Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 11:42
Static task
static1
windows10-2004-x64
13 signatures
150 seconds
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Exchange/[email protected]
- Size 265KB
- Sample260730-nt85lsgg49
- SHA256 1e1b62187e18f5e69ad9954dadf8506dab1ff24cd2673651b7d55ce1293792ef
- MD5 c0d7f807102c1064eb5e927c2176ead9
- SHA1 d0901fc2bf171bb1151aa4ed63555ad5f593ed58
- SHA512 c4d56955d4fcf349a39dc7bc2b51258d01d4db1f2b8776b74d282f137694da096015299ec5b04b9d54520535839e23b714a0b9cf24c31669dd75065ab9e0606b
- SSDEEP 3072:h62DsfJhygRubTGFWDxqO/6O+d9BrSfldzeWjwK9EqdsJeiBjPFK:/DsxRR+GFWDxtCO+d9B+fniWWE
- TLSH T167442876EF235340E1240B71AF7BD6CC2C69CC83ED62570D585E73C1A839A6AA6325F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe -
flow pid Process 301 2984 firefox.exe - Checks processor information in registry 2 TTPs 34 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e80922b16d365937a46956b92703aca08af0000 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000 firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 firefox.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff firefox.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff firefox.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4716 OUTLOOK.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5184 firefox.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 2984 firefox.exe Token: SeDebugPrivilege 2984 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe Token: SeDebugPrivilege 5184 firefox.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe 2984 firefox.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4716 OUTLOOK.EXE 2984 firefox.exe 5184 firefox.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4244 wrote to memory of 2984 4244 firefox.exe 99 PID 4244 wrote to memory of 2984 4244 firefox.exe 99 PID 2984 wrote to memory of 4400 2984 firefox.exe 100 PID 2984 wrote to memory of 4400 2984 firefox.exe 100 PID 2984 wrote to memory of 4400 2984 firefox.exe 100 PID 2984 wrote to memory of 2864 2984 firefox.exe 101 PID 2984 wrote to memory of 2864 2984 firefox.exe 101 PID 2984 wrote to memory of 2864 2984 firefox.exe 101 PID 2984 wrote to memory of 2864 2984 firefox.exe 101 PID 2984 wrote to memory of 4772 2984 firefox.exe 102 PID 2984 wrote to memory of 4772 2984 firefox.exe 102 PID 2984 wrote to memory of 4772 2984 firefox.exe 102 PID 2984 wrote to memory of 4772 2984 firefox.exe 102 PID 2984 wrote to memory of 2460 2984 firefox.exe 103 PID 2984 wrote to memory of 2460 2984 firefox.exe 103 PID 2984 wrote to memory of 2460 2984 firefox.exe 103 PID 2984 wrote to memory of 2656 2984 firefox.exe 104 PID 2984 wrote to memory of 2656 2984 firefox.exe 104 PID 2984 wrote to memory of 2656 2984 firefox.exe 104 PID 2984 wrote to memory of 2656 2984 firefox.exe 104 PID 2984 wrote to memory of 5228 2984 firefox.exe 105 PID 2984 wrote to memory of 5228 2984 firefox.exe 105 PID 2984 