4fa4785deef3fb9bc9df4fddcb54023191df31fae237235eb790db6e8a1a28d0

Analysis

user interaction
yes
max time kernel
149s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ripper.exe
Size 7.1MB
Sample261017-yle7nsgf64
SHA256 4fa4785deef3fb9bc9df4fddcb54023191df31fae237235eb790db6e8a1a28d0
MD5 e2f807082c61947738a412d5c7e0e8a9
SHA1 22ada656108c39bd515f7ced87692d824004a78f
SHA512 50aafa442b5b3e17d0ae87189e49350a2e89b9790119f9bb2a94690f2dfa095bb4098c79117087da352d5762948c15b250bdd97965f9590a47b950cdc3ee5f86
SSDEEP 49152:CX26Kzk1CTTHwyx7NxM+FZ8MmUVY5H+rDWFMBd2NFOXCswAyHtX9TSH8x3KuKPfJ:CXdK5HdAQZNmo4eriFMBGQMKzYbqhP+
TLSH
T127767B02B65B99ECD05AC8B0934696735E2274CB0B36B9FF41C855383F6ABE05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3616	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3840	chrome.exe
3840	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeShutdownPrivilege	3840	chrome.exe
Token: SeCreatePagefilePrivilege	3840	chrome.exe
Token: SeDebugPrivilege	4564	firefox.exe
Token: SeDebugPrivilege	4564	firefox.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1344	ripper.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
4564	firefox.exe
4564	firefox.exe
4564	firefox.exe
4564	firefox.exe
4564	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe
3840	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4564	firefox.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3636	3840	chrome.exe	95
PID 3840 wrote to memory of 3616	3840	chrome.exe	97
PID 3840 wrote to memory of 1772	3840	chrome.exe	98
PID 3840 wrote to memory of 1772	3840	chrome.exe	98
PID 3840 wrote to memory of 2428	3840	chrome.exe	99
PID 3840 wrote to memory of 2428	3840	chrome.exe	99
PID 3840 wrote to memory of 2044	3840	chrome.exe	100
PID 3840 wrote to memory of 1956	3840	chrome.exe	101
PID 3840 wrote to memory of 2044	3840	chrome.exe	100
PID 3840 wrote to memory of 1956	3840	chrome.exe	101
PID 3840 wrote to memory of 3568	3840	chrome.exe	102
PID 3840 wrote to memory of 3568	3840	chrome.exe	102
PID 3840 wrote to memory of 1036	3840	chrome.exe	103
PID 3840 wrote to memory of 1036	3840	chrome.exe	103
PID 3840 wrote to memory of 2776	3840	chrome.exe	104
PID 3840 wrote to memory of 4580	3840	chrome.exe	107
PID 3840 wrote to memory of 4580	3840	chrome.exe	107
PID 3840 wrote to memory of 4588	3840	chrome.exe	108
PID 3840 wrote to memory of 4588	3840	chrome.exe	108
PID 3840 wrote to memory of 436	3840	chrome.exe	110
PID 3840 wrote to memory of 436	3840	chrome.exe	110
PID 4432 wrote to memory of 4564	4432	firefox.exe	117
PID 4432 wrote to memory of 4564	4432	firefox.exe	117
PID 4564 wrote to memory of 2492	4564	firefox.exe	118
PID 4564 wrote to memory of 2492	4564	firefox.exe	118
PID 4564 wrote to memory of 2492	4564	firefox.exe	118
PID 4564 wrote to memory of 2776	4564	firefox.exe	119
PID 4564 wrote to memory of 2776	4564	firefox.exe	119
PID 4564 wrote to memory of 2776	4564	firefox.exe	119
PID 4564 wrote to memory of 2776	4564	firefox.exe	119
PID 4564 wrote to memory of 4396	4564	firefox.exe	120
PID 4564 wrote to memory of 4396	4564	firefox.exe	120
PID 4564 wrote to memory of 4396	4564	firefox.exe	120
PID 4564 wrote to memory of 4396	4564	firefox.exe	120
PID 4564 wrote to memory of 1480	4564	firefox.exe	121
PID 4564 wrote to memory of 1480	4564	firefox.exe	121
PID 4564 wrote to memory of 1480	4564	firefox.exe	121
PID 4564 wrote to memory of 3576	4564	firefox.exe	122
PID 4564 wrote to memory of 3576	4564	firefox.exe	122
PID 4564 wrote to memory of 3576	4564	firefox.exe	122
PID 4564 wrote to memory of 3576	4564	firefox.exe	122
PID 4564 wrote to memory of 5740	4564	firefox.exe	123
PID 4564 wrote to memory of 5740	4564	firefox.exe	123
PID 4564 wrote to memory of 5740	4564	firefox.exe	123
PID 4564 wrote to memory of 5740	4564	firefox.exe	123
PID 4564 wrote to memory of 5768	4564	firefox.exe	124
PID 4564 wrote to memory of 5768	4564	firefox.exe	124
PID 4564 wrote to memory of 5768	4564	firefox.exe	124
PID 4564 wrote to memory of 5768	4564	firefox.exe	124
PID 4564 wrote to memory of 5780	4564	firefox.exe	125
PID 4564 wrote to memory of 5780	4564	firefox.exe	125
