c9b67fbfe0f924eeb407cfb5e8ba8277f78d852e8c67db25142820e11b0c3f0e

Resubmissions

19/10/2026, 19:06

261019-xsj9jafw715

19/10/2026, 19:01

261019-xpc12sys6q6

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/10/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quickbook_Remittance_NotificatiON.svg
Size 1KB
Sample261019-xpc12sys6q
SHA256 c9b67fbfe0f924eeb407cfb5e8ba8277f78d852e8c67db25142820e11b0c3f0e
MD5 e4f52d82cf3587b7551e219a4cf887c6
SHA1 6661ea5eb98be44ed1d372f2a1c33e92e6de95d9
SHA512 58f1e7a1a24578a180596a451d0085023d1fceb6ae4cfc6678ff51e25280bb6514f433a27c47d2a92e7c940f8d02a68954256d71ae908aa91bbbcfd00cdd23c0
TLSH
T1704150A8F1848D3FDB245779D394FC66A249F1C5CB0A8220F481B93B71099CB9CE438C
MD5 SHA1 SHA512 TLSH

Score

6^/10

adware google microsoft discovery persistence phishing spyware

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
156	api.ipify.org
157	api.ipify.org
154	api.ipify.org
155	api.ipify.org

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
12	2740	IEXPLORE.EXE

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
136	4036	firefox.exe
136	4036	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2720	chrome.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000f055f7443e6b4735938a62ca08a5b7e7834c3cebe7f128201759577fb17db255000000000e80000000020000200000002d20e35fcce5c36dfd6ab98dd0bf11b54520a7fefde463842a6659d82eb7710920000000e33e9ca68933068bcc991f12d284a90e5f9d85db516ff5fabd187d4a124fcecc40000000a712b856330a96ba44bf6800d68e276b575388e09588521f1cbc66399515e4d1b6bea5d37c959f50d723b4cf9e8589863c1356eff811b6a182361d04f9b65dde	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\IESettingSync	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = b3a96356fc5fdd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "499201465"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000d1c86b3c6afd89212a9a780bd74c456a5ab5397de932e2c53ad2f51be7c77a0a000000000e80000000020000200000005918f3d0a5bd255b67e07e98e131e689ad38562639a82647360ffbee028af14c2000000020d86a4976deaa90d98a748ef635b5b58d70586fd09932f10c59105c9c7d9bbc40000000bb911d92716a58eac83e0762e925483999c066b5c0342827e74ec8202fbb5329ac542943b2f1f12f10c3064cbe51fc1eeb906e3b8f0bdb1d375460bebde8f443	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b5c7b60460dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31285244"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e00000000002000000000010660000000100002000000059239ec99ad04b07f589a347700e2a5a2fc055ec5a703e6dbf6c3228eda591ea000000000e80000000020000200000003669d70652115c21b45775dce22b8096c5b32ae0fc7eb075df15aa7c5bcb6b3a20000000da073a436090a50b1a980aee747401a96cea83a0f20ca9343a720261aa8dcb06400000005e907cb5be0fa2eba3c2801af52cfdbabe28c828f2dfcbeee71827127a24c01814c422094ee3ff04c9f23768de05449af830ec55d39fee6beed19f85cc1c3439	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04d23b80460dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "https://images.google.co.zm/url?q=https%3A%2F%2Fmuktopedia.org%2F.questar%2Fmanaro%2F&sa=D&sntz=1&usg=AOvVaw2VKAZJxSirvQq46ENAkdBd#?=#?2217507521Farnlly=cmVuZS5wcm9hbEBkZXNjLmNvbQ=="	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31285244"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7E65E257-CBEF-11F1-8007-621E4F736A29} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1395501400"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1391908244"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fac2b60460dd01	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeDebugPrivilege	4036	firefox.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1648	iexplore.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe
4036	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
4036	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2740	1648	iexplore.exe	85
PID 1336 wrote to memory of 2808	1336	chrome.exe	97
PID 1336 wrote to memory of 3260	1336	chrome.exe	98
PID 1336 wrote to memory of 3260	1336	chrome.exe	98
PID 1336 wrote to memory of 2720	1336	chrome.exe	99
PID 1336 wrote to memory of 2156	1336	chrome.exe	100
PID 1336 wrote to memory of 2156	1336	chrome.exe	100
PID 1336 wrote to memory of 2612	1336	chrome.exe	101
PID 1336 wrote to memory of 2612	1336	chrome.exe	101
PID 1336 wrote to memory of 1068	1336	chrome.exe	102
PID 1336 wrote to memory of 1068	1336	chrome.exe	102
PID 1336 wrote to memory of 4004	1336	chrome.exe	104
PID 1336 wrote to memory of 4004	1336	chrome.exe	104
PID 1336 wrote to memory of 4324	1336	chrome.exe	105
PID 1336 wrote to memory of 4324	1336	chrome.exe	105
PID 1336 wrote to memory of 2128	1336	chrome.exe	106
PID 1336 wrote to memory of 2128	1336	chrome.exe	106
PID 1336 wrote to memory of 1872	1336	chrome.exe	107
PID 3436 wrote to memory of 4036	3436	firefox.exe	110
PID 3436 wrote to memory of 4036	3436	firefox.exe	110
PID 4036 wrote to memory of 4248	4036	firefox.exe	111
PID 4036 wrote to memory of 4248	4036	firefox.exe	111
PID 4036 wrote to memory of 4248	4036	firefox.exe	111
PID 4036 wrote to memory of 2148	4036	firefox.exe	112
PID 4036 wrote to memory of 2148	4036	firefox.exe	112
PID 4036 wrote to memory of 2148	4036	firefox.exe	112
PID 4036 wrote to memory of 2148	4036	firefox.exe	112
PID 4036 wrote to memory of 5064	4036	firefox.exe	113
PID 4036 wrote to memory of 5064	4036	firefox.exe	113
PID 4036 wrote to memory of 5064	4036	firefox.exe	113
PID 4036 wrote to memory of 5064	4036	firefox.exe	113
PID 4036 wrote to memory of 3628	4036	firefox.exe	114
PID 4036 wrote to memory of 3628	4036	firefox.exe	114
PID 4036 wrote to memory of 3628	4036	firefox.exe	114
PID 4036 wrote to memory of 3828	4036	firefox.exe	115
PID 4036 wrote to memory of 3828	4036	firefox.exe	115
PID 4036 wrote to memory of 3828	4036	firefox.exe	115
PID 4036 wrote to memory of 3828	4036	firefox.exe	115
PID 4036 wrote to memory of 5420	4036	firefox.exe	116
PID 4036 wrote to memory of 5420	4036	firefox.exe	116
PID 4036 wrote to memory of 5420	4036	firefox.exe	116
PID 4036 wrote to memory of 5420	4036	firefox.exe	116
