009ba6c66e7fe78488767ee223659575d8475169ba5843060656121473c0effd

Analysis

user interaction
yes
max time kernel
859s
max time network
860s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/07/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Among-Us.js
Size 1KB
Sample260731-xp2dmsfc26
SHA256 009ba6c66e7fe78488767ee223659575d8475169ba5843060656121473c0effd
MD5 2a0db40133d08743afb05996db1a3841
SHA1 735e3ad63738441acd1d65a2fc5637c557c4254a
SHA512 69150b662c0bf290a628109a91b174a5ae727bf77c16e2ec1f3f75a4d5a00f3918abef190bced71b7b5f86a49e71a68bb7f0f39e7398579765d71dad4a8c2f37
TLSH
T16E31642476B9C5C962D0788D813DD9890D1AC212C63DE0E2DDCCD67AF5147CE46BD8F9
MD5 SHA1 SHA512 TLSH

Score

7^/10

google execution persistence phishing

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1900	plugin-container.exe
236	plugin-container.exe
4188	plugin-container.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
168	camo.githubusercontent.com
170	camo.githubusercontent.com
151	camo.githubusercontent.com
152	camo.githubusercontent.com
153	camo.githubusercontent.com
154	camo.githubusercontent.com
155	camo.githubusercontent.com
156	camo.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
373	5796	firefox.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1900	plugin-container.exe
1900	plugin-container.exe
1900	plugin-container.exe
1900	plugin-container.exe
1900	plugin-container.exe
1900	plugin-container.exe
1900	plugin-container.exe
1900	plugin-container.exe
1900	plugin-container.exe
1900	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
236	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe
4188	plugin-container.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe
Token: SeDebugPrivilege	5796	firefox.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe

