Overview

overview

8

Static

static

1

New Text Document.txt

windows10-2004-x64

1

New Text Document.txt

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    545s
  • max time network
    558s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 15:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New Text Document.txt
  • Size 1KB
  • Sample260924-slaz3avhnd
  • SHA256 1f91f949b0aa67feccca7b2316a7a9fe2d5cad1df18e4a3ce6519f57c04dde49
  • MD5 SHA1 SHA512
Score
8/10
adwarediscoverypersistenceransomwarespywareupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 34 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 5 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 53 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs .reg file with regedit 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"
    1⤵
      PID:2292
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4472
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4672
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {1ae7630e-32d8-44da-bbcf-3e84cef9090b} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:4176
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2392 -prefsLen 27133 -prefMapHandle 2396 -prefMapSize 270279 -ipcHandle 2404 -initialChannelId {29997793-b8dd-424d-9b70-5d1f371723d2} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
            • Checks processor information in registry
            PID:5664
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 27274 -prefMapHandle 3932 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3944 -initialChannelId {1c738d6b-eb37-44ac-afc3-bc29f908bacb} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            3⤵
            • Checks processor information in registry
            PID:3272
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3976 -prefsLen 27274 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4188 -initialChannelId {fac0c7cc-1e69-46e8-8bff-2e5d92ddb2b2} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            3⤵
              PID:260
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2660 -prefsLen 34773 -prefMapHandle 2884 -prefMapSize 270279 -jsInitHandle 2964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2744 -initialChannelId {8d9a7def-b6b6-437e-bfc2-3701a940d406} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
              3⤵
              • Checks processor information in registry
              PID:4144
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4996 -prefsLen 35010 -prefMapHandle 5000 -prefMapSize 270279 -ipcHandle 5008 -initialChannelId {35ae6978-d755-45a2-9ac3-3bfddc96d23a} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
              3⤵
              • Checks processor information in registry
              PID:5832
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32952 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 2608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1588 -initialChannelId {af6e9c61-41cf-4c8a-9a2e-af50260a7942} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
              3⤵
              • Checks processor information in registry
              PID:1848
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32952 -prefMapHandle 5640 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {3cbc8f5c-6bf4-47c2-92a5-740cbd7912f0} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
              3⤵
              • Checks processor information in registry
              PID:5140
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5824 -prefsLen 32952 -prefMapHandle 5828 -prefMapSize 270279 -jsInitHandle 5832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5840 -initialChannelId {7d9475b4-8e0e-4a1e-a598-3b871481c9bf} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
              3⤵
              • Checks processor information in registry
              PID:3076
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9796 -prefsLen 37274 -prefMapHandle 9660 -prefMapSize 270279 -jsInitHandle 9800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13584 -initialChannelId {ee8c18a5-9d65-4242-9dc3-872e3b414021} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
              3⤵
              • Checks processor information in registry
              PID:5264
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:3920
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\CRACK\install.txt
            1⤵
            • Opens file in notepad (likely ransom note)
            PID:2596
          • C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\BCCAE701Win_CS5.exe
            "C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\BCCAE701Win_CS5.exe"
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1060
            • C:\Windows\SysWOW64\MSIEXEC.EXE
              MSIEXEC.EXE /i "C:\Program Files (x86)\Boris FX, Inc\Downloaded Installations\{FD21283E-7491-4560-9B35-3DBA22521C5E}\BCCAE700Win.msi" /L* C:\Users\Admin\AppData\Local\Temp\BCCAE7InstallLog.txt SETUPEXEDIR="C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE"
              2⤵
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:4572
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Badlisted process makes network request
            • Enumerates connected drives
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:6016
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 49E8846E5048BA1CFD4D852D19A4FA88 C
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4552
            • C:\Windows\system32\srtasks.exe
              C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
              2⤵
                PID:1504
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 533DDEABEC0DC803E8A7B38C1E5632BB
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5668
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 10C244C847A52C635195AF9F51935B2F E Global\MSI0000
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4920
            • C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
              C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe -Embedding
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2772
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              PID:1748
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3432
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4108
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                  3⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:1988
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa0,0x134,0x7ffd6134c728,0x7ffd6134c734,0x7ffd6134c740
                    4⤵
                      PID:6036
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,4974971440430404233,11171997971369338874,262144 --field-trial-handle=1836,i,5887733464711616420,10760150702286949420,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
                      4⤵
                        PID:2352
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,16401910240919843300,90957711047095338,524288 --field-trial-handle=1836,i,5887733464711616420,10760150702286949420,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
                        4⤵
                        • System Time Discovery
                        PID:4504
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,11473962325451944267,3818669919523606684,524288 --field-trial-handle=1836,i,5887733464711616420,10760150702286949420,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
                        4⤵
                          PID:4648
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,17825940495064354059,16462791143323648412,2097152 --field-trial-handle=1836,i,5887733464711616420,10760150702286949420,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
                          4⤵
                            PID:4004
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,11770766630460754487,161929081588390340,2097152 --field-trial-handle=1836,i,5887733464711616420,10760150702286949420,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                            4⤵
                              PID:5860
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4648,i,3163587806643020239,18054928314200176166,2097152 --field-trial-handle=1836,i,5887733464711616420,10760150702286949420,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
                              4⤵
                                PID:1372
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,3397946455898649791,10689857769294174578,524288 --field-trial-handle=1836,i,5887733464711616420,10760150702286949420,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
                                4⤵
                                  PID:3112
                              • C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\CRACK\patch.exe
                                "C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\CRACK\patch.exe"
                                3⤵
                                  PID:4744
                                  • C:\Windows\SysWOW64\regedit.exe
                                    "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\\regpatch.reg"
                                    4⤵
                                    • Runs .reg file with regedit
                                    PID:1260
                                  • C:\Windows\SysWOW64\regedit.exe
                                    "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\\regpatch.reg"
                                    4⤵
                                    • Runs .reg file with regedit
                                    PID:4116
                                • C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\CRACK\patch.exe
                                  "C:\Users\Admin\Downloads\Boris.Continuum.Complete.7.01.AE\Boris.Continuum.Complete.7.01.AE\CRACK\patch.exe"
                                  3⤵
                                    PID:3012
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                1⤵
                                • Suspicious use of SetWindowsHookEx
                                PID:2592
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Suspicious use of SetWindowsHookEx
                                PID:3524
                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                1⤵
                                  PID:6096
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:3276
                                  • C:\Windows\system32\AUDIODG.EXE
                                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E0
                                    1⤵
                                      PID:3808

