e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3

Analysis

user interaction
yes
max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
locales/locales/ta.pak
Size 899KB
Sample260804-e469bsfq3v
SHA256 e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3
MD5 5002d84bffb908a2dcc7e1b69836c265
SHA1 4cbbe387a6744aa6c51b15b5a3a223135a3f6115
SHA512 c2a4a46a27304eb080b066f049d2eae733470dbf0f8107220049eaefdd73fd8b41abd1b02b4a2ee6934b4cae18de97bca5360022a8e295427a0bd63603bec410
SSDEEP 1536:gozNJu8JvUHZZvrdAYWSXR1q+y5fNU1prH+O8ep3EvFZRj2IpewYxg3ZHa4dpeJT:gsNJvUXdWSXRUlUj9yw5fG7zWtRjcA2S
TLSH
T159151CCE923EEE890F93288F0319536912996155C07BE3A27C756E1298ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4788	cmd.exe

Checks SCSI registry key(s) 3 TTPs 19 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{E49277C1-F7BF-43C0-8C3A-799ECFA6C21D}	ShellHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	mspaint.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
5376	mspaint.exe
5376	mspaint.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
808	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	firefox.exe
Token: SeDebugPrivilege	2408	firefox.exe
Token: SeDebugPrivilege	2448	taskmgr.exe
Token: SeSystemProfilePrivilege	2448	taskmgr.exe
Token: SeCreateGlobalPrivilege	2448	taskmgr.exe
Token: 33	2448	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2448	taskmgr.exe
Token: SeShutdownPrivilege	4524	ShellHost.exe
Token: SeCreatePagefilePrivilege	4524	ShellHost.exe
Token: SeShutdownPrivilege	4524	ShellHost.exe
Token: SeCreatePagefilePrivilege	4524	ShellHost.exe
Token: SeShutdownPrivilege	4524	ShellHost.exe
Token: SeCreatePagefilePrivilege	4524	ShellHost.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
2408	firefox.exe
2408	firefox.exe
2408	firefox.exe
2408	firefox.exe
2408	firefox.exe
2408	firefox.exe
2408	firefox.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
4524	ShellHost.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe
2448	taskmgr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2540	OpenWith.exe
2408	firefox.exe
2408	firefox.exe
2408	firefox.exe
2408	firefox.exe
2448	taskmgr.exe
4524	ShellHost.exe
5744	ShellHost.exe
5376	mspaint.exe
5376	mspaint.exe
5376	mspaint.exe
5376	mspaint.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 240	2540	OpenWith.exe	92
PID 240 wrote to memory of 2408	240	firefox.exe	93
PID 240 wrote to memory of 2408	240	firefox.exe	93
PID 2408 wrote to memory of 1508	2408	firefox.exe	94
PID 2408 wrote to memory of 1508	2408	firefox.exe	94
PID 2408 wrote to memory of 1508	2408	firefox.exe	94
PID 2408 wrote to memory of 3256	2408	firefox.exe	95
PID 2408 wrote to memory of 3256	2408	firefox.exe	95
PID 2408 wrote to memory of 3256	2408	firefox.exe	95
PID 2408 wrote to memory of 3256	2408	firefox.exe	95
PID 2408 wrote to memory of 2784	2408	firefox.exe	96
PID 2408 wrote to memory of 2784	2408	firefox.exe	96
PID 2408 wrote to memory of 2784	2408	firefox.exe	96
PID 2408 wrote to memory of 2784	2408	firefox.exe	96
PID 2408 wrote to memory of 3824	2408	firefox.exe	97
PID 2408 wrote to memory of 3824	2408	firefox.exe	97
PID 2408 wrote to memory of 3824	2408	firefox.exe	97
PID 2408 wrote to memory of 3812	2408	firefox.exe	98
PID 2408 wrote to memory of 3812	2408	firefox.exe	98
PID 2408 wrote to memory of 3812	2408	firefox.exe	98
PID 2408 wrote to memory of 3812	2408	firefox.exe	98
PID 2408 wrote to memory of 1756	2408	firefox.exe	99
PID 2408 wrote to memory of 1756	2408	firefox.exe	99
PID 2408 wrote to memory of 1756	2408	firefox.exe	99
PID 2408 wrote to memory of 1756	2408	firefox.exe	99
PID 2408 wrote to memory of 2468	2408	firefox.exe	100
PID 2408 wrote to memory of 2468	2408	firefox.exe	100
PID 2408 wrote to memory of 2468	2408	firefox.exe	100
PID 2408 wrote to memory of 2468	2408	firefox.exe	100
PID 2408 wrote to memory of 2248	2408	firefox.exe	101
PID 2408 wrote to memory of 2248	2408	firefox.exe	101
PID 2408 wrote to memory of 2248	2408	firefox.exe	101
PID 2408 wrote to memory of 2248	2408	firefox.exe	101
PID 2408 wrote to memory of 5856	2408	firefox.exe	102
PID 2408 wrote to memory of 5856	2408	firefox.exe	102
PID 2408 wrote to memory of 5856	2408	firefox.exe	102
PID 2408 wrote to memory of 5856	2408	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\locales\locales\ta.pak
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\locales\locales\ta.pak"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\locales\locales\ta.pak
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27098 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {eaccbcd6-8430-45a5-9105-35b83bd7596a} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:1508
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27134 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {ad334c55-0f8e-46f1-a60b-be30f69bcf08} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:3256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 27274 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {a1236a7c-0211-4e0c-b998-0bb6cb04ef2e} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:2784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27274 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4092 -initialChannelId {f0ba402f-cd7d-4dff-b499-e40f011a9e13} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3824
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4612 -prefsLen 34773 -prefMapHandle 4616 -prefMapSize 270279 -jsInitHandle 4620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4628 -initialChannelId {c68de641-2029-42d4-921a-f55e9b3778d4} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5296 -prefsLen 35010 -prefMapHandle 5300 -prefMapSize 270279 -ipcHandle 5180 -initialChannelId {c501ee67-84f3-40a8-840c-0fb91c2ec927} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 32952 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {57b2ff52-b86c-45ed-b156-a41e32ebf265} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:2468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32952 -prefMapHandle 5556 -prefMapSize 270279 -jsInitHandle 5560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {2b934cb4-7e55-40d1-9eb4-e9e58850331b} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5916 -prefsLen 32952 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5932 -initialChannelId {9a197da4-5a5b-4121-9db7-9ba0d634c905} -parentPid 2408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5856