Suspicious use of SetWindowsHookEx 58 IoCs

pid	Process
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe
5796	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 5796	3692	firefox.exe	89
PID 3692 wrote to memory of 5796	3692	firefox.exe	89
PID 5796 wrote to memory of 1516	5796	firefox.exe	90
PID 5796 wrote to memory of 1516	5796	firefox.exe	90
PID 5796 wrote to memory of 1516	5796	firefox.exe	90
PID 5796 wrote to memory of 4980	5796	firefox.exe	91
PID 5796 wrote to memory of 4980	5796	firefox.exe	91
PID 5796 wrote to memory of 4980	5796	firefox.exe	91
PID 5796 wrote to memory of 4980	5796	firefox.exe	91
PID 5796 wrote to memory of 4140	5796	firefox.exe	94
PID 5796 wrote to memory of 4140	5796	firefox.exe	94
PID 5796 wrote to memory of 4140	5796	firefox.exe	94
PID 5796 wrote to memory of 4140	5796	firefox.exe	94
PID 5796 wrote to memory of 6112	5796	firefox.exe	95
PID 5796 wrote to memory of 6112	5796	firefox.exe	95
PID 5796 wrote to memory of 6112	5796	firefox.exe	95
PID 5796 wrote to memory of 3660	5796	firefox.exe	96
PID 5796 wrote to memory of 3660	5796	firefox.exe	96
PID 5796 wrote to memory of 3660	5796	firefox.exe	96
PID 5796 wrote to memory of 3660	5796	firefox.exe	96
PID 5796 wrote to memory of 988	5796	firefox.exe	97
PID 5796 wrote to memory of 988	5796	firefox.exe	97
PID 5796 wrote to memory of 988	5796	firefox.exe	97
PID 5796 wrote to memory of 988	5796	firefox.exe	97
PID 5796 wrote to memory of 5000	5796	firefox.exe	98
PID 5796 wrote to memory of 5000	5796	firefox.exe	98
PID 5796 wrote to memory of 5000	5796	firefox.exe	98
PID 5796 wrote to memory of 5000	5796	firefox.exe	98
PID 5796 wrote to memory of 4548	5796	firefox.exe	99
PID 5796 wrote to memory of 4548	5796	firefox.exe	99
PID 5796 wrote to memory of 4548	5796	firefox.exe	99
PID 5796 wrote to memory of 4548	5796	firefox.exe	99
PID 5796 wrote to memory of 4864	5796	firefox.exe	100
PID 5796 wrote to memory of 4864	5796	firefox.exe	100
PID 5796 wrote to memory of 4864	5796	firefox.exe	100
PID 5796 wrote to memory of 4864	5796	firefox.exe	100
PID 5796 wrote to memory of 3884	5796	firefox.exe	104
PID 5796 wrote to memory of 3884	5796	firefox.exe	104
PID 5796 wrote to memory of 3884	5796	firefox.exe	104
PID 5796 wrote to memory of 3884	5796	firefox.exe	104
PID 5796 wrote to memory of 5468	5796	firefox.exe	106
PID 5796 wrote to memory of 5468	5796	firefox.exe	106
PID 5796 wrote to memory of 5468	5796	firefox.exe	106
PID 5796 wrote to memory of 5468	5796	firefox.exe	106
PID 5796 wrote to memory of 2668	5796	firefox.exe	107
PID 5796 wrote to memory of 2668	5796	firefox.exe	107
PID 5796 wrote to memory of 2668	5796	firefox.exe	107
PID 5796 wrote to memory of 2668	5796	firefox.exe	107
PID 5796 wrote to memory of 5124	5796	firefox.exe	108
PID 5796 wrote to memory of 5124	5796	firefox.exe	108
PID 5796 wrote to memory of 5124	5796	firefox.exe	108
PID 5796 wrote to memory of 5124	5796	firefox.exe	108
PID 5796 wrote to memory of 5280	5796	firefox.exe	109
PID 5796 wrote to memory of 5280	5796	firefox.exe	109
PID 5796 wrote to memory of 5280	5796	firefox.exe	109
PID 5796 wrote to memory of 5280	5796	firefox.exe	109
PID 5796 wrote to memory of 1276	5796	firefox.exe	110
PID 5796 wrote to memory of 1276	5796	firefox.exe	110
PID 5796 wrote to memory of 1276	5796	firefox.exe	110
PID 5796 wrote to memory of 1276	5796	firefox.exe	110
PID 5796 wrote to memory of 6024	5796	firefox.exe	111
PID 5796 wrote to memory of 6024	5796	firefox.exe	111
PID 5796 wrote to memory of 6024	5796	firefox.exe	111
PID 5796 wrote to memory of 6024	5796	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Among-Us.js
1⤵
PID:4396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {3c26e1e0-d72b-4eba-9e65-151b89e865cf} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:1516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27136 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {752305af-468b-4323-80be-6d0109b4d6cd} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27277 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {38cc6a65-b47e-4f40-be1c-a4e8e82abb3e} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27277 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {5814c14e-5db2-4e1d-b49a-00a2c98de3e8} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4508 -prefsLen 34776 -prefMapHandle 4512 -prefMapSize 270279 -jsInitHandle 4516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2612 -initialChannelId {6fcf9f73-03cb-4e88-b7c4-691b5292b520} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 35013 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 4940 -initialChannelId {23a553b9-9814-4e7c-bc99-f962d242cbac} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32900 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5096 -initialChannelId {e7794704-f134-495a-8a67-d8606b38539a} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5216 -initialChannelId {be44b9a0-8ff5-4c19-9eab-357e2ff4c6b6} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {78a5d0da-3646-4c44-8ebb-d4f8bedfdb84} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6172 -prefsLen 33071 -prefMapHandle 2916 -prefMapSize 270279 -jsInitHandle 6072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6188 -initialChannelId {7849b79b-7d70-4c24-a3b7-9f0f520e7b9f} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6456 -prefsLen 33071 -prefMapHandle 6608 -prefMapSize 270279 -jsInitHandle 6452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6516 -initialChannelId {25711a6e-9876-4956-a7aa-184816b9eb97} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6868 -prefsLen 36848 -prefMapHandle 3028 -prefMapSize 270279 -jsInitHandle 7100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {188fb22c-9e78-4203-8cd6-8abaaf0fdcce} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4784 -prefsLen 36848 -prefMapHandle 6980 -prefMapSize 270279 -jsInitHandle 6796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3000 -initialChannelId {154b35f5-2b1d-429e-b729-dd69e003e4f6} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6744 -prefsLen 39972 -prefMapHandle 4612 -prefMapSize 270279 -ipcHandle 6516 -initialChannelId {4553ea3f-f636-4599-800d-f3ff86a976e3} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility
    3⤵
    - Checks processor information in registry
    PID:5280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6940 -prefsLen 36848 -prefMapHandle 6148 -prefMapSize 270279 -jsInitHandle 4488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2828 -initialChannelId {9b6ca08d-dc3c-4d62-bb32-d1e57d493da6} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:1276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 36848 -prefMapHandle 5296 -prefMapSize 270279 -jsInitHandle 6484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7564 -initialChannelId {ba918edb-0cc1-40dc-8a84-a2a5296c605d} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7844 -prefsLen 36848 -prefMapHandle 7784 -prefMapSize 270279 -jsInitHandle 7668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7852 -initialChannelId {a9813fdd-2cae-4f32-b691-7591e6774313} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7712 -prefsLen 37150 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 6916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7912 -initialChannelId {8f828d56-0e4e-4792-9e13-e027f9de51ed} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:1980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7712 -prefsLen 37150 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 6916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4704 -initialChannelId {77d5b830-9f32-4bf2-bc27-50fcd68c97e7} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 37150 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {83f6ea90-a3ae-4570-b2d9-64fef5fc2505} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:3140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2928 -prefsLen 37150 -prefMapHandle 6788 -prefMapSize 270279 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7092 -initialChannelId {3e818b23-f625-41c9-a571-53a7736cceda} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:1036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7568 -prefsLen 37150 -prefMapHandle 5088 -prefMapSize 270279 -jsInitHandle 8076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5320 -initialChannelId {3e74c21e-23b4-422e-a071-72d3e2a51488} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8508 -prefsLen 37150 -prefMapHandle 8580 -prefMapSize 270279 -jsInitHandle 8604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7544 -initialChannelId {e77466ed-8691-43f6-bc1c-587462391f42} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6016
- - C:\Program Files\Mozilla Firefox\plugin-container.exe
    "C:\Program Files\Mozilla Firefox\plugin-container.exe" -parentBuildID 20250130195129 -prefsHandle 5380 -prefsLen 40315 -prefMapHandle 5384 -prefMapSize 270279 -pluginNativeEvent -pluginPath "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1" -ipcHandle 5372 -initialChannelId {34930ff1-c963-4312-a0a5-1318e93354fa} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 gmplugin
    3⤵
    PID:3560
- - C:\Program Files\Mozilla Firefox\plugin-container.exe
    "C:\Program Files\Mozilla Firefox\plugin-container.exe" -parentBuildID 20250130195129 -prefsHandle 6244 -prefsLen 40315 -prefMapHandle 6248 -prefMapSize 270279 -pluginNativeEvent -pluginPath "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.3050.0" -ipcHandle 6220 -initialChannelId {f356152a-8110-4dfc-a979-21499bf4cc75} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 gmplugin
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 8876 -prefsLen 40315 -prefMapHandle 8880 -prefMapSize 270279 -ipcHandle 8888 -initialChannelId {b550d2eb-22d4-48f8-b25c-fa86fcb8d1e2} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 utility