wrote to memory of 5228 2984 firefox.exe 105 PID 2984 wrote to memory of 5228 2984 firefox.exe 105 PID 2984 wrote to memory of 5444 2984 firefox.exe 106 PID 2984 wrote to memory of 5444 2984 firefox.exe 106 PID 2984 wrote to memory of 5444 2984 firefox.exe 106 PID 2984 wrote to memory of 5444 2984 firefox.exe 106 PID 2984 wrote to memory of 5460 2984 firefox.exe 107 PID 2984 wrote to memory of 5460 2984 firefox.exe 107 PID 2984 wrote to memory of 5460 2984 firefox.exe 107 PID 2984 wrote to memory of 5460 2984 firefox.exe 107 PID 2984 wrote to memory of 5492 2984 firefox.exe 108 PID 2984 wrote to memory of 5492 2984 firefox.exe 108 PID 2984 wrote to memory of 5492 2984 firefox.exe 108 PID 2984 wrote to memory of 5492 2984 firefox.exe 108 PID 2984 wrote to memory of 456 2984 firefox.exe 109 PID 2984 wrote to memory of 456 2984 firefox.exe 109 PID 2984 wrote to memory of 456 2984 firefox.exe 109 PID 2984 wrote to memory of 456 2984 firefox.exe 109 PID 2984 wrote to memory of 5620 2984 firefox.exe 111 PID 2984 wrote to memory of 5620 2984 firefox.exe 111 PID 2984 wrote to memory of 5620 2984 firefox.exe 111 PID 2984 wrote to memory of 5620 2984 firefox.exe 111 PID 2984 wrote to memory of 5904 2984 firefox.exe 112 PID 2984 wrote to memory of 5904 2984 firefox.exe 112 PID 2984 wrote to memory of 5904 2984 firefox.exe 112 PID 2984 wrote to memory of 5904 2984 firefox.exe 112 PID 2984 wrote to memory of 1836 2984 firefox.exe 113 PID 2984 wrote to memory of 1836 2984 firefox.exe 113 PID 2984 wrote to memory of 1836 2984 firefox.exe 113 PID 2984 wrote to memory of 1836 2984 firefox.exe 113 PID 2984 wrote to memory of 2952 2984 firefox.exe 114 PID 2984 wrote to memory of 2952 2984 firefox.exe 114 PID 2984 wrote to memory of 2952 2984 firefox.exe 114 PID 2984 wrote to memory of 2952 2984 firefox.exe 114 PID 2984 wrote to memory of 5184 2984 firefox.exe 115 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /pst "C:\Users\Admin\AppData\Local\Temp\Exchange\[email protected]"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4716
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Drops desktop.ini file(s)
- Detected potential entity reuse from brand GOOGLE.
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {38264659-5319-4fcd-b694-8dbc93ce7e27} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:4400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {16048ba0-e428-4264-82b8-8d448bfbb623} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵PID:2864
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 27276 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {97824029-eb2e-49af-9770-410369c176cb} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:4772
