8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47

Analysis

user interaction
yes
max time kernel
299s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/11/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 94KB
Sample261114-celj8aby3t
SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
MD5 eba77a34e9b8aa78fce520d1431fc68b
SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
TLSH
T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3968 created 3248	3968	explorer.exe	56
PID 3968 created 3248	3968	explorer.exe	56
PID 3968 created 3248	3968	explorer.exe	56

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2340	powershell.exe
3732	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4236 set thread context of 3968	4236	Setup.exe	89

Loads dropped DLL 1 IoCs

pid	Process
3968	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3280	chrome.exe
4108	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4236	Setup.exe
4236	Setup.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3968	explorer.exe
3968	explorer.exe
3968	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3152	chrome.exe
3152	chrome.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3152	chrome.exe
Token: SeCreatePagefilePrivilege	3152	chrome.exe
Token: SeShutdownPrivilege	3152	chrome.exe
Token: SeCreatePagefilePrivilege	3152	chrome.exe
Token: SeShutdownPrivilege	3152	chrome.exe
Token: SeCreatePagefilePrivilege	3152	chrome.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeIncreaseQuotaPrivilege	2340	powershell.exe
Token: SeSecurityPrivilege	2340	powershell.exe
Token: SeTakeOwnershipPrivilege	2340	powershell.exe
Token: SeLoadDriverPrivilege	2340	powershell.exe
Token: SeSystemProfilePrivilege	2340	powershell.exe
Token: SeSystemtimePrivilege	2340	powershell.exe
Token: SeProfSingleProcessPrivilege	2340	powershell.exe
Token: SeIncBasePriorityPrivilege	2340	powershell.exe
Token: SeCreatePagefilePrivilege	2340	powershell.exe
Token: SeBackupPrivilege	2340	powershell.exe
Token: SeRestorePrivilege	2340	powershell.exe
Token: SeShutdownPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeSystemEnvironmentPrivilege	2340	powershell.exe
Token: SeRemoteShutdownPrivilege	2340	powershell.exe
Token: SeUndockPrivilege	2340	powershell.exe
Token: SeManageVolumePrivilege	2340	powershell.exe
Token: 33	2340	powershell.exe
Token: 34	2340	powershell.exe
Token: 35	2340	powershell.exe
Token: 36	2340	powershell.exe
Token: SeIncreaseQuotaPrivilege	2340	powershell.exe
Token: SeSecurityPrivilege	2340	powershell.exe
Token: SeTakeOwnershipPrivilege	2340	powershell.exe
Token: SeLoadDriverPrivilege	2340	powershell.exe
Token: SeSystemProfilePrivilege	2340	powershell.exe
Token: SeSystemtimePrivilege	2340	powershell.exe
Token: SeProfSingleProcessPrivilege	2340	powershell.exe
Token: SeIncBasePriorityPrivilege	2340	powershell.exe
Token: SeCreatePagefilePrivilege	2340	powershell.exe
Token: SeBackupPrivilege	2340	powershell.exe
Token: SeRestorePrivilege	2340	powershell.exe
Token: SeShutdownPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeSystemEnvironmentPrivilege	2340	powershell.exe
Token: SeRemoteShutdownPrivilege	2340	powershell.exe
Token: SeUndockPrivilege	2340	powershell.exe
Token: SeManageVolumePrivilege	2340	powershell.exe
Token: 33	2340	powershell.exe
Token: 34	2340	powershell.exe
Token: 35	2340	powershell.exe
Token: 36	2340	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
3152	chrome.exe
1992	msedge.exe
1992	msedge.exe
4584	firefox.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3152	3968	explorer.exe	90
PID 3152 wrote to memory of 3936	3152	chrome.exe	91
PID 3152 wrote to memory of 1476	3152	chrome.exe	92
PID 3152 wrote to memory of 1476	3152	chrome.exe	92
PID 3152 wrote to memory of 3280	3152	chrome.exe	93
PID 3152 wrote to memory of 3196	3152	chrome.exe	94
PID 3152 wrote to memory of 3196	3152	chrome.exe	94
PID 3152 wrote to memory of 4420	3152	chrome.exe	96
PID 3152 wrote to memory of 3064	3152	chrome.exe	95
PID 3152 wrote to memory of 4420	3152	chrome.exe	96
PID 3152 wrote to memory of 3064	3152	chrome.exe	95
PID 3968 wrote to memory of 1992	3968	explorer.exe	100
PID 1992 wrote to memory of 1048	1992	msedge.exe	101
PID 1992 wrote to memory of 4108	1992	msedge.exe	102
PID 1992 wrote to memory of 5116	1992	msedge.exe	103
PID 1992 wrote to memory of 5116	1992	msedge.exe	103
PID 1992 wrote to memory of 5116	1992	msedge.exe	103
PID 1992 wrote to memory of 980	1992	msedge.exe	104
PID 1992 wrote to memory of 980	1992	msedge.exe	104
PID 1992 wrote to memory of 1788	1992	msedge.exe	105
PID 1992 wrote to memory of 1788	1992	msedge.exe	105
PID 1992 wrote to memory of 1788	1992	msedge.exe	105
PID 1992 wrote to memory of 4176	1992	msedge.exe	106
PID 1992 wrote to memory of 4176	1992	msedge.exe	106
PID 1992 wrote to memory of 4176	1992	msedge.exe	106
PID 1992 wrote to memory of 4620	1992	msedge.exe	108
PID 1992 wrote to memory of 4620	1992	msedge.exe	108
PID 1992 wrote to memory of 4620	1992	msedge.exe	108
PID 1992 wrote to memory of 860	1992	msedge.exe	109
