hxxps://www[.]mediafire[.]com/folder/4llcca8efkom5/minehack

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
360s
max time network
362s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/08/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/folder/4llcca8efkom5/minehack
Sample260807-smv2mage32

Score

10^/10

credential_access discovery persistence ransomware spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 24 IoCs

description	pid	Process	procid_target
PID 4544 created 2580	4544	minehack.exe	155
PID 4544 created 3660	4544	minehack.exe	156
PID 4544 created 2708	4544	minehack.exe	157
PID 4544 created 1180	4544	minehack.exe	158
PID 4544 created 2448	4544	minehack.exe	159
PID 4544 created 3164	4544	minehack.exe	161
PID 4544 created 3220	4544	minehack.exe	162
PID 4544 created 3016	4544	minehack.exe	163
PID 4544 created 2580	4544	minehack.exe	155
PID 4544 created 2580	4544	minehack.exe	155
PID 4544 created 2708	4544	minehack.exe	157
PID 4544 created 2708	4544	minehack.exe	157
PID 4544 created 184	4544	minehack.exe	170
PID 4544 created 2188	4544	minehack.exe	171
PID 4544 created 1788	4544	minehack.exe	173
PID 4544 created 5272	4544	minehack.exe	174
PID 4544 created 1260	4544	minehack.exe	175
PID 4544 created 1924	4544	minehack.exe	177
PID 4544 created 1472	4544	minehack.exe	178
PID 4544 created 2192	4544	minehack.exe	179
PID 4544 created 184	4544	minehack.exe	170
PID 4544 created 184	4544	minehack.exe	170
PID 4544 created 1788	4544	minehack.exe	173
PID 4544 created 1788	4544	minehack.exe	173

Executes dropped EXE 64 IoCs

pid	Process
4544	minehack.exe
4692	minehack.exe
4664	minehack.exe
5304	minehack.exe
4904	minehack.exe
5860	minehack.exe
4996	minehack.exe
5072	minehack.exe
5848	minehack.exe
112	minehack.exe
4604	minehack.exe
2416	minehack.exe
5264	minehack.exe
5576	minehack.exe
5252	minehack.exe
5644	minehack.exe
5780	minehack.exe
772	minehack.exe
6064	minehack.exe
3688	minehack.exe
5288	minehack.exe
5456	minehack.exe
2500	minehack.exe
2588	minehack.exe
568	minehack.exe
5916	minehack.exe
3692	minehack.exe
3880	minehack.exe
3940	minehack.exe
4864	minehack.exe
3364	minehack.exe
1152	minehack.exe
5000	minehack.exe
7056	minehack.exe
7112	minehack.exe
7156	minehack.exe
6256	minehack.exe
5752	minehack.exe
6236	minehack.exe
1360	minehack.exe
6324	minehack.exe
6372	minehack.exe
6408	minehack.exe
6192	minehack.exe
6460	minehack.exe
6448	minehack.exe
4060	minehack.exe
6588	minehack.exe
6596	minehack.exe
5616	minehack.exe
5516	minehack.exe
1556	minehack.exe
6060	minehack.exe
2144	minehack.exe
3100	minehack.exe
4512	minehack.exe
1196	minehack.exe
6792	minehack.exe
5952	minehack.exe
1656	minehack.exe
3872	minehack.exe
744	minehack.exe
6392	minehack.exe
6604	minehack.exe