    3⤵
    - Checks processor information in registry
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7400 -prefsLen 37193 -prefMapHandle 8872 -prefMapSize 270279 -jsInitHandle 9060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8964 -initialChannelId {ad16f673-9202-4313-90d3-7346d10eb17d} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:4268
- - C:\Program Files\Mozilla Firefox\plugin-container.exe
    "C:\Program Files\Mozilla Firefox\plugin-container.exe" -parentBuildID 20250130195129 -prefsHandle 8540 -prefsLen 40358 -prefMapHandle 3016 -prefMapSize 270279 -pluginNativeEvent -pluginPath "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.3050.0" -ipcHandle 5468 -initialChannelId {19a9fa15-9bb7-4946-9957-a83a7a78ccc3} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 gmplugin
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8376 -prefsLen 37193 -prefMapHandle 8380 -prefMapSize 270279 -jsInitHandle 8364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8420 -initialChannelId {025fae4a-dac6-43f4-8452-a76520b6e03f} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:2596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4760 -prefsLen 37193 -prefMapHandle 4492 -prefMapSize 270279 -jsInitHandle 8124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8328 -initialChannelId {99c68e40-9026-402e-9591-ac7bfcebd047} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:1456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6788 -prefsLen 37193 -prefMapHandle 9080 -prefMapSize 270279 -jsInitHandle 5916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8600 -initialChannelId {fcc487c9-008b-4ce6-bd4a-d3ceebb89bbc} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 37193 -prefMapHandle 8276 -prefMapSize 270279 -jsInitHandle 1360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {cab274a3-3d04-45a5-af85-4609bd9f7f36} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    - Checks processor information in registry
    PID:4108
- - C:\Program Files\Mozilla Firefox\plugin-container.exe
    "C:\Program Files\Mozilla Firefox\plugin-container.exe" -parentBuildID 20250130195129 -prefsHandle 8912 -prefsLen 40358 -prefMapHandle 8548 -prefMapSize 270279 -pluginNativeEvent -pluginPath "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.3050.0" -ipcHandle 8284 -initialChannelId {6ea1615d-b6f9-4c91-9717-a467bc9b2b3e} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 gmplugin
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7668 -prefsLen 37728 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6160 -initialChannelId {3c1cb53b-f977-4658-b454-ca2306afddbc} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    - Checks processor information in registry
    PID:4868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 37815 -prefMapHandle 6780 -prefMapSize 270279 -jsInitHandle 7084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7780 -initialChannelId {553c63c4-516b-45fb-a220-5fc2565ba824} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
    3⤵
    - Checks processor information in registry
    PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5944 -prefsLen 37815 -prefMapHandle 6468 -prefMapSize 270279 -jsInitHandle 12544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12580 -initialChannelId {e78aa0ca-b100-4fdf-8b03-41bcc2c46ee9} -parentPid 5796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
    3⤵
    - Checks processor information in registry
    PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\activity-stream.contile.json
Size 5KB
SHA256 853c684aa0d3c33f6193ae0d4d8e4e9f849aaa78383edf7e6edaa5a2eab5a615
MD5 48245e3e6756af45faad0f5b742926b6
SHA1 2260ea5a60b5503f95af02f82b826d2a00ce473d
SHA512 01e5f4e62c1d5ce81fbf7c5db181bb15b8b8718042961bce8128029454c2ad9a9c4ac4f5095961dbe6794fb146742c02c3b985171568919199a21c0836e437b0
SSDEEP 96:qoylJkQt8FzYlMsUzZ7V3y75t5VOx2/y3R7bcf6/IetAJb:HQt89uMsUZxcr5VOU/yRAf+7KJb
TLSH
T145C10A9F9AA549230BB2BBE53D5B378CD6A7B00741D4CE1CB742EC10A65835E02AE5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DF0C3F462E9405F35AF17656883992519F864F3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\0DF0C3F462E9405F35AF17656883992519F864F3
Size 382KB
SHA256 3e0a8cecf24d71ccf05b95e06d3a2072d21fd47dac23c48c7d4067b74013f091
MD5 0c0fc3e800afb5488ed07c9c0eb683ea
SHA1 42d8f9dd983a625bf61f7f477009ea7360ac895f
SHA512 449001de43ff3faf9dde048415c4fcbb69da3d7d35a6b3b303ccd00cb5cc590688425dd9c739074ea1b2f4a29e62a59d9e65712d6d59614ea5c26dc72ee42179
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8EQx:C8tg599lGDBskZP58B67znOwGQ8EQx
TLSH
T17284233D8D3E79006B0292B05FC6C75E4FE40A86A2C0E4C59154A283F9B7FB6F567279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1AF1553F70844FF04B63D158910B733C3061A089