PID 4564 wrote to memory of 5780	4564	firefox.exe	125
PID 4564 wrote to memory of 5780	4564	firefox.exe	125
PID 4564 wrote to memory of 5868	4564	firefox.exe	126
PID 4564 wrote to memory of 5868	4564	firefox.exe	126
PID 4564 wrote to memory of 5868	4564	firefox.exe	126
PID 4564 wrote to memory of 5868	4564	firefox.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ripper.exe
"C:\Users\Admin\AppData\Local\Temp\ripper.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff90eccc728,0x7ff90eccc734,0x7ff90eccc740
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,14280571081820610050,3323688602473102695,524288 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,13083409533308182038,2600053500816909393,262144 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,9245330110251616931,13534750706715307463,524288 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,9184990314520008601,2632752510971741817,2097152 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,1259864990141596827,12063199880392349799,2097152 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,10854513167930647314,16398729968062782061,2097152 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,15782381514423016914,9396358884436529290,2097152 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,10382948566160080447,6705481342121790886,524288 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5580,i,8382091582556482723,936347233958793987,2097152 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4784,i,3277899576709988805,11472188767472940686,2097152 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3360,i,10409945613972939580,3301840444597146149,2097152 --field-trial-handle=2116,i,5277899911913340542,12783035414935590118,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {eee665cd-3aec-4775-a3b3-f0493237f73b} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {19d7bdfa-9e01-4e4b-8ccd-068beb686ead} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752 -prefsLen 27276 -prefMapHandle 3756 -prefMapSize 270279 -jsInitHandle 3760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3768 -initialChannelId {cc281e47-efa0-47d0-9bd3-9c55cf5578f2} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27276 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 3948 -initialChannelId {59b4a0c4-54d5-4a1f-9eba-0e32d3ced9d8} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3064 -prefsLen 34775 -prefMapHandle 3068 -prefMapSize 270279 -jsInitHandle 3084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2996 -initialChannelId {468dbcdd-5f31-4e83-ad51-08cb6493d55e} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4672 -prefsLen 34905 -prefMapHandle 4668 -prefMapSize 270279 -ipcHandle 2928 -initialChannelId {a8afe675-4e86-4a95-9e2e-35cdf92f817f} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4860 -prefsLen 32845 -prefMapHandle 4864 -prefMapSize 270279 -jsInitHandle 4868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4876 -initialChannelId {4e71be09-910a-4af4-a259-137c35038139} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32845 -prefMapHandle 5096 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {26768b55-6a8e-47b1-b15a-b525b2008da7} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32845 -prefMapHandle 5268 -prefMapSize 270279 -jsInitHandle 5264 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5084 -initialChannelId {36b2d397-9676-4603-bbc7-042aca4fc3f2} -parentPid 4564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3a67985b-192e-4762-a158-5c6519bdc919.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3a67985b-192e-4762-a158-5c6519bdc919.tmp
Size 131KB
SHA256 909944ccb7e41d374c4ad13d0155d2816a5666b332dd34d2bf05b325a962edc2
MD5 9eefba8ff72fe008eb6c984e3d32b350
SHA1 8e5b1a7c96a6fb702a0ddef75ffcf62f3abfc2cc
SHA512 76cebc76a98daf5029eb05842bc6d26eca8e6bd86521f630b3d339749ae4fadf58483cedef438f970960d3bb332453ef3d7003b7452f3f660d97756cc711e132
SSDEEP 3072:1/+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:1/+hFD+7t56OD9ZfSAppr3
TLSH
T1F1D302326A95D8BB8AFD6541F157A304DE626CED81DE3A0984465F8ED09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

