6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89

Resubmissions

25/08/2026, 14:20

260825-rnpesshe556

25/08/2026, 14:05

260825-rd8qpaaq315

Analysis

user interaction
yes
max time kernel
328s
max time network
324s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
suspect_39C5C774.exe
Size 992KB
Sample260825-rnpesshe55
SHA256 6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89
MD5 3e87d95ba32e19c565247bad5d810ca3
SHA1 39c5c7743559a7d1d82e491cfc23d63f95f2fad6
SHA512 6a60c509de7a7753d9edc58cec9e9a43259de6091b127085bc95865b561646ccfebcc6898b5d93ce22671c3dc7a4b938b55ae66b56dfddc1a1c52ff2ecea8538
SSDEEP 12288:23hYgc2p2CM0bPdbo3KglweiAgGAhfub29Op/tV:23rMkcrlweiAgGkuso
TLSH
T1A2258E6DA6AC01E5C57AD07CCA438A1AF6F13C5503259BCB01E0866E7F27BF81A3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4164	WScript.exe
4568	WScript.exe
2980	WScript.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	3680	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4620	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2080	ipconfig.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2840	NOTEPAD.EXE
2248	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4688	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3588	powershell.exe
3588	powershell.exe
3588	powershell.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5140	taskmgr.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1988	chrome.exe
1988	chrome.exe
1988	chrome.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	firefox.exe
Token: SeDebugPrivilege	4448	firefox.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeShutdownPrivilege	1848	unregmp2.exe
Token: SeCreatePagefilePrivilege	1848	unregmp2.exe
Token: SeShutdownPrivilege	3680	wmplayer.exe
Token: SeCreatePagefilePrivilege	3680	wmplayer.exe
Token: SeDebugPrivilege	5140	taskmgr.exe
Token: SeSystemProfilePrivilege	5140	taskmgr.exe
Token: SeCreateGlobalPrivilege	5140	taskmgr.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe
Token: SeShutdownPrivilege	1988	chrome.exe
Token: SeCreatePagefilePrivilege	1988	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4448	firefox.exe
4448	firefox.exe
4448	firefox.exe
4448	firefox.exe
4448	firefox.exe
3680	wmplayer.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2728	suspect_39C5C774.exe
4540	suspect_39C5C774.exe
2516	conhost.exe
4448	firefox.exe
5140	taskmgr.exe
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE
4688	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2000	2728	suspect_39C5C774.exe	89
PID 2000 wrote to memory of 4540	2000	cmd.exe	90
PID 2000 wrote to memory of 4272	2000	cmd.exe	91
PID 4540 wrote to memory of 1824	4540	suspect_39C5C774.exe	92
PID 1824 wrote to memory of 2516	1824	cmd.exe	93
PID 2516 wrote to memory of 2108	2516	conhost.exe	94
PID 1824 wrote to memory of 5920	1824	cmd.exe	95
PID 2108 wrote to memory of 2080	2108	cmd.exe	96
PID 2108 wrote to memory of 4284	2108	cmd.exe	97
PID 1444 wrote to memory of 4448	1444	firefox.exe	100
PID 1444 wrote to memory of 4448	1444	firefox.exe	100
PID 4448 wrote to memory of 4896	4448	firefox.exe	101