PID 4036 wrote to memory of 5488	4036	firefox.exe	117
PID 4036 wrote to memory of 5488	4036	firefox.exe	117
PID 4036 wrote to memory of 5488	4036	firefox.exe	117
PID 4036 wrote to memory of 5488	4036	firefox.exe	117
PID 4036 wrote to memory of 5504	4036	firefox.exe	118
PID 4036 wrote to memory of 5504	4036	firefox.exe	118
PID 4036 wrote to memory of 5504	4036	firefox.exe	118
PID 4036 wrote to memory of 5504	4036	firefox.exe	118
PID 4036 wrote to memory of 5548	4036	firefox.exe	119
PID 4036 wrote to memory of 5548	4036	firefox.exe	119
PID 4036 wrote to memory of 5548	4036	firefox.exe	119
PID 4036 wrote to memory of 5548	4036	firefox.exe	119
PID 4036 wrote to memory of 6124	4036	firefox.exe	120
PID 4036 wrote to memory of 6124	4036	firefox.exe	120
PID 4036 wrote to memory of 6124	4036	firefox.exe	120
PID 4036 wrote to memory of 6124	4036	firefox.exe	120
PID 1336 wrote to memory of 5360	1336	chrome.exe	121
PID 1336 wrote to memory of 5364	1336	chrome.exe	122
PID 1336 wrote to memory of 1312	1336	chrome.exe	123
PID 4036 wrote to memory of 5364	4036	firefox.exe	124
PID 4036 wrote to memory of 5364	4036	firefox.exe	124
PID 4036 wrote to memory of 5364	4036	firefox.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Quickbook_Remittance_NotificatiON.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:17410 /prefetch:2
  2⤵
  - Detected potential entity reuse from brand GOOGLE.
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9aebac728,0x7ff9aebac734,0x7ff9aebac740
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2033250538399929586,4602838206088589334,262144 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,15514056490886284335,11932017106795154417,524288 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,16390860446340592286,5007677008057216484,524288 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2328 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,16212459253236326600,8547243034875231759,2097152 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,11318481107448373269,9750388438119047064,2097152 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1424 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,7550818704748180117,9976622697049141040,2097152 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,4751369615819930982,13812667624333192303,2097152 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4596,i,12208321577955674834,12976012584474172144,2097152 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,4138663925936267441,14971625350170913907,524288 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,4278816551147886185,13909222586175575322,524288 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,5846575195300431733,1538877281735039358,524288 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,14213812067550579484,8846865643532721909,524288 --field-trial-handle=1844,i,14992394345165450985,1759614523791126822,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:1312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {67f7cc5f-0c9c-4793-ad20-9cd6802cb967} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {2db9cd1b-ea21-41fa-b575-4f2f2039e840} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3788 -prefsLen 27276 -prefMapHandle 3792 -prefMapSize 270279 -jsInitHandle 3796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {b4d7962b-9c26-4251-9a0e-2e1b6ade357d} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27276 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {86392efd-3227-4c7f-89c7-e3542d98a2fc} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404 -prefsLen 34775 -prefMapHandle 4408 -prefMapSize 270279 -jsInitHandle 4412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 892 -initialChannelId {cfc3e07f-eab9-429f-93a7-de638d6f04f3} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4868 -prefsLen 35012 -prefMapHandle 4872 -prefMapSize 270279 -ipcHandle 4880 -initialChannelId {4d182507-7025-45da-a132-c2f9e54049fd} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5016 -prefsLen 32900 -prefMapHandle 5020 -prefMapSize 270279 -jsInitHandle 5024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {ce3c8972-08d2-4c5f-bff3-d867f2a80559} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32952 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {89da098a-aae9-4cf3-a9a5-4ee4ef015313} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {7e36d4bd-3fed-4dbc-a9e4-39452592a81a} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2788 -prefsLen 33031 -prefMapHandle 2792 -prefMapSize 270279 -jsInitHandle 2796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1628 -initialChannelId {dbe7b546-ed33-491c-81e3-602ad09b7722} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2780 -prefsLen 35415 -prefMapHandle 2740 -prefMapSize 270279 -jsInitHandle 3144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2776 -initialChannelId {b745da0d-cbe4-484f-8edb-d266b7e39fa3} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6428 -prefsLen 36844 -prefMapHandle 6432 -prefMapSize 270279 -jsInitHandle 6168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4320 -initialChannelId {bc4efbc2-52b5-4016-9181-8b1b017ecfa8} -parentPid 4036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 54ad07da9710f95a46a520c4c18861ff54283ae992e2da377e10fc76e15badfe
MD5 f4f31a6d36ef7f7436b197b4b6142c3f
SHA1 5c2d93bc3517432fd250286b9f83890f826c2a18
SHA512 f468a78bc86b719d5a62f1190913cd467f859306d68148208670f2e7e547383aba628177051ab467a9f6f880af7d0e646a83d4268bfe84ca551ec33cedbe9e75
TLSH
T1B3F0D443547FF950AF8274CC679A8F553020641600AD6523656CC9B05D6137F6D1B135
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 89b988f3d3dc8bb4def695c0b975ada788d00e1b7352137c217c82c6c3af33b3
MD5 40b8288b739c19bab01b134ace7d83de
SHA1 0c5595eb9363acacfb1ecec63f9722e7d77d5708
SHA512 ed0ad83135c0b4c62698032142ba3821df84d86c9dc1aeb74892e643d98243f0be521d4f3ff504f3478144a164da91fd0def3669f60a3479bba0f0df4b08b39c
TLSH
T1C7E0C03412FA411EF1E4D0794BD97826447DF137143C93B82AD49B04A7077809C03E65
MD5 SHA1 SHA512 TLSH

