428f5531b56e4568f266d9481ad716582344218ceb1cafe6042ce5da4c51b6b4

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/08/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdm (3).exe
Size 6.6MB
Sample260814-2fk3hsshng
SHA256 428f5531b56e4568f266d9481ad716582344218ceb1cafe6042ce5da4c51b6b4
MD5 cef337a666342ccde0f864fdec6203ef
SHA1 3971e83b7156ec549fc4fe67dd5b57669a629faa
SHA512 028954772448e92899144cea2ca63a464a8a6cc4464329c78657f7c8a3e019d038d988fce428c87e2ca94658dd5d1d01a9bf81012be1f58051fe6bf2ab8d5d4e
SSDEEP 196608:0T92TlYbckURXNYKzogqQtAwKLD2BxaQF1uujtx:0sTKckqYKMghyLq/BFUuj
TLSH
T1D466123FF28B613EE46A1A3539B2A210593B7A6165178C4296FCF44CCF691B01D3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4820	cdm (3).tmp

Loads dropped DLL 1 IoCs

pid	Process
4820	cdm (3).tmp

Checks for any installed AV software in registry 1 TTPs 9 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	cdm (3).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	cdm (3).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	cdm (3).tmp
Key opened	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\AVAST Software\Avast	cdm (3).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	cdm (3).tmp
Key opened	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Avast Software\Avast	cdm (3).tmp
Key opened	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\AVG\AV\Dir	cdm (3).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	cdm (3).tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	cdm (3).tmp

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
117	discord.com
118	discord.com
119	discord.com
120	discord.com
121	discord.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdm (3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdm (3).tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3616-0-0x0000000000F30000-0x0000000001019000-memory.dmp	innosetup
behavioral1/memory/3616-12-0x0000000000F30000-0x0000000001019000-memory.dmp	innosetup
behavioral1/memory/3616-7065-0x0000000000F30000-0x0000000001019000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	cdm (3).tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cdm (3).tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings	firefox.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\media_images_ptoszek.jpg:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\media_images_ptok.jpg:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\media_images_zlyptok.jpeg:Zone.Identifier	firefox.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4820	cdm (3).tmp
4820	cdm (3).tmp
4820	cdm (3).tmp
4820	cdm (3).tmp
4820	cdm (3).tmp
4820	cdm (3).tmp
4820	cdm (3).tmp
4820	cdm (3).tmp