PID 4448 wrote to memory of 4896	4448	firefox.exe	101
PID 4448 wrote to memory of 4896	4448	firefox.exe	101
PID 4448 wrote to memory of 2876	4448	firefox.exe	102
PID 4448 wrote to memory of 2876	4448	firefox.exe	102
PID 4448 wrote to memory of 2876	4448	firefox.exe	102
PID 4448 wrote to memory of 2876	4448	firefox.exe	102
PID 4448 wrote to memory of 1708	4448	firefox.exe	103
PID 4448 wrote to memory of 1708	4448	firefox.exe	103
PID 4448 wrote to memory of 1708	4448	firefox.exe	103
PID 4448 wrote to memory of 1708	4448	firefox.exe	103
PID 4448 wrote to memory of 2676	4448	firefox.exe	104
PID 4448 wrote to memory of 2676	4448	firefox.exe	104
PID 4448 wrote to memory of 2676	4448	firefox.exe	104
PID 4448 wrote to memory of 1116	4448	firefox.exe	105
PID 4448 wrote to memory of 1116	4448	firefox.exe	105
PID 4448 wrote to memory of 1116	4448	firefox.exe	105
PID 4448 wrote to memory of 1116	4448	firefox.exe	105
PID 4448 wrote to memory of 2256	4448	firefox.exe	106
PID 4448 wrote to memory of 2256	4448	firefox.exe	106
PID 4448 wrote to memory of 2256	4448	firefox.exe	106
PID 4448 wrote to memory of 2256	4448	firefox.exe	106
PID 4448 wrote to memory of 6064	4448	firefox.exe	107
PID 4448 wrote to memory of 6064	4448	firefox.exe	107
PID 4448 wrote to memory of 6064	4448	firefox.exe	107
PID 4448 wrote to memory of 6064	4448	firefox.exe	107
PID 4448 wrote to memory of 2544	4448	firefox.exe	108
PID 4448 wrote to memory of 2544	4448	firefox.exe	108
PID 4448 wrote to memory of 2544	4448	firefox.exe	108
PID 4448 wrote to memory of 2544	4448	firefox.exe	108
PID 4448 wrote to memory of 4208	4448	firefox.exe	109
PID 4448 wrote to memory of 4208	4448	firefox.exe	109
PID 4448 wrote to memory of 4208	4448	firefox.exe	109
PID 4448 wrote to memory of 4208	4448	firefox.exe	109
PID 4448 wrote to memory of 5432	4448	firefox.exe	110
PID 4448 wrote to memory of 5432	4448	firefox.exe	110
PID 4448 wrote to memory of 5432	4448	firefox.exe	110
PID 4448 wrote to memory of 5432	4448	firefox.exe	110
PID 4448 wrote to memory of 5088	4448	firefox.exe	111
PID 4448 wrote to memory of 5088	4448	firefox.exe	111
PID 4448 wrote to memory of 5088	4448	firefox.exe	111
PID 4448 wrote to memory of 5088	4448	firefox.exe	111
PID 4448 wrote to memory of 3452	4448	firefox.exe	112
PID 4448 wrote to memory of 3452	4448	firefox.exe	112
PID 4448 wrote to memory of 3452	4448	firefox.exe	112
PID 4448 wrote to memory of 3452	4448	firefox.exe	112
PID 4448 wrote to memory of 4824	4448	firefox.exe	113
PID 4448 wrote to memory of 4824	4448	firefox.exe	113
PID 4448 wrote to memory of 4824	4448	firefox.exe	113
PID 4448 wrote to memory of 4824	4448	firefox.exe	113
PID 4448 wrote to memory of 2556	4448	firefox.exe	114
PID 4448 wrote to memory of 2556	4448	firefox.exe	114
PID 4448 wrote to memory of 2556	4448	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\suspect_39C5C774.exe
"C:\Users\Admin\AppData\Local\Temp\suspect_39C5C774.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\suspect_39C5C774.exe
    suspect_39C5C774.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Windows\system32\conhost.exe
        