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27276 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {3914fef3-867d-442a-ae54-bd42261aa8b9} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:2460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1252 -prefsLen 34775 -prefMapHandle 3348 -prefMapSize 270279 -jsInitHandle 864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2820 -initialChannelId {d66e4a4b-962d-490e-9894-d0d629e574b9} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:2656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4864 -prefsLen 34931 -prefMapHandle 4868 -prefMapSize 270279 -ipcHandle 4876 -initialChannelId {a7c0d67b-1352-4054-92c7-91d58f12ab47} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:5228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32952 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {0cfee363-7a37-4d25-9d6a-111d79fef4d7} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:5444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {78bed59f-89bc-4cfd-a548-533176889c4b} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:5460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4860 -prefsLen 32952 -prefMapHandle 5600 -prefMapSize 270279 -jsInitHandle 5604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2844 -initialChannelId {bc95d4fe-e4c9-4b12-a94f-31c17610d507} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:5492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6220 -prefsLen 33071 -prefMapHandle 6240 -prefMapSize 270279 -jsInitHandle 6244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6248 -initialChannelId {1bebf2f7-a8c3-4f14-9857-9d38ec87c675} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2804 -prefsLen 33071 -prefMapHandle 2784 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6664 -initialChannelId {ff989280-c07a-44f3-8c7f-1cc85dd8cb70} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:5620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 33071 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {92fe34e3-072e-4328-99d2-2a36dfbdd046} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Checks processor information in registry
PID:5904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6048 -prefsLen 33071 -prefMapHandle 6016 -prefMapSize 270279 -jsInitHandle 6784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {515b78a5-bd23-4933-830d-5842c4e3c120} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Checks processor information in registry
PID:1836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 2844 -prefsLen 35200 -prefMapHandle 5664 -prefMapSize 270279 -ipcHandle 5688 -initialChannelId {61757948-577b-4f11-9c55-7ea5abbb23be} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility3⤵
- Checks processor information in registry
PID:2952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 5320 -prefsLen 35200 -prefMapHandle 5240 -prefMapSize 270279 -ipcHandle 5672 -initialChannelId {96709bb9-fca0-4926-84a9-de9a73ea32c0} -parentPid 2984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5184
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 15KB
- SHA256 f581e31b2caec1b2460927f83a2625534226b4ced246df6fc5156fd7c148d10c