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	firefox.exe
Token: SeDebugPrivilege	6124	firefox.exe
Token: SeDebugPrivilege	6124	firefox.exe
Token: SeDebugPrivilege	6124	firefox.exe
Token: SeDebugPrivilege	6124	firefox.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe
6124	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6124	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 4820	3616	cdm (3).exe	82
PID 1364 wrote to memory of 6124	1364	firefox.exe	89
PID 1364 wrote to memory of 6124	1364	firefox.exe	89
PID 6124 wrote to memory of 4444	6124	firefox.exe	90
PID 6124 wrote to memory of 4444	6124	firefox.exe	90
PID 6124 wrote to memory of 4444	6124	firefox.exe	90
PID 6124 wrote to memory of 5508	6124	firefox.exe	91
PID 6124 wrote to memory of 5508	6124	firefox.exe	91
PID 6124 wrote to memory of 5508	6124	firefox.exe	91
PID 6124 wrote to memory of 5508	6124	firefox.exe	91
PID 6124 wrote to memory of 1916	6124	firefox.exe	92
PID 6124 wrote to memory of 1916	6124	firefox.exe	92
PID 6124 wrote to memory of 1916	6124	firefox.exe	92
PID 6124 wrote to memory of 1916	6124	firefox.exe	92
PID 6124 wrote to memory of 4408	6124	firefox.exe	93
PID 6124 wrote to memory of 4408	6124	firefox.exe	93
PID 6124 wrote to memory of 4408	6124	firefox.exe	93
PID 6124 wrote to memory of 3108	6124	firefox.exe	94
PID 6124 wrote to memory of 3108	6124	firefox.exe	94
PID 6124 wrote to memory of 3108	6124	firefox.exe	94
PID 6124 wrote to memory of 3108	6124	firefox.exe	94
PID 6124 wrote to memory of 696	6124	firefox.exe	95
PID 6124 wrote to memory of 696	6124	firefox.exe	95
PID 6124 wrote to memory of 696	6124	firefox.exe	95
PID 6124 wrote to memory of 696	6124	firefox.exe	95
PID 6124 wrote to memory of 1640	6124	firefox.exe	96
PID 6124 wrote to memory of 1640	6124	firefox.exe	96
PID 6124 wrote to memory of 1640	6124	firefox.exe	96
PID 6124 wrote to memory of 1640	6124	firefox.exe	96
PID 6124 wrote to memory of 5812	6124	firefox.exe	97
PID 6124 wrote to memory of 5812	6124	firefox.exe	97
PID 6124 wrote to memory of 5812	6124	firefox.exe	97
PID 6124 wrote to memory of 5812	6124	firefox.exe	97
PID 6124 wrote to memory of 648	6124	firefox.exe	98
PID 6124 wrote to memory of 648	6124	firefox.exe	98
PID 6124 wrote to memory of 648	6124	firefox.exe	98
PID 6124 wrote to memory of 648	6124	firefox.exe	98
PID 6124 wrote to memory of 3856	6124	firefox.exe	99
PID 6124 wrote to memory of 3856	6124	firefox.exe	99
PID 6124 wrote to memory of 3856	6124	firefox.exe	99
PID 6124 wrote to memory of 3856	6124	firefox.exe	99
PID 6124 wrote to memory of 2176	6124	firefox.exe	100
PID 6124 wrote to memory of 2176	6124	firefox.exe	100
PID 6124 wrote to memory of 2176	6124	firefox.exe	100
PID 6124 wrote to memory of 2176	6124	firefox.exe	100
PID 6124 wrote to memory of 5352	6124	firefox.exe	102
PID 6124 wrote to memory of 5352	6124	firefox.exe	102
PID 6124 wrote to memory of 5352	6124	firefox.exe	102
PID 6124 wrote to memory of 5352	6124	firefox.exe	102
PID 6124 wrote to memory of 4040	6124	firefox.exe	103
PID 6124 wrote to memory of 4040	6124	firefox.exe	103
PID 6124 wrote to memory of 4040	6124	firefox.exe	103
PID 6124 wrote to memory of 4040	6124	firefox.exe	103
PID 6124 wrote to memory of 6180	6124	firefox.exe	104
PID 6124 wrote to memory of 6180	6124	firefox.exe	104
PID 6124 wrote to memory of 6180	6124	firefox.exe	104
PID 6124 wrote to memory of 6180	6124	firefox.exe	104
PID 6124 wrote to memory of 10064	6124	firefox.exe	105
PID 6124 wrote to memory of 10064	6124	firefox.exe	105
PID 6124 wrote to memory of 10064	6124	firefox.exe	105
PID 6124 wrote to memory of 10064	6124	firefox.exe	105
PID 6124 wrote to memory of 6784	6124	firefox.exe	109
PID 6124 wrote to memory of 6784	6124	firefox.exe	109
PID 6124 wrote to memory of 6784	6124	firefox.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cdm (3).exe
"C:\Users\Admin\AppData\Local\Temp\cdm (3).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Users\Admin\AppData\Local\Temp\is-JMSH4LRA6R.tmp\cdm (3).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JMSH4LRA6R.tmp\cdm (3).tmp" /SL5="$70184,5592098,893952,C:\Users\Admin\AppData\Local\Temp\cdm (3).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {2d6e0182-d46e-459e-bf19-715ac3500355} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27136 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {95e19026-db15-4166-a2b2-efe7e52b59a3} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3716 -prefsLen 27277 -prefMapHandle 3720 -prefMapSize 270279 -jsInitHandle 3724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3732 -initialChannelId {7986866b-96e9-43bf-8450-32766efea908} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3884 -prefsLen 27277 -prefMapHandle 3888 -prefMapSize 270279 -ipcHandle 3972 -initialChannelId {ca1805f7-36c2-4e96-b487-05a1665cba9a} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4428 -prefsLen 34776 -prefMapHandle 4432 -prefMapSize 270279 -jsInitHandle 4436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4444 -initialChannelId {76cf325c-ce21-4022-9864-625726893e2f} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4968 -prefsLen 35013 -prefMapHandle 4944 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {ff1a0f10-747c-4d27-a06e-c75eaf2f891a} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32900 -prefMapHandle 5128 -prefMapSize 270279 -jsInitHandle 5132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {f57b6c31-d5d4-4364-afee-ba1e0d293254} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5236 -prefsLen 32900 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {44c748f9-93ea-4e2d-812e-862cad80ab59} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596 -prefsLen 32952 -prefMapHandle 5600 -prefMapSize 270279 -jsInitHandle 5604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {03bf2f44-0180-4813-935d-fa2ae680c4c0} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6392 -prefsLen 37147 -prefMapHandle 8132 -prefMapSize 270279 -jsInitHandle 6512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6584 -initialChannelId {7b85e198-96f3-4399-8719-5dd4859207da} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 7228 -prefsLen 40365 -prefMapHandle 7648 -prefMapSize 270279 -ipcHandle 8056 -initialChannelId {8322619f-a9a4-4156-ae18-947f3b4fed26} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:2176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10808 -prefsLen 37147 -prefMapHandle 10812 -prefMapSize 270279 -jsInitHandle 10816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10824 -initialChannelId {709229b9-bf57-47b6-a089-41799fab0294} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:5352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11520 -prefsLen 37147 -prefMapHandle 11524 -prefMapSize 270279 -jsInitHandle 11528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11536 -initialChannelId {57b462e7-e32a-4289-80de-eb0fa0d7f217} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10960 -prefsLen 37147 -prefMapHandle 10964 -prefMapSize 270279 -jsInitHandle 10816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10800 -initialChannelId {2773eed8-39f8-49ec-be2b-6d6c2f2027d8} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:6180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15180 -prefsLen 37147 -prefMapHandle 15184 -prefMapSize 270279 -jsInitHandle 15188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15196 -initialChannelId {ab9b6203-c7da-4c47-ae04-c626827d6c2d} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:10064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 29144 -prefsLen 37147 -prefMapHandle 29148 -prefMapSize 270279 -jsInitHandle 29152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 29160 -initialChannelId {d3099a1e-253c-48bb-9cd3-a07a42588a8c} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 29176 -prefsLen 37147 -prefMapHandle 29180 -prefMapSize 270279 -jsInitHandle 29184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 29192 -initialChannelId {b24c1880-ffbd-4e12-92ad-0197949182cd} -parentPid 6124 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6124" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:9660