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\1AF1553F70844FF04B63D158910B733C3061A089
Size 89KB
SHA256 0eefab83f082599f91b6c9703d60042e36269e42ef158b926791dbccd7df7e36
MD5 bef33c58d02f34b73261fad0256e4bfc
SHA1 865c2ee11ca7c789aa33408ccda60b2c0e95f275
SHA512 a74bfc65530e133c0e7040c5c3f08b99ea5eff27316a8b9bb234ce76ec85a20f9a1e7a35d5a01a7c6147e79e36d9ffae62f009db032fc0b29082f3ca215c9bc6
SSDEEP 768:7Tfv2V+7uOKi3ia85s9iT/jWjW5kId61VkjvXYiGNAXLgSl+ERgulFNsqH9VMPHW:OWH5y1SAXLBnl/sIyHPPTnvY3mj0iBAP
TLSH
T1DE93B693F6D1102BA173821DA042F7BDBA3FE886D7512DEDB119F73482E21DBA615309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1CB2A9DD4B8EFD0CF15E9BF8C2B8607B7D14F107

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\1CB2A9DD4B8EFD0CF15E9BF8C2B8607B7D14F107
Size 18KB
SHA256 94f40e393274b9a27d71bb0f87674b7dd46d29a0cbb3fdba73722aef23af005e
MD5 7befccd1685fdec5e22ea1e539be63ef
SHA1 c00c5bcadc106244fb3579edf0233d3c115b273e
SHA512 c13a6e69c19c4b7ee1cec50c77506a735e980f90089e6d4b9d0c617ceba31c8d60b852ca40fd7dc659e2ddd6c4130e80dc5e28dd5342ae40c940c6619d254675
SSDEEP 384:DdEBxC+p37+C2f46k784IIcgWmC+Bsqsg7HXzHqq:5EL5p3Cu6k7JITgreqsgLXp
TLSH
T1D382BF791F11E6C805532892EC2AAC6A9C9D93F38FDDD2EE979831A08584739E351CD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

467FFDE1BE883588176A7E1FA42824ED9B785DEC

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\467FFDE1BE883588176A7E1FA42824ED9B785DEC
Size 51KB
SHA256 2c14b80ae5c9c523e43f15191c8ef84d8eaf8e30eb742637ba4d6d240d08cf80
MD5 615a99e4da105c717ade8bce04a78edf
SHA1 494d3784a73ca140db0b5fa967e4db6b878bad4c
SHA512 dcb556477a4d8130de9dfc7a05ce45701bd7db8ab7cc365632064da7e549f7db58831e42f0ca4b0d654b1de9818fcd8d1c04199294ac59a87513a7f666fe4ffa
SSDEEP 1536:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlmbEVM1W2w2m:c6nHvPxMUsglU4ATRi
TLSH
T1C933F2339F60B6054A15A0B195D7BF882E376613DBB2ECAC185877CD6FC027454BA8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 509e9449596e27178a94582f3d9654e1075bc538247b5628fa6810b9dedeb632
MD5 a0f921849f9a0b858c0582ff7028d3ce
SHA1 e34ac28d9eefca898cf58019188c12c9d9e5b3ca
SHA512 cf6677312f8a8a160802a911d21155bbc0d3c40013453676291bced31a4d6b62e87e6716f0cf47011cdee447287499165f92892b9fbd04855996938037071516
SSDEEP 384:HwCe7iO024YqDL84KKDL849B7SOEAd9KVRaAcP+AWRMAVDn:QqZYqDL8lKDL8CB7S/AmVAf+hRMYDn
TLSH
T144728E3E9F013CA81597C0E8C5F892D94D1877A7CFE6806D21683D0DC698969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

524AC778200161B6ADD049397CAC61E0484235FB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\524AC778200161B6ADD049397CAC61E0484235FB
Size 28KB
SHA256 d67b7094295682d09a0a3a4566ed2a654d34afcbc51095d55e7a9f511284de5d
MD5 043581031932e3bbcbad5576aad8be08
SHA1 0eb4138a39e589f33351ada56ceb0e186932755a
SHA512 abbf160c6013faac43e2528dc255dc89a38e77d8c0123f796fc836bf63fd54ffee49367d886874cbb1274182cbb15df26d795762d1d43eaa0afca17d089c5e11
SSDEEP 768:fxC0So4wRhx90K6ywQLIWS8S5By5Azdc0b2WMpWkKAvKiw2Bj:85oThPjNS8tx1W2w2t
TLSH
T1D6D2D03B6B8430196B90A3D9C845BF4C3DEDE7075DABD5BC24302615F5C296638A70EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5483B31F7B6C135C00FB3085A57AC1867FAA3499

