0720b89f6ff8499ab07e698097bd40b5343c2a0f2b757367d98286a1ac655777

Analysis

user interaction
yes
max time kernel
899s
max time network
435s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UnityCrashHandler64.exe
Size 968KB
Sample260808-xbb7lasfrb
SHA256 0720b89f6ff8499ab07e698097bd40b5343c2a0f2b757367d98286a1ac655777
MD5 a9411b8ca44bdd5eae6a290a4b10b386
SHA1 1160d6b5fa94cf32a2d28bae59a825a68b21eb42
SHA512 88a73deef0ec6dc47eec2aeb19394b800d779b78a9ded63572f4306b7a7fd64ae604b4c68ecd65410187d0d698fa7ab9519d263cf1515f6c33d48e1b6209c118
SSDEEP 12288:mb5YI+9IPDsKJDCRyXIZGVpDNW9mh7oSD6mynYCQfz2fzAN:mb+lEsKJMKDNW926mIYjz+zAN
TLSH
T13D256C1A62A800ECE5778179CA56594EE7B27C0503619BEF13A0B6671F33AE51F3F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
289	discord.com
293	discord.com
294	discord.com
300	discord.com

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
104	ipinfo.io
106	ipinfo.io
101	ipinfo.io
103	ipinfo.io

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Pictures"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000004fe594f939e3dc01e3bad6bf42e3dc01f07fdbbf42e3dc0114000000	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0400000001000000030000000200000000000000ffffffff	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\NodeSlot = "2"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Pictures"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 01000000030000000200000000000000ffffffff	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 03000000010000000200000000000000ffffffff	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\4 = 14002e80922b16d365937a46956b92703aca08af0000	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	mspaint.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\lubieptoszki.png:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\jaczup.jpg:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ptakwspodniach.jpg:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ptakwspodniach(1).jpg:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6280	mspaint.exe
6280	mspaint.exe
2272	mspaint.exe
2272	mspaint.exe
5288	mspaint.exe
5288	mspaint.exe
5200	mspaint.exe
5200	mspaint.exe
3840	mspaint.exe
3840	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2788	OpenWith.exe
3840	mspaint.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	firefox.exe
Token: SeDebugPrivilege	1688	firefox.exe
Token: SeDebugPrivilege	1688	firefox.exe
Token: SeDebugPrivilege	1688	firefox.exe
Token: SeDebugPrivilege	1688	firefox.exe
Token: SeDebugPrivilege	1688	firefox.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
6280	mspaint.exe
2788	OpenWith.exe
2272	mspaint.exe
364	OpenWith.exe
5288	mspaint.exe
3872	OpenWith.exe
5200	mspaint.exe
5676	OpenWith.exe
3840	mspaint.exe
3840	mspaint.exe
3840	mspaint.exe
3840	mspaint.exe
3840	mspaint.exe
3840	mspaint.exe
3840	mspaint.exe
3840	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1688	2100	firefox.exe	90
PID 2100 wrote to memory of 1688	2100	firefox.exe	90
PID 1688 wrote to memory of 3860	1688	firefox.exe	91
PID 1688 wrote to memory of 3860	1688	firefox.exe	91
PID 1688 wrote to memory of 3860	1688	firefox.exe	91
PID 1688 wrote to memory of 2572	1688	firefox.exe	92
PID 1688 wrote to memory of 2572	1688	firefox.exe	92
PID 1688 wrote to memory of 2572	1688	firefox.exe	92
PID 1688 wrote to memory of 2572	1688	firefox.exe	92
PID 1688 wrote to memory of 2112	1688	firefox.exe	93
PID 1688 wrote to memory of 2112	1688	firefox.exe	93
PID 1688 wrote to memory of 2112	1688	firefox.exe	93
PID 1688 wrote to memory of 2112	1688	firefox.exe	93
PID 1688 wrote to memory of 3852	1688	firefox.exe	94
PID 1688 wrote to memory of 3852	1688	firefox.exe	94
PID 1688 wrote to memory of 3852	1688	firefox.exe	94
PID 1688 wrote to memory of 4780	1688	firefox.exe	95
PID 1688 wrote to memory of 4780	1688	firefox.exe	95
PID 1688 wrote to memory of 4780	1688	firefox.exe	95
PID 1688 wrote to memory of 4780	1688	firefox.exe	95
PID 1688 wrote to memory of 5432	1688	firefox.exe	96
PID 1688 wrote to memory of 5432	1688	firefox.exe	96
PID 1688 wrote to memory of 5432	1688	firefox.exe	96
PID 1688 wrote to memory of 5432	1688	firefox.exe	96
PID 1688 wrote to memory of 5444	1688	firefox.exe	97
PID 1688 wrote to memory of 5444	1688	firefox.exe	97
PID 1688 wrote to memory of 5444	1688	firefox.exe	97
PID 1688 wrote to memory of 5444	1688	firefox.exe	97
PID 1688 wrote to memory of 5452	1688	firefox.exe	98
PID 1688 wrote to memory of 5452	1688	firefox.exe	98
PID 1688 wrote to memory of 5452	1688	firefox.exe	98
PID 1688 wrote to memory of 5452	1688	firefox.exe	98
PID 1688 wrote to memory of 5492	1688	firefox.exe	99
PID 1688 wrote to memory of 5492	1688	firefox.exe	99
PID 1688 wrote to memory of 5492	1688	firefox.exe	99
PID 1688 wrote to memory of 5492	1688	firefox.exe	99
PID 1688 wrote to memory of 3616	1688	firefox.exe	104
PID 1688 wrote to memory of 3616	1688	firefox.exe	104
PID 1688 wrote to memory of 3616	1688	firefox.exe	104
PID 1688 wrote to memory of 3616	1688	firefox.exe	104
PID 1688 wrote to memory of 5224	1688	firefox.exe	106
PID 1688 wrote to memory of 5224	1688	firefox.exe	106
PID 1688 wrote to memory of 5224	1688	firefox.exe	106
PID 1688 wrote to memory of 5224	1688	firefox.exe	106
PID 1688 wrote to memory of 3308	1688	firefox.exe	109
PID 1688 wrote to memory of 3308	1688	firefox.exe	109
PID 1688 wrote to memory of 3308	1688	firefox.exe	109
PID 1688 wrote to memory of 3308	1688	firefox.exe	109
PID 1688 wrote to memory of 1932	1688	firefox.exe	110
PID 1688 wrote to memory of 1932	1688	firefox.exe	110
PID 1688 wrote to memory of 1932	1688	firefox.exe	110