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d0 0x2d0
1⤵
PID:6760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16loo4mf.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 0ae91322c9e563f7e73d524bfe6733e4433fdc049daf15242d939d7f43048acc
MD5 5c573a15898d0d88fae701e2b15433a9
SHA1 a805b9e32666aa483967990f63411105131a58db
SHA512 aa5a2bb73494fdbd00f62effcb30b712b015af0485cae8c6589c6f78352f755d6188a4c11d41ec88e43862e64e170e640bb4463da5bfd672239dfdd41c6365b3
SSDEEP 384:HXkRyiO024YkDL84KKDL849B7SOEAd9KVRaAcP+AWRMAG:3mZYkDL8lKDL8CB7S/AmVAf+hRMP
TLSH
T10C727E3D5F003CAC15A7C0FCC5A982AA8D18B7A7DEE6C0AD21183D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d0c80cd-56c5-4cc0-8e51-157136a0e378.zip

Path C:\Users\Admin\AppData\Local\Temp\2d0c80cd-56c5-4cc0-8e51-157136a0e378.zip
Size 3.8MB
SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
MD5 95ba08187ddb4e27dd69430be0320e72
SHA1 ac31024971fe7cfb8b0f78f5fd711b67121875cb
SHA512 c4db61248a74a17417310c47b4c11d11b3299de2a3180541429dfc2d42a9adb4174381c54a321bec3a59dfc37ab6e2429c635f61b1ffc402833285d435d9d0cd
SSDEEP 49152:YRbffsMDFFzwF7YyPeit5NFn1ZG6joqDtaSi+Fk7mJe8K12MxH3+qcxDoegA3oE6:6bf2YXc/1ZLAAFk7Ge8sxVEh3oEVg
TLSH
T13606F135D65C1609CDFF83BA8D0D2FC2B84C4FAE8054B96B6A6A99715CE31E21F44B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdm (3).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JMSH4LRA6R.tmp\cdm (3).tmp
Size 4.2MB
SHA256 07eea42af4d565d09ce6c8723211e96a835400060dc90e53a6bac21b2fd3da42
MD5 af498a69fb53fc1ad081c0c884e4822a
SHA1 b35902fd0a6b1acb19bfb3002f4c0c44a44bdbaa
SHA512 7523307016fd0b58208cf4bb3aba539866bf59d3f154a95084384ad78512fd76380187ad1fbe1ca86043fe0e7384c858174417e2e5d90c57e11921b5e36b7de5
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333PZ:7xuHjWfZIzeZ
TLSH
T177268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\is-O17B8ODW5B.tmp\logo.png
Size 248KB
SHA256 8c5c80bbc6b0fdb367eab1253517d8b156c85545a2d37d1ee4b78f3041d9b5db
MD5 9cc8a637a7de5c9c101a3047c7fbbb33
SHA1 5e7b92e7ed3ca15d31a48ebe0297539368fff15c
SHA512 cf60556817dba2d7a39b72018f619b0dbea36fb227526943046b67d1ae501a96c838d6d5e3da64618592ac1e2fa14d4440baa91618aa66256f99ea2100a427b4
SSDEEP 3072:d9rAhuSnngAZK0u2vGWTbQ8VreGWVQx1RiiHs0dfo5yk5BRFOYfKa5ubF3/hlKHV:U/HJGWPQ2wV01RPQ5FoBJc+uHtjdhd3
TLSH
T13444122A9260C885D35201230725B4787F78264B7A1CACE6F5F77C1B4A0A67E2D86FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zbShieldUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\is-O17B8ODW5B.tmp\zbShieldUtils.dll
Size 2.0MB
SHA256 976d070339c1ecd80d0d2ded8f2c3fd1c6ec03f408053470f696066c2bb2b738
MD5 ea1aa2927ea58dfb8f57ae5f7dae0c74
SHA1 f1c1eca6070f82cd7c7918eeda144a207a53bb09
SHA512 20b10a4289bfaea9fe25bdeee636a07303799a78f0a732b65a182728bca9f48cf9802f32c833315e7d71a4816fcb9b7b09370c62867421824d554a87b6ea1559
SSDEEP 49152:y4yxp/wFOn9xRo3HVCEi2ynjsPAXkp4K0x8BFuchAFotKLIk:yJTwo93o3UEi2ynjs4Up4KI8BFucOE
TLSH
T103959E613556446FF21B12355A38B729F2BEA3700BF547C73ED4AA1C39334428E266AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\AlternateServices.bin
Size 20KB
SHA256 92f9bda9e1756d2e72993f0b9bbee85508f56795bfdddd34ae4d7f94bebe2b49
MD5 acfd4029820cd73c056d4539df23d620
SHA1 c87a43b2f30989ee8678ebbe30af60034fd6cfd5