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3280

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004C0
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4148

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3776

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\PYptRMWsO.jpg"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 997efa3ea16b278de7bb5cfc408932eb1bfbb1cb1bbbe70310da798e9ebac108
MD5 e8df7758f6cb7d01bc198c3ba9076cce
SHA1 33fc95ca9982b629d7370e166cbdf6be3e07ba5c
SHA512 ec3ebf37bf5838244a3260e1ae1fb2d5bd8db5b0d9d683d8fc3e75344fe118e2773c25c0eff7c5b9d0da7dd2e8607091e3cbcea10bc1caf0c8677f8f1c02c8ff
SSDEEP 192:+91d66JoztdzgCl6mc0diOv5zbonZ4hyjyOZ:kd66Joz/zgC1jnbonZ4hyjP
TLSH
T1B1E11FA8EA29867FC418027BCDA51B400F75385ADC4E7F19759D24082C572DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 70a20e770e80abc26069d07ca4168c895835b5e99751139bdd80f47ca411a06e
MD5 c58a332a06ce89af176572a21fb98fe6
SHA1 860d50b907dfcbd0d110bafdd7054f428b79b22d
SHA512 11c42dc34a2321480cce27e3fd94c898d0c6394d6ad52ef6426bcef7e9140e4db3eaac3c5992597d2a24c023c80b8a2d6a2e6cc58f12058ba29a709afee1d89d
TLSH
T17521495C3FB98D6AA8C7E39C7481028E63914E0714871D43AD42FE8DCEC1AD932EA53D
MD5 SHA1 SHA512 TLSH

Submit Download

3639a4a6-27f6-4184-bc6a-a3729d799189

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\3639a4a6-27f6-4184-bc6a-a3729d799189
Size 235B
SHA256 85374d95f94d651789d3b08fc50818bf702c26b9b754172462ebc667cdaaa1ef
MD5 85da3bf8adfec570491685981c5f95cf
SHA1 9ffeb04170c389a32e9bbce45b644c447bb687bd
SHA512 a97bede7cc61fcbc5d2cfb4e929a2754786fe140797b1afe0071979984840b70c3fb4929c4bec3cc013a24594c1b96446b6234b4cdab75828a5522a22ddeba5f
TLSH
T190D0A7852C98675D58184F17F0E0BFC6304D8C372575A860DA7285B4AEFEDCD92A2C1B
MD5 SHA1 SHA512 TLSH