410af8c1-ebbc-4f03-b6f0-2c117fdfb85a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\410af8c1-ebbc-4f03-b6f0-2c117fdfb85a.tmp
Size 130KB
SHA256 f59289213414f48550e88c65b2e6d6f9181af146861919827396d2eba0017b17
MD5 22402ab5519f6a640de18837081e6739
SHA1 804306a70965ef5c919f20941e03f925479b16e6
SHA512 b93d17e95c70defb8b0c6a0080825e59f4240972a0830d4eb3a28316ec587c81013abaaabf74c34d942ca28c6994488ac7b106711c6b563e75b17d828440c984
SSDEEP 3072:f+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:f+hFD+7t56OD9ZfSAppr2
TLSH
T14AD31232AA91D8BBC9BC6541B157A300DE726CED81DE3A0944495F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7038a5d2-1c85-484e-bccc-083d1630c2cc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7038a5d2-1c85-484e-bccc-083d1630c2cc.tmp
Size 131KB
SHA256 2ac6fe17bc925c227bb649299392e7c2e14381f7fce3504d38e92bca5caa9e4b
MD5 10a11eb002b763d704d7411285b62781
SHA1 8d7bf9577ec5bf45ff3677afcd98de640bbca96a
SHA512 ff72e9ec0457eb87a540f6b8c883108efc1dcfddf5e132fd6319a000fb9182cde6faed1cb7bd6f78705fcab69f3c390b655537e64736d1185d69e2417d3515f0
SSDEEP 3072:ek+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:ek+hFD+7t56OD9ZfSAppr3
TLSH
T1F5D312326995D8BB8AFD6541F157A304DE626CED81DE3A0984465F8ED09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4804f5345dd7a1abbf91d44a7d836e7cbb1ee9fa6385975e53c6f8ec96c6c47d
MD5 32c88c9b05a228b002f5b75dfb4c0817
SHA1 3cfbfb4201df76afff930c067ab2c233fa2beb39
SHA512 89395192d03f0f9a91b688fc636f3d51b65a076c4acf3bf3ba0fdfc95cfd25b45ed242cdb8af832a41a19e32ea5d26632a963197aa1d5794faf628696e9cfac8
MD5 SHA1 SHA512

Submit Download

0d61d2ad-1079-4151-958f-5050113208ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d61d2ad-1079-4151-958f-5050113208ee.tmp
Size 414B
SHA256 397f06e8469b16ecd84e4ee8223dae9ed1fda0b4066316acf8971d3a782c4556
MD5 366d70dbe6051ccda7cde676a2527907
SHA1 2272d5db4b491e4f73bd683dc857c0eb48332a00
SHA512 3e799c02973c1e6663acb7daf0f57c0d6d43ede5c336c6d97c2b58b7a4b8942f3075f975c73c0873595e68211203b16ba00f5d268dc572dd12f103cccfedaca2
TLSH
T1BAE02BFEC933FC2758FD0B595054064AE741135B3A41894F3B3D41088FB563702C985C
MD5 SHA1 SHA512 TLSH