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          e5da08c.rbs
                                          • Path C:\Config.Msi\e5da08c.rbs
                                          • Size 51KB
                                          • SHA256 eeb06175be9f2a0c8adc34261e2e06e88f24ff999b11bd7e3573da0a4b6b1a7f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          IDriver.exe
                                          • Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
                                          • Size 744KB
                                          • SHA256 e398cb00486e49de8f3dfa278cce395fd4c02a4795fb61b2e73653cbcdb75eea
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          IScrCnv.dll
                                          • Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IScrCnv.dll
                                          • Size 256KB
                                          • SHA256 02a761aa2c05fe1b3f95284557bd55ac9d6a82ab72a18de70dac1820c6f03751
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          iGdiCnv.dll
                                          • Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\iGdiCnv.dll
                                          • Size 176KB
                                          • SHA256 aa86d6fa20a0be2d41aec48a47b5d94f316acb4c4b7d8c6054d9988b27d108d7
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          iusercnv.dll
                                          • Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\iusercnv.dll
                                          • Size 168KB
                                          • SHA256 820a03405d4a7a0ddc20f7be3c79266d1bbc6a7778c791c6de260ac9c51e77ec
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          objpscnv.dll
                                          • Path C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\objpscnv.dll
                                          • Size 32KB
                                          • SHA256 dbe6d61dbd15894aa2a304d36c2a6ec0e8e3e78438df35124ba2bd58df9e6e6a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          ISRT.DLL
                                          • Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\ISRT.DLL
                                          • Size 400KB
                                          • SHA256 dce057a7eeea266a1cbc630505d08eed458284b30e25dab4f7c7ae142835b660
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _ISRES1033.DLL
                                          • Path C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\_ISRES1033.DLL
                                          • Size 528KB
                                          • SHA256 14d8231e716b79e66d2ef1a971f74ff6244af0c89717977e7131e7cf7de2072b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          BookmarkMergedSurfaceOrdering
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                          • Size 6B
                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          BrowsingTopicsState
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                          • Size 649B
                                          • SHA256 e72ff1403006d678b3ea1307338eb89471db426d55b360fa29f567ef69e5f8cf
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          292ba289-e103-4661-848d-6b4b8b27ef6e.tmp
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\292ba289-e103-4661-848d-6b4b8b27ef6e.tmp
                                          • Size 1KB
                                          • SHA256 b71132f133238b78bbf135e7250dcc2827191c5df2e3304c91cd48c81a0079a2
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          2a79a94c-3a9f-44fc-8799-95d4c6ae8854.tmp
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2a79a94c-3a9f-44fc-8799-95d4c6ae8854.tmp
                                          • Size 523B
                                          • SHA256 65c56f9b718d3505c7ace3a9d11b69786f1cb2f7ddfcc7101556466a512ab357
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          SCT Auditing Pending Reports
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                          • Size 2B
                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                          • Size 10KB
                                          • SHA256 ca38245d935ba6abe534f9faa6a753565a81099b32af2acc197eb6f72773919e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Secure Preferences
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                          • Size 11KB
                                          • SHA256 5bfc57bbf01808fd012652fe41b3c9f2681159a7a6d60659be5fc6a34535a5bf
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          • Size 4KB
                                          • SHA256 90f82a181a26344f5c9a54981092a92bd7a2e70335dcb3bdefa6228b8c7c0d6f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          • Size 5KB
                                          • SHA256 4005d730923ada63873de98c7b5dd8c140595d60c1177ecd6fdbbd8a8fb6c3d0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data_1
