa091712718e7839
SSDEEP 192:A0RD4BM8zT106xr5bfGdRzxGXLPeXXJsYNfZlA6wKtOnmT+pYLJDdGF8vHyeSpx4:A0N4iqxtbudRlG7PwJdGF8vSNxFK
TLSH
T13F72DA16686045BA8791E39DD4E8BFC3E5F628CB4C418FCAC7E4BD0829DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
Size 6KB
SHA256 507ab7c99311809e4b2902ed80d2cf42d77bae1e2e3d3ba38d7155101e50d6c5
MD5 6bfd1167d1cb81f034791358060bbaf0
SHA1 7b02943e46a4b7b9dd00eaaea019a08f71ddd941
SHA512 b798f49d0ac1d5edc843ed8e080e5999caa7a008bfd941f544716d27a131faa9e4a88ee3a9a643123e15474aa335f3c42eeadd524b78bb87375000d20ba7789b
SSDEEP 96:xHLkUTUiqGq2fke8bCObzSlSSlNdv9jlA6n+H/vukBw8OP8L4cn+5M:KVR2fk/+DSSRynukBw8Oa
TLSH
T14AE1007895088F7F64B676ACAC6488316AB2013BBBBF68D750B554C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
Size 6KB
SHA256 0de612a11e2db89fcdfc2424d1c4bae742d0af1446efd15eec659434b8aa011f
MD5 63b5340cb711126ac963f9cd8748e0b1
SHA1 399f85cbb96a095e92ffb47e4c1f13ae226f7bd4
SHA512 432515934d319b12298fcd9c508e3b7db0d97b10d78bac21cb26007764f2cfcdf70d62ae62cd57558a79cad5810cfc99545ff9ae1764e61d872e983f698718f3
SSDEEP 96:xHLkUTUiqGq2fkIj1zShSSlNdv9jrVn+H/vukBw88P8L4cn+rM:KVR2fkIjwSSunukBw88A
TLSH
T166E11E7895088F7F64B676ACAC6888316AB2013BB7BF68D750B54885050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
Size 6KB
SHA256 a538141a4cad62bc8e6f5b30d677df1a5ed6286f3ed063f75705f3773a4f4c02
MD5 7f82b55bfe757f0f6ec5916a1ba9c44f
SHA1 3774b19f6c2181864c0b7f6eed4b555855b4619f
SHA512 59d06032cb662e966553d48a4e06079ba957b0e57aeba9f6ca7e0578a2560890d6e07adba097add0dbd0324464b8e2737c0e350e78b62aaf089a22f958be8570
SSDEEP 96:xHLkUTUiqGq2fke8bC1zSlSSlNdv9jrVn+H/vukBw88P8L4cn+rM:KVR2fk/+gSSunukBw88A
TLSH
T1BCE12F7895088F7F64B676ACAC6488316AB2013BBBBF68D750B55884010CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 3742178b2c30d2fc721b7497043474c424bbfeb24ddaa9700d0a0a0e851d0252
MD5 c0e910de55b0fa533a88a72ed4dc0038
SHA1 de71dd89677ee3ea8c926187f82fa2702bfc36f1
SHA512 1e10dcc5e6ac508f072bdacdefb12a77171c3e6ee6fd371393c7bf159e3bb487b007d7d10c820d978af6012e651e074ea15416bbcbb5ed952413e60d3ba58b39
SSDEEP 49152:YDmgBuOjA5lUT2loNcNeaKvgmRBbFOYTg/:AmYuO856T2KOeaKvgmc/
TLSH
T1961639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download