Submit Download

02181edf-4785-4123-92db-ee8815f9ab75.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\02181edf-4785-4123-92db-ee8815f9ab75.tmp
Size 130KB
SHA256 24e27fa1b0d0656e755a8dd9887f1488693e49c63c3a024b184914f14f42d363
MD5 38700608cda306b64b796bf6b2609d29
SHA1 74c0cd84b1fc7d131bc08a19128bab1ec251c35b
SHA512 809dfeca73b5b771c3129be7357ec8f04ff3645e92633b0d7511df50de8d8c59f543d137ee834825891dfcd2620dcd2a2e9fdf1fd1d98906cee7af97085ed5f8
SSDEEP 3072:wJS+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wA+hFD+7t56OD9ZfSAppr3
TLSH
T145D31232AA94D8BBC9BC6541F157A300CE626CED45DE7A09444A9F8EE09FC5C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e8f2c96-a912-4d1f-96fc-1ee63d03798f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0e8f2c96-a912-4d1f-96fc-1ee63d03798f.tmp
Size 12KB
SHA256 4c975d588d3235b11e0564200e001033d1ba79e7c0cac8def49b4a72581bf046
MD5 b47ee8f6c04cb04bc7b9dacda60f239b
SHA1 027aafe86c89534ba071653cd2f2650811dc6020
SHA512 15515d79f9fb97e871e26a51b2d9606be9260f2a0bb507b64ba85b08bfb671cb7406de52a20defb926f5b834a8a7e84f346b8353a90928c42c506f19637dc35a
SSDEEP 192:ARioF4R/i7mO+v7VJhAPRp23ld9fHsb+WNnBNoS62cBR2QTgesjaruVyIsnAUgtK:ARiqX6v8XEhwbE2c72QT6arm8
TLSH
T1B552A329FA10753B9DEBD32AF9613766D7F6102225902E80EAF8893C15DB6CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4aa0e167-6b85-49bf-8c24-be80bce61cad.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4aa0e167-6b85-49bf-8c24-be80bce61cad.tmp
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78a0bdf4-b0a1-40e6-ac73-bf1c015b2fc5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\78a0bdf4-b0a1-40e6-ac73-bf1c015b2fc5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a7e9de6b-9697-4297-a55f-d74e5588afeb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a7e9de6b-9697-4297-a55f-d74e5588afeb.tmp
Size 2KB
SHA256 992813384c0a8d80716794fa955b083168e5883b0b75d5491afeeceb31f3c8e4
MD5 ff9952e09d363ccbcf90b06b0489a66d
SHA1 e9fdb8d31e19bf5689c0add1e3db0bb6bbae1592
SHA512 01600fbde99e9c6de26b648e6ffea89d98d8901d69ecb15824fe474e68c2294393e077471581e438680145951e3c4124d986f6ec8dca26dab026795ff0274844
TLSH
T1E551ADF7C7E8867E881156F4AB257E1FCE2D0A18021C3C2688D4AE5B53E2872D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 948b3afd47ec02a97ca86dad90adbe430de4c0fe2958e6cdb986b86c1bb39e29
MD5 361ad671f955c2b4a8db82038b0c5c2c
SHA1 9c140e9d1dec29dc855cecc945dcdeb6a434d603
SHA512 28255c0d5b7b6c0721ee22b437cfa3d776924c12878970d8fe2250a8e52284c1e958b9c64f683ebf51142fef14848dc101c0879d8a5746c2b576dec117e1baaf
TLSH
T1E9B01244C0425301C40602F41160148D3694EF22E606130181F00D418C35150901B0D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 8fe94b9ba87b49fd74ed7e35463b5cbac664026d9936091a3c0944f19339b4a7
MD5 afef5d4e9586fd9b378fa9ddd1e07eaf
SHA1 e0594f144ab88fe6165a85c478b1d751558a3e06
SHA512 9b3859b666b8065612445f3a08c173cccad487aec80ae56af1e36461d2a0dc273a013163927f6fdb829975695e7b3efc2f5d7b3a8b2fcb874ead253284f172c8
TLSH
T1B5B02200C0022322C00203B028E080CC30B0CF38CA030222CAE00A22CC30232803C8B0
MD5 SHA1 SHA512 TLSH

Submit Download

b94e9d9f-9b1a-470c-a478-68f8a61860f5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b94e9d9f-9b1a-470c-a478-68f8a61860f5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e32abec9-dd68-4367-a0eb-49a3905eaffc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e32abec9-dd68-4367-a0eb-49a3905eaffc.tmp
Size 414B
SHA256 4b79f83b00ba856081ecfa126f67e176da6cbafa56cd64440673eb4c24dac97d
MD5 69f7bb5f20757aa952b359e255ec79af
SHA1 7177c0d5fd2abad2a42a0bad9e878e2945f4e480
SHA512 d4b6723941c6aede97b773dfdd54fda4c886a07c71f586f3925183b1e33844369d64048cf7d9301d180c361656aecc0b91e291a7cd1c5381eff35dca6eb78dcb
TLSH
T1F8E02BAACC20AC371CFD073A5090174AE76153672B51854B773D811E8FF46774685D9C
MD5 SHA1 SHA512 TLSH