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\5483B31F7B6C135C00FB3085A57AC1867FAA3499
Size 21KB
SHA256 d5fd9517550f0de56b5e131e5f9f1ab4bb058293b21d59b3c4e89c626b5ce508
MD5 87999fa852a9ab2fba986459f25ce851
SHA1 be6c541804ce94d45a7884d04ccc03562e9baab5
SHA512 148c34ca7d017192c3681fef797a83bf9388640befe2f7aa147a5470464be781e895910f0804be50b823b0bf48fab5796fedac3a4a9617f94965db6f4faf55bf
SSDEEP 384:URIbYmHlwyaucYYL6/FIOj8E6t9PWGrWt4ibgl5HdSp5jTMS3/pJX38yQX38yLX2:URIki2yaucYm8w9PWGq4HlDSp5jTMmM+
TLSH
T1F6A24ABF4447AA5D0BA1BBC58737750CA873E20DBCCAEDD1DC0A2604D1C8FB26917946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D1852F90D551AF7BB9D3CD57DE72522F6C41977

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\6D1852F90D551AF7BB9D3CD57DE72522F6C41977
Size 117KB
SHA256 021fa0cdd84ec4d790076bd4d894b1a45a8cd01aaf7cffc364154ccc3dfbf99f
MD5 6b247a04da1481b596289208a8898432
SHA1 b4f04132e9a63d42ced3f8a26402e3e761b4e801
SHA512 09676903fad37105b9fc21b6fd029165c96d244cf2728822af1bb4a1ae4ce106d3083605dfde61e2b8d0977924a43157e7118b3edc2a75af0a0650b28ccc799f
SSDEEP 3072:ST58qtdQBC2YkHep+ihDWzeAAfdS0psL40pLoAC85pCgEE:w8OdkJ4ppoe11SOyoA3j1
TLSH
T1BEC312FDDB5D09252011619E9C4C76373F80FBE39980ACBE2960A982D5DEB3064F985F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8FE33CBF5B82075A913639EAFFBA21E241DA06B5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\8FE33CBF5B82075A913639EAFFBA21E241DA06B5
Size 23KB
SHA256 3b1698c36d649f79cad4865ef3551cd774be89daf1e1df7e06b63e678bfb77b2
MD5 1afb24a81db96ffe5ba73410532924e6
SHA1 af9713bc85c2c76785ed0acfa994ddbfe52656b0
SHA512 6ce393f52bb5c9fd2295548d6c002bf876d3356854de508e80e4f7a2f46bc55a1b52e447cce0004d7766978167bf060740eac63bde98071144ee427e8041a978
SSDEEP 384:2pIjE+DZ7LfY/UtmN1EtYhc4U12784IIcgWmC+Bsqsg7HXz0PaPM:2sE+t7Y8orhc4a27JITgreqsgLXi
TLSH
T1AAB2E135AF10782D26233724DC3A7DA80C9CEFB74F5AC6FDA49534885C29B35F694089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C6D7CC9699A93EC4A689CEC179A83A11353C231E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\C6D7CC9699A93EC4A689CEC179A83A11353C231E
Size 11KB
SHA256 2fb82606aae3c2d5a289f8f98f78aaec9ea023b6924613c2511993e7f4209491
MD5 8175d92c9155aefb3bbf91afb6e472c6
SHA1 123f07cd00e55d4cf7a64dc3fcee86c144e4d0c2
SHA512 08dc0a35e0751a85d4b5906c8282159632ed46073f4a431fb459a4583402e375eec50b098bbac379da129e9142cfd609a7c5c9bf590ebc93ee4cfb12727bcee4
SSDEEP 192:/tjZh34wq0Pvz7yYT064vONLZMVJl8C2akEwgdkEwpwM4HP+m65e3uOCN1Pw:/ttl4aPvXyYTX423249gEpB4tf34M
TLSH
T19D329EB9DF04821848E15577A65D8BA42D19B3430D46F8BE2C08344ECBCE3BA3C7668B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDDAA28EBB2B4A4DD6737C63978906CF15A3E453