Submit Download

26222685-29f8-47f6-85ca-6c4800e721fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\26222685-29f8-47f6-85ca-6c4800e721fe.tmp
Size 12KB
SHA256 60aa9ac892359b24118fde7d9dfd595e86d2b851769334ee1b708e2a7a2e2a00
MD5 f3526b25c2e4740ced8630a27a65313a
SHA1 9db0b6c2dff0c6c0e0648c2d7150cd6b134a2b3e
SHA512 01547b0bab43c26927aea7c3d0da89646951112e0bea707c4dda750b55e4196836ca63eaa627fe03d65a607279042ae5348d0e995e717e0a6491649f529abb94
SSDEEP 192:4yRtncBextjVFHIrW9JJy/v7+pAPRp2+h9THsb+WNnZ+0p0JE0NkzakrzPyIsnA4:fRZmeLPHVeaUXz9ww0CdNCaE8
TLSH
T14542A42DB9147A3B5CEBC22AFA667B53D7F5103174982E84E6FC892C14EB5CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

866eb98c-cab5-4608-af72-4280c4bad7e7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\866eb98c-cab5-4608-af72-4280c4bad7e7.tmp
Size 1KB
SHA256 0e269cadbc4a950b15989db243175811f8c6e9e5791a8f2e4ec472f28c845208
MD5 58c214d31b9226310ee075fa43d0c193
SHA1 d0bf51af1163bdfaa1a87d0ae5ed68ba7cdb3174
SHA512 b07201f6a64f339ee8d57924504c88c3802e7cd9f9a0b8869af6bd1d5c8785908ff8efce4406140ace39fe5811302b68320a618d5943a17a036379c7d472fb1e
TLSH
T1DC2136F71370997E8710D2E4EA15AE1FCE790121131C78B685A46D2743F39A2D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

9d8937d5-20d0-4865-b46d-2bce7ba64473.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9d8937d5-20d0-4865-b46d-2bce7ba64473.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 b1f5046c88778f262522b66e74db58957046e798267d44003e415abfa6993d40
MD5 91d788d0f1a2967e2bedf8d5ab1f3775
SHA1 09e17773bc4105aa913164e5d92e5a287d177b4e
SHA512 909e865132518202cd70c327c01ed6892a9cac2b43d76b71b9a3ed68949529fc23b6c6dc07e8d586423d669e03ed154f920374da16b91beadd8600fa9f13b9d0
TLSH
T182B01214C0415350C01301F4111014983564DF21A504234241F40DD2DC350E1812B1B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 7602a2213ed37e094282ad1733939956103a5387d88a8461188f72d77602ba79
MD5 9b653f15487ca6260d4e60a744fb8ceb
SHA1 c5b764a7fb9002753eb02651c54f2561fb14adb6
SHA512 498eb804a7febe2b887e5f17b79797c46da1285bb9a022c217693f141758bcf7f488880842be236df452253d15d1c932786a1aec8acef665b1ca35741fd8a79c
TLSH
T11AB02203C003A282C0820BB02880C0CC32B0EF22C2030202C2E00A33CC2023000202A0
MD5 SHA1 SHA512 TLSH