SHA512 ef48ef536083c503e57e61f4aed458764d80a1d88597d00a39382dee74e709c1896fad3ff4d6babb7ca4622f913647f243f7369209141b40572dc0b2ac343be7
SSDEEP 48:J4mGHGbGFHn1iFvJ+fAd40TMTOTV6cFY0:J4mGHGbGFHn4vJgc6
TLSH
T1129273E75372A2B2F0FA5FB040AC769D8C33160A1B65D9548B28D4A601D67E5F03FB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\AlternateServices.bin
Size 27KB
SHA256 20b99264f68ff3f8827264c93bb9af12bc26a9bf63d209998d912a2851840658
MD5 5d2180887c82473edace8bc66a61e7b5
SHA1 d60443c77b7e9fc0bcbed9bfa6bfcdaffa465099
SHA512 3004657ba61e4d641027fd37f382d05d982d0f57a6fc07c6a85b9136594d43fa0ed8f7de6f0112800dc97563a92d97a777409a3199142522af9932ef3997bef2
SSDEEP 48:+4nGHGbGFHn1iFvJ+fAd40TMTOTV6cFY0euI68KiCI:+4nGHGbGFHn4vJgc60I
TLSH
T12EC296E753B662B2F0FA5FB040AC768D8C33160A5B65D9548F28D49601D67E1F03FB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\AlternateServices.bin
Size 27KB
SHA256 b3508a6b9c1cb81b6b84ab2b7945345a3b4975a5152ce4a6ca954b0620054677
MD5 79c8d5281e186c6483199f881093f555
SHA1 68468c5163eb1dd50b4eef3c85a23c11af55c6ec
SHA512 2b39305658c484faaa15246fe15ae69af8dfe228754345d835c3b7362a7720d46a4129891a64e3d32c2e5b54d5c94c17d8cf1995d8a99dcc3944e3e7fe320218
SSDEEP 48:+48tGHGbGUH1vJEd40TMTOTV6cFY0euI68KiCI:+48GHGbGUH1vJg60I
TLSH
T139C2A5E753B262B2F0FA5FB040ACB68D8C63160A5B55D9448F28C49605DA7E1F03FF98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 e9f5b39c9474600e2b96e8a8193eb6dc700031a10af9b2c16a13dc5478138246
MD5 7389812d39f020939e78c08440b4584b
SHA1 5e4214a9681a04bb97785af1b057d345686eb3ef
SHA512 f50b2997b04ee10f4eb7c00f55d2d2f550843461ebdf41da275458317f144a5086b567de8b96214dddd1e686e028f7c465fe857fae4d968056081fd8e997b400
SSDEEP 384:dmCiDlY+FOJBoGcmhuRjkxKDw5FjbsbXD3boQ8lyjwd66Joz1zgC1jd:dmveWGcmhulGKDw5FjbsbzLW4P/
TLSH
T171C21084FB2A913FD41552BBDCA607001F79B88A580D2F573A8D64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 11f5e1e457f0eec5613d8ffde60e3dd985fda9d17f923152eff357a7291d1c8f
MD5 c521e1f9b6978432230ee124409a2b3f
SHA1 e2328d4bbe7774982a7d064f926a3837baa13909
SHA512 3e839c9ad9f6e425c3f1bb4be99b083625444bb56cea58b19f8d6667e2cbaea0eb9dc77177d88d495db4c0f6ff1c02f545a197ee12e52c372fc9936f7ccd3bb8
SSDEEP 192:h1d66Joz1zgCl6mc0dxOv5zboBZ8lyjSx:fd66Joz1zgC1jEboBZ8lyj
TLSH
T1CAD1CB28EA29963BC815423BCCA61B500F35389A984E7F1536DC245C2D973DE7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3730df982bc13815ba79947944763b74898914799c35befdcdc20bc67a3cb86e
MD5 e871cedf9ca417b7a370c5dcfe4655a7
SHA1 b96333cc411016afe1ac43576dd39c6618ebbf79
SHA512 d220321bf5b0f9ee2bc131df15fba3544fd59ee562441edc066dc4de44baa6cec27576c1efb1d0f53ad7ebb652b2c415f6fdbf546500ababa0b25be7b2c50729
TLSH
T1E7217C4C39F94D7AADC7F35C7444038E53158A4B05871D438E02EE8DCEE5ADB326A8B8
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\events\events
Size 5KB
SHA256 ee2f37a3714a42154a3bd65740b1d4f889aaf800b961c63c11a26f0ff84222f7
MD5 b51a2a7bdc7323a24c7f817ac69c6638
SHA1 963bc3912d7cca8f633fbb90b367f036727f566b
SHA512 2d7784bb1587ea4c77307351e24679336f4ee4a3995e6442bb334d3196fce1cae411546ed0f6d36403f840919baf49942afc69b1fc56b4662cf2394897533725
SSDEEP 48:Y/blaYAAGpTSU4sw4FNwB83eCp739tnqZ3aJayrXcRHzXueV/F/i/yN44XnsI+0K:/OIPZoQ4RHrB9yUstnsobiVpkfnPv
TLSH
T1EFB10D1D76AA4CBF6EC7F3ACF845078D5389464344822E834DC2DE4CCDA669A325F16D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2978691b-e705-4b95-9b98-390d3e2c0743