Loads dropped DLL 64 IoCs

pid	Process
4544	minehack.exe
4692	minehack.exe
4664	minehack.exe
5304	minehack.exe
4904	minehack.exe
5860	minehack.exe
4996	minehack.exe
5072	minehack.exe
5848	minehack.exe
112	minehack.exe
4604	minehack.exe
2416	minehack.exe
5264	minehack.exe
5576	minehack.exe
5252	minehack.exe
5644	minehack.exe
5780	minehack.exe
772	minehack.exe
6064	minehack.exe
3688	minehack.exe
5288	minehack.exe
5456	minehack.exe
2500	minehack.exe
568	minehack.exe
2588	minehack.exe
5916	minehack.exe
3692	minehack.exe
3880	minehack.exe
3940	minehack.exe
4864	minehack.exe
3364	minehack.exe
1152	minehack.exe
5000	minehack.exe
7056	minehack.exe
7112	minehack.exe
7156	minehack.exe
6256	minehack.exe
5752	minehack.exe
6236	minehack.exe
1360	minehack.exe
6324	minehack.exe
6372	minehack.exe
6408	minehack.exe
6192	minehack.exe
6460	minehack.exe
6448	minehack.exe
4060	minehack.exe
6588	minehack.exe
6596	minehack.exe
5616	minehack.exe
5516	minehack.exe
1556	minehack.exe
6060	minehack.exe
2144	minehack.exe
3100	minehack.exe
4512	minehack.exe
1196	minehack.exe
6792	minehack.exe
5952	minehack.exe
1656	minehack.exe
3872	minehack.exe
744	minehack.exe
6392	minehack.exe
6604	minehack.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
4544	minehack.exe
4692	minehack.exe
4904	minehack.exe
4664	minehack.exe
5860	minehack.exe
5848	minehack.exe
5304	minehack.exe
5264	minehack.exe
4604	minehack.exe
4996	minehack.exe
5072	minehack.exe
5252	minehack.exe
2416	minehack.exe
112	minehack.exe
5576	minehack.exe
772	minehack.exe
3688	minehack.exe
5644	minehack.exe
6064	minehack.exe
5288	minehack.exe
5780	minehack.exe
2588	minehack.exe
5456	minehack.exe
3692	minehack.exe
2500	minehack.exe
568	minehack.exe
5000	minehack.exe
5916	minehack.exe
1152	minehack.exe
3940	minehack.exe
3364	minehack.exe
4864	minehack.exe
3880	minehack.exe
7056	minehack.exe
6324	minehack.exe
6192	minehack.exe
6236	minehack.exe
6256	minehack.exe
6588	minehack.exe
7156	minehack.exe
6408	minehack.exe
6460	minehack.exe
1360	minehack.exe
5752	minehack.exe
7112	minehack.exe
6372	minehack.exe
4060	minehack.exe
6060	minehack.exe
5616	minehack.exe
2144	minehack.exe
6448	minehack.exe
3100	minehack.exe
4512	minehack.exe
1556	minehack.exe
5516	minehack.exe
6596	minehack.exe
1196	minehack.exe
1656	minehack.exe
3872	minehack.exe
6792	minehack.exe
6392	minehack.exe
744	minehack.exe
5952	minehack.exe
6960	minehack.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2708	chrome.exe
1788	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 58 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	minehack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	minehack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305894945914594"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "3"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000000eae209104e3dc014d5237ce0ae3dc01f1c359967f26dd0114000000	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	mspaint.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{8D576BEB-4013-4637-A196-671AEB2DE686}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	mspaint.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\minehack.rar:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5480	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3524	mspaint.exe
3524	mspaint.exe
4544	minehack.exe
4544	minehack.exe
4544	minehack.exe
4544	minehack.exe
4544	minehack.exe
4544	minehack.exe
4692	minehack.exe
4692	minehack.exe
4692	minehack.exe
4692	minehack.exe
4692	minehack.exe
4692	minehack.exe
4664	minehack.exe
4664	minehack.exe
4664	minehack.exe
4664	minehack.exe
4664	minehack.exe
4664	minehack.exe
4904	minehack.exe
4904	minehack.exe
4904	minehack.exe
4904	minehack.exe
4904	minehack.exe
4904	minehack.exe
5304	minehack.exe
5304	minehack.exe
5304	minehack.exe
5304	minehack.exe
5304	minehack.exe
5304	minehack.exe
5860	minehack.exe
5860	minehack.exe
5860	minehack.exe
5860	minehack.exe
5860	minehack.exe
5860	minehack.exe
4996	minehack.exe
4996	minehack.exe
4996	minehack.exe
4996	minehack.exe
4996	minehack.exe
4996	minehack.exe
5072	minehack.exe
5072	minehack.exe
5072	minehack.exe
5072	minehack.exe
5072	minehack.exe
5072	minehack.exe
5848	minehack.exe
5848	minehack.exe
5848	minehack.exe
5848	minehack.exe
5848	minehack.exe
5848	minehack.exe
4604	minehack.exe
4604	minehack.exe
4604	minehack.exe
4604	minehack.exe
4604	minehack.exe
4604	minehack.exe
5264	minehack.exe
5264	minehack.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe
184	msedge.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	firefox.exe
Token: SeDebugPrivilege	1972	firefox.exe
Token: SeDebugPrivilege	1972	firefox.exe
Token: SeRestorePrivilege	1860	7zG.exe
Token: 35	1860	7zG.exe
Token: SeSecurityPrivilege	1860	7zG.exe
Token: SeSecurityPrivilege	1860	7zG.exe
Token: SeDebugPrivilege	4544	minehack.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeDebugPrivilege	2220	taskmgr.exe
Token: SeSystemProfilePrivilege	2220	taskmgr.exe
Token: SeCreateGlobalPrivilege	2220	taskmgr.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeDebugPrivilege	5948	firefox.exe
Token: SeDebugPrivilege	5948	firefox.exe
Token: 33	2220	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2220	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1860	7zG.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe
2220	taskmgr.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1972	firefox.exe
3524	mspaint.exe
3524	mspaint.exe
3524	mspaint.exe
3524	mspaint.exe
3524	mspaint.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
5684	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
4240	OpenWith.exe
5948	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1972	1252	firefox.exe	84
PID 1252 wrote to memory of 1972	1252	firefox.exe	84
PID 1972 wrote to memory of 4236	1972	firefox.exe	85
PID 1972 wrote to memory of 4236	1972	firefox.exe	85
PID 1972 wrote to memory of 4236	1972	firefox.exe	85
PID 1972 wrote to memory of 2100	1972	firefox.exe	86
PID 1972 wrote to memory of 2100	1972	firefox.exe	86
PID 1972 wrote to memory of 2100	1972	firefox.exe	86
PID 1972 wrote to memory of 2100	1972	firefox.exe	86
PID 1972 wrote to memory of 916	1972	firefox.exe	87
PID 1972 wrote to memory of 916	1972	firefox.exe	87
PID 1972 wrote to memory of 916	1972	firefox.exe	87
PID 1972 wrote to memory of 916	1972	firefox.exe	87
PID 1972 wrote to memory of 1580	1972	firefox.exe	88
PID 1972 wrote to memory of 1580	1972	firefox.exe	88
PID 1972 wrote to memory of 1580	1972	firefox.exe	88
PID 1972 wrote to memory of 2684	1972	firefox.exe	89
PID 1972 wrote to memory of 2684	1972	firefox.exe	89
PID 1972 wrote to memory of 2684	1972	firefox.exe	89
PID 1972 wrote to memory of 2684	1972	firefox.exe	89
PID 1972 wrote to memory of 5604	1972	firefox.exe	90
PID 1972 wrote to memory of 5604	1972	firefox.exe	90
PID 1972 wrote to memory of 5604	1972	firefox.exe	90
PID 1972 wrote to memory of 5604	1972	firefox.exe	90
PID 1972 wrote to memory of 5656	1972	firefox.exe	91
PID 1972 wrote to memory of 5656	1972	firefox.exe	91
PID 1972 wrote to memory of 5656	1972	firefox.exe	91
PID 1972 wrote to memory of 5656	1972	firefox.exe	91
PID 1972 wrote to memory of 5720	1972	firefox.exe	92
PID 1972 wrote to memory of 5720	1972	firefox.exe	92
PID 1972 wrote to memory of 5720	1972	firefox.exe	92
PID 1972 wrote to memory of 5720	1972	firefox.exe	92
PID 1972 wrote to memory of 5728	1972	firefox.exe	93
PID 1972 wrote to memory of 5728	1972	firefox.exe	93
PID 1972 wrote to memory of 5728	1972	firefox.exe	93
PID 1972 wrote to memory of 5728	1972	firefox.exe	93
PID 1972 wrote to memory of 1204	1972	firefox.exe	114
PID 1972 wrote to memory of 1204	1972	firefox.exe	114
PID 1972 wrote to memory of 1204	1972	firefox.exe	114
PID 1972 wrote to memory of 1204	1972	firefox.exe	114
PID 1972 wrote to memory of 4672	1972	firefox.exe	115
PID 1972 wrote to memory of 4672	1972	firefox.exe	115
PID 1972 wrote to memory of 4672	1972	firefox.exe	115
PID 1972 wrote to memory of 4672	1972	firefox.exe	115
PID 1972 wrote to memory of 744	1972	firefox.exe	116
PID 1972 wrote to memory of 744	1972	firefox.exe	116
PID 1972 wrote to memory of 744	1972	firefox.exe	116
PID 1972 wrote to memory of 744	1972	firefox.exe	116
PID 1972 wrote to memory of 5572	1972	firefox.exe	117
PID 1972 wrote to memory of 5572	1972	firefox.exe	117
PID 1972 wrote to memory of 5572	1972	firefox.exe	117
PID 1972 wrote to memory of 5572	1972	firefox.exe	117
PID 4544 wrote to memory of 2580	4544	minehack.exe	155
PID 2580 wrote to memory of 3660	2580	chrome.exe	156
PID 2580 wrote to memory of 2708	2580	chrome.exe	157
PID 2580 wrote to memory of 1180	2580	chrome.exe	158
PID 2580 wrote to memory of 1180	2580	chrome.exe	158
PID 2580 wrote to memory of 2448	2580	chrome.exe	159
PID 2580 wrote to memory of 2448	2580	chrome.exe	159
PID 2580 wrote to memory of 3164	2580	chrome.exe	161
PID 2580 wrote to memory of 3164	2580	chrome.exe	161
PID 2580 wrote to memory of 3220	2580	chrome.exe	162
PID 2580 wrote to memory of 3220	2580	chrome.exe	162
PID 2580 wrote to memory of 3016	2580	chrome.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/folder/4llcca8efkom5/minehack"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/folder/4llcca8efkom5/minehack
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27100 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {49850c28-a870-46e7-bbbb-438cb0c1b936} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27136 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {3d75814b-4d02-457a-9c27-326e40486f5a} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3736 -prefsLen 25164 -prefMapHandle 3740 -prefMapSize 270279 -jsInitHandle 3744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3752 -initialChannelId {a79cf98a-c54c-4bea-8a86-98d15bddb688} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3936 -prefsLen 27277 -prefMapHandle 3940 -prefMapSize 270279 -ipcHandle 3744 -initialChannelId {5557556b-9ef2-40ce-b988-18442e5b66bd} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2796 -prefsLen 34776 -prefMapHandle 4328 -prefMapSize 270279 -jsInitHandle 4320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4416 -initialChannelId {ac8e4aa9-fe10-492e-9504-db3a5974c62a} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2952 -prefsLen 35013 -prefMapHandle 5056 -prefMapSize 270279 -ipcHandle 5032 -initialChannelId {a083ff79-c452-41d9-95a5-a77ca96d6b69} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 32900 -prefMapHandle 5076 -prefMapSize 270279 -jsInitHandle 3260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4908 -initialChannelId {9ed47d1b-cde2-40d5-b2fc-2462e4fd0775} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32900 -prefMapHandle 5556 -prefMapSize 270279 -jsInitHandle 5560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {922e0427-5cfb-45bb-9503-3955d79ce431} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32900 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5592 -initialChannelId {f8be21e1-5033-4544-a800-72e03a35e124} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 35238 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {f5bc8364-6631-46ba-a2a6-6b530fa20463} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6152 -prefsLen 35238 -prefMapHandle 6168 -prefMapSize 270279 -jsInitHandle 6428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {6abbc759-e05b-4ef8-a18e-0209955d2c82} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 36729 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4404 -initialChannelId {ff3c9e9f-b5ae-41fa-bd54-1bd282ef4047} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5948 -prefsLen 36729 -prefMapHandle 5916 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6796 -initialChannelId {fdc246e8-99aa-4aa9-ac17-3e2a36943ecd} -parentPid 1972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5572

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5512

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\minehack\" -spe -an -ai#7zMap9501:78:7zEvent14920
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1860

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7fffb1b0c728,0x7fffb1b0c734,0x7fffb1b0c740
    3⤵
    PID:3660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1688,i,16692085287182462244,12937462459955054105,524288 --field-trial-handle=2036,i,11784766756292737975,15043987555273221638,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2076 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1824,i,11452008641911460153,14798883963357977518,262144 --field-trial-handle=2036,i,11784766756292737975,15043987555273221638,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2032 /prefetch:2
    3⤵
    PID:1180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,3621537902491749726,16778690390107116092,524288 --field-trial-handle=2036,i,11784766756292737975,15043987555273221638,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2512 /prefetch:8
    3⤵
    PID:2448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,11246743508111406288,5920544148271028750,2097152 --field-trial-handle=2036,i,11784766756292737975,15043987555273221638,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3116 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,13589176254595389752,14318328606407209886,2097152 --field-trial-handle=2036,i,11784766756292737975,15043987555273221638,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,7992465939042056629,3431613791128473983,2097152 --field-trial-handle=2036,i,11784766756292737975,15043987555273221638,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4224 /prefetch:2
    3⤵
    PID:3016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,6051091097833368011,3883511997705478554,524288 --field-trial-handle=2036,i,11784766756292737975,15043987555273221638,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu --edge-skip-compat-layer-relaunch about:blank
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7fff9f0fc188,0x7fff9f0fc194,0x7fff9f0fc1a0
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,16542152680424407575,7207052649400990401,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:3
      4⤵
      System Time Discovery
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1780,i,5917199126735541920,10373626307008986021,262144 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:2
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,9365367838170647581,4610582079091084160,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,14654589438320665676,15326637312105403266,2097152 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,9580459063157617880,8471056196610301474,2097152 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4040,i,17797295211473909764,11002554385975753571,2097152 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4052,i,1831778427966447471,5409541348009556862,2097152 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,8429644599365227807,14015379376834295776,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,15848548135239208565,14579512786006217429,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,7889519916846487370,14021211871790737881,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1152211360753124274,7724392804468216358,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10053231772235659886,450072232815799984,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10053231772235659886,450072232815799984,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,10920741854864467993,478474432247073346,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,1181924421344870548,16033985649608847106,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,6618483457698625459,12627274699514911003,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,6570152267998521796,13359121398993292005,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
      4⤵
      PID:6240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,12569396151385964657,12370525611949232780,524288 --field-trial-handle=3008,i,8026473921182969022,14236486141255338226,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
      4⤵
      PID:6392