Submit Download

a831a8ab-eeb2-4c40-b035-6f6bf36d7f22.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a831a8ab-eeb2-4c40-b035-6f6bf36d7f22.tmp
Size 12KB
SHA256 7692f1a2b89c94bd728f64fc32f2d5924cd8a8dcb2d7c1c9e4be9ff555970e40
MD5 16c8befc1cd04f8e043393e2c4390435
SHA1 6b109576af1ee5b4037d2c69262f0a4620210760
SHA512 a507942f30fd9eaa1d3357efcc92e0d55c193e63a14f23b2437f69654c2eaa729d291e7e0b88dad35494865ed611064e47478716099337e8214c18cf4d2b496c
SSDEEP 192:4yRt7xtjVFHIrW9JJy/v7+pAPRp289THsb+WNnZ+0q0JE0NkzakrEVyIsnAUgtaJ:fRlLPHVeaUX79ww0vdNCaH8
TLSH
T19C42942DBA147A3B5CEBC32AEA617B57D7F5103174982E84E6FC892C14EB5CC621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4499599-c099-4cf6-b774-c8bba3f2c9a0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4499599-c099-4cf6-b774-c8bba3f2c9a0.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5d75442-d9a8-41b1-a8d6-b1148efa2562.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d5d75442-d9a8-41b1-a8d6-b1148efa2562.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\acaoqdel.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 3f4fba1ded6681cc20c8f8d81bf08517ae4a5c7a1b9bcbe860a4a42b98c218bd
MD5 74bd01c65d8961cc1503be6bd87cb5da
SHA1 da953a88f875ae09fe736bb98246f83cbf68b9e3
SHA512 e20e029d7025654ce1207817f51ee326bcf3e5cc7f5260fe14ab358946d4d9e579c1f07aa055109b18674b28428047435dc09649e33095a329ab4bebb216e052
SSDEEP 768:wByxdhQsDm3MoPi51i8Dki+rfLariz2jtZPo4Y4ROOrEmMVTK2CmSany+GL:wwxduyM8I2O2jDPo4YNVVTZoaTGL
TLSH
T13873FBE3D6E871BB0BA477C72C0F7A5B52E10195E38602C9EDEAC61C81DD658123E5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\acaoqdel.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

23168

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\acaoqdel.default-release\cache2\doomed\23168
Size 52B
SHA256 f605785968036d148fca75fa8bbb51a399b2db2eb0b2829a10d711499e61011c
MD5 adb03afba9efd16dffffb2fc4a5732f4
SHA1 e8496f2c9caad23564b493b85da581188c3f36e8
SHA512 26195ff7f91b1dba9f0f30d276e20a0bb532da0f8185ae0b35cc789f7217ec531abe1f7885b6966935498446ed71fe66840035cebc0f2fbd727153372294b39b
TLSH
T1CF9002054351C620D416C5330C09D5F405907E04488402633499075735524D20001214
MD5 SHA1 SHA512 TLSH