Submit Download

467d5f39-a413-46f2-9b9d-a8588d5ea47c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\467d5f39-a413-46f2-9b9d-a8588d5ea47c
Size 2KB
SHA256 5fc6f26886b9170cca905e5f648fc8d3eec7f12c43bebdbe8988db618e4c1d24
MD5 62f7c30f70d9c89a5a7542f548ebc9f5
SHA1 695bf5d9cc063e79cc2e06d5525ec7e6cfcc7ae6
SHA512 2caa6539b5b769904833481c2347ad91ce5a84b47ccbb266ccf5a9c4574fdeefeaad7d9445bd25fb2e68a141c8d2f57fa8f66671c2dbdffc661db55578959e70
TLSH
T1E341206C36B85D769CDAE15D9091338A83E19E5340C21C433E51EF488EA6A9E736E42B
MD5 SHA1 SHA512 TLSH

Submit Download

663b61ac-8666-42de-aa14-14663ef30919

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\663b61ac-8666-42de-aa14-14663ef30919
Size 883B
SHA256 b539628b5c131b0a178b2f7b4d068c737f03dd902ef85845fdeff04b578ef5eb
MD5 9135562e1937b0eadfc6608ae2569d13
SHA1 d1e0ae549fba9fde99c6345ed5b70cc491e616f1
SHA512 724f7e04429f16171dd9e76cd4a9a69ee040a40911be672af352a5e4e0c0e5b1ed5e16f87c3c1fea8dbd786929b4a591ff05f10ab9c70d702fe164257ae839cc
TLSH
T139110094E535B6B2DC7C825BC694370287E4B42384C645143DA51F180E7F50BEBAA60B
MD5 SHA1 SHA512 TLSH

Submit Download

7123a5be-f5c1-4c37-bae5-ef1de38de56d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\7123a5be-f5c1-4c37-bae5-ef1de38de56d
Size 15KB
SHA256 2a22ba19a46670c321ff71a065c86fa27a312260db1d4bac5d1a770793fd0854
MD5 fec0cf51db2442ee34609c70521408c0
SHA1 32e03b13440cf5aa118c0fc4ac934796945b7cd2
SHA512 e908ba8e1116381e7381cac277c53b653392438419cfbf8972d3c4150c16912bb7f86b971a5c2cda7e26224ff12ccfec479fb07d0900a44294d60dbfc72e2441
SSDEEP 192:eQJJHey4pEfBy1EvMMCQ8KhK8hIvctAxGXzgSS0UR7K8MuktTpdsZRJelh3MJNIX:34pEf5gKdqctAx6USNUR7K8xrU
TLSH
T11E62D9596430497E8691E368D8E97FC3E2F518CF8C019FC99BE47D0869EE0AE5127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d808ade-dc80-4887-a405-6c664ea1a39b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\8d808ade-dc80-4887-a405-6c664ea1a39b
Size 886B
SHA256 7daaa616b164669b53c64846b8467b33c80eafaa432f9786de20929f3411dc7a
MD5 9eac91708340f0d5c421fdb5b565a27b
SHA1 102b1699646089dcd5e9fe9a232028d8cf15f505
SHA512 2c7d5db453d9575680c79ee5952aafc874ccd49ff4d6261c86850e82a3499ba730c683e69bae707e90eb603cb6cb7bd5c623d2640017ab56fe222db82f7ae5f3
TLSH
T1F11100549A34B6F3CC78C25BC5E037428BE4B523C0CA4A187D641E180DEF51AABAE60B
MD5 SHA1 SHA512 TLSH