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4692

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4664

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5304

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5860

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4996

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5848

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:112

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4604

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2416

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5264

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5576

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5252

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5644

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5780

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:772

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6064

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3688

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5288

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5456

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2500

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:568

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2588

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5916

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3692

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3880

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3940

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4864

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3364

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1152

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2424

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5168

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7056

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7112

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7156

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6256

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5752

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6236

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1360

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6324

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6372

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6408

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6192

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6460

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6448

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4060

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6588

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6596

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5616

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5516

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1556

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6060

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2144

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3100

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4512

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5684
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\minehack\mpclient.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4240
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\minehack\mpclient.dll"
  2⤵
  PID:3704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Desktop\minehack\mpclient.dll
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 31114 -prefMapHandle 2016 -prefMapSize 270975 -ipcHandle 2124 -initialChannelId {34fae0f7-04aa-42ed-837b-652657be22e3} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:6852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2384 -prefsLen 31114 -prefMapHandle 2388 -prefMapSize 270975 -ipcHandle 2396 -initialChannelId {0c1cf3e9-b4cb-4e99-a51c-d97d85a766b4} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Checks processor information in registry
      PID:3312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 31722 -prefMapHandle 3728 -prefMapSize 270975 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {2559fa81-10ad-445f-b362-929ca0546509} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 31722 -prefMapHandle 3936 -prefMapSize 270975 -ipcHandle 3944 -initialChannelId {7a026804-5914-4661-8998-936890c6c543} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:6240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4544 -prefsLen 39278 -prefMapHandle 4548 -prefMapSize 270975 -jsInitHandle 4552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4520 -initialChannelId {594ce15d-423b-42c3-b680-92d670ad5a08} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:6496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4480 -prefsLen 39278 -prefMapHandle 4484 -prefMapSize 270975 -ipcHandle 5700 -initialChannelId {deb618be-e578-4911-af8d-74100272cbb3} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3104 -prefsLen 36313 -prefMapHandle 3200 -prefMapSize 270975 -jsInitHandle 3196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6100 -initialChannelId {dfb01938-86b2-41d7-b640-953becaf1eb5} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:6160
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6252 -prefsLen 36313 -prefMapHandle 6256 -prefMapSize 270975 -jsInitHandle 6260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6268 -initialChannelId {4e0762e1-1c66-456e-b826-8bb3da1b35ef} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6464 -prefsLen 36313 -prefMapHandle 6468 -prefMapSize 270975 -jsInitHandle 6472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6424 -initialChannelId {97df3ad3-8eb1-4465-a9fa-2ffc3d2106aa} -parentPid 5948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2156

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6792

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5952

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1656

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3872

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:744

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6392

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6604

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6612

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6524

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:7032

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:772

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:2980

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:5984

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:3864

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:5092

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:7012

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6960

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:4252

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6168

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:3464

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:1152

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6560

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:4624

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6648

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:4656

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6052

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:5264

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6740

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6448

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6932

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:1676

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:5848

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:3708

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6556

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:5936

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6200

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6324

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:5128

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:6780

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:5368

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:5524

C:\Users\Admin\Desktop\minehack\minehack.exe
"C:\Users\Admin\Desktop\minehack\minehack.exe"
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 07ee51d04f9784a31e2008e95b814ab89ca7bce226d6fddb1ea89e86102dfd51
MD5 09196d526448ff29428d827181a290b4
SHA1 6b05006808c3beffbd2cbb7cb2b23568ab6a1063
SHA512 75f2c1065cc46ea19cf3ce24535ee22f6707972a4a8f9cde36a46eb31d1489c178cf3afd90f40bcb2e158d2d9ee92e728779b28806d5c144ebbca924d521ccad
TLSH
T1A5E02BB7C921AD370DFD071861244686FB5203572681859F7E3C910CCFB5A36459385C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bb3f949559adc7c1fc6f1e2188c352312905a1e4693741fdfdd8043d75974c64
MD5 7a6835e49409a83cd26c655cb696e0b7
SHA1 fcad99760c487b74c729a027cb7c756a72e7adf4
SHA512 3e746ba2698551755f72d609eb21f4375d40563d3a631134a19701240e2ef12e2106483bf5189274f6cec3b0afb891f404f8a6c0ef7ca087c19df9910d9c47af
SSDEEP 1536:MgnSwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/QW:qw3LffUnBKU/F8enCW3iyVEXGey0cB1W
TLSH
T196B31231E5A6FF7B6269962A750F93191CE149BB44E1A784443C2F1DE0CA388EFA9C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3764a6476994d5830531cdcb2514a8b46e3d1c14fe0e7cb13bb24030e84ac5d5
MD5 4da0c8a0f8d9122d54cfa74b5a62d821
SHA1 cee99a64fd394b5b951874e405b1a976579914e8
SHA512 db405586fa7e8b8138894516a55b83ebf60a18077476a2ac3714be436120558d099eac67331bf43224f77b97c756ddb2b942497117dcceff2f80bda73025e470
SSDEEP 24:Kdvf290axdl1l4VfAzqaPdXD74z3+KIjf7KiUhax71EdrSmlMA8jIyXYffmtkaBg:KEx6I/K3qozypcI3KFWchhIhKiM8DyD
TLSH
T12B914612767A02C12CBE640E96B69A371A4135B33014E96F77B901A21DA7E211EFDECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ebad271f68ed6564f8f7e855f06081b96abd08fefae4d6fe59f3dc14b2950c6
MD5 f55b1373042b8fa5d0248d6ae5b2274c
SHA1 1811dc683d17d5a05b434570be753bc84146fe43
SHA512 921d78aaacdf328903c47fed37e70911c0c9d3a549c7a4b06a5204a09f66010fba3bf16cffeab3438d97bc04697a6780a7558f0b5a4ce69bd13dfa37b9a14555
SSDEEP 192:mOND6rvoQmiUygKwDrKhD4XqMB/1jfX3jzocMeBEx8lU6:mOND6c/+6Xq69X/hJaQU6
TLSH
T19902D83568787C7B9EF6AE49B48B2B135FE4202B9A956F84DAE81A1C00D765C1306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df972926edb72f90a10ec9e475da6d0d319d5cbc25eba6f9d0c243aab9877488
MD5 1d2b787f2816e72e5f343b9ac26e4b35
SHA1 e3e0270c99b5074b9ee0c95dd28274f1bfd03bbb
SHA512 aa923ab9c5bec6ae8ba02a4fbdac15a3f0844409b1918c0fcbc351e232ecc5511edce60503490bccdd979662525852bfa7dd01d746820e47c98b25e9c8eb4c86
SSDEEP 192:OONN6rvOQmiUyWwDShD4XqMB/1jfX3jzocMet+XhIC4qDKU6:OONN6WQS6Xq69X/hJt+XFUU6
TLSH
T1E712E671B468EC375DE7F509B08B26939EA42037DE85AF80E7E81A2C00D775C270AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b73c4d03355751bbaa1ebe82aed40aa077113a3ee6397d89187e5e4f067ae988
MD5 c467c8c690a997b3b3129622bf112a9f
SHA1 5faba5bdbcfa1338988b2567ad76e4f97e961f67
SHA512 418bf0d8a4af4267fd0cd21f98bf6dd57d5c54c72d5a0003f22d6d3fa63392645b92d7749dd5a8c4010ec66671a7f1f6625e38234252507e163c03be488032c5
TLSH
T195410B5876E91148B3B37F1AABF6A96D487B78771E06949E10110E4F0A36F00C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\activity-stream.contile.json
Size 1KB
SHA256 4601152e69e108859dabf31f4c383bc30f5dc819f59bf8db01bf28c536dfb0f2
MD5 22166d921eabafa7d3918e96e1d2ecce
SHA1 6db606aa4ea271c07e0f4a64d230dcf9c1f9c3f7
SHA512 d170e3360dbbc91bd8f4316a95a925b6b7ced6b8bf5f0d28f62c764aeb4ad9c04905345b636a9c10a8c0f677f01dcdfa22263990f0ab8e9aa7d6b41f356f3151
TLSH
T13831C8C7D5E8DCA35B3378F43E4637ACE883B16745E8CC0CB725BD0181AD2269194484
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 97b218f282fe6f7ba43a5a0c7f1d05ef0c8408ad67b90586b25917784a7b3ddf
MD5 ccdd43465b00c20fa4968a1e8fa76c43
SHA1 17ca1210ba555465c917c16054390bc848985730
SHA512 1ab24ebc756ed5f7029efa52193bdda41c814f3bf66d9860e1ebaa88c92990ae8b64ea60fbb0c7779455db8139c8ac9da29e92b8449a306524a760bcd4b7145a
SSDEEP 768:ryyQsUyl1oMYynNFbgdVzCNdyXcjUT0mp6VIOYAL0exsbvua0pBH6E080RFe5:WyQsb1oMZqXcjUwJ2Zaxsbv7Ne5
TLSH
T1C2731AE3A6A8B1BB1B953BC72C0F795BA6E50159F34506C8FCEDC51CC1C9754123B2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 30ee548240b58d9bd53cfb58298e30e46f987646fec9b44603d6cdcb86c97ce1
MD5 179edd86041a8800c32e45f6f322b399
SHA1 06af4dbbdef1473adda62a0ae0d69eef38216e4d
SHA512 2d6451674b80a6d1c48f952e4ad098a9129558a2384aa9e841cde58fc63c154049dbd0454286e4e8c70aefd0e069cf368994dca7d85e750f7afbe9905790724e
SSDEEP 384:HwCe7iO024YuDL84KKDL849B7SOEAd9KVRaAcP+AWRMAzxF:QqZYuDL8lKDL8CB7S/AmVAf+hRMuxF
TLSH
T177728D399F413CAC1997C0E8C5F952DA4C18B6A3DFE6806D22683D0DC698A69B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54E2F6F0F1D9BE9D5B372F4978F53367D923CAB8