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                          • Size 264KB
                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                                          • Size 16KB
                                          • SHA256 ddb0669de00d6fa5e71d5dd0b4530e7bae83e649de68b55b6ca10a395798b108
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          prep_Activatable Class_Hermes_perf.cache
                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                          • Size 607B
                                          • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          8860a991-1fc3-40ba-91a8-f6d3f758080a.zip
                                          • Path C:\Users\Admin\AppData\Local\Temp\8860a991-1fc3-40ba-91a8-f6d3f758080a.zip
                                          • Size 3.8MB
                                          • SHA256 4449a0ec139e3b42a1d2670be8818b201101b6135dedaa582f00bd2bcc3128a2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          BCCAE7InstallLog.txt
                                          • Path C:\Users\Admin\AppData\Local\Temp\BCCAE7InstallLog.txt
                                          • Size 13KB
                                          • SHA256 2b0104079abbf5db9fb097cf7ad576634484d2ddc92ce65ad98c05f77743c0aa
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          DLL_{A31D5812-F0AA-4AFA-B584-C2C4AC141518}.ini
                                          • Path C:\Users\Admin\AppData\Local\Temp\DLL_{A31D5812-F0AA-4AFA-B584-C2C4AC141518}.ini
                                          • Size 547B
                                          • SHA256 1cc683c9fb2b3c6eb05692a698d7fcdf2b0cce27b44913a3200dd949776ba203
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          DLL_{A31D5812-F0AA-4AFA-B584-C2C4AC141518}.ini
                                          • Path C:\Users\Admin\AppData\Local\Temp\DLL_{A31D5812-F0AA-4AFA-B584-C2C4AC141518}.ini
                                          • Size 547B
                                          • SHA256 9b6707c0d59e9c929c828d1974f57654b63841755938add0d3b4c0a270ca61a6
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          MSIBDA6.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\MSIBDA6.tmp
                                          • Size 108KB
                                          • SHA256 58170b73eb7a56c8aa2b2750b6baeecbb316bd44958722b11ae88806c0740663
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          MSIC42F.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\MSIC42F.tmp
                                          • Size 48KB
                                          • SHA256 e773262195ea40982cdb692ef53f65966b3e11c7cad9920098e95710b808f1fc
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          MSIC440.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\MSIC440.tmp
                                          • Size 212KB
                                          • SHA256 fcbb310b111c96909bc4dc3fa0cd6cd2e020e18b7321052cb5adebe6bc713e61
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          RegistryDLL.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\RegistryDLL.dll
                                          • Size 42KB
                                          • SHA256 6ffa08d02669d0966e6c35847298eeeae20209e38134f8da81706f7476f2269c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          SerialDLL.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\SerialDLL.dll
                                          • Size 141KB
                                          • SHA256 54c3d67758af1409f2d5a364c282222e878b80af07d77eb43985e9700a1754b6
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          0x0409.ini
                                          • Path C:\Users\Admin\AppData\Local\Temp\_is8D21\0x0409.ini
                                          • Size 5KB
                                          • SHA256 43160e278e4302e378e754149c6394bc51d1969a7941687cfcc6c00b25151282
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          ISScript10.Msi
                                          • Path C:\Users\Admin\AppData\Local\Temp\_is8D21\ISScript10.Msi
                                          • Size 876KB
                                          • SHA256 76e1acaa795755548fccf95bf99590febb1474d70ef107c4ff589df77d65df4a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Setup.INI
                                          • Path C:\Users\Admin\AppData\Local\Temp\_is8D21\Setup.INI
                                          • Size 2KB
                                          • SHA256 77d5cf35a9b6ab4d33d6b2dbf3136c073887b7cd8d496f2c1eb477a6bcad02ad
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          _ISMSIDEL.INI
                                          • Path C:\Users\Admin\AppData\Local\Temp\_is8D21\_ISMSIDEL.INI
                                          • Size 11B
                                          • SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          tmpaddon