- MD5 56548581401f32f66825d16da08d0402
- SHA1 fe132ebb805ff6315be2d5ce63be180377bfecee
- SHA512 23e0002c97b13bb84053c74062f96015d9722ba15a6644d0b692a52115cc2426aaaf9738ae7fc8b5f21121c800b91883be239af335b27ff6434bc53bf5b00a4d
- SSDEEP 384:HwCe7iO024Y0dcs3hk2nhfdDE2Ba/rIVy8eHD+bD+4:QqZY0dv3hk2nhfS2sDIVy8w+P+4
- TLSH T1D1728DBB8F512C5D1917D985C9AD53A9DC08FABBCFF690B608243449C78432AB0F608F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
- Size 10KB
- SHA256 5be04b228328f42006ffb71034c0031330c382a8bbdc476de6447a5539001553
- MD5 ccfd32c25427750079ede4b50e40f4a1
- SHA1 65c9dc70ae655f0295e18f2480887d0ba72621d2
- SHA512 af74699a5b6122684f5360cbb689e7fa5c8ebeef3985fd632c9adb72f6303e848986e29916816e0a5df3684e4b2e9e3b0ff41ec8f13d0152b32b3d53e11f1109
- SSDEEP 24:EuhMZRti91G29xKu9Buj9VvtfVMc9FxfVD9l1fVu5q9F55A5CfV:fEsk0QRBLZFxxEI560
- TLSH T1272283E36B73A462F1A28FF54058714C8C331329557DE684CA4490F746C6AA9A13FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\AlternateServices.bin
- Size 35KB
- SHA256 1d199c9b4b7f0b95431bca283404083688c3abee92cde9748ce63b2ed490553a
- MD5 dc164c4500785225159138de06cd69b8
- SHA1 8aa0d18d1e3eff52f0589181648a5084721b8eca
- SHA512 b53d88977295774d1fefd81c2b0133e211881e4aae9647a0835b05393c46cf18d0aed4c7bb0ab003ff1914a1464dc62c55daa9b175713e67fe44d2e10f31b11d
- SSDEEP 96:XlWO2SqnBFnjvn6I56q/7SM/p/3Leyx2kUW++CX03ffrNeJalnQzouylh7XG32u0:TQc22QCZY6Fgj
- TLSH T1B8F2D9E72B766452F1A24FF44069725DCC3303158869EAD4CA18E0A702C67E9D03FF98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 100KB
- SHA256 87269dcdad4047e53d80e89b822fb0b98217c393c973bc42d185ecba23820898
- MD5 90cb73c02f2440937690570f5ff5c59c
- SHA1 35744bd3ba9be07b4500134df79bf73140312eee
- SHA512 c27e71190682a449aaa5ccee9fdbc64c3579727c996de0c9d21d15f5794109feba23898cac7d8a4a59d89980a12c81a04ca98446deb589de1adeae7fc29d6468
- SSDEEP 1536:LWChVXpTBjinT8dugc/o4Kjrm2iy67FIe6:LWcxZhE8duo4Kjrm2iy67FIe6
- TLSH T19DA369D4DB1B407BFC1085BFB495673C2635F4214A599B0B3AEC04661DCB7BF2D0AA2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 ebc53d04a68821ed5be8f3a095b444b31003760ac92759e52411f997ee3ac6ab
- MD5 752ddfa457994176601f4083da08ebc5
- SHA1 d2b52503740960876e23824e5ba9efcebee9a5e7
- SHA512 1c6b1259764a38f4e14340c5d951f716f0d911803a2ae08f51f8f4e8579d33de38f5bcd4425e491a04df5961434fb893f2384512efd16bb64a3d9e3b444f4cca
- SSDEEP 192:OOv5zbowZRgcyjnxqf1d66JozGzgCl6mc0dz:FbowZOcyjQtd66JozGzgC1jd
- TLSH T15AD1CD68F729853FC418423BCCA61F410E7A389B984E7F15319CA41C2D572DE7A8D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\db\data.safe.tmp
- Size 100KB
- SHA256 67e9cddcdac84529c293c4ccd1c48eba7d2272b18b81fc74c051df1e43d8494b
- MD5 4ad4e0969f6ac692e6e5c7c29257d307
- SHA1 d563141f5b7934c1f6736a4ff66d9d5ff9264e22
- SHA512 ff7c6a14fb947000d4c1184c5b361d93ca9bc77b6e6df06d0e0efd3cbb4e3af69757ffd477aaf82d7422edd8bc7c7945fa66b215a3303df4d8f86c3e322711eb
- SSDEEP 1536:rWChVXpTBjinT8dugc/o4Kjrm2iy67FIeq:rWcxZhE8duo4Kjrm2iy67FIeq