        conhost.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:2080
        
        C:\Windows\system32\nslookup.exe
        
        nslookup
        7⤵
        
        PID:4284
    - - C:\Windows\system32\conhost.exe
        
        conhost.exe
        5⤵
        
        PID:5920
- - C:\Windows\system32\svchost.exe
    svchost.exe
    3⤵
    PID:4272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27098 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {9bfa4eda-90a1-4ad9-9f82-be49a434b7d1} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27134 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {62a827a3-9d33-4621-b047-7c22dd7034ec} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 27274 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {9e5cec07-a736-4341-952d-5a89e75faad3} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4044 -prefsLen 27274 -prefMapHandle 4048 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {2ea44863-ab00-43f4-b5dc-a3689bfaac00} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3040 -prefsLen 34773 -prefMapHandle 2960 -prefMapSize 270279 -jsInitHandle 3024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2744 -initialChannelId {f18c9945-e3be-49d0-a329-dc1984762741} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5004 -prefsLen 35010 -prefMapHandle 5008 -prefMapSize 270279 -ipcHandle 4972 -initialChannelId {9856b817-031b-49be-ba0f-1a7558e2365c} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2640 -prefsLen 32952 -prefMapHandle 4044 -prefMapSize 270279 -jsInitHandle 4236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5436 -initialChannelId {7b904c83-6719-48c4-916f-9df75d323b10} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1608 -prefsLen 32952 -prefMapHandle 2364 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1276 -initialChannelId {f6b67c8b-b986-4954-bd3b-98a98bb262e9} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4236 -initialChannelId {055772af-c211-4e7b-abdb-6ac915dadc7a} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5644 -prefsLen 32952 -prefMapHandle 5648 -prefMapSize 270279 -jsInitHandle 5652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2640 -initialChannelId {7258f9c7-9105-4eee-b47a-75cb741de735} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856 -prefsLen 32952 -prefMapHandle 5860 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5872 -initialChannelId {ae9955db-ba9a-472f-8c52-e91528fa2c83} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5892 -prefsLen 32952 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5928 -initialChannelId {b9315efb-b3e6-45d1-b8c7-bcae80d6f3f6} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6192 -prefsLen 32952 -prefMapHandle 6196 -prefMapSize 270279 -jsInitHandle 6200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6216 -initialChannelId {a3fc435f-fdfe-4957-b800-69a649deec3b} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6224 -prefsLen 32952 -prefMapHandle 6228 -prefMapSize 270279 -jsInitHandle 6232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6240 -initialChannelId {88e987be-fd15-4912-9f0c-7e0b7064d772} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:2556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6536 -prefsLen 32952 -prefMapHandle 6540 -prefMapSize 270279 -jsInitHandle 6544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5800 -initialChannelId {99a3abe8-b5c0-4ac7-b277-9042e3f6a7b6} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6560 -prefsLen 32952 -prefMapHandle 6564 -prefMapSize 270279 -jsInitHandle 6568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5792 -initialChannelId {4b64f9a1-7182-4a67-b05d-47c51673cc6d} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:1076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6848 -prefsLen 32952 -prefMapHandle 6852 -prefMapSize 270279 -jsInitHandle 6856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6912 -initialChannelId {9be2ce6a-41fd-45dd-b823-56c3b2d063bb} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6872 -prefsLen 32952 -prefMapHandle 6876 -prefMapSize 270279 -jsInitHandle 6880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6920 -initialChannelId {b079d51d-653d-4264-9afa-c8148c758929} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:3044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6896 -prefsLen 32952 -prefMapHandle 6900 -prefMapSize 270279 -jsInitHandle 6904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6928 -initialChannelId {bf7c8605-7d4d-403f-9866-6d3063ce91eb} -parentPid 4448 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4448" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:5368

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\FindCompare.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4164

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ResolvePop.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4568

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\TestOut.xsl
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:2840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ResolvePop.vbe"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2980

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3680
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1904
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 2384
  2⤵
  - Program crash
  PID:2204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3680 -ip 3680
1⤵
PID:4892

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3756

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DisableConfirm.ps1xml
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:2248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffa480c728,0x7fffa480c734,0x7fffa480c740
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,15228113965058777797,16278393263979645098,524288 --field-trial-handle=2120,i,17479792361423446853,10696453597796108644,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,1206791002147938761,3123494413094140451,262144 --field-trial-handle=2120,i,17479792361423446853,10696453597796108644,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,18266946505779802616,10192371253966108880,524288 --field-trial-handle=2120,i,17479792361423446853,10696453597796108644,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,17237211134068921745,2815825220292209439,2097152 --field-trial-handle=2120,i,17479792361423446853,10696453597796108644,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,8906370477937565184,16946894931959298153,2097152 --field-trial-handle=2120,i,17479792361423446853,10696453597796108644,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,2230757382696237854,14035199987162092886,2097152 --field-trial-handle=2120,i,17479792361423446853,10696453597796108644,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,4831240768751661647,779028242979768413,524288 --field-trial-handle=2120,i,17479792361423446853,10696453597796108644,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3240