PID 1688 wrote to memory of 1932	1688	firefox.exe	110
PID 1688 wrote to memory of 1768	1688	firefox.exe	111
PID 1688 wrote to memory of 1768	1688	firefox.exe	111
PID 1688 wrote to memory of 1768	1688	firefox.exe	111
PID 1688 wrote to memory of 1768	1688	firefox.exe	111
PID 1688 wrote to memory of 4684	1688	firefox.exe	112
PID 1688 wrote to memory of 4684	1688	firefox.exe	112
PID 1688 wrote to memory of 4684	1688	firefox.exe	112
PID 1688 wrote to memory of 4684	1688	firefox.exe	112
PID 1688 wrote to memory of 4960	1688	firefox.exe	114
PID 1688 wrote to memory of 4960	1688	firefox.exe	114
PID 1688 wrote to memory of 4960	1688	firefox.exe	114
PID 1688 wrote to memory of 4960	1688	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe"
1⤵
PID:4692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {0126eb80-2aa1-4772-a005-72c9ca8580fa} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27135 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {17cdd554-1ac6-437d-b813-1b871c3daef8} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3524 -prefsLen 27276 -prefMapHandle 3528 -prefMapSize 270279 -jsInitHandle 3532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3540 -initialChannelId {3f3ddc3d-4453-4387-a897-7a6031a41436} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3688 -prefsLen 27276 -prefMapHandle 3692 -prefMapSize 270279 -ipcHandle 3796 -initialChannelId {b4e48935-de8c-4814-8e40-1ac1aa97be8b} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3152 -prefsLen 34775 -prefMapHandle 4292 -prefMapSize 270279 -jsInitHandle 4296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4360 -initialChannelId {d9a2fb93-9dd9-44db-96d8-1b1d64b66047} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5060 -prefsLen 35091 -prefMapHandle 5064 -prefMapSize 270279 -ipcHandle 5072 -initialChannelId {4909c567-fe92-45ab-a217-01e27239fae1} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 32979 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {cd0b59b6-0372-42fd-aad4-fa7f6255c5a6} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32979 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {e22f8e07-b831-4864-9816-6a6a2a4079df} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5772 -prefsLen 33031 -prefMapHandle 5768 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5756 -initialChannelId {383e5533-5796-441b-9547-535990fa6ea4} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6200 -prefsLen 33071 -prefMapHandle 6204 -prefMapSize 270279 -jsInitHandle 6208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6216 -initialChannelId {7dca26d0-119a-48d0-8d76-1c99fa10d953} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3172 -prefsLen 33071 -prefMapHandle 6136 -prefMapSize 270279 -jsInitHandle 6580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4332 -initialChannelId {65815c29-7ee2-4f7f-acc7-a96e36ce6273} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6948 -prefsLen 33071 -prefMapHandle 6776 -prefMapSize 270279 -jsInitHandle 6972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7020 -initialChannelId {4597af82-ee35-445a-ad5a-4e8707711ee3} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5976 -prefsLen 33071 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5660 -initialChannelId {d29b33bc-7231-41ce-a1c2-fad892bf4877} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:1932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 33071 -prefMapHandle 5732 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7096 -initialChannelId {2f80a5aa-81ab-4be0-a29e-4a079297d710} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:1768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 33071 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {44a0856b-3ac5-4ecb-a606-e661610b3ad7} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5624 -prefsLen 35200 -prefMapHandle 5788 -prefMapSize 270279 -ipcHandle 5904 -initialChannelId {8161c05b-7fe0-4971-93a8-4e6271bc3dea} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 utility
    3⤵
    - Checks processor information in registry
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6796 -prefsLen 35864 -prefMapHandle 6836 -prefMapSize 270279 -ipcHandle 7176 -initialChannelId {417f3a35-819f-4c39-aaa5-61bfb7e81ce9} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 utility
    3⤵
    - Checks processor information in registry
    PID:2148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6856 -prefsLen 33986 -prefMapHandle 4852 -prefMapSize 270279 -jsInitHandle 6184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {9a36b2e4-46c5-4e67-aff3-27af55404444} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8880 -prefsLen 35325 -prefMapHandle 8888 -prefMapSize 270279 -jsInitHandle 8892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8900 -initialChannelId {40a41d0f-637a-41f1-98a0-2267138be686} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9116 -prefsLen 35325 -prefMapHandle 9120 -prefMapSize 270279 -jsInitHandle 9124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9132 -initialChannelId {810209b0-2ffa-4ee3-b244-5a119f1a043f} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9272 -prefsLen 35325 -prefMapHandle 9316 -prefMapSize 270279 -jsInitHandle 9324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9332 -initialChannelId {4b9b5caa-5adc-48e3-b83d-b516b69bb5a9} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9780 -prefsLen 35325 -prefMapHandle 9784 -prefMapSize 270279 -jsInitHandle 9788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9796 -initialChannelId {603149ca-227c-4850-afd4-0d3e0a40f7b7} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:5372