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\cache2\entries\54E2F6F0F1D9BE9D5B372F4978F53367D923CAB8
Size 19KB
SHA256 16ff188b73e9de781909cc898453a9f1f19904690cb52f05148e6d9df5c91d63
MD5 b0c7f1d6434f0572519c32e81f4195bc
SHA1 f745bfae1d0540c4bd1d275f80a2e2f9539def31
SHA512 af71e765dcd91c0466e14cbd4ce3bc4c602e118ecb861986d1f70768c068e94a6845f90405e10cf7bbd8ac9f6d8f6ed16f03f04cff07fd4198b297bf49bb72d3
SSDEEP 384:EHVTNUbruYTdlc4VYfEzN23APgB0KG1hcf/LArhRrpPrkJPXlwl:EcvuYplfSf8N2ErKG1hSAVRrRrfl
TLSH
T16992D0F4AE661424AEA16A51DC0FC158CF04E923D3A562F49B44628D85CFFF053DA6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 1698e8d2d0dcc9403032188720aa444da9e83aefb72a14e50058ee40c2c1a31a
MD5 caa4dbe2b4af47017be129a121291094
SHA1 446f5e7439b0de248ade67f11ca97ab3296b28b4
SHA512 fda702fbded9364316c5e647a8e4219c1c3bc89e90bfc33c90d2c516af16c62036e41dc21f611f24d4ae88435ee096af80eb692d844bfe674ffbf4370c5e19cb
SSDEEP 3072:j3lxCWKMmz1YD6B0LEFBZwojAzzHEanGz:pxeMm+e+QFyzzHEaGz
TLSH
T13EB3A0F6DBE2CD6965FFD41D5B82883EFD262814B3E33009C9632350A1C6F78A675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0olu2cg3.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 72d1e0694a93ed88e1e3568042f9ebc6d3b63d16e7233b18b32790c883b61bc6
MD5 309b341199fa021f81dc14f4952257c0
SHA1 3cfa9414c318068d35eba6613dcda538fbaae3ad
SHA512 58f18774bdf2987ee28dea61dc554737c7cd18671a5ce3dcf86ea548d3a290256fc3e7f141291d09d5cc1071b218b34e3c6f88fc0c9109d02057e05ae7e80991
SSDEEP 3072:X3lxCWKDP/jHHD6B0LEFBZwojAzzHEanGO4:FxeDHbe+QFyzzHEaGO4
TLSH
T174B3AFF6DBE2CD6965FFD41D6A82883EFD262814B3E3300DC923235461C6FB8A675644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e52c4408-bc1c-4af4-a238-3b435b444f58.tmp