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                          • Size 11KB
                                          • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          tmpaddon
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                          • Size 502KB
                                          • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          IsConfig.INI
                                          • Path C:\Users\Admin\AppData\Local\Temp\{A31D5812-F0AA-4AFA-B584-C2C4AC141518}\IsConfig.INI
                                          • Size 64B
                                          • SHA256 21a9be63265f62c1f890dcaccfc8e7409548e3a0c792d1281cb3c7906440a7f6
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          String1033.txt
                                          • Path C:\Users\Admin\AppData\Local\Temp\{A31D5812-F0AA-4AFA-B584-C2C4AC141518}\String1033.txt
                                          • Size 91KB
                                          • SHA256 efe0ef6c5d676625b9de35889df1e76ec841735ac4d279338e97ad2bbe2c9d8e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          setup.inx
                                          • Path C:\Users\Admin\AppData\Local\Temp\{A31D5812-F0AA-4AFA-B584-C2C4AC141518}\setup.inx
                                          • Size 236KB
                                          • SHA256 54bb48927090d183cfeaaa36eb658b79b8d76a643d266b285173427cf37cd213
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data.safe.tmp
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
                                          • Size 7KB
                                          • SHA256 4c44543047c4f0b1f8955c91308ba0a62b1d8c7a3adea5b362083aaf95b5f2f8
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data.safe.tmp
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
                                          • Size 26KB
                                          • SHA256 0d9784d7736da9ffbd7c1f9a7204d8c7ac5a2bc5612e146b56c753f6246fd61a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data.safe.tmp
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
                                          • Size 40KB
                                          • SHA256 9dc18cd3e0b03c6f3b171c83a198c6e175645f42020830e6c879a87fe144806f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data.safe.tmp
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
                                          • Size 26KB
                                          • SHA256 360dda8c5f2bed156582a2d20c7af4180f84e1dc9262463b4864460fc094c739
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          events
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
                                          • Size 1KB
                                          • SHA256 7c05c314a08bb4da8adb0dd7e013fb13bd40bbf9962abaecb07b7a4303f7dc95
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          03d8f109-c7ef-4d1f-9746-a537a4b4577c
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\03d8f109-c7ef-4d1f-9746-a537a4b4577c
                                          • Size 883B
                                          • SHA256 8afe78639c61d9d6398ced919e06b42f6f77f76aae21ccec76149fea5843a3a6
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          39fb7430-b63a-4890-b07c-235610cf8515
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\39fb7430-b63a-4890-b07c-235610cf8515
                                          • Size 6KB
                                          • SHA256 f3a2c9bed665df1d0169611f29aaf0f1715cbf6fd8decf1b76e194e15444c812
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          8a952a66-2b69-4147-8fcd-90241d1d2707
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\8a952a66-2b69-4147-8fcd-90241d1d2707
                                          • Size 235B
                                          • SHA256 1f99c5953b8e63fc9fc21c20ee91b91b1112a782e644afb75adaf5f8464b40ef
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          b7a94228-cb33-4e27-9abe-678e8750031f
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\b7a94228-cb33-4e27-9abe-678e8750031f
                                          • Size 886B
                                          • SHA256 4568bf2919133f6eb1a8e41e090de45bcf1e5aa231ceec2b8dab6cdeee6d1575
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          c93f6b85-5972-4548-a770-1e1aac7e9a74
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\c93f6b85-5972-4548-a770-1e1aac7e9a74
                                          • Size 2KB
                                          • SHA256 43ae1ec5c61b67938239e6964f6feb8c015a445531fe4af77246becdc7390852
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          ce42b819-7286-4d5a-966e-b30f584efbe5
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\ce42b819-7286-4d5a-966e-b30f584efbe5
                                          • Size 16KB
                                          • SHA256 943abb5aa5b643f6b5842be93aabbc907a21c07702c9d0e52ebf407dcf296a01
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          f16748df-5c67-4dc2-a2a4-95afcd357f46