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\DDDAA28EBB2B4A4DD6737C63978906CF15A3E453
Size 17KB
SHA256 2cee4a0b2417d25018cbef55679b227418c3a7a4becc87c43b700bf54af82954
MD5 bc5aea1f7d211a0bece5e17d4178860f
SHA1 12814f2479c6f3016ff9f09347d198e29b8882f6
SHA512 078738cf8fcb59d0ea77cbf2ee4a48c258a16c710357272a7d0c5567f4410966fa60303e3872c0485f93174baa3ce52041fa801da3bd974f99c07d8529d26754
SSDEEP 384:cLMHrYdir7IgAGFcgY2ApTDGgEpB4tf344wEws:3oyR/FcgY2ApvGgEX4tQc
TLSH
T17282AF768D3D541009E1BF9A9972A6442C19F2872E1DB4FD28193086F2CCB7F39376CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E07222A1D17D463346CE6EEFB52502C5D76D422D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\E07222A1D17D463346CE6EEFB52502C5D76D422D
Size 107KB
SHA256 4c53bdb183173c504614d312620ebe4a51be20d103de5e2119a45262f618f5e5
MD5 c751e0cabffde89e1a922f9374d980c1
SHA1 808098d9ef440a7929af1cd9f3a01ba10831e838
SHA512 40c942d7f1cd529d449b639041db848b6094ebf85c85a5f5c213820cd62237944f8063ebb761cebed7bfa1522fc4ca57833ad5dac6bb41b4663468c2e6576516
SSDEEP 3072:EcC6LHvCrZNDUWxxsF7P3eEdN0u68bo7uf/K/1:RTmjxWFDIHoo70/o1
TLSH
T1E2B3023FEC19B51809A5B8F3D9A4E3A4CD1266A7FED9D9E09804150FC478974B3D0AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A2KXekYBdVLsuRFgWeE3KQFOLdY8bF1O8hi2zjhGU9k=.ico

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\jumpListCache\A2KXekYBdVLsuRFgWeE3KQFOLdY8bF1O8hi2zjhGU9k=.ico
Size 587B
SHA256 05d0ff89048fda82e5c923a788fcdc4b33d133676369f0d6e5df0e6327f7621e
MD5 49aa5bf6324c9358e307baff2dca9d2b
SHA1 dab0a235c2c03e5889f3664b9bfc2f68f4e8208f
SHA512 d78397de8875952c9a3b093f88fb5973079de291965660abdf26f106007c2d1cc3828a0f0308c18e3073d736fec1cb936a3672f480b0a984fdd7b3860910fbe2
TLSH
T1B1F0ACAFA3D48E1ACCA712B8C202E6854C2A10EE4AEB40143E5A51B56D667484DB5F97
MD5 SHA1 SHA512 TLSH

Submit Download

37d60a67d8dabf57dfc23a87a27b7391.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\thumbnails\37d60a67d8dabf57dfc23a87a27b7391.png
Size 17KB
SHA256 cb8d51c2650faa57f487ffaa360e1bd7778362e927f273846d4596941ae93fdc
MD5 8af195d3b6c150f7440eee9edefb9827
SHA1 09c7208fd5aee7a53efcf3c7752ebf8b05039b42
SHA512 b5d208a01ee07e7772a6989de6c46e17799b2b19b11dfcceaef303e47d509b3803d61f7c6946eb78201ab8bb08d0f070e04241910afd6dcd245e870fe29f78d6
SSDEEP 384:EhtyrmdKIdAg+W21N/d0n2G1h3gIj+F2lqZkY4//PBfCibPt:u5JA/N/dE2GP3Fj+tZwpz1
TLSH
T18182D0D06F98D46C6079BA584C8DBC9D40FC51848FE251B40EAAF910506E663F68FACF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9faa95e-79f3-4ede-bde8-18ac6f032e3e.zip

Path C:\Users\Admin\AppData\Local\Temp\f9faa95e-79f3-4ede-bde8-18ac6f032e3e.zip
Size 3.7MB
SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
MD5 3850f642d336e5b283975359ae18e3d7
SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
TLSH
T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download