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\NewConvertTo.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8d1235963465e2c222b281751a25b0332ec7c6fac4a187e653462953836b91eb
MD5 124d56f3594a8450c32aa7b8f11ae8b1
SHA1 345a42e1d1b25b14b695c380497a0b14e8c1cc43
SHA512 c2bc0231bf8cd963c0c66dd762535998ba8b579c7c887a1a77673c4e1de96b898f510d0565968082a41cf59183c26151abdd4fe894c3234831445a0296242aca
TLSH
T1712169FBC3E4997D8A0092F4AA116E1FCE2D0915131C7C67C9D46E1B43E2872E10068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e58cd041babd1c25429a33f584467d9b3ce0f36b52abf22527233f76c74bc1b7
MD5 b8899d20574fdf2a43e10e875ebdd487
SHA1 b5b4a0d11a40e62a4a3af287db6bc9e39ed4a58d
SHA512 e6a5e8a20fd880a5a3e6c629003b233c90752943a3bdb733dbc2b28889654cff194fbce2bc424e2bf4d7e109e416bbe38509db463a27d0c0cc629acde8c014fa
TLSH
T176F0E0BBEA79F4571079C57A5D04FC056975F8360641B8F4CF5A816DA0915F34B02843
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f550d77bc053fcbd2009619f50c999ca10aced78f6f49cd716d0326540574cba
MD5 07222092d653aa38b9c5b65b85f440b3
SHA1 2268c6b7aac99621a838687ffb3b6afca5886797
SHA512 3a4950dcf612981f37fb9186a5662be5c4d6b5d8fd38748f2eea4ad40ee9a08c4617247f18ea86fa20954147b950150b802da7cb6dd65a863a8ea53feba90fae
SSDEEP 192:RR5n7eyv7+TAPRp2O9pHsb+WNnB+0ktGPyIsnAUgR:RR5n6e3XtTwc0qIR
TLSH
T1B522742FB915653B5DCBD22AFA267B93E3F5102526912E84D7FC892C11E7ACC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 0078c737ecfbcb746215dc0fa8f8e1067ac5b959f51dcf94ad2bc45d0615547a
MD5 419c9ab7bce49b9d101af237da588599
SHA1 c675dee038d4e94487ca6f59d532a79c5606ea92
SHA512 d075117fab3d1cd2f017bb6a2c4576ca6c229ffc6a2866ffc2891a9ff100595eeff43873ec6ce0375fb60d0dafcbfd77204a18c5e40177ef33b1cd70191aeae5
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKN9tn50i4/+/:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLt4
TLSH
T1E532E827A48E9E7F0FD8E51CDC536F4BACB502577278082497FB9C0403A978E214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ffe2780fac923ce8bd3dca0cccb44ddf93929e7dff62f56a60f85f22887d890a
MD5 0f5ce8a28ad21c0462e2248b95d6c9a5
SHA1 e4253addd55530b64f9a7bbd85bbafcb7f596574
SHA512 25cf2b6793a4860b016ff052b73a4a28c7178b57d6a24b14d902f8de22b95309b723f166af8790408692ae08af981edf2c0f7e850918d46ae9bdc08b61ecd72b
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5yVDxB6JGyvTNm6zj0+PEhiv4a:mC0Nr7OJRPrL9/EtDUDUH9Imgj0+shM
TLSH
T126A1F832647E5CB759B3C546F5563B07CFA4617B6A21AF8499D92A0C10A70DC1386A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c06f3f74048bfa76b1c3995895a7a5bc19c592a8359a26756e8cb9ee36361bc6
MD5 77850dba1c5a2421273fd9db52e0f4c2
SHA1 581cec51662a049b2c938716ae12bebd4b279720