Submit Download

6616

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\acaoqdel.default-release\cache2\doomed\6616
Size 122B
SHA256 4ae593b8f10eb273602de53a12cf995d53742acb9d33bffd6673b9cea782c769
MD5 4a7b363ac4f2292699b327e6624efea5
SHA1 fcb24578547b57e6e48d9e9053f2de19e118668d
SHA512 622b5a9ab5a08eb402e6f78f111452ce8c2c21a53d0f4c5b6fb13bed380c54f0af3883b6eb2959c5853217f6c7838ea10500b4afb3e7267dea4eff4234935ea5
TLSH
T1D2B09BA30487C925D14655F55D35444C1D866745495E6016759047D33045FF52195594
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\acaoqdel.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 64dc8cd6f40b8e74ddeb2582130ef8495e63eefd4dd58493700840c12ae4f2b2
MD5 fdfe362ab0ec2019c4aa307def60dc87
SHA1 a771fec40f54fb9991863e77a474684f7d8f6035
SHA512 2b9f24fbe942e66d503a96c48c3dbcebc457cb802e4d9a97ddd458c9b155cb94fb50a41baf0f6ff0cecf14f86db5dcbbdb0e7ef9595bfad2a6ddb2d22aee5735
SSDEEP 3072:j3lKSkzV6ehTPPUiGB8Q0uHyKMgWm+YJT+:pKfV6ehTPPUiGB8aH9MglxQ
TLSH
T19EA3A0F6DBA2CE3D64FFD02C6AC2893EFD166410B3A32009C963671555C7FB86279248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a969acd99186d2b87af4eaf770340b6f24ef838260a03522692c93679a147292
MD5 a2b43d71b3a50a41bc4b2a3a13f62739
SHA1 88ff3696ad9212232cbd31d9e312ed5f57e44def
SHA512 399975b55c542631788f31f8e5694ef8e104868c2e274666695d85135a0db6b1734bc347e6b896fbe62e8b8ad7b266a74f48ed38102865f57080e0c504fb5b58
SSDEEP 192:bG1/66JozGzgCl6mc0dMotOv5zboP8yCzJyjBvOQ:E/66JozGzgC1j2bo0Rtyjj
TLSH
T107E111A8E628863FC048127BDCA21F414F76385A9C8E3F29359C651D2D572DD378E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 370a84fffa1147b0d928e866983ae807cdeabc3cea74784022768669d4035804
MD5 5ec8fcf2068207f76aa47bc3521b813b
SHA1 3c059dba097d76229d026dbc3785458c7e2804ba
SHA512 c85e66ec2bac18b618f810ec5645af5ecc1e47e878d76fc0fbd108631fa26da43791b9bad571082ab381427b54407ca7797badd30e29b08a57e021caf38cce7e
SSDEEP 192:KotOv5zboPKyCzJyjBHxGx1d66JozGzgCl6mc0dz:+boyRtyjed66JozGzgC1jd
TLSH
T107E1ED58F628963FD458023BDCA61B400F76785A9C8E3F29319C641D2D573DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d6530a5c48c231a6d705e8ea606fce21af9656e5b1e26dfd8910f68ecfefdd05
MD5 33eb38c04b0e70f3b2dbcc26ef8978ba
SHA1 1f016072c31a4c544d5f9159a9d326e4044331c3
SHA512 7e8b62c4d3d79bb13e47c65ad2c0fded0340b803bd20c540d20f737778c354ac6e2bdc99763c125a35cfa27986d0b5e8fb92af7ee0f41cbcb2f3491701c4a7f4
SSDEEP 192:TotOv5zbo+ZyCzJyjBHxJS1d66JozGzgCl6mc0dI:Nbo+ZRtyj2d66JozGzgC1j
TLSH
T16DD1EE68F628963FD458023BDCA61F400F76786A988E3F25319C641D2D572DE368D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a4d31277b9d86e174b9732fb06fe12f454484218a1a899ed0ee4b7cb779ac2e1
MD5 88c1c422d654ad967aa9b3ffb4b1418a
SHA1 d1a0370baa477ab66226175084ce2bcf80c99598
SHA512 8ad2a8cffb58341f532891eda7484ad65c4fe7f7ab8ecad894ee88b7743485fc9c0cf805284833c72c309f3ceae769455efdb18431312e4ee29421cbf0aad4d3
SSDEEP 192:bS1d66JozGzgCl6mc0dKotOv5zbozZyCzJyjBHx:Yd66JozGzgC1jYbozZRtyj
TLSH
T108D1EE68F628963FD458023BDCA61B400F76785A9C8E3F29319C641D2D572DD3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6db2c5f228b236d79257ac59283ad231d681273dd77430506ac04b4f8c747fec
MD5 567ac5845e5ab34f6c25327a5df8fb52
SHA1 8de36c60123ba24076a38a6f600ac55eb6ea1457
SHA512 61ccc49cda33f19039fc21322b384ac783e3c296dc3bf1d351425393c9a5687e8e2dad534c60a71b3bed26d44ab5b40b67878fd7f56a439e7e0b4a827ac5c00d
TLSH
T196214B5D3DF84D2A5CC6FAA87450128E53514E0A048B6D471E42DF8CCC91AD932EA97D
MD5 SHA1 SHA512 TLSH