Submit Download

b4e27412-5f2c-4844-805a-28f7baefc0e7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b4e27412-5f2c-4844-805a-28f7baefc0e7.tmp
Size 266KB
SHA256 74f3c0b4b279fb0e9ca63d09b5ba38c5a2b03abddcf1ba8c8e451c7ff5a1774f
MD5 1cd2d750517b84b53d2846b7099d915d
SHA1 0ff2dd5bb89342524a9eec929bfb05240edc30c4
SHA512 0b2102672076d09b88f75d25281f1c0bad160e6466b66ad60a564f18fc89da44fed0252073d6c4d856882b12c4a1ad67f34f9109ae72e82f28680f36f83ae84a
SSDEEP 6144:bTVmEu6N1bV8rTvMeKi/uT0+hFD+7t56OD9ZfSApprY:Zu6N14hxNyFSXD9ZfS4+
TLSH
T101441252A690ECBBC0AD2541F36FB701DFB174EA829FA54D4588CF4BA25F94C0785C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8c8103f-a484-4fab-9445-048d1b1bb729.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d8c8103f-a484-4fab-9445-048d1b1bb729.tmp
Size 266KB
SHA256 1c3ab3f207c7a32cb6e3c2413c7f6bee4feb3786e77fc3129e8662517f65e2a4
MD5 f9f56aea2dc61ff37de4f77605ee215b
SHA1 6fff78d93277058362a097ceea3dc3539d5c7923
SHA512 cbe9606e1c5562086327cefcf120c210cfbcb522ebfb556c47f968a20ce053fde04fb34ce5986f1b1c9f89103355e06111ab6b2482ce401168c576589769ea19
SSDEEP 6144:KTVmEu6N1bV8rTvMeKi/uT0+hFD+7t56OD9ZfSApprY:iu6N14hxNyFSXD9ZfS4+
TLSH
T123442252A690ECBBC0AD2541F36FB701DFB174EA829FA54D4588CF4BA25F94C0785C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed600506-9f39-4d27-8823-6b33d69e035c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ed600506-9f39-4d27-8823-6b33d69e035c.tmp
Size 267KB
SHA256 e546cb4e9182926a4308c6235e561e9404d74389f6791a984fdc8211fba28f6a
MD5 16dff111629afdb7f445bd491b3a0fa7
SHA1 007eb4082fc41759ad3e7912f995853c29290621
SHA512 af122d15f0c4a602db6e447377681a343cdc7252d05a3dc9fbf3ff7c00df308f5072c93e877e43837caa8030062a880b3656dfd4a4da20923ce10a42207c0f96
SSDEEP 6144:KN8VmEu6N1bV8rTvMeKi/uT0+hFD+7t56OD9ZfSApprY:9u6N14hxNyFSXD9ZfS4+
TLSH
T166441262A551ECBBC4BD2505E26EB3019EB174EBC29FE94D4448DF4BE25F90C0B85C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imagestore.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\vuo5a6h\imagestore.dat
Size 5KB
SHA256 0353375f5ab2be34aab3893978affd8e8d97f272c4a3dcc4e507424d4f026026
MD5 6652364b09838d5a76b0aee2299472b4
SHA1 3290c21a9eebb2de92ff44902cb7957a86b2d4f2
SHA512 ece3115f0b20b9862a3f8bb50618a581284fec6fcb4e9bbf5fa80695f9c8cf3e74514288ef7e98dd876531dc979ee8585d836be944745117e990ee2e39f761fe
SSDEEP 48:cS+DOO7IJct3xI4S+DOYxG/7nvWDtZcdYLtX7B6QXL3aqG8D:67IJct+ur47v+rcqlBPG92
TLSH
T1F3C1CBB3E6C63134D85805BC49373A6D1E2BAEE31A9CF164FDCC326A19350D07424A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\85D7AFSJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon[1].ico

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8FXVQJ29\favicon[1].ico
Size 5KB
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
SSDEEP 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
TLSH
T165B1B8B7E6C63030C85805BC49373A6D1E1B6EE31A9CF064FECC326A1A320D175256BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\activity-stream.contile.json
Size 4KB
SHA256 9c21103192856a4e76b86059e690af5c32e6ed183933fb7bb58de2816f71adfd
MD5 3341b76c8a0f2978d2fa092059bfc0bc
SHA1 3e4bff2913f0150591d34ebb69542235991cbc06
SHA512 08ae2754ff279bff1697687d68d295fbc3966dcd0fc2af8a8af2c06afa346ff1a279d6a86ce0e3af4797d6874fe7a111aa14b4e3251c471e5c312d1bbca02b53
SSDEEP 96:TEHM3dxmWVcHlzT+mROqn4KYkyFnt6Dr7olz:YMNxcHAmROqz+twr7oF
TLSH
T1A691C75B853885331B71B9F5AD4F36DCF017B012EAE0CA58F2698C6185BC7FA80DE948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 7f99d93df523b020254ab5d37b88971451812aa20807aade18a2275ec616459a
MD5 f2d6b261a29c5ebf9219fada63f8e2ee
SHA1 39a170b53d2fd92d0a643eeb8020107256d9e74e
SHA512 b14f474fcd75ae6952fdd743647ec5f57131268cf2eaf685c09a7ebb46a8eba4a77b21e5dc2de1c908735ce08910dcae8c18d9e4725f90628b518ef9e1d8ca3f
SSDEEP 768:RyoQDGQsD8N38ugi+FiY4P4spd51biSNhHr+G6r4M1SOOr1FkQ7XBiy:goQbhY4gsBttnyG6r4QSXUy
TLSH
T15573FAE3A6A8B1FB0B9137CB2C0FB95B56E1018DE38505C9ECEDCA1C81DD754123A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 e65d40224df7bb57a6c96107780a1458f413e3f0086c7601abe6ea8156d81df2
MD5 017c7009559709acf3268cf814b196b9
SHA1 7b6a474eaf0520102690f0f78049cb9c988bec4c
SHA512 e3dc4bececab52bbd4e6e86b8342302033d9b87d167fa872c2ffef6245bc3785963ddfff01321e085b95e279033fc20f015324eec4cbe4df0db0efd57ee4f6a1
SSDEEP 768:Ry47gaHimo0FEGNqU6u6vBNJaIy1ALs4/nNWeQGw5jZzJiJ:gaVHimdFEGNg4f1Ys4/6GD
TLSH
T1A873F6A356E9B2BB1F9437CB2C4F794B67A1014AE38542C9EDFDD50C90C8758023A9AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14067

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\doomed\14067
Size 52B
SHA256 83551d0bb8815739a0d65ce64225323e17ad52cbaba27a36f73223550d1db7fa
MD5 8c0babefdce653b8d735ff8f0cb410bf
SHA1 f8d878616fbd31a2dc146673a39b198191a9fad1
SHA512 f4a536441e0599275d97210e6923f6ff4ec7490d24b462c3d9b920a5efbd80352f21efafa75c604e0c7754b57185511639ed87e0ddb56e24b5516e049e6e2207
TLSH
T12B9002058355C906E11880710884C1FA04A43D1044C0036238A90B5245910D35C20200
MD5 SHA1 SHA512 TLSH