SHA512 8684af57ca994a8540082e8f59ed106c1f6abb9f391b0d3506f25e2d8166197bfad67ccc37486ff21d59a30a7b6c68f82062f5565d14645f62456bc1d5e53466
SSDEEP 96:f7C6bSd+Ar2aetJRxW2rgj0+f+U+/E6sezoSl8h4otok5ytDxB6DGyvTNchCzb3d:TCqSNr7OJRPrL9/E7iUDsHfIcMnyfiym
TLSH
T1E2C108B1687DAC735DF3D856F1473A47CFA471BB6951AE54DAE62A0C00E30DC038A523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 256KB
SHA256 0f1805187eec6d6bb24828ac4916e9877254e1134a73a7f8e7773cf3e94c4a0f
MD5 533afdae748bf568787a0bc0e39c7543
SHA1 ea8f9a82fe5bd86c068a2e6d7df39f700d49264a
SHA512 fbdec55a0019b4758300b015e3e5be34e030cf27725318dc85d1d32eb103782493aebd9df9371dabed7f2b99db2e7d43122bcb6d6f87240ad71486c39d4f44fb
SSDEEP 768:af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:a69
TLSH
T1E1440137E5A0B084DF2CB571E2AC1F48BA73250B01E416465FF4A57DBB233D6890B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 838d47b50afd3db3124a5e4708de3dc407a40af4fab68fed7fed5b357d82fa3b
MD5 89c5597acf011f3005f84eece5af7ff5
SHA1 204e4b719084c8e561c9043ecabc5eb66da65ee0
SHA512 30275e9c02781aa39aa430bd24f2df5767c4e63352b599671e12b49232a9bd8f7e0eb247fdd69cd1d6ab2e717d80f28343c03d0d0ac5d00248670363e6cc8919
SSDEEP 768:P0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbag:BZP2tFP3vqY8VqEMbTaBacg
TLSH
T1B6257437D190B0C5CE2C7171E9ED8F09BA23A10B11A052465FF8A57E7A633D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 499413b892231e0562828bb622b4458d25c8c2d2e0d6ff0c266fdfdf5ec3f5bd
MD5 c5821cf7269ef7825df104509fc2a328
SHA1 498b5458a2c8398d986ef48aa353fb4ce4aa8607
SHA512 582b1450f21250737a38bc11d3cd2aec0d3b687750bf3b0fd4b67115bf3f61ec9b1e6ca11fde5713fc3cf5ec37cfa78965729c2362dec57854d61474e18f8842
TLSH
T1D1214C574A0AE4B5CD6287B3A8CC8A2773B6B7CB5364D015B38EA05E890213E273D17D
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 206B
SHA256 bbdfe9a826ab886695f2d2cf52377e99867f40649798cd2bee433654a1c6d0f1
MD5 8b7065bfc4a8ffe2a98cce37d1ea7272
SHA1 3545815be19bbaa8b32a7ef0ba2467d42503235d
SHA512 31fdda9dda41a42405da612acd312b8612572d7c398fa8ef4eba226fae0b75e8adec9925983223c741dbaf6991a51a37d26ca12387f329f5470b7c6405269f65
TLSH
T1D0D0C9A72B25E7E0933C11E0B8359CF447F2889AC2F8413200CC0EC50C546071297188
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 1KB
SHA256 b20cbde1af0247dc803e17f13bc1b473d597bea7748c82521b446576ca688985
MD5 0e576e21e905d77ca2c5eb0003f69357
SHA1 7e7405abb6825b99fa3f3323f1468670bcb5b52b
SHA512 6b7695b99f88b43457dae87d1fc2a2d3ca99eb50b7009d4ceb26cdeb15f0409fae9cbc453eda6afe9534c9d187a6b9c0484b7e882e808d310dfa038a21856b10
TLSH
T17631EF10E7D11159E1B3C533BD7767017BB9F806EB1E964F414C925A0C6490079777AF
MD5 SHA1 SHA512 TLSH