Submit Download

4aa61e1c-ad91-4786-9159-4132324ecca0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\4aa61e1c-ad91-4786-9159-4132324ecca0
Size 2KB
SHA256 573ac91cbf70552c1c0456235392a6e53f1eb21314ecfc336ea428a3bbbba5d3
MD5 4afea92fe738da24b2d8be35da3b3e87
SHA1 909b26e8cb84f8e477244c1d53a55bf5639b44ae
SHA512 9bb97d9598688f41486db406ad43e3dec0dbe29aab766840879639cc6f885e16c3bef900aebb54e15d470fb5b6e3ee3fbebd5bd4b828bec0eef46a5f56b322d9
TLSH
T1E641435CB5B85C769CCAF14CD092278E53B48A5300C61C832D56DE4CCDF769D736A42B
MD5 SHA1 SHA512 TLSH

Submit Download

70e73d14-e21c-415c-ad90-23320f8d1158

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\70e73d14-e21c-415c-ad90-23320f8d1158
Size 886B
SHA256 ecfb8855603651748cd9c3fee1f50d99f827846b1e4940336b014ee00f64367e
MD5 2eaf559a06e17bf6a0649e84e3dc6751
SHA1 f3245b8ed8237289d9c1dea5c46fcc615e175d9e
SHA512 7e4e49cd7ef5e5cbee18bb3da93e1e62c2b1db64f925f8d66ecff18414e8ce759a405d887e9d427cfdee9a35d4655f43caec1b75fd300bec77560a6e515a015c
TLSH
T19111C0408B20B5B1D8F8E29BD5A17B4287F4A13390C909283E645A184DBF25EA76760B
MD5 SHA1 SHA512 TLSH

Submit Download

a7db60cc-23db-42ea-8131-76163838868d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\a7db60cc-23db-42ea-8131-76163838868d
Size 15KB
SHA256 377fa2ea413fecc7e869e7f6d716304b183e53c855e3af364806f33de31b7d63
MD5 bfd566f591901a5a0bedb89a6ea6a7ab
SHA1 8e7f37cd0ac448426d01f62876239e988ab0c75d
SHA512 a8819dcbd2db8f2b3c06eaa23f897d385a177b859c8cb006dbc1d50a1e2127bd22f62aa84f4174e59896f45f4064dfa770f0560982b6ed797fb542a2f3c91654
SSDEEP 192:re76IBQlMK1KAugB8+VLxbgfwBSFV1YRiH2P6hiSxuBzx7GuRsq9cq1RSaJNYI:r5tuLuxkwcvH2P6hiSMBl7X59JzSUeI
TLSH
T11772DA566820457A8291F3A994FCBFC3E2F128CF4C419FCA9BE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca4efffb-fe0a-425d-980c-e1a14c825f93

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\ca4efffb-fe0a-425d-980c-e1a14c825f93
Size 235B
SHA256 06602803a26015178db5bd88f68d5ef0ffff6ac2fe376637c6b0b699753ed5cb
MD5 c3b50c482672c30822b1ffc76777fac9
SHA1 4194709ea571e540352a1da7445864c365df80a6
SHA512 205a47554b6443459641a9ca6af1b6db6ad84b59f9f53687de18883ed26c1d0bf562d0eef0c1276c8451122a4711cd6c8fd2b00d12a212df27f7a92e2e873150
TLSH
T1E3D0978468E8A3AC0C281F42F0A428C230894C371874D810EA5144B899FFEC4812281B
MD5 SHA1 SHA512 TLSH

Submit Download

e71a6e60-982f-4db6-935e-27a537278ea4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\e71a6e60-982f-4db6-935e-27a537278ea4
Size 235B
SHA256 a861935fd8a3c1952206a35fc4444fc4916393a81a6ebd0291ca69395567bc77
MD5 646e40550f3f5eb11dfad61574d3ef8d
SHA1 62d4db69d48c107e29aed6591b62187e6eefd032
SHA512 e8c1b8fec1bbdcbc10f0daaf8faf8c6935fde024d4176cafd89f9ac91d20360180cf6bb1879a60f71b6f045b0e44e850e25145c5a112b02be76e2a4f574c6550
TLSH
T122D097D018E8675D08000F0AB0F068C230488C375470A83097920A38DABADC58267C0A
MD5 SHA1 SHA512 TLSH