Path C:\Users\Admin\AppData\Local\Temp\e52c4408-bc1c-4af4-a238-3b435b444f58.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir184_560877838\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\AlternateServices.bin
Size 28KB
SHA256 17c8a8b8ad7d01c10e54298344ba2dfa12060c570b983b590a2e986004b061fb
MD5 23c2bdada1130f5c332b1930d5a4aae5
SHA1 5e252b46abe67f27982854aeb05fcce4bcfd7818
SHA512 930906fe47f5576b01175a1265ab0cd8bcb2e27ff5991352923690ea3bb64c707103f1084029efc851b3c0bbb75cec086a4e59becd674d4575706810b13d3fdc
SSDEEP 96:Orf//BG83HQzi/DoH+7Rt4sRlHaGuCRPvKGRO0YcNOlVWBYbUvzHyXaOeMG54+d/:VSxYwMVUyMo
TLSH
T12BD2D3EB8BF56462F0734FB080AA75CDD8330566691C8A84AF14C09753E63A5E0BFF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\AlternateServices.bin
Size 10KB
SHA256 7cf225563c6e5aa4f665ffb9424000287862134b21af76e5172f94242c7f39c1
MD5 131daa871ee08e34d6a028743394dd39
SHA1 cb08c917a7de9dd466896715d8c3f1c7f7b287e6
SHA512 f288b4d94c485f86b9521cffba7f07adcf29cace30cb9f6edd2b69fa084433577ab44b5696db90f5e635f35db6d6d81b9f6085d5016b49e362ea5356b109eaf6
SSDEEP 24:tuhMZRASp3ejgewlp3ep3e8ew7223ejgewB23e+b3ebewQ28gewhBew0eqgewBem:xA8u7v/Y1biQi5XHQz6bLrH+769R
TLSH
T1BA2296F3DBF6A462F0774FB0846A71CD88230A56A968C6846F10C09393D26A5D1FFF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\AlternateServices.bin
Size 15KB
SHA256 02c4cd1d38c7e3f0c72768e76ed59ae2f8c47710fb84cf129fce23b7456ddbad
MD5 8a8c71935310efbfcdb9b8554febb2e2
SHA1 606b1704d4fa59bff4f9dbcf35022b3487892dc4
SHA512 b2a83842abc130e0de270be95811d1ce25061c645362b41ded74d31926cc34bf7caae7e2ae9c8bd6a8e1e01457157b7c91c02a12ab8c99dcd1917e663a2740a2
SSDEEP 96:bu7/YJiF5XHQz6bLrH+769Rq2uM608GHEGjG2:
TLSH
T13162B9E79BF6A462F0B74FB084AA71CC8C230A56A56CC6846F14C09353D26A5D1BFF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\AlternateServices.bin
Size 23KB
SHA256 05165ef764dc5ccd149fdd25d1fa8e608d2fd6eff127dfbc60b12f4ea6322bca
MD5 f8ad453b3f0e29c7139cbbc5e7b8236e
SHA1 bb055778eb7d470f5ec2d52889bf9a88a0724047
SHA512 488c2dc289569fed61ad5c67d3b0d31d7cd597e70ec42a3bd1a43863468086e5cf4c68ecdf475ca6b0d905c8251358458c2036a892418d96d46b98eac0652bdc
SSDEEP 96:zOVV3HQzi/DoH+7Rt4sq2uM608GHEGjG2KO0Yn3HIL2mYb/93G3ssHG/92034:hBxYSy
TLSH
T10FB2E7E79BF5A462F0B34FB0C4A675CC88330666992CCA84AF14C09353D27A590BFF49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\AlternateServices.bin
Size 23KB
SHA256 248a0def63852cdc6968aa0dfb304fdb5a97d7a8993d97806a184f5e329d6803
MD5 85bd7015c75c469badeb2883a5c51b10
SHA1 8ea90644ee9c247100ae5e7611eb9d0ca6eebfe0
SHA512 35ab3128178062232c6bb67f339868d1bd45eb406f06259a08d45e72d8b560ed20037bef70b085aa8024d6a4181911cb6124ac047e7df46295b6b231c112eea2
SSDEEP 96:7OVV3HQzi/DoH+7Rt4sRlj/nPvhGHEGjGNRO0YceHILNmYb/93G3ssHG/92034:p61xYty
TLSH
T133B2D4E79BF5A462F0734FB084AA75CD88330A66592CCA84AF14D09753D2394D0BFF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\AlternateServices.bin
Size 23KB
SHA256 a60c46ced6f402c9dd6b1fdd72f6a3225f1089216be49d64703a1379a427fbd2
MD5 c4ed442e61c285709e736acb9545bae5
SHA1 adf93afcd1549a4ef679c51604374c7f8aa257ff
SHA512 67a9cc15bd30b58bc43973110c209222568dd1331d9467a69263b0438ce15d3073aa16092a8443547e46d641ce2e45f7ec1bd350b8df7bea292535ee14b738d3
SSDEEP 96:qr/jTf3HQzi/DoH+7Rt4sRlPvRO0YcBYbUn3G3K2034:0GaxYqy
TLSH
T1F5B2D3FB8BF5A462F0B34F70806A71CD9C330666691C8A84AF14C09B53D279590BFF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\AlternateServices.bin
Size 23KB
SHA256 6d0fbdd97d6e2c8a5fb3e3a584e63b863fe4bec3454a78fdbba483c5f69657f4
MD5 a8ffdbe54e2eafac4af9a58d2bc6317e
SHA1 dd075577c4a96ff6d6bab8949637d3be0ec245da
SHA512 7809e80c202669d265656f03af05fab0c83c6322c977572caa58fdb60d6f48fd3a5a277b509c723785916a7e32d4dc41fd1df357cacabd450bf82f0e6bd1d9a0
SSDEEP 96:qr/jTfcGJ3HQzi/DoH+7Rt4sRlFGuCEPvM6NRO0YcxOlVOBYbUn3G3KMG34:0yuxYoMVcy
TLSH
T1F8B2D2EB8BF56422F0734F7084AA74CD9833066A591CCA84AF14C09B53D27A5A0BFF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\cert9.db
Size 224KB
SHA256 df30ff2a73b2714e315541e5ca072c53cd5ac895ad304ac8ad612acf4f635576
MD5 58f11509f73b344b2c336dc641317164
SHA1 3618f6952f19a62a3d070dbb98bc80e2f8575b15
SHA512 262939f66d922cdfd6b525144d7e8aa5d607b80e83c78867f9534fb5947ea45cc041880a32b84d1d87a0ebfb45fdb3be6f18b6664f8a09d662d98ed0c25da991
SSDEEP 192:zOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vg3HaRPNnKoP70O+:K1zkVmvQhyn+Zoz675cPVPQB
TLSH
T1532420C3F820745ADF8A6D31B662DCF23D7227410385A422CE289D3F5D64A1F67A68DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\cookies.sqlite
Size 512KB
SHA256 36fb858622a8e3c609d6aa18a263fc6f5eb6978c8d4185f87818cca3f3167142
MD5 6263c655029b5d6e28851f3d53dc4c71
SHA1 a62cf20b27e4b732a5d1d05b0b1be4acd536b357
SHA512 5755d888cbf3578f6362a019c1dc0b736babb26453697414e422bcee268ae629ac9c962c972b6029f36f5f1c90317ea4a072dbdea456a4a028e586fac73d8ef7
SSDEEP 192:8Sa3c42yO4/4H4y4+sV9/4NZj0gDOK/VZXK4mfxAn4H7lAH47MBAMasLRxsmjsMX:8l3Iy6mByTKNhr7OAMj1J
TLSH
T16CB4A861CFF5B89DDABB1F3BC5E9B99D0A173AB5F044C0CD790864D4A1A230224B5F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 68KB
SHA256 ae44449ded9b31ab8fbee025f8bde2602c7489ee445fc3ab8da327faef5b3578
MD5 b3018660505c37909c768911c71a7588
SHA1 70a40ed0479df4de339d5f4e508432b4659799b0
SHA512 eb05ac02bbb6feaf4e16e9c8a8da864a9aaa6e3abc82c868e3682cc0ff55524582af2c04d9f3a427146d471eaa2407523117169932029b728b488ad22413604a
SSDEEP 1536:B1Wc2EwUMhsHgv0PXAelGxkg5icRrEDBy5aoMehTZLQ:B1W5Rb+AvmbGp5cDUwwBQ
TLSH
T118631044EB1A553FD82803BA9CD61B003F79F8895A1A2B67371C65386D873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 85KB
SHA256 5782943cf88a01b441d87927079f1c31840276193ed57cfb68f97e684d4653f9
MD5 f7a06d9cfbee98ef341af26cf9b63292
SHA1 72892ca043ec71dee1ce3416667752c9e7d5c578
SHA512 6218b1433476ae5eb31a81677abce3ea1212b19f03713e2d507ddf4d816f7a132e034ad0cc886327b011a7c6991dcb00bf4ef0d2e9e551e75cbc9aa4e0ffa7fe
SSDEEP 1536:NYm8CQyIvmChMu+U0MGb1lNxfSg3NZJJYFhs+19Y+Gn2aEoU4sva:NYmRj4mUhb18NsgjYfnh6PEoU4sva
TLSH
T13283EC80DB1A403FE82442BB68D617283B35F4654A5A6B5B3A6C50391DCB3FF2D4E53E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b49ec489d48a0ca99febfabdedd7df945f2c81e34dc6d700e6cd392bb004a039
MD5 1321b44ee507c8fe3993030644c082d8
SHA1 b4b20d3a479d82a97204a492f49127199ebfd1e5
SHA512 fe4f324382bcbbdb96754a01dac1328a32ea415db05483a1d8ecd595db5175fa4967041bbd63af9a8643ea10c9164ea26daa23fddd3e3ce70774067ccad4a254
SSDEEP 192:gOv5zboBb2ByjTxZ1d66Joz1zgCl6mc0d:LboBb2Byjld66Joz1zgC1j
TLSH
T115D1CD68E638463FD448023BCDA61B800F76395AD88E7F1532DC741D2D562DE7A8E27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 70KB
SHA256 6273b738fe89618b4565d9ea7a6b272b503830f49f95a802ff2009f0dd7b4d16
MD5 528f023cb95715bd0d982875a60d67f3
SHA1 8a2d2a3e6ff54afc5027abc75b9fc8e382b12265
SHA512 4cd24bb0a808b9176fc6aa02191271151851154791a5742b4ef6a23b1c7af88b84e89d6c871a1411b378659819c60df2c39356f0f9d1636e9d6c9c9934b767f6
SSDEEP 1536:XYm8CQyIvmChMu+U0MGb1lNxfSg3NZJJYFhs+19Y+Gn2aR:XYmRj4mUhb18NsgjYfnh6PR
TLSH
T149630F44EB1A553BD92803BA9CD61B007F78F8895A1B2B67371C65386C873DC3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 253895d36d4f3075215f782c30987a0f68fdbd70f4111efaa1e71be5b9e8187a
MD5 4e44dc45961ca49009ae54315344519b
SHA1 1957b0c6e2d8f6cfee085035e02ba1c8c52b2663
SHA512 3797915c271aa089c016091ab1cbc4c7a578de9fce0e9ccad3d0f24b0e7546f82763794b98f3c662eb0c4224e8e986279cec0398ca491d9382a433ed2500bf6a
SSDEEP 192:7Ov5zboAXZ2ByjTA4e1d66Joz1zgCl6mc0d:kboWZ2Byjkd66Joz1zgC1j
TLSH
T179E1FD68E638863BC448027BDDA61B800F36399A984E7F1532DC741D2D572DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 85KB
SHA256 62a9fac71eb3bcb518ab8ae6bf311e9ac0da0d0ec3842a03415c6216308e2e14
MD5 e07b3870a6baaf73374cceb1b3f91916
SHA1 a2c50ed7b5e4ed7fe740f93df5d1a51a1856950c
SHA512 8301654aa170baab137b7b58c03ac0acd04ccbcce4b872d7034a0e0a72e435d17a043fdd46bec760b47462f0dc3e2bd610b09e1554e88b33c47574c0bcc78c4c
SSDEEP 1536:lYm8CQyIvmChMu+U0MGb1lNxfSg3NZJJYFhs+19Y+Gn2aEoU4svZ:lYmRj4mUhb18NsgjYfnh6PEoU4svZ
TLSH
T15D83ED80DB1A403FE82442BB68D617283B35F4654A5A6B5B3A6C50391DCB3FF2D4E53E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 f47ebe93ecb0b3c1ecc592b1901639a9af3be810d9ecd2517c5b2f1cb186b2df
MD5 79b5ea13c797d0cacc29eb3e5cf0b2aa
SHA1 ef4fe8cd6055be0d05a6344f565c90d529e1aebd
SHA512 41b54a5154f041dfb2ffbafb5c9a09c6556ec7305361323c81c0601ea656cdc0abf1fbc2bb8146999eaeb60710de84b863ea44ee8f18aa9676b7516ed7477159
SSDEEP 768:nm4/Z1otkZGGcmhucE/5RKWGq5yz9Uxb+bFbPbTMm3S0P6KU:nm4/Z1o7xRi9/g
TLSH
T126031244EB2A913FD41812BADCA51B102F79F885591A2FAB3B4C646C6C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\events\events
Size 1KB
SHA256 7321f8330734037b3cfdd5e96456aa5af28082d634a4f31c20bdbed2d9776589
MD5 f8519718cf1af2836263e899026c293d
SHA1 49b4e1664e00f4798b07d56768e6f5fd1298f477
SHA512 736746954b6f3a1d1afe9decfe3ff06b99af35069312c3de482745600559d7fefbbf7262724def6dc88423fc5f126b015052215e745fed0466803c13627ec897
TLSH
T15B216DDCB5B84D3A58C7F6987442038E53554E0A448B1D439E42EE8DCF81ADD316E43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d30683f1b617f7096069ade698854f7b67bfd6469e3f7caf8c91c9176112971e
MD5 bf6d52bb2c37c2fd27a836c2b7ab23c3
SHA1 514fe80d0fe6dd30e77530635a88bc06b392d42a
SHA512 43567fd8caffb2c7c4ca702d5ca007127605c1fccd2c508e14d5092203a22ae3538b0cb90bc76a7a00f664fe5b09ff921305c4d8a34cd56968c9eecd1c81881e
TLSH
T1B3216E9C79F98D7AACC7E25C7451038E93514E0B04872D434E43EF8DCF919E93269478
MD5 SHA1 SHA512 TLSH