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x2f4
1⤵
PID:6076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5844

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\ptakwspodniach(1).jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3272

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2788

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\jaczup.jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2272

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:364

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\lubieptoszki.png" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\ptakwspodniach.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5200

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5676

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09C967C60D313F0BBACDCC9EDF117D56E37DF5FB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\09C967C60D313F0BBACDCC9EDF117D56E37DF5FB
Size 68KB
SHA256 b9a94436ffc037f6e7134101b5f23c5f75c17a2b4f896f7c66c1fdf1ebbb9212
MD5 6d72af7ec84b72a78997ce8932c87eac
SHA1 a243af523c5a8bbb3ef87cba967c253c824994b4
SHA512 ff5e5d4bfd6450d2a289c806c59e5ce066105a616ca8c88b05f44f6df3e6c99a693352f24b6a291b1602ebadf2a5bfb1c46cf554e1edb31450f5c7065beb850e
SSDEEP 1536:85r4DfsZORys7yoFHdzfBwDh7/w8x3mnlTBDHcY1:kr4zskRys7pjyOlTBDd1
TLSH
T12D63F2FFAB4234A56D450E511A4A34151FE4FC2BEB48FA7C020E639B8DD8389D54BA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 ebab38dd8262bd0497c1d8fd363b42f5daeee1bfafa8251b242011a67a102e17
MD5 3e7df3e96cf6df148adf47b589f3a09e
SHA1 3ac8a4be98f20a76d124a5586851a1d6bcc952ba
SHA512 88eac06b2741696f09c3326266a785013e6c400aa5cf102f2dec9d8ccab7dd87784e35bdc60e94ef3f0a1efba36894e38a624c4aac8532e3eb6c4b630ae9601b
SSDEEP 384:HwCe7iO024YMDL84KKDL849B7SOEAd9KVRaAcP+AWRMAi47:QqZYMDL8lKDL8CB7S/AmVAf+hRMh47
TLSH
T1C3729E799F413CAC19A7C0E8C0F982D98D1977A7CFE6806D21683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 0336f8a9eba1b5f5e3e36ecdc6006f4a7e0b65721752e4dad27a8a77fc639c6e
MD5 495d91b1c21acd26646c0b59f418eb20
SHA1 f57632421c0810a47ad3305ba252536ed1e81e68
SHA512 fcc648d9c9e52a73ed38a739aadaae37405aef1564a1f2fde70130eaa52df90df66e2c4742a4d4ecc938307906713346bbff29cb7860a669f4062fd0f0d8a6cb
SSDEEP 384:HXkRyiO024YODL84KKDL849B7SOEAd9KVRaAcP+AWRMAP:3mZYODL8lKDL8CB7S/AmVAf+hRMW
TLSH
T13E728E3D5F003CAC25A7C0E8C5F582AA4D18B7A7DEEA80AD21583D0DC79896DB5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CE6999AC4A8A75F454A511BB2CFC11BEFD0282FE

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\CE6999AC4A8A75F454A511BB2CFC11BEFD0282FE
Size 78KB
SHA256 48a003c4a99d5799908de6d3870205103e66fe0d37774cc8b4c16df49cf27083
MD5 53747f94265fab69d68aa097745c6055
SHA1 5c95edff99136fd2f5bc21ad1d9aa74e5bef1647
SHA512 916624b4ccd19571e7fc06448f2ea08035e024a61ec279a7762027e022471f99ccb2b930516a901a411646767ca1fc2b3d12cb4a5bbafe9a43d6fa035b51ec42
SSDEEP 1536:GBP9GJWx5DSmbUkQoyGWUgwCWTwoKVBDTrI25drHer4Y9OBDHcYL:6zpb0pCgDWTzeBDD5ZH+5OBDdL
TLSH
T12573F2FB36509A252F13D2BF9949B6148D8782EFC88B2D19B39C28B70C41F53D9B7518
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E7BD267F20072D6ACBFB011962A1FBE6E87C6739