Submit Download

ebdbe19f-dcdc-4442-8bf6-a22d1ed0e2a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\ebdbe19f-dcdc-4442-8bf6-a22d1ed0e2a3
Size 883B
SHA256 7dc6d93aba3773826b7e0ff4c7e5d76ec95c614a2f7bb87b83efc632cdc4086a
MD5 e245bf2fa2e2f512d94fa6376d4b2cec
SHA1 654e022f44b809d1651d6e2357dcb9ace057f908
SHA512 46ab007582f478239f452e4bc1444fac8a600154d36cd5e33670e6af72f248d8eab56ac48f5d329c5ec5a092ee0b6cfc5a8f62e1d92a082cf07849b1ce7ae24d
TLSH
T1B2112340B675B9B1DCECE28BC5613B4687F47533C0C941143EB14A284D7F95EA76620B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs.js
Size 6KB
SHA256 f4f3aba341def9804e659eb16bc8fe7bd5cd65e2e8df5237fd1f7b631ecad64a
MD5 3f43255d5f7631329bc476216353e691
SHA1 9dcdfb29d8855590f7f1eff0c268df0fb95f29e8
SHA512 ca965adb5734610de74832f21b5d096c021f7c5d132ee99ed6db8db6d01ec92feb7e0d539b8048f5f29909f3ee717d3806d219c7a1da49068d2ec7152256e333
SSDEEP 96:xHpUTUQqGqEfKkj1zSxSSlSdv9jfnJH5VXBw88n8L4cnd2+q:7rREfKkjoSS651Bw88Uq
TLSH
T198E11E7891488B7F74B676ACAC648C315AB2063B7BBF28D750B994C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs.js
Size 6KB
SHA256 6259db58ac746943be55e81d343ee63795bc0ba703e42c63347e5dac4e024827
MD5 41825446a738cc28c49a1e40626972f7
SHA1 b80e6ed56644a4942163ac60f2a59349e8078f2a
SHA512 6880a6def9d5b758c898ae5b24a523642a4b7ed2f945f29f90d1da96b377ab830cf0a57d54c8074af5a006fbb0f00fe6059463a6b1ae4a3a3c76f99f190d649c
SSDEEP 96:xHpUTUQqGqEfK4n1zS5SSlSdv9jfnJH5VXBw88n8L4cnd2+q:7rREfK4nwSS651Bw88Uq
TLSH
T111E11E789508CB7F74B676ACAC6488315AB2013B7BBF68D750B95484051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\sessionCheckpoints.json
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 0b51a273dc36fd483c4a0cc526490e4cbc9845fa9e92dc8a2659a1093a5b093e
MD5 5efad495e326d7b1691b4d1891199cae
SHA1 b2785d588e3c5430cc886964da4617ddefa17d3d
SHA512 4bb5ff0dfaa717e546a4ff0c43d7357e6795d146f1a90e9302696ca8928a51f261206e81de870b226a2480489a5712ee50c22229d4f69df284dbdf09e228dfc8
TLSH
T16721C6C3897E2DF63E65C26BC08C8BA6CB4A3031496958A081ED5B5631D905D7B8625D
MD5 SHA1 SHA512 TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\targeting.snapshot.json
Size 3KB
SHA256 d731fe976686b2e61359fdf0d370162963209c3d666bdf7f693d80e0b87fecc5
MD5 3581c00c98583a22fbde7f657eba44d4
SHA1 96e3c628d63bd0d500a3cf5146981d635e313b1e
SHA512 3a04243ffbf6e61fa54996178eb1966d426814d46b3e10df8fa79ddf22a549629f0ce08d5bccf71ea7bcd5492036971e971ee8e931c5a6c5e3fa52b186b3a005
TLSH
T16E71810CA51CA4BEA66BC3C0DA44BF978BBD053370446458DAFE460C55FB5FB123621B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\xulstore.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download