Submit Download

17beb59f-8ba7-42c5-aa0b-851bed5572bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\17beb59f-8ba7-42c5-aa0b-851bed5572bf
Size 883B
SHA256 2ef70a66f159b85f390c10e28deee0fe9509aecdf33054ffaf037845e5f715d0
MD5 33e27a45938869143d08690bd6f173e7
SHA1 081dfc8a17573ac7c735f146f46447d931f5731c
SHA512 397874d480b838c368c739fc607b5c41342dee8aef9604466f8c3fdb2437e4a3024171de912159483d6eb0b4777017dc86dc7a75351f3df2b6fd6c62e604b7d3
TLSH
T1D51127908530B7B2CC6C924F8691374347F4651380C950143EF05E0D4D7F51E539B70B
MD5 SHA1 SHA512 TLSH

Submit Download

20da475a-c3a7-426d-ab96-3430942ca0dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\20da475a-c3a7-426d-ab96-3430942ca0dd
Size 921B
SHA256 494f04421a32a94b1d0aeb04d8de4a570172dff1a27116197e904a12b6801fc7
MD5 ccd3610669ac573690059e2a929aebc9
SHA1 f14428dc3bb38c81d54894acdafdff8cfe32ab87
SHA512 50b93a6b9ff6e64df4e65c2432f5b937f325b0fb80ff2480610af6e8b11f4e3a0181dcd8ead24fbd9f0eb6fe3a7b77c0f2dcb388581d7b9fa17449869dcdbe93
TLSH
T15D1144078921BC36DF7DC20D85D6738A97E4A15300CA69217EB55F1C899521F0266706
MD5 SHA1 SHA512 TLSH

Submit Download

31cd28ad-7691-41ca-bdb1-a53cd42d84e4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\31cd28ad-7691-41ca-bdb1-a53cd42d84e4
Size 4KB
SHA256 bcaf0ecd81e65dfffc8e5aeeb71ef12111f65bb4bee5c84b9d70d722110852e8
MD5 720af82eebd70deecf66be257aa2d446
SHA1 115c44eca2235debf24035b72a062575f78cc270
SHA512 3f1df20cf2cdc6c9016e4064c00311ac0e08cd94df7e361ed80e5b2711a86483fa8c26288f5582d34801a5e7919d282f425e554029a4b97e12d917881eba2771
SSDEEP 48:j9+UCNhs8JkIpOtVcRO8O1RDKZ7TK6pMvPd3RQa8TA53Xp:jQNliIcRK7TK6pMHBKFEp
TLSH
T1C3913188A3B95C7A6CC7E19DE443038D43D44B4390C62EC3AED6EE0C8E5765E325F42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dd99196-e22a-469b-9d0f-7c631424bd30

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\4dd99196-e22a-469b-9d0f-7c631424bd30
Size 8KB
SHA256 dc3b6fedbdea666df811e533ccd9cb7b14021c2d09ff2acdbf259ee353fa6d2b
MD5 f3cbb6466402ffccdc075d00e4665b01
SHA1 9ee163f8b4e5da2545059db4ad9b85e86f021a83
SHA512 e519deee300ecc5999f665678ad32b7b5fe385c69240dfd308348af97ad736430ddfdeb8d046e5ecf85a20c226d8e1fe329bb3b13d1e6a6b76b8950af460a469
SSDEEP 192:WvzGx39w1Q/bvoxVFl1E1mm6XAxWK9e1x:4zutwm/bwLFl1E1mmcAxWK9e1x
TLSH
T1FF02C3FDDE12415A3D75D60B72EA956B30571932498CC69E3EFC043A0ADAA3F1663238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63655e22-06bd-49bc-9052-9804d4063135

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\63655e22-06bd-49bc-9052-9804d4063135
Size 886B
SHA256 ea53acbcd086061d43c44c14ae9173560987fa358fadf7864d572d6019660a1c
MD5 d77dafaa8ef519f7741e486d010687c3
SHA1 55b6ff38a21469f7f993bb668f1c2abf8d8d2fb7
SHA512 443b46852e68fb9c0871085733783455dfdccbe2bd10bb5a72b604d49b0cdbd65a9b59064424d5ed58a05024a4864dae0d98deebe8696deb881e24af4283ed65
TLSH
T1241163C08A70BAF2CC6C838F99D6774247E0352380C515147EA49B0C4EBA21E73A6B0F
MD5 SHA1 SHA512 TLSH

Submit Download

7a5ea5f7-9f4d-4d1a-ae42-c07832e59168

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\7a5ea5f7-9f4d-4d1a-ae42-c07832e59168
Size 235B
SHA256 3074934b42afc3e74d5fea25497c8bcd5bed869622cb5ebd8a4b81775c63c686
MD5 9b3dbfb8b6ab367ebd5a6a1907742ac7
SHA1 2a5579b633ed684eb3b29a97c8a441d2061dc60b
SHA512 e2b03c40d8360ad191c54393a0ef45def1b53117bbbd0d35f51dff6ab34fde0e5169e4c12952b4783d6a8c0c9067152d307d010c53c92a0e24a27bb313f509ca
TLSH
T102D023D05C98735C08040F0BF0F06AC23545CC3314F89C20EA510138CDFEEC88232867
MD5 SHA1 SHA512 TLSH

Submit Download

a1546782-aaea-466b-b723-b77fcdc42cf4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\a1546782-aaea-466b-b723-b77fcdc42cf4
Size 11KB
SHA256 1cd2bbe5c63c3e3271f841c045a1b20005ecaf1e5f6ee54883b21a387562573b
MD5 7ae1f27709322fa628653a28e2b17405
SHA1 61dbba6a4e71a7fc649bdb7e982f4740f0532be4
SHA512 64a688d25174cd0105fc98a233bece7952d797cd4dd48a9032c5e406d61cc44cec0d00f8446ac086b06ff2d83192d32b2b8fd04c4d902988ee79700701432d80
SSDEEP 192:yvZgnNl6eNemDYSo9ikTDW9yCH09rgAIO5V6liB9pTv5:kGnT60em0SqikTDIyCH09rgAIQEliB9j
TLSH
T1AC3224FD9D1200473E76E52DF1E9AEAB005628314ADCC7DD2AFC083A36D2AB74653394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a942d783-03ca-48f8-8567-a8b8f7642117