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\2978691b-e705-4b95-9b98-390d3e2c0743
Size 235B
SHA256 2365b31caa142e646be91d548218e26f504d198d5e2eaeae49c5de6bccde655b
MD5 d3f43990abe874892bc9ba7764b79891
SHA1 60e9633e3362fa84c867157022662b4d9f80040d
SHA512 8cf1c088c950b5d1c716a5daade48932a2bc265f9b9a8b46dec48b32ad68f52a63c07b389b657f8d48371832f221a3842906a9caa6bf927c190ea49704fe76e4
TLSH
T1CDD097C01498372C48000F17F0E028CA308A4C3324B9AC50D65180B4AABDDC4C252C16
MD5 SHA1 SHA512 TLSH

Submit Download

3d600cf8-ab39-4d8f-9f60-78ac1fd17314

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\3d600cf8-ab39-4d8f-9f60-78ac1fd17314
Size 2KB
SHA256 10fa92077897a6b85bc8f98e9d63b77f7f1b595fe97256236d9f267460b617cb
MD5 b0eb9aed93761b3a150482c3fb28d4e4
SHA1 1f012e23575a4a82e2e9855a00e394121846cbe4
SHA512 e1ea6641d864cf3eeab086237804aca442d2e9c6e0f69a4e7bac787cb7739e039a62525448d00e21d30cea8468a1350d3d025968a54e28f77e2506e7ce550740
TLSH
T1EA41236C79784D779D9BE19DD842338E57604A1310C228832E52EE0C8C9A75E33AA53B
MD5 SHA1 SHA512 TLSH

Submit Download

4eec4b89-2268-45f6-a3b9-9c7b7fa62649

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\4eec4b89-2268-45f6-a3b9-9c7b7fa62649
Size 886B
SHA256 f0a31a739709ab9b36bc664fd82af12a8065ef55cfacdae82c70693254509f06
MD5 5486fe58128e10ed0a0e1813f02343ba
SHA1 820be46a057abcfe01a8cf95668977d9cd6afd2e
SHA512 b1562db73910d87a4b7216693f355db505f9622b1c92cafffc3d5451b885a46d94d7748758316a8e403350b68a8448d3245a1c919f0f94c6f80b527f389ae15c
TLSH
T11C1104909A75B573CC78E2ABC5A5774287F4703380C68D043F951B184EEA21D57D630B
MD5 SHA1 SHA512 TLSH

Submit Download

74ddc5e2-ea01-4a74-89a5-202963a131b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\74ddc5e2-ea01-4a74-89a5-202963a131b0
Size 235B
SHA256 d4ed63eb2a45136d190bba09e5e1f9bdb8c8e10b0210232a595eece963266daf
MD5 534d508740091f75cfa89d6b119d3532
SHA1 79b57bcfa9beda8b523990682ef55cb85eaf57e2
SHA512 644225112478f8c801f4ce98382a0d54c86aab45a34adf68f7ed2d605395a58849e8c30937078c722473a373b3f8004e73bea8394688ff440f58245b3eefad08
TLSH
T1A5D0978014A8ABAD0C254F0BB0A069C670854C3B286158109A50403489BADC6013282E
MD5 SHA1 SHA512 TLSH

Submit Download

8e6ba85a-c9d5-44e3-9c80-d6011756c5e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\8e6ba85a-c9d5-44e3-9c80-d6011756c5e9
Size 883B
SHA256 d8fd7b25e6308ddbd6213be14818e1ac318be7d7fa0db81d2ce8826505254a83
MD5 a1beaf7f535709358802f38e8f193597
SHA1 042a806263b892440c3a734319e53aa3e57d13ca
SHA512 404f8b582dd08de293ea4b11c496ed096a44fb6dca1c557ba3d644b5545ae4bdc19f061ff3230b9128f5f3944e3896eb803dc776f25d9790f3beb3dce7fd9471
TLSH
T1E01123409735B573CC78D25FC56677528BF8352384C694043FA11E180EBB22E97EA30B
MD5 SHA1 SHA512 TLSH