- TLSH T15BA369D4DB1B407BFC1085BFB495673C2635F4214A599B0B3AEC04661DCB7BF2D0AA2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 aa706216516582540022edcf7dc535269ba750b8f0c5b13fa30f1e7d8c96dfd3
- MD5 5139a15e997d4872ecc21da4f737d05b
- SHA1 afa64b2d3c09f69cf9b19c81cb24f7dbf47ee7f2
- SHA512 fd5a76b36f1f845763b479d443ddd9ce0b335bf8e939c3003d76280336d2e168e7b86c43e856508eec97ed23bbd9b6a82f6c5982507512b96f10b2a4efe70c79
- TLSH T1BE21454C3EF84D2A5AC7E39C7451028F53518E0685975E434E52FF8DCE85ADD326A439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\events\events
- Size 4KB
- SHA256 0a0926c5321f406b0c6f1fa90fa55dbf4dd3aae5f45adcfae161d9cd788171f8
- MD5 dd148e3244ea52afcc536dc440476eed
- SHA1 29d233f5744f3efa758ded187d15437a914e4680
- SHA512 f3b869e87c327aae765deb90d69c78222fc0b72ead742085fbc86e5842b7d86809408f418ad8825abfa27657f4674ed0dfe12af401c097c1d822827b891a31dd
- SSDEEP 48:YpnQ2Q/s6pQaYEnHIuZLli/ShNsZx5uRX+9ec6t5cI4nsZdyuvdzsddNXgVhI2Xc:KHxohNyuRFt5X4nCd5dYddNO2/nR3gq
- TLSH T121A1EF1D3AB90C7F6AD7D39CB881428E86994B02C4871E874DDBFE498D4AA99311F139
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\096415d0-b63c-445e-929c-e0f2a4aed248
- Size 235B
- SHA256 8255051dd36e5bb0ccffa29bfbc441db2041573a93a57da7483988cf82a6af4c
- MD5 d955eb42dd8e2feda9848ee8789abc64
- SHA1 8148a4a6d3f4ec6963886fe5da2af886efc8ae24
- SHA512 b8e3820e8d18d8bf6d7a79ed3ebe98bcf2ac46b31cb50fcc88dc153f56564ac13f685c9fd11eb55a692c91ba9c3d9e7a41e8762c44f98a22d90a0301f2c5d9c8
- TLSH T19ED097C12898232C08180F4BB0B02CD231544C3320A0A850C69080B489F8AC45262C0A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\26af6c3a-dd7a-45bb-ba8d-36b6947f3928
- Size 2KB
- SHA256 452c2febb1fd8db5f8986b8898f590cfacc0ef6e512e06c6a1e23d476be0e36a
- MD5 53515b209e94d4a22c373a445ddb3d15
- SHA1 427d733cb01928e6794aaac783a3bc4c1a2343f5
- SHA512 80062a4b830e349fe3f061f2b68ad065e6e829cd0d4e73adfb2e39798dd2acde267019d06c0cef7d115c3b92a4943526073ac1427322b856b77e2643b9265ffd
- TLSH T1AA41646C39789DB78CABF58DE482334E4BA98A0340C62C432D51DF0C8CDA65D336A53B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\2dad0198-041e-4423-975d-0308f5cb2198
- Size 883B
- SHA256 dd7cbf9a9f3b65ba63327b2f722bdd5e94b1d185bda8debe1e54450aa3baeff5
- MD5 3faf1ca3650ee7a9df6133b60fdb2cea
- SHA1 1df2762d9a2ab9b3bfc97db276a55940414fcb53
- SHA512 53914374690dfd79253b6965a298f91926c042aa334ece6281bcd174fc3ff14a5bc258d4adadb9fea08adc5a3ab9d2e1fc41de96852450a45e77f4cb6a597345
- TLSH T1C411C450A639B8A6CC7CD24B89557B068BE97413C0CA55183DA19E180DBE51FD3A560F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\bf5eadc2-ba82-4183-80c3-30cdac5f8bed
- Size 15KB
- SHA256 6e29460482d28fecc2fa5cb746acfb39ee5e908462ec3abe6250a4ee533be5b5
- MD5 bfdfbe17c1898e2fd8231aa958edf3e1
- SHA1 1b82e583b3b169b0f44033e6bc34db9fea7ea6f6
- SHA512 cc99d344b896e87b1668d17104455f00ca90096e32ab5a43bebf2f178882cb4b938887df8c8eca57956a953fbddba16556d15eac0c3acb0f2132be3edf7d07d4