Submit Download

8335

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\doomed\8335
Size 257KB
SHA256 4b6a74ada841dcdad1eb8e512f7e23ebf5d3c29e568dcdb141f0644429aca794
MD5 462019b69214c90756bc7f959090d5e0
SHA1 aecdeebfe93213be8c15d1e1e5c8f0c55940585e
SHA512 cca3816ced00b5d8a2c3d93ecbf5b48955e32d06f8c9db458b28e8a3ac9ccd0b9ffb64fd64083790cf603093a8ba1353b242221fa0cf3220e7919fb5031797ce
SSDEEP 1536:8YCYPsAsUxd8Moz4dTnSPrN7WvkcIVn8sBvagJAA9FYa+jWw/K8Ct92ZFZWkM1SR:5DdE7/c+Fadu2Zj3V
TLSH
T13944F8F796AC30FB075256DC6C0E72CF62AF4139DB5208DAFC6C8148D3C9A651076B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 4f905289922d31f47ed31f0c0474cdba27777fc15bf4d959f874f159bb9a4f43
MD5 e40e725069b8d15866ba4172f78c6917
SHA1 d2df11473d6a3946cedd7c59d349c265f60f60ad
SHA512 4ab0859341e453aff5a295f92003fc46424e41241f1c1183c383a76263351e3990d7b03d43014fc0be547d408f04752d5191bf3d1117640e7d8efe410d482c4f
SSDEEP 384:HGNQiO024YElWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA+:mDZYSWTToXJWTTogB7S/AmVAf+hRMz
TLSH
T110728E3D8F013CAD175780E9C8B683558D18B7EBDFB6C06D16983D09C984A1A71FA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 36d8b479823a224fa55517877472ccdb7e3150ed5cc908445023205f7498b71c
MD5 d48515ad7abe98da7775b46ad134bb6c
SHA1 44bed73c07de6823f650262e490ff0fce700500d
SHA512 ddd9ee33b96ae428d195a8a9ae6753460a259741ebfee8294c863e7272b8b70088dbaee503027de0444a4a0696df1345cfb63f7c8fa60ab49015f9e60ff64387
SSDEEP 1536:jTrli7H3j/Wuks+znrq1uR1m9x2C1oLLMoEPFPQs0eIou6DGEAKBKByOwH2LkAlg:j3l0r+zI2OoLZENPQlUn5BCnh1g
TLSH
T179B3AEF6DBF2893DA5FFD41D6A81883EFD163504B3A72009C963635462CABB87375248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 d2c21e5ae0e577d1590e037e7f33959b8ae542f37caf629a7c4a9c6b92f03db5
MD5 4d81c068ed1016b3de571dc432b7d38a
SHA1 2096dae51cac456bf3219096f56bb2a0386df624
SHA512 2528f01182654b64353105a6b7953b1de7fa45e1d305714304bda34a378e25b59b3e747b116b1ab70fc87afedbb85e87f2373cc3a29c300619aacdab08eccf8e
SSDEEP 1536:XTrli7H3j/Wuks+z24ViAxy9Gd5VD1LmKaEPFPQs0eIou6DGEAKBKByOwH2LkAll:X3l0r+zrFX5R1LuENPQlUn5BCnh1l
TLSH
T194B3AEF6DBF2893D65FFD42D6A82883EFD162504B397200AC963635462C7BB87775208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