Submit Download

df78a30f-c043-417f-bf7b-aaeb277d2d12

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\datareporting\glean\pending_pings\df78a30f-c043-417f-bf7b-aaeb277d2d12
Size 16KB
SHA256 7a57764df3fd83bffe91eeff03cd6b2354f7c8746b5632437d3f7b633df7f416
MD5 e0d35178a15b1be8065800a58b3f624c
SHA1 6afb981628673d2e9ccd6641aeb646245e4069d2
SHA512 91ee225ec8f43a3afdebd3ba83c16205bbde045d3c6f9a70742691629612d9c54374807891d1941b0afd69f88764807b330d52b1d31bf0f1ba8ecf497aa9d08a
SSDEEP 192:7Um6L26NBdsPEafuBQ5ywNN1ubtiHTjuwFUDkGrB4vf1HFKhBvHub3jbMvY8cHug:Ima26ThB65y3STjB6cqVfxiQivvR++dR
TLSH
T1EA72EA166860457A8291E7A994FCBFC3E2F528CF4C019FCADBE47D086DDE05E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\extensions.json
Size 16KB
SHA256 670ce01364aee61fbf66f3bd0c8f178681851bbf10cf33ebbefd4eaf36d411e5
MD5 9c92a31678646060f08656eba5ddae85
SHA1 351d0390838b4939bb79a0c255af65a540c0146f
SHA512 00ce978c2488a31bbaf52a75ee9fc17a95545fa5eaac89dea76f9aff4a17cf267b80a8abc244b05580ee88a6aef0548ba4455f05147a6fc0498948c76457e411
SSDEEP 384:xkI4v4Umldvr8dhWp94zJ96oaL4HmWL4POL4HnL4HRjL4HaS4hN:CI4gRf4XI4D6D4Gc4c4r4xP4B4z
TLSH
T11472431545049EB8298FA78AAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs-1.js
Size 7KB
SHA256 0443f2330a840f2861fa03cbe47db0361895dca6c91e6057bee2d64e28b515ec
MD5 b897920d874037cbd689eed7941d1e01
SHA1 66a1329256466f1689e5368d58bccfd8d0c1e526
SHA512 b19ce1fd2c05fe87b9221faffb6cb58c6522b8e726730d35a797cf144c76aca1862b036a0db4e41900205816952c17ee059f9888338360416695849865c6e1c8
SSDEEP 96:xHaUTUrqGqMfYEiRObzShSSlNdv9jgnqTRH4BnSpBw88Zd8L4cnlKSx:wWRMfRiRHSSF9MSpBw888
TLSH
T1A8F10E7894488B7F75B6767CAC6889715AB2013BB7BF68C710B944C4015CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs.js
Size 6KB
SHA256 159a0dc80942e0c5fbe03310c9684e8d2419360259a10750d0c69cf5a5b0c1d8
MD5 a34a0c507867ce5d0a12e1ea19b1193c
SHA1 82b81d965228018862dc1f3f42ed7bf1d30dd398
SHA512 1112a63c0491f872fa5add16d4e19723dbd1d14cf8948a012cd22531313e7fa74f834ddc26f56ac03b78ed0c3b0813d35460ab1fe709fae8b7c51d266e4cd409
SSDEEP 96:xHIUTUrqGqMfYEFY1zSwSSlNdv9jenqTRH4BnSWBw88P8L4cnlKSx:SWRMfRFYdSSP9MSWBw888
TLSH
T1CBE1207890088B7F75B677ACAC648C715AB2013BB7BF68C610B944C4454CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs.js
Size 6KB
SHA256 3e4dff58c868832b877791afc4043aa1aacbdafae60134e1c2bdd1765c5c79ab
MD5 de0975f7851105395b7081033113af25
SHA1 72cdca884790ba5d9eac581ce155d32292bc0956
SHA512 ea7b34b45d87e539efba685612ce8717f962d2008dc85ab390f7d1065be0e747ded5423eddb2264080fd5ced17a38f7ab6b79ee661032ab27c70001d82cddf34
SSDEEP 96:xHIUTUrqGqMfYEiRObzShSSlNdv9jgnqTRH4BnSWBw88P8L4cnlKSx:SWRMfRiRHSSF9MSWBw888
TLSH
T171E13F7894488B7F75B6776CAC6888716AB2013BB7BF68C710B944C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs.js
Size 9KB
SHA256 de2af1a00cbc886d6c13d8db327ca6294707d3ed79430eb5371e1902a2e093ee
MD5 11226230b8838dbf49d706101a05a144
SHA1 55ccd0c2b943c116da2c9cdf6333adbf8b762c85
SHA512 7aaced9278c0027b6ba2a43a3dffa9a347b24a0900097a98ffdea5fa99074e7d6f20f65036f73466eeb8238aa45ddfa6c44ca18c6e33f2e32ebbb77ad8caa1dd
SSDEEP 96:xHaNTUrqGqMfYEiRObzShSSlNdv9jgnqTRH4BnSFQkOBw88VK2y0e8L4cnlKSx:wHRMfRiRHSSF9MSDOBw88/y01
TLSH
T1ED221D3C5404CB7F64B6327DAC2989712AA2023BB7BF6CD705B85481456CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs.js
Size 6KB
SHA256 1b379e887c988c29f1440bf4aac5ef0743a097bd5bacfdafadd82b196c42d72a
MD5 ec177c7df314ecd95ca31a27da50ad7d
SHA1 e69d6f15f73fe58896b72b0b4ef3c7e40a2238fc
SHA512 c65960e5c3233620892c4b1e13e64bae15c59a0b52bbb3ed1284fd53763499cc7086df82cc9432e4b90301318eb8470be9023badc774edae77dbb0e91edc8724