- SSDEEP 192:DCpcuNhWRtwyG+fKPgkqUTVMstdSwodD6CLV52+BP1eGPiOChswsuh9+YayXSTzT:DC+uNZSLJx6Ozw3b+YayXST5miPv
- TLSH T1FC72C9166830457A8291E3A9D8ECBFC3E5F538CB4C419FCA9BE4BD085DDE06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\e1aa2829-3437-42e4-bef7-a7e59569112e
- Size 235B
- SHA256 caf6739f88e5dbb17e500a4a5da98396b78dffaf958c48377d6d0c6e3a5cdb86
- MD5 608534753c4299725de18a4112ce861a
- SHA1 f9cac774a0c7f7f91bb0cfe210cef5771703a943
- SHA512 b3fd0d1834fa0228d81738c346da8bb71eca9ecd8ac74e7f3e9aee42c0d2a93ef7442cbac2258ddfa401b0718c22dd2945060476e7457836dddd9429a7918c4c
- TLSH T19CD097846888A3AD48140F06F0E028C630458C3728B268708A5690789DF8EC44272A4B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\datareporting\glean\pending_pings\f1df2498-e273-4554-81e5-15ea7da5f224
- Size 886B
- SHA256 993e35828fe0c48d4c3818660897b94615f76767f20346239eb337bc7467e1b6
- MD5 e6dd84c5d5b1392a26e4b9be65e5fce9
- SHA1 cf0d67e5514cd316dd1300e71fd2cbf5b7828e59
- SHA512 920f7adf5d950a88b43ee37d809c1c4d5a5e728d621472b6fd5f420240d86b449f9120374f3341836f17f5bcf9cd8dfe67fe08301d356a82dae132bd0c18e01c
- TLSH T1E31104408A38F8628C7CD38B9991BB474BE47423C0C659043D518A280DAE51EA357607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\extensions.json
- Size 16KB
- SHA256 63fa742b6c18e5664040f9d874e8416a0e3952fa4f019bdc0afb1dc116f91464
- MD5 185c3f921e85ddff7229cbe0ac98be21
- SHA1 ea1855004ee13c9f023ebb23cd17a1217af66d87
- SHA512 83313fa32e20c6b22060e74323b0db0b6473cbe56b9c9b430e514a7def01102fab1a43401718df5c630a9ba8e05db58ff7ada923f233206c4b4c621f4928991b
- SSDEEP 384:ghkI4vzUmldvQ8dhWo94zr96oQL4HQL4PGL4HzL4H/UL4HnW4h5:PI4LRfJXF4F6Z4y4U4f42424L
- TLSH T18E72541545049EB8294EA79BAA367E02C37D473B60845C78F4DD8FC802FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
- Size 6KB
- SHA256 11484e1ca1a5038c91d0d59aeb25718be25b91692935ca59c4bbfc768612e012
- MD5 ae9a5cef0e8608dd1b954ac8107fd719
- SHA1 1de09e8f640ffc1fb7ab94d51cbccbab9cd42d3c
- SHA512 4daa470b65458fd840126939fd5eccb093311f4f9dc6773b3539dfcd6720567341fff5a145dc09163896074e74d73aba014868a18ee2502862729666cb0c9047
- SSDEEP 96:xHiUTUMqGq/fSmJkzSGuSSlmdv9jwnytHlAsO7HjvsBw88n8L4cn23U1jGS:U/R/fSmJAuSSWxisIHzsBw88C
- TLSH T16DE12F7890088F6F64B677ACAC6888716AB2013BB7BF68D750B594C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
- Size 7KB
- SHA256 28c50edc54d153674fedf142e6793735f09bac517bfba9ae9ffcaa269881f794
- MD5 22debdc065fa2b0d32a3cbd812aa363f
- SHA1 8b832f2c955f45dac74499e6332f815268edcd82
- SHA512 2f698996263c2c667107db4e6fa18c428274e9b1c0b36319a7b262f7ae1d88ba0683d2649ff3b88b566e964e69ab6294c6b63ae18fc3360cc6d78f86e32c9889
- SSDEEP 96:xHiUTUMqGq/fSmJNbzSGuSSlmdv9jwnytHlAsO7HjvsBw88n8L4cn23U1jGS:U/R/fSmJBuSSWxisIHzsBw88C
- TLSH T14DE1307895088F6F65B677ACAC688C316AB2013BB7BF68D350B594C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
- Size 7KB
- SHA256 153765bf5cdfd8dee7c211021a068261232e48b725fae76036c7fbc7e87a647c
- MD5 241faf60103740474e563b483df6d570
- SHA1 d8b80f615d6a0ac2e0223e832f3b1480421e31a0