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\E7BD267F20072D6ACBFB011962A1FBE6E87C6739
Size 45KB
SHA256 4abf1f310faf78b15a642aa60232da024b86731b4045518d8080cb28e8f49685
MD5 c8bb9f694b799f0c742eed7d7addd6be
SHA1 8776dd806898873ed98f1e450a0fa07325b91a18
SHA512 9066c2e08322e340b2f1faf81a143757d205cc30a4e7d01f0ff6089d3b5f80b7d4b66a90a03f7dd20ef16f9c326b0dceb84586969045cc6c14d14a561d7d02c5
SSDEEP 768:fzelPIzRfDb5wrKTe5P+QSQLV4N5zs3u1FDKlceaZ4ytxmOOnzVKKyvk2TfcSDfi:LcPIztBwrlP+QDB05/1FwNaZptxmhzV3
TLSH
T17E23F137CA9C14E82E632980D90A46148E47FE075F44322D90A40BB5DB92BD8E36B3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 10KB
SHA256 cfaae5a49a68c91ef391fd8c2731c58be0211d6dfe8263b94034fb0d4f303879
MD5 a8ea3d7a7e5907a8a52d2bc062d401a0
SHA1 b4f6cedd9e23d88685236582dfcdc7b8be97c2dc
SHA512 0dca71e31b9ef156fde455787047a36dc468d1f84c213a7e661419619f09cea738783985a016b0b86891f9e79a1ac422a5790f305559f1fff1fc4c35a8da5fdb
SSDEEP 24:YuhMZAsfZh91h49xMo9B4P5q9F55A5pw9FiPd9ldJ9Vvl:6zTymiKRI56p6ovjrBl
TLSH
T1752260E36FB6A472F0A2CFB0545A719C8C330329096895C4C754D0E702D6BEA913EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 26KB
SHA256 890028629ff1671b73c1287989fe539c8b71e1531966bda9170da93c3663f680
MD5 71b4e9cce724ab2671bd6c0e2fb4e918
SHA1 2fa6773af086633f71afd34049b93ed2044cdb6b
SHA512 2342c9457c6116fe8d2d7316c4191507ce2675a427b8142f463784b94b7470d9c0a31be200ebe45d1c42cd00dca2a089e741efb81f8724ff865ade85c3285c02
SSDEEP 96:CveeCShI56xKU/P3B9nM/pMoMiEVoAlJe4OCTY4:CQ1EVo
TLSH
T1C0C27FF757B26072F0B28FB1549A759C8C330229596895C5CB58D4F742C2BA6E03FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 78KB
SHA256 a86f47882ae1b48847be9ec3394e7220562591dad3cb89d26cc7d4871995dcca
MD5 383a7f157f30dade9145362ae2afc7d9
SHA1 bd9b3b396b5c8ec0c559a28cedec887a1c599204
SHA512 9a1720c4649cb536baac910705047de23e7417f5b8e360f59bbac0dbaa6799eafd682dac59ca08d1c8f07a2c8856a34785569c3ef5b311bf08bd3eeedead65de
SSDEEP 1536:rBdE88N/S787e0p/TGJg6GmCi8zgCTV8Ug5NtU0:1db8pC0JpsoRL8O87n
TLSH
T1A6735544EB5A553FD92802BAACE21B103F39F8895A1A2B57371C64343D873DD3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a77511fdf5e731e64f6c1b51eaeb1612cc0a274bcbcf052af579a452ee772b46
MD5 b5e735eab8e8dbe593d75a9205e11970
SHA1 18cd9015bcb81d9165b4ef087316872fb9caef13
SHA512 c6cb99b0a90d9c144f5b92ff032b879c0b1e10d2e9008f13ca942bf6260247aa983d016dee7b28a0bacbac3dad6a01a29c344b821d82924ba70a6af9d881b0d7
SSDEEP 192:ZQcOv5zboPYxLpyjO11n1d66JozGzgCl6mc0dz:QbowNpyjCd66JozGzgC1jd
TLSH
T12EE13F64E629463FC408027BDCA51B414F3A389AAC4E3F2975ED741D2C8B2DD7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 25e0bf757e61c235b173abaa6a85a0178f41d7cae7188f50c0c83144f2bf7b1a
MD5 d6bef1c7588295e230a891f299f1eb02
SHA1 cf7a1333adef21d558e59ad0ce3a4814974c7360
SHA512 4cc0919ccb443536db9aa5b1a958a0d78a313cb91917ad7760acb2dead7a05db5f88338db331e5bf231c14f31e88ad3a7cce6a3231607b57bdbcb0dd8028b084
SSDEEP 192:d1d66JozGzgCl6mc0dkQcOv5zboSZxLpyjO11g:7d66JozGzgC1j/boSZNpyjX
TLSH
T108E12F64EA29463FC408023BDCA61B414F39389A984E3F2975ED741D2C8B6DD7A8E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f4619ed9cf4ac3c47de7f33ade956dfb50e3586046ed49cfc5749fd7085ed362
MD5 3807e04359405c44aa67c0771acd00b0
SHA1 cba2ff0bfa26dbf9b4cd035cd98f0ab2c081f4c9
SHA512 a0b0678670b9f6830c6f3a9249ece600d778e6b8f147715559697979522b5344af74c3ed4ffcf34084dad83ee9fa5cc0ab444dae42be1d41446681e85ce95dc7
TLSH
T10731ED9C34F84D7A998BE7587D8A034D47944A4E8C861E078E02DF8CCDC5BCA332B52C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 5KB
SHA256 0206558854dab314c83f155068d8f7a37ec6c2ed96bcb2a792c222420b310451
MD5 5d66259c905a097dbbeca14ad3a08050
SHA1 cb3aadba8b59d11bfd8e643f075dda5e5b149d5c
SHA512 6b66dfadc5f07086d8a9b1c314c102ca2e17d4f42c5ddd7d40a664355b5cbf32aae7349bedc5e30d266700fb912cef212e1ffc19ce3dc6eeb48d4bb0e60df8ba
SSDEEP 48:YailbvYAQtiwwexi/J9UyCujKIC1iPdGi/42dOBU5uwpLoUt32ve4B7Bdvpdeynh:Qy8HaYPy2ru9e4BtdBdzXvBi182+
TLSH
T1F2B1115D31F90CBE29DBD79DB841078D46E94602C88B1D478DDBEE49CD8AB8A331F528
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bddddc1-0807-43a4-b29b-3aa436fbe7b8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\4bddddc1-0807-43a4-b29b-3aa436fbe7b8
Size 28KB
SHA256 43cdf3152eb10842608e72c0c9001b244cc398371f2ad9ef85d990f25b42c850
MD5 f627f598ced1207af13dc3fcb4a82612
SHA1 b25f60b8e56d1745503d2034a3737635e8bc855a
SHA512 4ad1d196ce4343461aa0ef14d8b76d60251c9aed574812ecb1cd95477b8a010f7957e1d440605d305b1cb00462372463c3564775bf44721737e0636ee62ee6f0
SSDEEP 768:K9y3HqWSbNv9GilcHSMSJK5RCQBWf61aGKyKZDa9bsmPT8l+Vo2NWmMllM6ujWCH:P1v5iJSBu6dQmPE+V8Ol
TLSH
T13ED23FFDDD1300473D25E51EB2EAA96F2017193209CCC7DE6AFD083A2AD69BB5527318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e47517c-e1dc-4be8-a5c4-4ed4aa9100df