SSDEEP 96:xHIUTUrqGqMfYEiR1zShSSlNdv9jgnqTRH4BnSWBw88P8L4cnlKSx:SWRMfRiRISSF9MSWBw888
TLSH
T1B0E1207894488B7F74B6776CAC6888716AB2013BB7BF68C750B954C4054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\prefs.js
Size 10KB
SHA256 5d49b92088b52d1bee313b446cea75ecffd82bab3818488730fddfaa877c5946
MD5 63f252a6096d5e1622003310f496b7e9
SHA1 e1dfd458ef7f0efc7ad213a76840c69701729539
SHA512 d9b325d7ea1665859c07d4e4e3429fb65c15866d97c3a2061fe157f1beae03b304f33887980c6c6250adafc227dd6bb956849b02b1dd933de271a03621991fdc
SSDEEP 96:xHaNTUrqGqMf+iRObzShSSlNdv9jgnqTRWR1kBnSwQkOBw88vEQUa08L4cnlKSx:wHRMf+iRHSSF8RmSMOBw889Uan
TLSH
T16622EE3CA0448B7F64B6327DAC29897169E2023BB7BF7CD305B95481455CF3441EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 610637ee3cfae5f44af68db0ede17dd84e3fbc46622ba50a0816d65bedcd16f6
MD5 6684ba82d3909b970061c42dba95279c
SHA1 6f76ad35bc3d61f4bcc63caca0206fbaedaf408c
SHA512 b70d7e24b851dafabb917223fa1493f6a130007dbf1ae7729ec1c0789293400e42421caac0966db0f140f7abd90443e11d6e8aa2af26a82630586e33575299de
TLSH
T1F421B440EEAF28F73584C04A80C65FC8E68420A1C768A4F0C46D960425C816BB299319
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 0e94e0a3c95cb71b7548a21136952252df1d9a995f0c347f65927dbc9e867daa
MD5 0fcd15a76dcf229acc1dd44b2c7a571e
SHA1 411d017de1c0126ec8c226493ba2b7c8cc329ac3
SHA512 3705ef2f35f0fd496f977864e7501a474bab621d177cce6c904e1e057cf95dc927d8dbf90e156a9569726e4181a899a1ea4dc9bbfe9e25301ca637be4cc53c68
SSDEEP 384:aGIUAGLhQQ/N0NJuUMk/8FydVsPNhALAa30O4Jeqcr:atUfLhQMN0NJuUMgyckhALL0aqK
TLSH
T198527CFDE0A129F63F3B83CAC5851533DCC54F6631658A5B08BD380049A719EA72B3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\sessionstore-backups\recovery.baklz4
Size 13KB
SHA256 321da3ba67e1545d779d18814d43a9bb2b61db1bfe35f7401e34846a7bcb96fa
MD5 e42bd8d8dc429208e55ffa034d7c4288
SHA1 3740698a9cb8280828a1852c9bf8204565ef731c
SHA512 7c5bb5f31685761ed9ece5e0c5c7a3f67ee238d8be3913322e32a549c3dcdb760befc03e520ec1ce36c2beff54c38ad0f6e712298c34867bd3b23535a9a603e7
SSDEEP 384:fGIUAGLhQQ/N0NJuUMk/8FyFrjYin3uFBd+glKra6kO4Jeqcr:ftUfLhQMN0NJuUMgy58QTKlk6qK
TLSH
T10C527FE9F0612DF53F3793D6C9451632ECC48EA2327089AB04FC780045A719DAB673AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 f826e71f93396d09e648b1121cd2dda4bd30fec8cc03057eb4b7ce8d080674d9
MD5 5c1db796af7ab4655b0fb13f286ba0de
SHA1 54ea706a7835d899fdfbc008e90590c6e453009a
SHA512 de70cf0e7c5b2a49a65ee5ae332654a27a78d19e0f625ea02904a0ac878320236ca41012b5c2d03a9925b23cb5c7378d760fba1d6afbff1c3a97c725b2719e4a
TLSH
T18521F952DCBB2DF67DA59125D0C84FD6C64C3032C87594F0816D8B0666ED11EB38622D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 171ce4946abcea526e713775242f13d374e073a1a7ddb67c49183ab8eb1cf245
MD5 e826591372bb65856032f96f0d4e0ba1
SHA1 3ede8267c1d32905511099b977880f440172f62f
SHA512 e2f61fc91a1d65149ef48f2527c9dd24ca37e375fde3634b16b593f666931676071659c336500fa829e00b93063b55904639e4ae92c9befc2e75e17f7435bc1f
SSDEEP 49152:lDmgBuOjA5lUT2loNcNeaKvgmRBbFOYTg/:VmYuO856T2KOeaKvgmc/
TLSH
T12A1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16loo4mf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 13.4MB
SHA256 8f2329308ea299b2a1056859306b23be42bd8ebb2ea0fdd53119d66c50c7f66b
MD5 0c2da06b8ea4f2e97cf00e879b36e628
SHA1 c4bc29f319e86a72b11d9106e4c728c6677c7217
SHA512 f948fe1aeb1a08c204f10166a0d2480429c1fdd1a3528403ec0ea7d760acc211d1f685fe717b7a5e2cf8d420581113b8b0590110a06871a01dd271bf04cb3784
SSDEEP 49152:5a64RUV7uF0Lt/zyxdpqHY0dKWVBAsrwomoqIa9mt8IXz17CGFUV1Cn4CCUkTrz6:464R87u0B/DPspomxg
TLSH
T139E64B9270E0D6A2EE0086F2B35F43EB313FC1DC20E589941678B56C596369BEE6F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8yJR2IJP.jpg.part