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\a942d783-03ca-48f8-8567-a8b8f7642117
Size 2KB
SHA256 424fb82af264750c13c6bced931203641ead7f64c98ae8ac1128c02f721538cb
MD5 b0ed39022e81e1122ec62dbdf2c66ccf
SHA1 04ad3eaf9c3550fd93aadb0c921a0bef005637a3
SHA512 420edc0d2a5ac1a2047fc2168623c156fe589aa3cf0295452ea8696dd1a60c3476eaa085edd89bd51cfa656afbb6bd14aeb0febb8827f6a2ab45a71fd4031ccb
TLSH
T1E941735C3A744DB68EDAF24DE18233CE43E04A1300C628436EA1DF0DCDA679D337A52A
MD5 SHA1 SHA512 TLSH

Submit Download

b5980e68-fad0-4547-8d38-b539c2d25987

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\b5980e68-fad0-4547-8d38-b539c2d25987
Size 235B
SHA256 83199e89c3233a0bbd3de39c5a20e6da45e461eac37a412e679cab557ae0f5fc
MD5 8923ba852649b390d0c0c3eed3397792
SHA1 35e7f31486f97d626ea5e48bf7cc7d1a8ebd2fbd
SHA512 f5270bc1dd15281f5e11c08867c1b1f37f72dfad4060175276fd606c07ede46afd515d659a24fa0bdaf9215d0847ea10080657da6830de2f9a77cac440838c31
TLSH
T12BD0A7D468A8E76D09144F17F0A46AC770488C732875B820DAD645B8DAB9ED843B2817
MD5 SHA1 SHA512 TLSH

Submit Download

e05d049b-3c35-4496-8d54-5be7e217bf3d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\e05d049b-3c35-4496-8d54-5be7e217bf3d
Size 280B
SHA256 4576cb0eff201399c82832b4da9b73e5364f57832344b8fe56a5bd8d9bfd9916
MD5 e23fd36e78b4639543f9ce2f799d786f
SHA1 8cde344da313e693a9b1ce6a5bcebdbe3d22e4da
SHA512 20a77049c87113a0b62a38184fd3320e24768c95fd95901b6488150867c2d3021e96106f72db07a71e6757956cd6bc860eb419faf9590afd74d5fc508e4b3285
TLSH
T142D02BD52C8866ADCC681F06B0B028F335A54C3251F15C00D9A189745AFEED98156D1F
MD5 SHA1 SHA512 TLSH

Submit Download

ea943369-ebba-47bf-a7a7-4ec3d96c72d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\ea943369-ebba-47bf-a7a7-4ec3d96c72d3
Size 15KB
SHA256 0adef9e4e2e164394fcc9a836eec697c5b463c4195160118695856b9bff19058
MD5 44bcd4ee3f0400243e85f1272c793b23
SHA1 fd0e9bfed74ff2b80b91e30fb424c14a188e4e0a
SHA512 a0e796a49064d1ae20f1f32be4ef5828ff8fc79df6b301868bd86264588ea5468ad621a421c6f2f07fca475a9853ec75e43197f2d742a5dc47fef4f2219dd604
SSDEEP 192:fNSWP6jAK3oK+RiHBDU+13e9xdZa4KxDurtNhfsHHM/2jPdxftLkFSYKzjVia:1SWycKzwetUr9nMs/0PrVLcSYKPVia
TLSH
T1DE72C856686045BA8251E36D94FC7FC3E6F528CF4C018FCADBE47E086ADE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f16f26ce-4f4b-49f7-85d8-fd2af18ea857