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\5e47517c-e1dc-4be8-a5c4-4ed4aa9100df
Size 16KB
SHA256 87c7da539607f9c5096092f5aed9638bd514408c6a3765517d707cabbcebcac5
MD5 e3ec7a05f307cba55d1d6dfc308270b1
SHA1 b959fdd1b7d7104f5d718dc8fcaa1ce1dbddf543
SHA512 e69b0c628fae892fc22825299d54a7c7182e2521bf1eeac2f12db874024966e02bd9229574bfb2f29a1ccda5a0044d584d872e9e16eaaf46672dc349678b081f
SSDEEP 192:XKywuBSIL13suMJX87JgeF8sLDCNTU6y3WW21STcUJgie4ZZd4BTcvt9pzxgZn3l:6ylcIyPsV72sVUB4vtTlgZn3i4cW9n
TLSH
T12F72D806243045BA8251E7A8D4F8BFC3E6F528CB4C419FCA9BE4BD086DDE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64ce2c1e-077e-41c2-8152-09e8e9370776

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\64ce2c1e-077e-41c2-8152-09e8e9370776
Size 886B
SHA256 b631f7b3475727c23b0ba4532f1ff9e1f4cb46e2ac6c0b51f03c7d21d2d2e558
MD5 8b42ae6e9690803fe5ffb0c05deb6a27
SHA1 a7658a555e6ef774b0437d23d632ee67bf754dec
SHA512 8880ba8c925fb8d43e974a50512d997b033191c40a7e827eb7e8e8c4521f5d888509868a015a4aba5c6f843c2a71e294d0feffebed90fcdfa99fd9e328dd652e
TLSH
T129112741567579718D78D28FD4A17743CBF47213C0C60A247DA19E180CEF51E93A770B
MD5 SHA1 SHA512 TLSH

Submit Download

b6140cdd-3146-41c3-8abe-ebfa57f6cd71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\b6140cdd-3146-41c3-8abe-ebfa57f6cd71
Size 883B
SHA256 90a4af048c5ff4b68571a4a8907b7d8541e96b937591805d5d9c0dc16830b7c4
MD5 7f356b0121f284cd2543c730efb7c187
SHA1 1cd5863e55933ea4b07b7db734783da15f22d0c5
SHA512 bf7eb770d83bfe5a4929d918bca8230afc81309560132735c31235712a332ff5e7bb62111e9256854d57f6a54efe49ce4e1ab8fb8b1c9cdf524748159fcd3b78
TLSH
T1B21104419635B9B28C6CD25F856137028BF4761380C545243CF159150CBEA2E936660F
MD5 SHA1 SHA512 TLSH

Submit Download

cdda3e7b-405e-49ae-ac08-2b94ed3301ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\cdda3e7b-405e-49ae-ac08-2b94ed3301ff
Size 235B
SHA256 7ee8639ea4e3a4c7d3a4e8b7454528a865b4785f16009d6e579c8429b2c4fb7d
MD5 7e93a23392d1368a379d405052efd6ba
SHA1 f178a8c42f7c469d211c8ccde4dc42610f6f807f
SHA512 e2400b99f9f75389fe22ad48f112e02d18d1f3a4c314827756d16d81a44667ff0ed8a0915bb2c90ae9857f981963205e17bcfb5d497880477537d776c23a5b57
TLSH
T1EED0978428A82B1E09040F0AB0E068D631C94C332870A82086510938CEFCBCA42A1D2B
MD5 SHA1 SHA512 TLSH

Submit Download

ce67ac9f-cb67-4e08-ba41-7ce153905c12

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\ce67ac9f-cb67-4e08-ba41-7ce153905c12
Size 235B
SHA256 c495ee2597364356de52595eb66e44de220a81350ffd66b3d64e8535e4c2969d
MD5 9d2856d0c4c67772d30df53f5bb3ef5f
SHA1 790c16cb7ccfc3c9d5e338d08f63f320a48aebf1
SHA512 3ea25e61ecceb9af7e6f691d95c2aaf4fa4ab2b676bd3590fc48e3dbe431319f462920ecf389df76a742209fc1404a880508ee7a1302938c33c7cae2de486526
TLSH
T1BCD0979018CC676D4C000F0FF4E069C630888C37146498208ED20634CEFDEC4411282B
MD5 SHA1 SHA512 TLSH