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\f16748df-5c67-4dc2-a2a4-95afcd357f46
                                          • Size 235B
                                          • SHA256 a0d24657ef5cabae38762b437fdf9810b22b831988b4a4ee3a5fd6436de08afd
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          extensions.json
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extensions.json
                                          • Size 16KB
                                          • SHA256 0dc716e4b29c1dc351afc7cf3db6472972402bb2fcfcd27f0a1c0bc89a2fead4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          gmpopenh264.dll
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                          • Size 1.1MB
                                          • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          gmpopenh264.info
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                          • Size 116B
                                          • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          manifest.json
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                          • Size 1002B
                                          • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          widevinecdm.dll
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                          • Size 21.6MB
                                          • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          prefs-1.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
                                          • Size 7KB
                                          • SHA256 92ca70f956a6c8cb0b3b818f2abace3339e355a27f12cd409a0b3ed64e12607c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          prefs-1.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
                                          • Size 10KB
                                          • SHA256 6302d7c9b6655f3c9b9467dacac88351dfd8f5ed58208b1150f52b3dfc30f273
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          prefs-1.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
                                          • Size 12KB
                                          • SHA256 204bb623bc0cf85dd351e18faed7d7d0bbadbeb57a521e4ae8ca383be63667f9
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          prefs-1.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
                                          • Size 6KB
                                          • SHA256 854f302a6e676841ba9b24568cc8fe0bc21b2ae4bd8c101a1e4311ebd7074cdc
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          prefs.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
                                          • Size 6KB
                                          • SHA256 55b541ca0ad412a4bd56465100e14bef39e1a33bf5b6b3b899e273d7c3a39ef1
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          prefs.js
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
                                          • Size 6KB
                                          • SHA256 d167a5a6ce401348a03d0042b56f4e8b17ca8ea6b46d38770fd33b9b3dd54420
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          recovery.jsonlz4
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
                                          • Size 1KB
                                          • SHA256 5844f09af60d0b62750207d056477a4a5674ffd2ab24169b0c0993e6efe0409f
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          3870112724rsegmnoittet-es.sqlite
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                          • Size 14.1MB
                                          • SHA256 3ff3625b483061f630e58a5b8dcb7187469d6a30d3e281e8498c4c987579763a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          3870112724rsegmnoittet-es.sqlite
                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                          • Size 14.1MB
                                          • SHA256 a68e88b6006af70788fc5feefc894529928cfb46c973fcf5e8e6f2e01188d277
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          metadata-2
                                          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                          • Size 26.1MB
                                          • SHA256 aaa4b62d8cc45dc1e57c9ef2d5eb44d20480fc17fde67130c31f788d1d3f9271
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          {1651195f-04c0-47ce-afb0-6f07531fb37b}_OnDiskSnapshotProp
                                          • Path \??\Volume{f0fdc120-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1651195f-04c0-47ce-afb0-6f07531fb37b}_OnDiskSnapshotProp
                                          • Size 6KB
                                          • SHA256 6a2d82e4e88203994ee2fa8c8d2dc9e10f06399028840adcfbe27481d4c9ec21
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          memory/2592-13214-0x0000026B801E0000-0x0000026B802E0000-memory.dmp
                                          Download