516fcbbd02132c56f29e3a47efcabdd7.png

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\thumbnails\516fcbbd02132c56f29e3a47efcabdd7.png
Size 6KB
SHA256 c6a167612873ddff154e2c627d3778b1ef1528ee08be7a7f6999dd5614340671
MD5 5f3fca1d94c4bf0e50e4ae9b551d6b1e
SHA1 198ff962ccbb3d10baa665812c21ae456cab7ff7
SHA512 3f391a1260617bc264ab3dc0805b079897e07f92ddc4ccc6afdbd9b57900d1018ffe450dce2b50a89610fddeedc8dede60400e55d0193d1bda0b632258d5b256
SSDEEP 96:6ApPTZvD7urDFYgG63sogngSe5H60MfjnVjC0ZuMf1Dqlfi88Jk0p5DqTQ:JprZLafFY57fgSeRMTVW+H1Dy1u4Q
TLSH
T1D2E1852F0E879AD19A0C7565F7FB3C0EC449D2CF2B8EF5488C2D5A2927245D541F6632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\AlternateServices.bin
Size 8KB
SHA256 7b3413c4b9f8789fe7571798842b09e433f1eeaf585dd57b110ff801bd93abc2
MD5 19dd484eb7d2c0cf06c8cc75bb30728c
SHA1 eb437173395e2511538d4655e97993954fb8f475
SHA512 8b28997874457804aaf75e972ec9265d7a4578dc74d5a7ceab05c3f1c4151363a9a08e3d662720d039f1dbd606cc301dbf3065a507d97be9f07cdb50eb9b7dbd
SSDEEP 24:ruhMZu/S+lzCY9UuTl4GAp2WReA0AmAWH2WloWh2WFNAW:r4CKBT6P61XHJr1
TLSH
T161024CF716B52212F0925EB169993DC88C33160A543487C9EF5290DB21C17BAD5BFF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\AlternateServices.bin
Size 8KB
SHA256 a1e25ab8791204c95f821a3824f564b2d5e030f95679d1c44799fe5546197650
MD5 bd0cb9be4aa50a67d873f096179f8afc
SHA1 c04d966d13bdbab889eb0e1ec74336eed35f000e
SHA512 113c1fddfe9c98085da6c13b297c5dd50d1b3dae0c6460fb71f2c54a9a0f4e10da4575ddd9e5f31b1176f05476a17384569626097ec2be95d6e8c9fceabe547d
SSDEEP 24:ruhMZu/K+lzbfgY9UuTcZ/Ap2WReA0ATuWb2WlJuWV2WFNRuW:n4UKBTUiHLj9rR
TLSH
T1F502F8F316B62222F0925EB165993DD88D33160E943487C9DF4290DB31D1BBAD1AFE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\addonStartup.json.lz4
Size 4KB
SHA256 8376ef8b8c5f2d6d13a30530f3870c2e2af2cfca34a5f29a8bc4e9a3dda750f4
MD5 83c032216a7cafbf3ee061af89d3aa79
SHA1 ffeb80bdee73b55afd6d55025daa5ebe1036e1e7
SHA512 f0e6a7e80f5bc9cabd2d78b5a8462a903314cb0155e37869a9d5233d56b34f87530fd463ef2c6f1251594e2cd2bb0bb0a5e996ed7f875786dc64355bbd604e53
SSDEEP 96:N+44sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:N+52xxhD8rGvm6ApwnHUuhN
TLSH
T112A17DB6D542EFA2FE32C04358D93FB2E6A69B7410A9C4D0F1AA71194C34E735704344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\broadcast-listeners.json
Size 221B
SHA256 f72128b6cfb672099cbaf9d341fad4d1b9d1a6a0c2cdd0a25ed6ece40b48bd2b
MD5 7551e2a23132b2ac3a934ce33ed80753
SHA1 d05e5073be4a13a106644fb4a7948fcc25fb6b48
SHA512 3398aff52b33c76efb69ff6217ac14efe4dbec7b16cc5aa0266779ac2278e3d9b49fcbbd063d4431eda7f77031aa9c7174b782b6a0a40503c26cbdf0e4d964dd
TLSH
T1B9D0220E14133C7F4B8C672DF00827C10B9B204976B0903DC3EE31641A6ABFC8008990
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 55KB
SHA256 8f89df928bafbc390131283cce0847e898ef86a7f169b2d209c2f2fb262f7e5d
MD5 42011a27a137d29d9b9e44fc37be66c9
SHA1 faa40fe46520d8cc9b5bd2fd916c641790bad721
SHA512 b00c89b8fdd674d722e681e194494f0358b26522cd81f8996cdae9406e2b89ebd98f7dac06c8556ae4e31ffaef8006be512b1261bd2f4d6a2d396f8c4a23e125
SSDEEP 1536:r5A7GiXKdKEQInCKsTf3M4hYCh6v9QNo3jRCw:re7/KnQIsfRzhqm+ww
TLSH
T1A5430144EB1E553FD82802BA9D921B003F79F8895A1A2FA7375C64786C873DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 55KB
SHA256 330a87788856803e9a021e25d205f073bf0280f29867e726d63d0cffeb0bb219
MD5 3c3f17521e4400d32442caf432f9f007
SHA1 02120ec35840d6b7876335bbe52e75b5415498c0
SHA512 6efcf6b98a352dbe4a271418646adc8d92b236d326512e24bf7a2a278f4be23c5ac6db711d57f94e3ac5de6426a44590884ab9079fe11364902138bb96a77bd1
SSDEEP 1536:15A7GiXKdKEQInCKsTf3M4hYCh6v9QNo3jRCi:1e7/KnQIsfRzhqm+wi
TLSH
T169430144EB1E553FD82802BA9D921B003F79F8895A1A2FA7375C64786C873DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 97810f3bf5e37946a99b1d94975ffc4582e37f744cd8df8da97297532271f9b6
MD5 1b6177faf4f193e1f02f97b7d95f6fb9
SHA1 0debeb14084a1836ee2240936c52f81adbda8648
SHA512 f30488c191fd7aa2be66a622849636ac6f5a00c4fca6afdcb99babfd21daa12b674d4362fa0fc147b5a4677396c987baf67ddb53d5232154198bca1e54b88922
SSDEEP 192:gcePz21d66JozGzgCl6mc0dL1vOv5zboPtk4Tvyj6V+o:gcmzQd66JozGzgC1j8bo1k4ryj4
TLSH
T1C1E10DA4FA28863FC019427BCCA51B410F39389A9C4F3F19359CA41D2D566ED7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 55KB
SHA256 138eed17f79b5bcc84cd6c174a193a41a181c32a0944fb31b874b055f5e4950e
MD5 13eda410811650f4d9d8a38830981e39
SHA1 64e8207326b7e580f232453fd436520e28348f78
SHA512 d77588f822c3c50e897c74d5220ed4418ee095537ba89beb40adb70bacae9263f06b1b5ef01a0367fcda28a8d5a0d2cf61e97538009f15380e8970edf1314568
SSDEEP 1536:R5A7GiXKdKEQInCKsTf3M4hYCh6v9QNo3jRCy:Re7/KnQIsfRzhqm+wy
TLSH
T1E3430144EB1E553FD82802BA9D921B003F79F8895A1A2FA7375C64786C873DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 57a72c4006ab42be618de3b57457a9467bd1039e17fa64bd7669a9a64014f368
MD5 1077fe7c561d8ddb69d46ff5029cd13c
SHA1 95589ed83d799fc61d451571346dec562259fd1c
SHA512 fdd3730c6a2af911b3fa24454312ea2002bc1e39bca5da81e376b8e9b63154ebe9b436bc6ec8184ee35878749045c53187f44256893a72e6274c0a20cb43ece4
SSDEEP 192:e1vOv5zbowkZ4Tvyj6V+6cePz21d66JozGzgCl6mc0dz:9bowkZ4ryjqcmzQd66JozGzgC1jd
TLSH
T15AE1ECA4FA28867FC049427BCCA51B410F39389A9C4F3F19359CA5182D576ED3ACE17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 55KB
SHA256 45d84c9eb437f4bb2c13212c73c956b4f23b17e257489e29534d2ada301abfd0
MD5 94628642a836a60742a928b20b09a764
SHA1 16f7b576d1f640e351107e262474ac66eccef121
SHA512 add2ba05756c3909ad3d8803fed973e6476ba6dd1cf7b5235b1f139d573cc08f0db780de4860b1f165bce829406d73f9e4149d29c928474be3873be247dcdc2b
SSDEEP 1536:75A7GiXKdKEQInCKsTf3M4hYCh6v9QNo3jRC8:7e7/KnQIsfRzhqm+w8
TLSH
T12B430144EB1E553FD82802BA9D921B003F79F8895A1A2FA7375C64786C873DC3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 d6713aa806bf25646a5882581baf7b0e99dd6c56c9f41455fdc416202795249a
MD5 84886c05b68c00b07dd4b06b157aff62
SHA1 ffae2701658170ca2b26bb91fd438cb0d6f4154c
SHA512 abffa75698c4e8bcdc53a08b8763f162b459b97571624e5cb539df824bff85631bdfa6e2feaa982f6ca414f602b5803349252c55c486e4e0cedd05a921a6a762
TLSH
T1C161C998F629863FE045423ACC966B411F30745698AF7F2A35ACA04D1E5B3CD7ACD13D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3ab52fc45be8b1c812fb6306593dcdb6cac3d397427efa0d4afe80d944cc01ad
MD5 0b652fe14f83b3dd677d742c5ffd9084
SHA1 6a0b97f5f413e7e96daa16c2f3a9a784de5c2291
SHA512 1b5367b5da76a5b833ad9802958ef67d8b85e42d90df3f787c6be090760428888ee5c08c20eef4e278b8ca2ef79270f380adfa73d51c87e7595e1cd766347d3b
TLSH
T13B21AC4C3DF89E2A5ACBF69C7452028E53518E0A44871D470D63DFCDDC82AD972AE43C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\events\events
Size 2KB
SHA256 162e1072ce276315c3e7e676b34783f0f21c1ab5af65ad9aefe8abf680d3a375
MD5 c85b5f918b5a56ff6ec64bdb3e3cf2d4
SHA1 b357c7c4060b235e9fb395bab5a7e4db25ae9316
SHA512 69a862d9b75e1df68364f35f882ef65e3e744146018726be2d84b58d76c9a050181b04cf5a2ebfde041e2fb0316197f6dc6ccf0d3eb9190185a1c2ec4e2fb817
TLSH
T11551FD1E39EA5D3E6ACBF68DF402028D87954A0684871D870CD3DE8CCC57A99725F52C
MD5 SHA1 SHA512 TLSH