Submit Download

d4ed4da9-ec6b-4206-965c-ef10819186bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\d4ed4da9-ec6b-4206-965c-ef10819186bd
Size 2KB
SHA256 84c250e6d21e155d8c7c0744969ab668b163cfcbbd07997a5dde0f539fb00109
MD5 5ce8b8564e1cfd7fa0dd14b6d3afc173
SHA1 c8a2dd8f7ef8876fbcd50ce8c9ecd3e32e9110d2
SHA512 4e1aaba4d34c8910fd54a574a7ac20b8b77fe4b44f7ea33a3d624d6ce263cdd5895047f1e4a38659318cacb4ace63d0586e298d407313e990e6b10e105a6177b
TLSH
T11C41365C357C4CB78CEAE28DD491378E5764870340C618532D52DE0C8CD769D636E57B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
Size 16KB
SHA256 c4aca9bedd0d170bf242786442be85502f6dce3abe98892ff8d3a48b19357561
MD5 9ae22321bc088c81de407568e9c3b00a
SHA1 1177f66fc319fa7119054324c92f5dee94f7becc
SHA512 f4c8dfe6274dd2422586238ebe539183f20092ff6be74d1cebc274e42191f4042402eb9328b767d08eebc821d7ec4e02ced6303b94fb5501dd6ff5827f4e7287
SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4H884hr:TI4vRf2XZ4D634q4V4c4D4l4R
TLSH
T10C72511545049EB8294EA79BAA367E01C37D433B60845C78F4DD8FC802FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 12KB
SHA256 e77a866999425adbf344cb4ab34793225bb693ed362fc6520dc399c5c6cd6a34
MD5 b24b11eff8402ab54775c31af9683192
SHA1 6956897657730d416fc66752639904698d5bba2d
SHA512 a4163c2077f927e0268f921a74f16a81c77865eef12ad3bbf1f338e4bd553fba47645b51a055dcbce615e5e680bf9e4a89eb28c3b9736fd39aa484a5039f4f49
SSDEEP 192:k+bRNafbH+sSSOLRXlfWfOBw8OVJQZ+HsO:keaERlJwtND
TLSH
T1C742EE7C51808B7F25B6367DBC2949711961036B76BFBCDB02F8C882454CF2541EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 7KB
SHA256 3d29c9f6e0de3d6d663690fe7762c93aa3be364fd1b9d6b6f3ac8312d2aac718
MD5 51c116cf0e309c90c33c7c232a4e3f1e
SHA1 36a678fcd6ef65c765fb201c69f9197917c65ab3
SHA512 13ac37480f9ef8e09f0aff5069a9bb358af11f643406feb74519df82981769368cb0d0018d0dc1c97885a1538c9d24a1ae261df84dd5d5ed428791359c685a0d
SSDEEP 96:xHi+ZTUHqGqgaf0H+NbzSxSSlmdv9jmnuH5lNdHWTBw88n8L4cn3XHAGS:k+bRgaf0H+sSSi5lfWTBw88qO
TLSH
T15DF11D7890488B7F74B676ACBC6888315AB2013BBBBF68D750B59484054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 7KB
SHA256 ace9b742be403f0b1f159bd1c079980f8e5f43f7557f7ee8e46b735667974a8a
MD5 b206fd98bd88dce21c2bb1a09efda8ab
SHA1 da8fdea1b09de472434da8a952ce02cb1e3fda35
SHA512 354cee770f9743d5d62d69c4e61e5cfe028ba12a44702e969e39d17533ecf67bcf508f47472bb7ad932bba0355239006a5f48ad75aaede0f70bb11301ddae9bc
SSDEEP 96:xHi+ZTUHqGqgafbH+NbzSxSSlmdv9jmnuWRx9lNdHWdBw8878L4cn3JHAGS:k+bRgafbH+sSSnRXlfWdBw88YO
TLSH
T1F8F1FC789044CF7F74B67AACBC6888315AB2023BB6BF68D750B59484054CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 16629fcce9018b6415bdd2d8a344293ee0928b076368e2d2a95d1f8402f314e5
MD5 07a14317545351d3d7bb06e1e23e70c8
SHA1 46b809398e92398f3ca6f43ce098c549f048fbaa
SHA512 677bf784fdbb366272ef6d3ca4016bb65b36287b166255dca1e2141ff5d51358fe63dc4081b3e1204f10c4bd42df7da87e84a698c7de1f32edfe28ce91ace415
SSDEEP 96:xHi+UTUHqGqgaf0H+1zSxSSlmdv9jmnuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0H+wSSi5lfWTBw88qO
TLSH
T1A2E11F7890088F7F74B676ACAC6888716AB2013B7BBF68D750B59485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 dbd9a8880372461975aa9183e4544fc59cb1798e11b7a93f1480cb9efb82f7bc
MD5 dcefd89320a4311007e80e04e46a982d
SHA1 e3eb38bb85fda9fedcb30589548f8352bf67e24e
SHA512 2998c1610513e78399757ffaf86c3b94817c46c17bf74e8ab9c0d688078e9b3cc7ad1df6f8ca663dd02bb9db66aab54dcb9a68bdcffe0d3f192a49219dacf531
SSDEEP 96:xHi+UTUHqGqgaf0io1zSxSSlmdv9jrgnuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0iowSSIf5lfWTBw88qO
TLSH