Submit Download

74d7f43c1561fc1e.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms
Size 3KB
SHA256 a8454c55b659f8832e579e55cb978f9d05481b79a015736d37f381013126c133
MD5 b37ce60336c47018fa706d9948033a64
SHA1 4a88c0e299e5313b17574c950626d42000d1f225
SHA512 831e80042d5442878aef34fda274603786cef2152b4d1a33b871f43ad7839480b14fef0d9639d250c8b70faa804612f667aaef849d1e6be7e2ab9b1dc7b76be2
TLSH
T15C712D00A7D1115DE1B28633BD776300BB7AB802EB1A964F4148519B0CA4900A8BB76F
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d69126355e6f85f7e4f59a47f0f7379beb3150c90e60a46c35f1b4a66a258b8d
MD5 f56cb3c316a498b0041f0ab8151fe351
SHA1 d556f4981ae8e3eb091b021132defa283e2356ec
SHA512 2701e5a3a2a08809c66306185975a6df5a0fc934b7c40f791f589c30d5f4765e93455025ab340f28e94702883fadffe78c4c4bbf59e640d88f02b12b2bd6a077
SSDEEP 192:1tOv5zbo8MCQyjjcHz1d66JoztdzgCl6mc0d:1Cbo8MCQyjAd66Joz/zgC1j
TLSH
T1DDD11BB4E628463FC408537BCCA60F400F35399BA84E3F1935AD69582D5A29E76CD1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 db650f2c5f44503ae8a3c6ab2b2b0f2d76606f3c602aa7c117736fe932d26c74
MD5 61c978fbcf9953062aa41379018890b9
SHA1 96b98141cb66ffeb279540b62e59d30b517f1386
SHA512 6be2e90bef9917783edd016730b6e17e95a897d89207a6b77add9e5c7a8e4ad3056079fa458853d238be31ddd301e2369afa6a2f3963a4421edfda6c12bc4505
SSDEEP 192:gz1d66JoztdzgCl6mc0dAtOv5zbo7DZCQyjjc:+d66Joz/zgC1jqCboXZCQyj
TLSH
T14CE11EA4E628463FC408537BCCA61F440F39388B984E3F1935AD655C2D5A2DE76CE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
Size 1KB
SHA256 82e9c4e2bb786ea793290e52f9803ae4383ee6bdad988bb88b49c5184149c836
MD5 3bc6d7ee2fac1e8de1aeeb280067ab96
SHA1 a121c859bc66491d5fdf08c3452ad639955a5b81
SHA512 4a7fdeffd80b4c0ff9b91b740db1bc4102b59b27e25e436360e65385261b43a955c24db097e885b7763fdd1a2fb94105d15da1ad9a2fdb8088a9b59997aae65a
TLSH
T14B213A9C3AB84D6A988AE29C7441028E93554E07188B5D874D03FF8DCEC1BED326B43D
MD5 SHA1 SHA512 TLSH

Submit Download

1df80811-32d1-4223-9336-83ed03cc6d45

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\1df80811-32d1-4223-9336-83ed03cc6d45
Size 235B
SHA256 be1bc9a3d515c712b367cfafa2dcf4f22051edbc051a691f845dea94d609d183
MD5 61a8d139bde7d314c6b47e99770adf3d
SHA1 df07e98e2f03712a5607a496de7a13f8957a26c3
SHA512 f76411b53873c643d323b64c8a2d5d8316fdcd2a174071bad20eb3f463776a772ad98b92fda849665849aab73fe0cd8950c0cbf2ec77b6e81c4cac86cb4f1a64
TLSH
T11FD097802888631C08188F03F0E168C630558C3364A4AC60D75181788AFE9C80192827
MD5 SHA1 SHA512 TLSH

Submit Download

6ebdce80-1a87-4cce-9634-9aeaca3c32bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\6ebdce80-1a87-4cce-9634-9aeaca3c32bf
Size 15KB
SHA256 68f97f7cfaafe2d52cdb686e19d63b610e0db30113f5965e68eb5c38f978b19d
MD5 633eafaa3b5dfc6785f4927eb3caf205
SHA1 31e92c236d142aa0e29956721c0b006a91e28898
SHA512 e2b45dc69ee0d5d64a0033c9801bb7e365426c1aceaa9321431d1ddb93d7168f1374660813bf8ed6adb68b8f434362bbedc2b0fa116a9de0e8574f515a6e0c89
SSDEEP 192:cW8VVwzxP5jRxZ7kxY1VSB+216XtddpJu4vMLnzpzNhTLG1thX+h9zU028XoUGV:QVwlP5jRx5k+mQvndOn1Uu7zl7oUI
TLSH
T19562E9666420497B8591E368D8EC7FC3F6F518CF8C029FCD9BE47D086AEA05E5127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74bdc5a5-ffeb-48b3-bc42-457b45f34008

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\74bdc5a5-ffeb-48b3-bc42-457b45f34008
Size 886B
SHA256 2e37ca0ab22a6d3423fd674bdd8395986c2a17302d3a8470f7f96990ab757b77
MD5 93474e0e0e73c77be2b11902dd023421
SHA1 852a01a6905d56f1b1adb1d41a5bf00c58682f97
SHA512 2818a4c9e6baec2756d122f38f77f7bbb72308d8ba938c05f5c5696751613fb32f9e93f4848c73833d4b7df2e01c12ce012ba65ca9894519c800ac8dd995716e
TLSH
T1141127E2967475B28C7C928F85D47B425FE06513C0C619083D905F184FBA60FE3E6707
MD5 SHA1 SHA512 TLSH