                                          memory/2592-13258-0x0000026B94840000-0x0000026B94860000-memory.dmp
                                          Download

                                          memory/2592-13225-0x0000026B81EA0000-0x0000026B81EC0000-memory.dmp
                                          Download

                                          memory/2592-13226-0x0000026B943E0000-0x0000026B944E0000-memory.dmp
                                          Download

                                          memory/2592-13243-0x0000026B84340000-0x0000026B84360000-memory.dmp
                                          Download

                                          memory/2592-13212-0x0000026B801E0000-0x0000026B802E0000-memory.dmp
                                          Download

                                          memory/2772-8847-0x0000000003640000-0x00000000036C6000-memory.dmp
                                          Download

                                          memory/2772-8851-0x00000000036F0000-0x000000000371E000-memory.dmp
                                          Download

                                          memory/2772-8840-0x00000000035D0000-0x00000000035FC000-memory.dmp
                                          Download

                                          memory/2772-8835-0x00000000033D0000-0x0000000003436000-memory.dmp
                                          Download

                                          memory/3012-13613-0x0000000000400000-0x00000000004A7000-memory.dmp
                                          Download

                                          memory/3012-13608-0x0000000000400000-0x00000000004A7000-memory.dmp
                                          Download

                                          memory/4108-13443-0x000000000E220000-0x000000000EA9B000-memory.dmp
                                          Download

                                          memory/4108-13399-0x000000000E220000-0x000000000EA9B000-memory.dmp
                                          Download

                                          memory/4108-13378-0x000000000E220000-0x000000000EA9B000-memory.dmp
                                          Download

                                          memory/4108-13610-0x000000000E220000-0x000000000EA9B000-memory.dmp
                                          Download

                                          memory/4108-13573-0x000000000E220000-0x000000000EA9B000-memory.dmp
                                          Download

                                          memory/4108-13602-0x000000000E220000-0x000000000EA9B000-memory.dmp
                                          Download

                                          memory/4552-8822-0x0000000003080000-0x000000000309D000-memory.dmp
                                          Download

                                          memory/4744-13604-0x0000000000400000-0x00000000004A7000-memory.dmp
                                          Download

                                          memory/4744-13611-0x0000000000400000-0x00000000004A7000-memory.dmp
                                          Download

                                          memory/4744-13612-0x0000000000400000-0x00000000004A7000-memory.dmp
                                          Download

                                          memory/4744-13617-0x0000000000400000-0x00000000004A7000-memory.dmp
                                          Download

                                          memory/5668-8900-0x00000000029E0000-0x00000000029FD000-memory.dmp
                                          Download

                                          memory/5668-8906-0x00000000029E0000-0x0000000002A16000-memory.dmp
                                          Download

                                          memory/5668-13394-0x0000000000A00000-0x0000000000A1D000-memory.dmp
                                          Download