- SHA512 7be7a0eaf09bf8af0e16fe71f0154ca3309705d9651d52cd8563047eb959cc7b32e1f7670994caa7af221322af1d6d22ff2560254ba8f478dacd7beedbddea6a
- SSDEEP 96:xHitTUMqGq/fWmJNbzSGuSSlmdv9jwnytWRa5AsO7HjvPBw88wC8L4cn23U1jGS:UqR/fWmJBuSSW4RlsIHzPBw88Y
- TLSH T16DF10D386444CF7F65B677ACAC2888715AB2023BB6BF6CD710B59484015CF3446F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
- Size 6KB
- SHA256 c989c386c53013ec60dafd7a71dc014c1acc253695e1c693633dd6c065d5aa7f
- MD5 8b80f8a287620f1e17354c1f331ead31
- SHA1 d247412586a6f663fb23ef2d172acd1f8411b967
- SHA512 84b7e3d7e296a06248156f451c7cf0f75c693294c2c2d4ff6c98429d4df15f6e69632413c2802ba05d01547ec5b1081e2fc7be6caf2ac81c31011ce9043c924f
- SSDEEP 96:xHiUTUMqGq/fSmJ1zSGuSSlmdv9jwnytHlAsO7HjvsBw88n8L4cn23U1jGS:U/R/fSmJNuSSWxisIHzsBw88C
- TLSH T18CE13F789008CF6F64B677ACAC6888315AB2013BB7BF68D750B594C4015CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs.js
- Size 6KB
- SHA256 a08caa92e0c707ba1773a6d080e21caecff587294f0527636af7a30e66b33de3
- MD5 8413c24059454281bdfde35bf20ad5f7
- SHA1 59c7402e03a58d7bb2c7bd87b03ddc0a93d9db1b
- SHA512 ec879ed911e4d3f1e116ee273ff56dd2254da0e9196b12211f6a25a45e7c516d3eb5c6b55b2fbc2ed74c723b3a90868b3de8409b58f62f1f290a82aa15a579f6
- SSDEEP 96:xHiUTUMqGq/fSrO1zSGuSSlmdv9jjnytHlAsO7HjvsBw88n8L4cn23U1K:U/R/fSrONuSSxxisIHzsBw88J
- TLSH T12BE130789108CF6F64B676ACAC2888716AB2013BB7BF68D650B594C4015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 11b491759e3c3bcfb43e7aab39c43b66228bf368adb886c27551766294068d53
- MD5 7b03183bc91f0fcc5f21ba59ab6cd668
- SHA1 56c09ad7cd31dd00d680169e7031cd68f23d5fea
- SHA512 cdfeaaa3d513d56f0088d6382da846ce576ab3c766346026a82527b87a144277719fa7038d14860f5658285d7eddb858d8e8801484395cb8479abf8d2501051d
- TLSH T1A421B9466DBD0CF12908B3AEA0C16FADDB55006743A898E0DC44E80444AC2477FAAD4A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\sessionstore-backups\recovery.jsonlz4
- Size 5KB
- SHA256 1e96f0f078ddd53ec471a2205ba57cecfe5687d2cd13d9859d3096b911e1c789
- MD5 0875341c4a0fdf096904cdf400515faa
- SHA1 821ab04e6778a7c5f71b9e0d6f76dd40cfe49d2d
- SHA512 18a5eea64874cc18cded29ebea7fea8dac8ec19a49b2c7180a0d53c60db1f81954f613f9c5a59939bd15b2c9f5c3ccf40ad05ed44877328151e9a218866921aa
- SSDEEP 96:x2D9FjIJPzJ97nyjBH8Sx8RQ4tl8upjKejCb5+99wn6cQmU0iEqNfDqLYpnm53:x4SPzJ97yjuZNzjKejV3w64YNJqF3
- TLSH T12AC19F7BE88C2E77217DD44EC4E9BE12D6C630D5C57C2E94C68C34954329F5B0B5E289
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.6MB
- SHA256 5e37edf1f6101de01d9d192baa23f5d437197a6d6e8856538501094ce513849e
- MD5 8f150a7adc086ca17ba08230f2a96fd6
- SHA1 bef6bec141021249f2f7c3941daa8deb61c27422
- SHA512 8a59ad739d35fcb66416d33aaa62fd91811725c9b66ab942a74636c770690479548c0d3dc6d155a88f63239042a47bf7ad7acb568975daf2c2605f6776f532c7
- SSDEEP 49152:OBl3Q9jg9SieD+YhuB+GXZaW3seb0b/qEwL6tC7:Yl3Q9jg9/+GXYW39bs/YL647
- TLSH T156262AF820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B6E
- MD5 SHA1 SHA512 SSDEEP TLSH