T112E11F7890088F7F74B677ACAC6888715AB2013B77BF68D750B59485015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 7KB
SHA256 de0cee5e2b2d321daa32b934cac0416284f19a32045043381442eb8587bbc35b
MD5 1f9de9e2c93df73d3fe40323c1e18263
SHA1 0827f94b9c87f552bbda69c12de61cf61246cc56
SHA512 d27cadf98066583679f056f9addbecb88111568a32396a9eb0ed91f1aaa52537ada07c7f7d7380ff567c5ce08a89dc0104a63e9efda714845f0ab2853398aa4a
SSDEEP 96:xHi+UTUHqGqgaf0H+NbzSxSSlmdv9jmnuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0H+sSSi5lfWTBw88qO
TLSH
T1AAE12F7891088F7F74B676ACAC6888716AB2013B7BBF68D750B594C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 4542c1ca03a9d40c6795e072be23f32d476b0c8c4d7428e903fa78346eb4cb6e
MD5 545660b668c0054ed8131b58d0007b5b
SHA1 4f48ec03e8b3231380b5d15f4cd8f7f7cbf66c23
SHA512 533146a5cb7770028f7381f8535c1c61861536f777caa747d4d546fd18b2f6e05fe56572383a99c65f177557c8c64739bdbf58dea54817dcd829383ed0309c09
SSDEEP 96:Z2NqtvK/ATCMjbGmZCm5uGjHxaayWzG3DahI7b4uI1m/js2YbDBBOlz:ZBEKjrJuGwaIahIvy1Yjs2okz
TLSH
T1CDB19E92ADCB0FE4E07B53F0C0C605C5B73B64271AA999D45039CC0807A68D9FF7A09E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 f1e4f7595c30ba189bb6e9de3ee7c1f7c0690b8a460b938b42f4e9e74fc31869
MD5 850bcbcadb923d384149a532daa7d5a6
SHA1 b2658628a70f94afe08153ff32d77f0067ce4d5d
SHA512 b9260b3e928a485c9a40642898b8ac5ed6cb4b00662ad94405c66d87f7637460e3174dc894420fb6d7eb8d7a359029dfc49fee28f0783bc7ae6f2a30b8379554
SSDEEP 192:QZi9Uv3+4LOxJUyQ30gU7Z2WSXAh+PknS7pITwd2HuZMK:sie+4gUcLZoX4+PIYIMd2HdK
TLSH
T18DF18DCBE469BB7D91A4B0859C9ABF0153C865A7C2F02EA4DF5424365AB0A9C137C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 e33f53d68705f70ffb486eee316437b28696f14ff4b8f23025f4ea886b3b609e
MD5 6773d7f8d98a708c2c1d99c564a64dbb
SHA1 fff91e831fd5f398a36f787e11645a2ff9e6dc80
SHA512 862f24cc013c9e3067e3aef4e34ea81a1fd692900bc32fe31faed76f94fd27133e4c6012a3991d339f4b2f85ae504caa08124a7d4d42f94d28ff8ecaaea08682
SSDEEP 192:+Zi9Uv3+4LOx6Lj0GQv0gU7Z2WSXAh+PknS7pBwdf1WA:qie+4njNLZoX4+PIYudf1WA
TLSH
T15E029DDAF168BF798198B0829CCE6F009388655BC6F05FA0CA94303656B0B5C537D62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 a736a502e2a5169106e3e321b5887398f14f4c1c9cb1c130023ec88bf240f592
MD5 c14d161e8dd48365a2a672de7c758f09
SHA1 8bb0bc6a131ee85f4c18446f38179c16c64f3df0
SHA512 53ce46b9c459bf7618a73cd933fdf8b26c91a3fdea627daafda7092256126d4f6e4d08a2eb3b90daa09b9b5f5f4ad141417f4e0775a2b3a09687ec69515b4fd6
SSDEEP 192:lq9HA91PBrPCQ90gU7Z2WSXAh+PknS7p4wdwTWmQtPmpYOaSvwxQtOER3jhUl:lqm91PFqLZoX4+PIYrdwyPatvkQtOERE
TLSH
T14232AE9FE229575CC4A9B1855C85FB00D3D83967D2F07BA8CA9430198AB1AAC437C37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 10KB
SHA256 96d8a274ac7a89026d455338c1551e67c7e61970f7b01b418cbc93e0e282245f
MD5 f889736374b9d463e1b652591ed43032
SHA1 7727a930597dd591081d415e7e302e08a087c332
SHA512 27517a161be12c9b1c3322ffa510ee18d8bd69f318b99a1ad8eed5a16865215f80a20695d3520435a495a7eb8bcd6e6c299df38b6439e32872f73e70d8682fe4
SSDEEP 192:SZi9Uv3+4LOx6LjtOGPXqVpQ90gU7Z2WSXAh+PknS7pywdH//sMA:uie+4njtDP4RLZoX4+PIYxdf/2
TLSH
T131229E9BE9386A7E95A4708A4C85EB00D3C4346BC5F17F68CA64343A9961ADC036D3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 1559880e3ee72a4bfe2d9bbd9dfe431d99e0870a97b05feaf4414df6b052d405
MD5 72ecbfb2a4c19411a053c7ac88b335ae
SHA1 8ee57480114635f1f21f7852fe0be26f89fc826c
SHA512 0341f61945d5dc56bd64b2d75a71850f1f9d7e440f91df34232aebb9e9466207e4c6115842ee06b925e180d3a3020e92b87d32f4e9902fd5cda956c276b4cb27
SSDEEP 49152:BiwbkMngv6R+JhJY/ABD8Q9hJCHkda1R6UTX:0wbkMngiYD8Q9hoHkd8v
TLSH
T1B11639F824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3KoY363d.jpg.part