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\datareporting\glean\pending_pings\f16f26ce-4f4b-49f7-85d8-fd2af18ea857
Size 972B
SHA256 48d2028cdad5f8d498d6afeef8407f9531346c823e54a05257c35419a34a6c0b
MD5 a81d1173660d3f615eeee6fc055a5a8d
SHA1 2a62b8fc3f7460285b6ea16a01b6a8598d98fe78
SHA512 f663393603f564af0ea0c8d7576806ef7010e734ca16842ea940825d2a8c22c2a1e1f289c9f7bd5520736f96b08b6ceab13c17562719781b882d8820ddc77694
TLSH
T173110ED08974A6B2CC5C828EA5E573939BF0212380C90A147FE41E084DAAA2E6257B0B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\extensions.json
Size 16KB
SHA256 0929cfc57241e5f98af094990403275b6e7bb71d7079ea77ed09c6fbbc30e68f
MD5 356f584a3d85709dc6a778e73709f405
SHA1 6ef07c7e242dd3c0479db579e207999ad8d37995
SHA512 2a465f7479565faa2a2ac71d2244bf348a36a7da3a98a270423b4eda2e341d5be6440f8db993b27fa1903e7c29f63255d9f81808d5583d546d4b2c7529ab2c88
SSDEEP 384:MkI4vcUmldvW8dhWr94zV96oetL4H5qQL4PBL4H1L4HnL4Hs+54hc:DI40RfLX2436jt4ZqS4R4V4r4MG4q
TLSH
T1A072432545048EB8294F979BAA36BE01C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\places.sqlite
Size 5.0MB
SHA256 75298f06e28eebb8094c3a76e5149f381d1875ebffe5f2321a5333737741b93c
MD5 a751162417c2b1de150ab26813972a30
SHA1 0df5226745d426fc3b34b6ff8b7046d48772653a
SHA512 b1528522e2817f266cedf2ff931d63a38a06d35fed2d6bb85f0699609762b46abbec5217da7e92c011f60bcd838f98ca5ae51a5e782b76b90579308421708ce6
SSDEEP 384:M8r54w0VW3xWFdlHjLNh0IL2fZ3SHsRR/iT:rqVW3oFHjTalosRdY
TLSH
T1C936F90FBA701155C0EE6632EDE37F04183F250A8932B68338A4256D4DE0727786DCBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 12KB
SHA256 fab2ac7e01841561198349d344f96dc5089a2a99d79c8c5255d57814ffd5f6f6
MD5 13a504577df0ccf372d0017d761f4e5e
SHA1 56435b1cf931a1fc97e2153cafd903f799a2c79b
SHA512 abaaabd1003619b2e9f6aa09c3730b2acfa3cbba59b6338dca2766cc1e4d33fd11510f08294c35652e69b3925e330006079c3bc05d9190916db0559154655bb3
SSDEEP 192:4kRzfkJ9jVPSSSS6LRJZKSYVvOBw88natwJL8:bJRWStwqY4
TLSH
T18542DFB89100CB3F20F7327DAC6A4A701AA1023776BFBDD61AF99491455CF2441E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 6KB
SHA256 80a63a6ab8ef9bf03e443c1b51f758f588baa442fb204e2dde4087ce8cdbc639
MD5 9059d49abe1116fba54f71be9cfaec39
SHA1 bbc872e4cd296902c3572cd02dc980ee9d4a5392
SHA512 50a34e4dddeaace9536419aaa5f587459dea2865c522fff3068a1d6969c3e06faa3edeb50dd4cce897681b4c90cc9cb006f327171f163c512843144d79d9cb2f
SSDEEP 96:xHXWUTUuqGqSfxPS1zSQSSlNdv9jangH5XJKSIHBw88P8L4cnzbF:4ZRSfxPSdSSP5ZKSYBw88q
TLSH
T10CE110789008CB7F74B6776CAC6888316AB2013B77BF68D650B954C8051CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 7KB
SHA256 ad097903f739a4ac26d9c9b849712715ca98fb7f3b2c27c2cc340c76c3bc6379
MD5 c194de8720977209851fd40fed9851fc
SHA1 97a20e0c6ab738a5a58bf46ab9a4719d308f79d5
SHA512 bf470791e738cc96b0ba23f71e188a02fa54c816e187d09e2803423a749e412f1a53f010484bcb7d05df55c4946ba40af3a21b1ed9e4b6aca1857b6cd98df77a
SSDEEP 96:xHXWhTUuqGqSfkJ9jVPSObzSQSSlNdv9jXngH5XJKSISKuBw88T8L4cnzYF:4kRSfkJ9jVPSSSSK5ZKSvKuBw88j
TLSH
T1EFF1FFB89104CF7F64B6766CAC6988315A72013BBBBF6CD615B95484060CF3441F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs-1.js
Size 12KB
SHA256 87a7e04d1c1d29cec3328d40be569b1d02a0b1a15924a332d878504e9e9d33c9
MD5 21a5a8ef6024259afea93144eb307b6e
SHA1 87f1332220f1c87ca9bebdc19e37e7ba32ce310b
SHA512 82d148080c7ed879e46247345e5a23becb4fdecb53e49ed0a3062447b60f0f403bdbda80f0f8ba2953e5f630dc4055608c7272d5aef82e87dbfa003ec8c3670c
SSDEEP 192:4kRzfkJ9jVPSdSSHLRJZKSYVvOBw88natwJL8:bdRWStwqY4
TLSH
T1B442DFBC9100CB3F20F7327DAC6A4A701AA1023776BFBDD61AF99491455CF2441E6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 6KB
SHA256 adf5f3ad3048072f2247663d59737c9c144f416b756103f49138c8486a1230b1
MD5 f5bce3c902a6142b467d8067c8b0eea1
SHA1 d50205cc94e848610103badef697e555eca93ffd
SHA512 440d0ada199d0444a79d980eab12c16ba288416f890f917bab255c216227c5b04f79da3a3ca8da16d0ce45cbceadcb6cb6cbb70486fc1aaa5413b3a34c750002
SSDEEP 96:xHXWUTUuqGqSfxH5Y1zSMXCSSlNdv9jangH5XJKSIHBw88P8L4cnzbF:4ZRSfxH5YhXCSSP5ZKSYBw88q
TLSH
T170E1207890188B7F74B6776CAC6888316AB2013BB7BF68D650B554C8051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 12KB
SHA256 ee37ef602100326baca1ad56e8950830452b5d5cba0aa8bf69c58c9b9e38b314
MD5 14e3a343ea74b9db710ca68089fe548b
SHA1 3163318d552548da5496657be7ef773ca882023f
SHA512 55cb57741bc58f48e65c563202af2450f479d5e90bade06807be2f188936c552785bc402bd463fe0dbf7ef54d720f604473bb652b502957fee9431acb226d773
SSDEEP 192:4kRzfkJ9jVPSSSS6LRJZKSYVvOBw8OnatwJL8:bJRWStwQY4
TLSH
T12142D0B89100CB3F20F7327DAC6A4A701AA1023776BFBDD61AF99491455CF2441E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\prefs.js
Size 12KB
SHA256 e45c056545895bafad4e6d0b29d7fbc79abe7b031da1b4bd2a85ef324044fdcf
MD5 2614404bb659b0061e3f21ebcf164652
SHA1 28a1f4ec3a8b0f11c23b514bd147c31e2ca786c4
SHA512 e9ebb9c1e3151eeefd4ac2b9aaef527cacf32444663c7fdb47cac26d063a62c6781886f157cc9bf4b2907dd7931d65eabd433cd5eb1100381a1d95f803116267
SSDEEP 192:4kRzfkJ9jVPSjSS6LRJZKSYVvOBw88natwJL8:bORWStwqY4
TLSH
T19142DFB89100CB3F20F7327DAC6A4A701AA1023776BFBDD61AF99491455CF2441E6AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionCheckpoints.json.tmp
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 11KB
SHA256 0a9fa5ae4091c3bf08de33525b2e969c9bdc4de34639e18a401ba6dc2feca87b
MD5 8222a41e387417fff002263f535edfd6
SHA1 0dca052698215dabb3d3aee3bf44922b34bdc1bf
SHA512 5ae2d2cae83d8209523e0ca93d9403b6af953c806e2b5abb85b6bd229463ff5f422b6e4c071392697d49862c4afe97d9acf6d32b57d23cd1ab3f6c26fe8585db
SSDEEP 192:7vHPFmYsFEoKL23OlGBJ9rii4lHzf1LRJ41gya0NFuhm7aoOqUng:7vHdmYstKL2fTtiigT1/43DN48XUg
TLSH
T12A32AFF62BB04E34076D0D6D8089DAA51F9FED5383D86988980D3C9B28F4B009F9D328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 50dbf1c2274b5966bd46279da5fab1d1c7f10032f64a5144096d1b656d6abb70
MD5 9fa15819abae9e1675bbbec423059166
SHA1 f81491a6e4b9fd2ac40b35ea171b2ce312d97326
SHA512 77316698dc6da9c04f43f2367c3852469a9d7ae0716e8758acd6b05309b31a6d07fe9d5de9652ace0eeac1e1829699d9b91bb2cd66aa34666f0b40a4254c5e97
SSDEEP 96:XlfAbXy9K9J/EGjcgbl0otW07r2HAVcRiA4iHVZR1LLbtsWi4vsf96qb81f6rXDm:1z9K969olS07KsCdV31LbaZ40lzbrH4
TLSH
T16AD17EA7DBE01D69F37504FE84D48E7C056B70E1C6EC98E48E6E1D133899715EE4A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 6cf97e7af2677665120e9eeb1a94a8ba39b0692e35c0822e37a88fd01b0fd805
MD5 81792e9c5c2299ebeb4b648b3ba9d73a
SHA1 4822f0e9002892213f5ca70a456894f14a069ecf
SHA512 00c06701896d069b8f0a799df00df2eab16d52c8196a551debd0f39796f38416b5ae9124e9db4bb12edbc5990fa319b9906556951b60d8048e2d478abac9d60e
SSDEEP 96:+lfAbXy9K9J/EGjcgbl0otW07r2HAVcRiAB9rD2lIrR1sbtsWiO4t1Lfw6qb81r1:cz9K969olS07KsC7OIlibatO4XIzbzHe
TLSH
T1DAD17DA3D7A01D64F33544FF80C58F7C166B70E1C6EC88E84E6D1D1338A97119E0A364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0olu2cg3.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 3acf3ba520ad324c6f8d5806bec10ea5bcd9747a0ed9db430e46e52d3ff643f8
MD5 56812f836de0b159d7e85456954bea20
SHA1 6081d4eeb45a57bad0b92b9bf40898f2110b3a49
SHA512 cbeb413c6b2ab5ca90812eceb4a07656f89e06bfd447b8077f2aa220159099830588b3938442da2b0f980eb8ae332ab3098bca57127d70be6309a2a6982364e5
SSDEEP 192:uz9K969olS07KsCcOIlibatO4XIzbzHWre6:uz9KoBiKlmCn//h6
TLSH
T1A1E17DA3D7701E58F73504BF80C58F7C066B70E1C6EC9DD84E6D5E123899B01AE4A368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minehack.exe

Path C:\Users\Admin\Desktop\minehack\minehack.exe
Size 683KB
SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
MD5 6669e10c960f6c2297bcd3d5a27412aa
SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
TLSH
T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpclient.dll

Path C:\Users\Admin\Desktop\minehack\mpclient.dll
Size 5.4MB
SHA256 26de84c8bb7cc95a1fbfccec4ade4320f415f4046d574da92361559f13024df6
MD5 6f6c43bfd1e58e36ff100ff63fbcab34
SHA1 0ca1d76c5732d78eebe2819843169b5e34f83a18
SHA512 665a4cd9bcc5d00ba6e4889eeeffcb2ee5c0916cf6e69e4448dbf272d528d59f17a6396bb7c985edf7eb517536a39bb8f90d067e19dfda509d0f368d5640814d
SSDEEP 49152:2uPbSKqkkF6arXNt23KvwME2lSUQpYM+1ecgh/aljZMlAgCgNbqKT2DSOQcvX:2ooPisZMe0cvX
TLSH
T1FB466C03A9A19878C0A5FB3085BA8292F616B84C573837D32D71EE7C2F767D25E35B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minehack.5g-MXsPk.rar.part

Path C:\Users\Admin\Downloads\minehack.5g-MXsPk.rar.part
Size 1.8MB
SHA256 2888745794ad96993b151fc8ba85aa75b1a9cdbce1039b960b9f68be55034252
MD5 9f5854fe48c981e20d7e7b8a952a0238
SHA1 5bc45ed6e6f5628850aaa8e3f18064666ab050a9
SHA512 ee38f1402c85dbc5e2bb6888d4af814649817b913e87dea5500078e89122e63097748af669a78bce329be09a1b0d7c6bf417f33f5664b366611822153944844f
SSDEEP 49152:Q1clWn4ByR72buEW9RR4a7jjjgGjhkPtV2:hi6+jnR4s1jGX2
TLSH
T113953388AC3C9588B54613533C2E7BB39B4EC1C5E6F58CEC9427284180D58EB979EBDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-1233-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/772-1251-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/2220-1320-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1332-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1318-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1321-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1326-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1327-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1328-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1329-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1330-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2220-1331-0x0000028E7E470000-0x0000028E7E471000-memory.dmp

Download

memory/2416-1235-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/3688-1253-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/4544-1200-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1305-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1319-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1333-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1310-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1154-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1155-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1156-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1157-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/4544-1158-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1159-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1160-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1322-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1309-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1173-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1177-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1317-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1201-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1340-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1176-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1179-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1221-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1224-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1229-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1227-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1180-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1195-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1222-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1190-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1202-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/4544-1178-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1181-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1182-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4544-1187-0x0000000710000000-0x00000007101EF000-memory.dmp

Download

memory/4604-1234-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/4664-1216-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/4692-1215-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/4904-1218-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/4996-1220-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5072-1231-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5252-1238-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5264-1236-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5288-1254-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5304-1217-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5576-1237-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5644-1249-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5780-1250-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5848-1232-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/5860-1219-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download

memory/6064-1252-0x00007FFFA3DA0000-0x00007FFFA4333000-memory.dmp

Download