Path C:\Users\Admin\Downloads\8yJR2IJP.jpg.part
Size 27KB
SHA256 2bf3b01afc66b991275909dae575ed1185ac3356d537844fd4f0cd9a1804fb97
MD5 9e4b1b3e7c52e090c8e70df1a98bad85
SHA1 f4367b1f35b1032f0f1112e7af4c016a52a033bf
SHA512 753dc9f3329b8630baa22b0a513e5d659b2c9ed0ecd62894527dc37c03ef688f27368bc342766b6aae10755d11277c466e409b5a677428779df89b0f1db68e5b
SSDEEP 768:9YyaRnf71mZ73n+tmDzzeCl10cxA/Pul/Lbtygpy:9uf8Z73n+te3X0cXD5y6y
TLSH
T110C2D0B6A8DA4723EFF3E03006B537486290772EC6945EFEE194875400B08A666DD0FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IgZ_ghc0.jpg.part

Path C:\Users\Admin\Downloads\IgZ_ghc0.jpg.part
Size 4KB
SHA256 7b4efa4e224f9a9befa780cab54fc03cdc1bc6d90d78dda68856c1b91e26b9b4
MD5 0d9406f22c33746ab08f2ae809c4e029
SHA1 f85811fbeeb303d78ed6e029593fd80ab0c15ce4
SHA512 5d047ce63a638fa81cc526be6feb755a53a168ffe03abf602d5ab084bd3b89c93e05bbe9edf4bb42c0f960765d264272a29bdd44d1b4b1b7778171ce9fe4edf2
SSDEEP 96:dQszMUDxz6e7+hHHzga9UQXyfAJs7k24vIumbJcD1ztj:Hfse7+FgLIE2klSmbJs11
TLSH
T1DEA15B52B9D119B1CEF89F36937B9C48C7762365CA44C601F82B9AA02C981AE8DA8D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s1Fm-pZ9.jpg.part

Path C:\Users\Admin\Downloads\s1Fm-pZ9.jpg.part
Size 8KB
SHA256 f31abee6629248b05f89c5b8d40f3180f207c0b5263a1dccdbcb5a9b65f27a8f
MD5 abcd67add008164a9e8a6fdda7c44110
SHA1 9dd2e268b07b080a6c18df73d5313e4b8ca1ef0e
SHA512 d3d55e8cbd198bd3c5c7d76e47774aaa347413ddae78e1f17cfccb2c99ce6ce1392a9747b551d526fe272a12ba6c7a5819d6edb5df9f7c3643bcc0cc70e1c23c
SSDEEP 192:5ZbHqTUzxoIGup+pu0ZhGuy/13VwwjIkoxG:XjquGdAX0yuY1i7G
TLSH
T14402AFD36E66C31AC7C8FF6B44812C8DED0307D738996B58A6EC422515351696A0D89F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3616-7065-0x0000000000F30000-0x0000000001019000-memory.dmp

Download

memory/3616-12-0x0000000000F30000-0x0000000001019000-memory.dmp

Download

memory/3616-0-0x0000000000F30000-0x0000000001019000-memory.dmp

Download

memory/4820-622-0x0000000000720000-0x0000000000B6B000-memory.dmp

Download

memory/4820-16-0x0000000000720000-0x0000000000B6B000-memory.dmp

Download

memory/4820-13-0x0000000000720000-0x0000000000B6B000-memory.dmp

Download

memory/4820-348-0x0000000005FE0000-0x0000000006120000-memory.dmp

Download

memory/4820-14-0x0000000001330000-0x0000000001331000-memory.dmp

Download

memory/4820-349-0x0000000005FE0000-0x0000000006120000-memory.dmp

Download

memory/4820-7032-0x0000000000720000-0x0000000000B6B000-memory.dmp

Download

memory/4820-356-0x0000000000720000-0x0000000000B6B000-memory.dmp

Download

memory/4820-5-0x0000000001330000-0x0000000001331000-memory.dmp

Download