Submit Download

762bea41-eb71-44c0-ac12-b725141cbf93

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\762bea41-eb71-44c0-ac12-b725141cbf93
Size 2KB
SHA256 353cbda08fc6c91d4d88548b97442fe589c4beb8a9454cf9e88da5998b30ae5e
MD5 63199d810f861450fe593b78bc0ea978
SHA1 7c44b8f974b3dc61349aeedeaf9f1937ed3dac76
SHA512 3a4959e0b75fbb679f76b98ee8623a7d2207f11dc64027e9ffbad5ae9971c482b4bfe477bdd72cee5c6a809a722f39b9d178db63dcf98bab45a53f8fdbbfc966
TLSH
T16A41556C75B85D7B4CDEE65E9091338E6360DA0350C618832D91DF0CCE9675E23BB527
MD5 SHA1 SHA512 TLSH

Submit Download

dfd6c30d-8acd-41b9-8665-88f2a3bd26b4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\dfd6c30d-8acd-41b9-8665-88f2a3bd26b4
Size 235B
SHA256 83766efb839f83d1058065a448c12f8a71cf16f305f2832a8fcc97d78df9734e
MD5 361897631ced087382bff864d86dc719
SHA1 ec057b21e17f1dee457b5375f5c2cba0d0321466
SHA512 af1665640a8de661679039f54ee7cf626beb915a85594bfcf623c819268017b4fc16382226ca4304d6ecac7bc77609e1e1e326871d553d09b78ec76277910065
TLSH
T1BED09788289C672D0C180F0AF0E06CC270484C336A7898A0D5A000B8CAFADC80222C07
MD5 SHA1 SHA512 TLSH

Submit Download

eb408d18-474e-475b-900f-6bd86d521bb6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\eb408d18-474e-475b-900f-6bd86d521bb6
Size 883B
SHA256 0189fd52a7422cf132dfc7612c47db188959729f7fcd050184b2471e4e1395dc
MD5 3d15141ae0702bbd97aa44a59e11d266
SHA1 8c2e51c53204a3bd2b2e25ba4563fef5eb4a58bf
SHA512 8881190b915a4a578d7a4fe46f1a1da1e68790c0aebf38c2aad14171e074b1db859ccd9315916bb6e076babb3c871be4f3527100fa17149a5da2c1fcdc1e651e
TLSH
T1B61123D1923079B2CC7C924F85953B568BE8B81380CB54083EA54E184F7E61FE3EA747
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 6KB
SHA256 31e5a440582018a995506bc44c8ecdd7474bf28910ee360ae1ca27b69caf01af
MD5 0d6a1a5532062d35315f85a583ab5132
SHA1 3b77f8caceafb8b863f5dbf9ee1506b114f0d8ce
SHA512 7e4049ff40b3869ba9017efe4490db5382fc05a558a03f15b8d484f2879bbba2e7b14ab50ac480d8a5e32ab866c66e7c13970544a5fa9e763130a5e171bbfe69
SSDEEP 96:xHGqUTUmK4qGqvfMTmObzSGwSSlQdv9jwrnoRHmBw8Ou8L4cnSHL0:oqWKTRvfMTmswSSPM9mBw8Ox
TLSH
T1D4E10F7891189F7F64B6776CAC6888716A72023B7BBF68D710BA54C4050CF3482F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 6KB
SHA256 51c05765017b9ca25fab3cde7fd31840d993ce1c54cdc215d5627a9b1e7cf832
MD5 1501ce1e1964d4eeed1562b0f70cbf0b
SHA1 83cc3ea3053f7acf9118f6d51711f9749ba5830a
SHA512 cc284390a0d4642ae34cf47c99d82d41e277394d5427d0260e97006b172c76d89e0ecbc8e6d752fb7931069cdd1daf565f7fb4c326819203d65ab7d2875a9b7a
SSDEEP 96:xHGqUTUmK4qGqvfMSi1zS0gVSSlQdv9jbnoRHmBw8828L4cnSqoL0:oqWKTRvfMSivgVSSn9mBw88fZ
TLSH
T17AE11F789018CF7F74B6776CAC6888716A72023B7BBF68D610B94484450CF3882F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 6KB
SHA256 b3868fad47b2df4fe7074df4b27d90de19a7988a42dfee5c68cbc523072ea46f
MD5 e838e0dcd059d9727854b5d20a450fe7
SHA1 1bd6015062f82186b0ab9c4c7acdb5b330e7424a
SHA512 6a8593d2e669e3dcc1b0c19a8427a3a6d1edb4473e1fc0868e1895917ab7f245c363941afc81813982598d86f6e9d3d49ee78b2e1449d042da15e3c5784d5ca1
SSDEEP 96:xHGqUTUmK4qGqvfMTm1zSGwSSlQdv9jwrnoRHmBw88u8L4cnSqoL0:oqWKTRvfMTmnwSSPM9mBw88nZ
TLSH
T1EEE11F7891188F6F74B6776CAC6888316A72023B7BBF68D610BA5484450CF3482F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3588-393-0x0000017DD7B90000-0x0000017DD7B9A000-memory.dmp