Submit Download

e0e09fe2-d310-4d07-b5b9-375d65d4dd52

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\e0e09fe2-d310-4d07-b5b9-375d65d4dd52
Size 235B
SHA256 2311d18dd576d422ba4af98f4279db750a26060b81bb634631fa61591915cfa1
MD5 5df1fca338e6028fd3e972942e7191c5
SHA1 d850510a5c90c90f4685d100af2e8b7d7736533b
SHA512 1d74fca6a2d95abab38d149db33ca2d072f6acb6a68136f5290d166e8e127d2a9df2c55a35a93dd83005e0d310b68658ed12b94182b8fde50617683207453002
TLSH
T144D0978018DC275D09145F06F0E0A8C230C84D3310B95C60CAA108789DB9DCC022286E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 76b78c8b970fbd9f61134b6c9ff1c466d660045c02fd23056cd53e66551059a9
MD5 76a827a98bd7b9bf599d0ede8c33778a
SHA1 5584c2a37f34871dad69e942c678889c9ced4b3c
SHA512 2b0c38ef963016030b1a6537d2c0d9baf35ec8dd73a686d1ef9c7090bc6f0d1a8cefacd6edf76212ae6b0cb02c5dd4c7ff3d7cde357f747b179846a81ec895f6
SSDEEP 96:xH+UTUQqGqsfu0iBObzSRSSlvdv9j9anAHdA0ScSqBw88u8L4cnEVgR:ArRsfu0iBLSSvdA0ScDBw88e+
TLSH
T1C9E12E789508CB7F65B6776CAC6888316AB2413BBBBF68C760A554C4014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 19d12464f1592e7b502ce5fa3990f29323b5b0436a921ad6301c4c9ee67c99ef
MD5 a5ad8db07439c4be54cac7bd117d8e62
SHA1 96114b0bab6fdc2ea2e41d8324ad83d4095473bc
SHA512 87b7a3b5c6be86d0fa3206e2f18b20282a73330d306ae0737638c7a5b1d783f31d6e964a675dbf87167d3ff9de3a9d45a74e746327e9b906b945f77a4de478ad
SSDEEP 96:xH+UTUQqGqsfu0iB1zSRSSlvdv9jlanAHdA0ScSqBw88u8L4cnEVgR:ArRsfu0iBsSS/dA0ScDBw88e+
TLSH
T122E11F789508CF7F64B6776CAC6888316AB2413BBBBF68D650B554C4014CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 1b24c4fffd9fb30465c6042c2a6700b5af75335247562636e87cfa4c3489d297
MD5 5d360724c6b352abc15192378ca6de30
SHA1 456cc553fbcc98c732e364f51322b067e0309437
SHA512 60ce88216c26963c7d7a635d570983c71a67131dfcc00ca22fe614ae27f097c7dc5fa282d8d96ec9fc17bf3043529082bdedcec1967d01370a8170d3574204bd
SSDEEP 96:xH+UTUQqGqsfu0on1zSDAdSSlvdv9jlanAHdA0ScSqBw8828L4cnEVgR:ArRsfu0onsAdSS/dA0ScDBw88W+
TLSH
T116E11F789008CB7F68B6776CAC6888716AB2413BBBBF68D650B554C4014CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xy2BNozL.pak.part

Path C:\Users\Admin\Downloads\Xy2BNozL.pak.part
Size 899KB
SHA256 e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3
MD5 5002d84bffb908a2dcc7e1b69836c265
SHA1 4cbbe387a6744aa6c51b15b5a3a223135a3f6115
SHA512 c2a4a46a27304eb080b066f049d2eae733470dbf0f8107220049eaefdd73fd8b41abd1b02b4a2ee6934b4cae18de97bca5360022a8e295427a0bd63603bec410
SSDEEP 1536:gozNJu8JvUHZZvrdAYWSXR1q+y5fNU1prH+O8ep3EvFZRj2IpewYxg3ZHa4dpeJT:gsNJvUXdWSXRUlUj9yw5fG7zWtRjcA2S
TLSH
T159151CCE923EEE890F93288F0319536912996155C07BE3A27C756E1298ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PYptRMWsO.jpg

Path C:\Users\Admin\Pictures\PYptRMWsO.jpg
Size 74KB
SHA256 be96e557f64489c4703b1e952e9fb985d3633ea6fe0be41cf94230fce4339e16
MD5 e12a80969e0de2b0b58fae4b90957b70
SHA1 96ee10eef066804a48ede4ce74398825b988551c
SHA512 4716919c8c9e0bc3cfe120dd46359da25b962e23f91b4e10e081278f8d5c0bf3c71bb753aef285dba04afe858c985cd0a4772d2ef565b8aceaa0cafa6eb9984b
SSDEEP 1536:3M1ZB/DSINnO3gs/7gf7bgFLLrnJ560yECMi:cB3Nn4gsEfcLLN56Iti
TLSH
T14E73F1138C598BC3A45C97E9BD471DAC2F0A671CE9923EFF01221ECB3D106261D9E56E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2448-325-0x00000159BD440000-0x00000159BD441000-memory.dmp

Download

memory/2448-323-0x00000159BD440000-0x00000159BD441000-memory.dmp

Download

memory/2448-334-0x00000159BD440000-0x00000159BD441000-memory.dmp

Download

memory/2448-333-0x00000159BD440000-0x00000159BD441000-memory.dmp

Download

memory/2448-332-0x00000159BD440000-0x00000159BD441000-memory.dmp

Download

memory/2448-331-0x00000159BD440000-0x00000159BD441000-memory.dmp

Download

memory/2448-330-0x00000159BD440000-0x00000159BD441000-memory.dmp

Download

memory/2448-329-0x00000159BD440000-0x00000159BD441000-memory.dmp

Download