Path C:\Users\Admin\Downloads\3KoY363d.jpg.part
Size 63KB
SHA256 25539eb30a24e86165f9611f8c658617a3ab337e6c683ac788d14e7172152ef1
MD5 7625ec198fa4f96f2eb3f48a9792ca98
SHA1 e1b255e4029ecdca97489d39102113fe6fcd6cf1
SHA512 598dfeccd4293990061cdc6117e96ac5d133ad60766fa81431341caa255ef3ac620bc32b7579e9a67eecf78d92d04b11015b3f37aedd1f540a246d066279ff44
SSDEEP 1536:ZQdX/A7u78+wbFOliAYmAWmmKPpI0PK6dc4f:ZQdX4SO8gAYmAHlPKYc4f
TLSH
T1E853025811135693D7C895F0486E6B590A0B39EDB3AAC77AD11939EC13B8C927CF80F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aLXPDtsF.png.part

Path C:\Users\Admin\Downloads\aLXPDtsF.png.part
Size 22KB
SHA256 2b9fe468dc52059f3a207414600eeb8d787423d5ea5d45bc5442a8c0158bd4e3
MD5 064e97d007644379c202d10e85aa7b61
SHA1 67de184fe063c2ab06ca40f5704620229cf94e76
SHA512 2270990af3b489dc3928823289a62cdb0dceaffa0e550505dafcb749966302120896832cc722a5a138c675f4cf142ea97ea43e49f4807f0a9e2c9e16082376d2
SSDEEP 384:7gqYvfUrUm/cRqvFKaXnq9CdXa0zXOB+100Fmh3HcT3jFfVrqHeDjGq/1bbbR3yd:7g+UCci3qqTXKe00FmpHcTbrypgb92mc
TLSH
T114A2D14564BDF163DC4FCC1E3CBFA3927A9BCA2CC8A098518B418D0067C59B1BD27316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kXXJlAEq.jpg.part

Path C:\Users\Admin\Downloads\kXXJlAEq.jpg.part
Size 46KB
SHA256 1480e09300dde94453bbf45950edbd2bcee237629c59c4930ae3dffa675ca75b
MD5 9987455160273726f5894678429d5abe
SHA1 5291675ba62eb06953ea2543d139eb8d8ba1dd4f
SHA512 75086a0cd7c6768c1a004871ce73e2da80a4b8b55134a881729b81067610e5fc61b5db5d9f4c1840a55f7fa74a782a8d3e33df10cb37c3d50eb6d6a560e1ae1d
SSDEEP 768:/yJ5hj4MA0IAdPvTlCX3QF58j+Tnupwusb+Yq47rhRsuD4SUtJNpe1qkw62fPW90:/yXN4M7dPvqQr8jIupw9bVq47rUSUtJz
TLSH
T1B92302ED296162B0F4ECAD04FF030E4A31EF8F26265B6203D0E81E29E5263E9375574D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSS.chk

Path C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk
Size 8KB
SHA256 c7b1454f0bb393344fa79749edbb1f2f5ce729bb76f18f472cdde44018f57c23
MD5 b9224650eec5d86c1a04a2d7fb45ccb3
SHA1 c318368ec1227f8c6bf62594a1d7bf00e3d7315b
SHA512 39194aa11b4eeea2d92c5a4378a2f6d238d29cc13216ec6e86d69e8aeac2705bf405b6c7827cc38fb1d5609b4527a590acb716cf577edbb8e419e5c49d189961
SSDEEP 12:aE78g6Ph6CX6Ph6CwVlBseE78g6Ph6CX6Ph6CwVlBs:aEYg8h6Q8h6p1EYg8h6Q8h6p
TLSH
T10EF1A003931505B2C82E8C3E688B67104B3AFA4632C88352008950ADFEC622A3FB1CF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3272-1880-0x000002583B360000-0x000002583B370000-memory.dmp

Download

memory/3272-1876-0x000002583B160000-0x000002583B170000-memory.dmp

Download

memory/3272-1887-0x000002584B480000-0x000002584B481000-memory.dmp

Download

memory/3272-1889-0x000002584B500000-0x000002584B501000-memory.dmp

Download

memory/3272-1893-0x000002584B590000-0x000002584B591000-memory.dmp

Download

memory/3272-1892-0x000002584B590000-0x000002584B591000-memory.dmp

Download

memory/3272-1891-0x000002584B500000-0x000002584B501000-memory.dmp

Download

memory/3272-1894-0x000002584B5A0000-0x000002584B5A1000-memory.dmp

Download

memory/3272-1895-0x000002584B5A0000-0x000002584B5A1000-memory.dmp

Download

memory/3272-1903-0x000002584B600000-0x000002584B601000-memory.dmp

Download

memory/3272-1908-0x000002584B5F0000-0x000002584B5F1000-memory.dmp

Download