Download

memory/3588-394-0x0000017DD7E00000-0x0000017DD7E1E000-memory.dmp

Download

memory/3588-398-0x0000017DD7DF0000-0x0000017DD7DF6000-memory.dmp

Download

memory/3588-399-0x0000017DD7E40000-0x0000017DD7E4A000-memory.dmp

Download

memory/3588-402-0x0000017DD82D0000-0x0000017DD8346000-memory.dmp

Download

memory/3588-397-0x0000017DD7DE0000-0x0000017DD7DE8000-memory.dmp

Download

memory/3588-396-0x0000017DD7E20000-0x0000017DD7E3C000-memory.dmp

Download

memory/3588-403-0x0000017DD7D00000-0x0000017DD7D1E000-memory.dmp

Download

memory/3588-385-0x0000017DBF660000-0x0000017DBF682000-memory.dmp

Download

memory/3588-395-0x0000017DD7BA0000-0x0000017DD7BAA000-memory.dmp

Download

memory/3588-386-0x0000017DD7BB0000-0x0000017DD7BF8000-memory.dmp

Download

memory/3588-391-0x0000017DD7D00000-0x0000017DD7D1E000-memory.dmp

Download

memory/3588-392-0x0000017DD7D20000-0x0000017DD7DD2000-memory.dmp

Download

memory/3680-447-0x0000000006EF0000-0x0000000006F00000-memory.dmp

Download

memory/3680-442-0x0000000007F00000-0x0000000007F10000-memory.dmp

Download

memory/3680-441-0x0000000007F00000-0x0000000007F10000-memory.dmp

Download

memory/3680-446-0x0000000006EF0000-0x0000000006F00000-memory.dmp

Download

memory/3680-444-0x0000000006EF0000-0x0000000006F00000-memory.dmp

Download

memory/3680-445-0x0000000006EF0000-0x0000000006F00000-memory.dmp

Download

memory/4688-601-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/4688-602-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/4688-637-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/4688-638-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/4688-639-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/4688-636-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/4688-604-0x00007FFF83B10000-0x00007FFF83B20000-memory.dmp

Download

memory/4688-598-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/4688-599-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/4688-603-0x00007FFF83B10000-0x00007FFF83B20000-memory.dmp

Download

memory/4688-600-0x00007FFF85F80000-0x00007FFF85F90000-memory.dmp

Download

memory/5140-474-0x0000025F43890000-0x0000025F43891000-memory.dmp

Download

memory/5140-463-0x0000025F43890000-0x0000025F43891000-memory.dmp

Download

memory/5140-472-0x0000025F43890000-0x0000025F43891000-memory.dmp

Download

memory/5140-465-0x0000025F43890000-0x0000025F43891000-memory.dmp

Download

memory/5140-469-0x0000025F43890000-0x0000025F43891000-memory.dmp

Download

memory/5140-473-0x0000025F43890000-0x0000025F43891000-memory.dmp

Download

memory/5140-471-0x0000025F43890000-0x0000025F43891000-memory.dmp

Download

memory/5140-470-0x0000025F43890000-0x0000025F43891000-memory.dmp

Download