Submit Download

452036d2-60e2-4c18-913d-916e2f428864

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\452036d2-60e2-4c18-913d-916e2f428864
Size 2KB
SHA256 5b0c5cde8cd9947ceff019388231cbc67cdd99ac782ec4920380e336123a954b
MD5 0ee35616ff751652bd53a35b5124023c
SHA1 40e6fc8787e93761380b753455da33dffa5f8282
SHA512 592ace2394b8fcff4275ff08e8ac11019d9347af02ed312b6dda14101231cfaca7f6aae917f1afb0f2ec962ff91e00c8e590ec7a63223c27e0fd105ba241b680
TLSH
T11A41539C79B85C7B8CCAF14D9491238A5374895B00C62C436E51FE0C8DB6B9D33AE52A
MD5 SHA1 SHA512 TLSH

Submit Download

6f194f14-04b9-4794-af97-ee3b1a9bc91d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\6f194f14-04b9-4794-af97-ee3b1a9bc91d
Size 883B
SHA256 48c8559de47f9778e0f2a99f790bef00786f2e270c5a1f18e46cdff8d332bb78
MD5 d1939f52b942f5b3421e55cee23106ba
SHA1 961c9db386db78fd66156b367da29147acd62923
SHA512 bb4ec0a93d54f6d7334ea155752be860d54f15c35f530cfec446898f15e584c4c8dffd6368c80323771357ba58cca8e97198371138371022b8511470bd984819
TLSH
T1A7110040BB74B5B2CD7CD24F8CA8375257F8612380CF85047EA49E244D7EA1EA3A620B
MD5 SHA1 SHA512 TLSH

Submit Download

adb06be0-a02a-4138-8eaf-d77c81543384

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\adb06be0-a02a-4138-8eaf-d77c81543384
Size 235B
SHA256 b7925996e0288e04ac8654fe65df3e078772ca44f4874c728349ac039dadf6a6
MD5 fffacabb257e4c0a0f2e5ebfd99e90b6
SHA1 e853ed1aa5050f485dc80e2a17e3e43fec22639c
SHA512 48f476bdaabd966c44c3ca10f8f97e80a464f3772b6d856bd2f88dc8cc99f2be789b0bffc763a193ddccd09899c976461a90364cba2488f40f34c12fe4a6b6db
TLSH
T131D097C038882B2E08141F0BF0A029C330488C3332B49820C5A04278EABAEC40152806
MD5 SHA1 SHA512 TLSH

Submit Download

b4673343-bd74-4739-8c87-65e43dc09a76

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\b4673343-bd74-4739-8c87-65e43dc09a76
Size 235B
SHA256 2258e7ea0605db8f74778bb9829a2c47430df528d42276811bd1a5fee8793a87
MD5 949bb1422416958c506b9dbd7e2c723c
SHA1 bb12460a7acd539e65604d5081f674f2f4f6a56e
SHA512 2bc789c36bc6ead664c23dcfa78e3d0cf7971f1510b77966d39f951d9a15dc613721a59d7c68737c692e036ed61b092eacd417d24e8d42a52fac278fb09bf634
TLSH
T133D097E424ACB76E28100F1AB0A069CAB0458C3370A05850AA601534A9BDFDC12A1D17
MD5 SHA1 SHA512 TLSH

Submit Download

bb1059b5-5c96-4368-8a3f-311e83f9fa28

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\bb1059b5-5c96-4368-8a3f-311e83f9fa28
Size 16KB
SHA256 967abf6dfa51c60802a973a29a12b78ce052b9b9947f92c047b780f002652615
MD5 68eab0b6854b45b9a544dc30aed8da60
SHA1 f0d9561652b169ec6f807812998d1d46173a5c07
SHA512 4c185f664f3ca4ddf582e6c5ccd880c8489e0283fcf5dfa217caffb9d704e883d3b366d8b3256af80ab2be7773eb9a4357242d3102de15f291ccf10fdf4e740a
SSDEEP 192:6EKqdVi6KlbEzxVSaWLwAbe85HK71W/BOd1YwPxOtAvEeUUB6+s0OCiLhct5dzJp:6EVdJKlbElVSa8be85HbW1TIhDh96yxI
TLSH
T19872DA56642045BE8291E36994FCBFC3E6F528CF4C418FCA9BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db6cf9ea-ac44-4849-8736-8560aabcbeb5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\db6cf9ea-ac44-4849-8736-8560aabcbeb5
Size 886B
SHA256 636419a862d49a5ab21f6e079ff8ec6a116af075caf16be2fdfa1d0115bccedd
MD5 1317700bffab958b0175c69b326f6fb4
SHA1 3ad62db0082a0633d5a4ad4343ec24fb2de6447f
SHA512 4d490d04e4414b5e05e55f213f1a374cd0246125248c3ee5d20a82ca21454216ecc228684da07e8ff04148ce2d406247b0e403a248fef3030cdf6dac2da8107d
TLSH
T146110081AA64B5B38D78D24B9890B75287F4702380CB45147F949A184CBA91DA39621B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\extensions.json
Size 14KB
SHA256 a34c6faf4278323ec4cc02d04fba76d5c1cb2af7ebb62ede56ac40bb108ec7d1
MD5 d9de4ec8c877a5b893a2ec70f96b129d
SHA1 47589e19e86f8da35a4547a3b6be9a0a622c5927
SHA512 f0e95886824f9cbe9625fd6a4584447787fc3c6550327c1c6b974402fdfe3c16db1dbc55f57c273e283811cc0a42c35a44e9801ca7d9290e78e09cca06ecd50c
SSDEEP 384:IkI4vB9UmldvB8dhWR94zv96oSL4HPL4PCL4HoL4H6L4HC:fI459RfyXM4h6/4z4I4K4o4i
TLSH
T15262321545148EB8298FA78BAA36BE01C37D473B60445C78F4DD8FC842FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs-1.js
Size 6KB
SHA256 825986c037e41bbd78dc257a0fe24e73fa4089478cb8d0a937292c3b2d0a87b1
MD5 4b64429b7988c27bc5e9366b7975151b
SHA1 aa6232d994ca80aa721d575280631689549cf216
SHA512 fb862facbaab458030ca54ca5d2cd59b9af92403f81b455f4176a71ced2631a27b2ae706982149db2a53b69724cdafb7091d689976b337240de2a66696fd6a82
SSDEEP 96:xH+kmUTUhvqGqpfqa3J1zS3vSSlSdv9jZnhHa7QDkBw88n8L4cncV3+RGS:RmkRpfqa3JmvSSkaUkBw88Zk7
TLSH
T104E14F7894088B6F64B677AC6C288C316AB2013B7BBF68D750B954C5015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 8KB
SHA256 77440f3212dc1bd51754508b2a45ece961999eab1ac26d4b8f4b9bfbfe4c874e
MD5 cace65dc54eadae455ccdd30a98053a3
SHA1 9794396a977caa49c8c293808a7d89680817cda1
SHA512 ebf9a22e5b06937a1a2255a8803eb9fa96a34372837ed9f4ab7db0dc076004833cca609df79ac7b1bd8b749be62acb96ec6b7d1ea1b8473b842fa22a9892e97b
SSDEEP 96:xH+kmJTUhvqGqpfWa3JObzS3vSSlSdv9jZnhWRAe7QDxoBw88j88L4cncV3+RGS:RmBRpfWa3JNvSSBRJUWBw88jok7
TLSH
T1AB022E3C9444CF7F65BA76ACBC2888315AA2013BB6BF68D710B954C5150CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 6KB
SHA256 7d0ee0608fee0dc946633ba2950dcf686b3386bbe72f3d8c5a960dd79bda10e2
MD5 169fbc49c42acc35f52ac85616be2087
SHA1 e29a0dfba287ff4f5eb5d060b24cb79429c08e07
SHA512 18152d2db93968e0a04d8e926a90496895ff1b27101befcd1b5a0d118bc5b3e305198ceae8c53a38dd07a45a97cc037590bdb6efd1bcc2a0ae37f0753e8f2244
SSDEEP 96:xH+kmUTUhvqGqpfqrq1zSChSSlSdv9jSnhHa7QDkBw88n8L4cncV3+U:RmkRpfqrqLhSS3aUkBw88ZkU
TLSH
T1E7E13F7894088B6F74B677ACAC688C316AB2013B77BF68D750B954C9051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 7KB
SHA256 885cdc4203aebbb59d6e6355d496b492f81c21bc0dd111aa3c122fd288dd94cd
MD5 3c519d8944a5bf4f3eda41affa370218
SHA1 a34a511e53844f5a677fe21265843dd14c983e91
SHA512 df4a46162bab8d2f6d137de6e1b763a33a7eb692b35f58e87792c56da08c35a0831dfee9ef4c15df22a7e2a22311942090a1bfcadca8cd445c3f2f7cd08cb4a6
SSDEEP 96:xH+kmUTUhvqGqpfqa3JObzS3vSSlSdv9jZnhHa7QDkBw88n8L4cncV3+RGS:RmkRpfqa3JNvSSkaUkBw88Zk7
TLSH
T1E4E14F7894088B7F64B677AC6C288C316AB2013B7BBF68D710B994C5015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
Size 6KB
SHA256 ec47624bcd8781dc84be6b37cec493ad341360c462f5e7cc986197cd6728d1fd
MD5 6bf4c90076a630e668cd92ec68aca72e
SHA1 bc68cc09df705cd230baf9be972e0e212ff2a7a5
SHA512 59249613d094b67c100a3d7edecc89934af13ae74d081f60da6c303d5634fc03167cfbf1a23e38170ac334a217de9a62938224891a05b5dd22dd4443a9a4a8a8
SSDEEP 96:xH+kmUTUhvqGqpfqrq1zS3vSSlSdv9jSnhHa7QDkBw88n8L4cncV3+U:RmkRpfqrqmvSS3aUkBw88ZkU
TLSH
T165E14F7894088B6F74B676ACAC688C316AB2013B77BF68D750B954C5011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 df1091ffabb7252d5ba2007b5f3ccdf599c9f18e064b419fa11ce21a5e2c9bbc
MD5 8a8149f3b4f51257281f7397e3a761c7
SHA1 a83983531c62de204456fcb00a0fca7aeedb3a43
SHA512 5d4e9dd884e0a64e14b35f46458a482b6cef08dd1b6c632d2c32e2eaf0d5f9fa237a31db34771d5eba3db00b2e86ae4e8bd0635d1a32598b1c3da70702b59e45
TLSH
T1EF816D52DD15AEC2F8F6513631D38DE3DBBFA00152F6C1A9B6151176C0871C22B856F7
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 bd77d3b80129e284f2a97eaafea6d5af38e3f52c64adbe914b11b6d6500f2c2b
MD5 91d0fa92c21ff889176c961064fc4b69
SHA1 e7ea70af93b4b0e105c57aeea1d9868a62228740
SHA512 b79efe2b47b6c10772443465ba5738dc350ab40eeecff9c48a6d51e5110d2ec0d577fb1fbdf42a26ff6c2eb11d3d94881b2daebd69186591df2159ad4bd9b2c2
TLSH
T180816C61D91CACC6E8F9D3BB10D189D3EB7F500057D5D896AA05013A849B6C527C46BA
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 5867e950f8ba7b38becc1346b825e9eb9f6da2fa56a8c4cd1b624abf533c5c3d
MD5 9151b415ae2cedc59bbcc54be83bd84e
SHA1 483afb07bfc49db9b6a184443f8a597cade75c2c
SHA512 34092890c727b36e9dba65b5afe572fde2292091229c04fcbfe84efbf7a204bbda2c753fe3c955fbeb1b50ac3a26803d149f2eae9fc312ca7d119759cd5a7d85
TLSH
T15C511B115A22BDC3599AE1C54083AEB3571F1C0B4B694CEBD51DF92D03B2708B76D1F4
MD5 SHA1 SHA512 TLSH

Submit Download