PID 1992 wrote to memory of 860	1992	msedge.exe	109
PID 1992 wrote to memory of 860	1992	msedge.exe	109
PID 1992 wrote to memory of 464	1992	msedge.exe	112
PID 1992 wrote to memory of 464	1992	msedge.exe	112
PID 1992 wrote to memory of 2120	1992	msedge.exe	113
PID 1992 wrote to memory of 2120	1992	msedge.exe	113
PID 2268 wrote to memory of 4584	2268	firefox.exe	115
PID 2268 wrote to memory of 4584	2268	firefox.exe	115
PID 4584 wrote to memory of 1740	4584	firefox.exe	116
PID 4584 wrote to memory of 1740	4584	firefox.exe	116
PID 4584 wrote to memory of 1740	4584	firefox.exe	116
PID 4584 wrote to memory of 1740	4584	firefox.exe	116
PID 4584 wrote to memory of 4112	4584	firefox.exe	117
PID 4584 wrote to memory of 4112	4584	firefox.exe	117
PID 4584 wrote to memory of 4112	4584	firefox.exe	117
PID 4584 wrote to memory of 4112	4584	firefox.exe	117
PID 4584 wrote to memory of 3812	4584	firefox.exe	118
PID 4584 wrote to memory of 3812	4584	firefox.exe	118
PID 4584 wrote to memory of 3812	4584	firefox.exe	118
PID 4584 wrote to memory of 1288	4584	firefox.exe	119
PID 4584 wrote to memory of 1288	4584	firefox.exe	119
PID 4584 wrote to memory of 1288	4584	firefox.exe	119
PID 4584 wrote to memory of 1288	4584	firefox.exe	119
PID 3968 wrote to memory of 3844	3968	explorer.exe	120
PID 3968 wrote to memory of 3732	3968	explorer.exe	121
PID 3968 wrote to memory of 2340	3968	explorer.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3248
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- - C:\Windows\SysWOW64\explorer.exe
    \??\C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3844
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3732
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9e536c728,0x7ff9e536c734,0x7ff9e536c740
    3⤵
    PID:3936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,6496412189894328039,2116853991094824672,262144 --field-trial-handle=1684,i,4198418087960068021,17103417181344971353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1672 /prefetch:2
    3⤵
    PID:1476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,10196886020958736905,7509528670884733612,524288 --field-trial-handle=1684,i,4198418087960068021,17103417181344971353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,3480495337530243597,6811612970678304183,524288 --field-trial-handle=1684,i,4198418087960068021,17103417181344971353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2532 /prefetch:8
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,6563852851288932967,17383645681461525468,2097152 --field-trial-handle=1684,i,4198418087960068021,17103417181344971353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3092,i,12202646038507545114,5386373054156804214,2097152 --field-trial-handle=1684,i,4198418087960068021,17103417181344971353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9e19cc188,0x7ff9e19cc194,0x7ff9e19cc1a0
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,2881660324157790661,15803757467681968640,524288 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,4616127063448379523,10353694888576387908,262144 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,11818094632914507432,14353586299837608865,524288 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2536772140171982506,1502160308278921791,2097152 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9043043592872232062,12843293609039815470,2097152 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,2428086928103123786,3919737645040624042,2097152 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,6834446889228053731,5348297045450999861,2097152 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
    3⤵
    PID:860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,1587397483525115973,9306991198347064214,524288 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,11960668641138200711,10012934269490006754,524288 --field-trial-handle=2356,i,4209926899810378339,945429253261865036,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
    3⤵
    PID:2120
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2788 -prefsLen 24447 -prefMapHandle 2792 -prefMapSize 268500 -ipcHandle 2856 -initialChannelId {de322109-bd18-459a-a640-06fdd22f7a5e} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:1740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1812 -prefsLen 24657 -prefMapHandle 1920 -prefMapSize 268500 -jsInitHandle 3736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {e3de559c-5275-42c7-9230-d38b37ea529d} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:4112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1848 -prefsLen 25543 -prefMapHandle 2028 -prefMapSize 268500 -ipcHandle 3976 -initialChannelId {4b4eecdf-bcff-414a-995b-88097d5a4762} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:3812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4040 -prefsLen 25606 -prefMapHandle 1876 -prefMapSize 268500 -jsInitHandle 1880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1792 -initialChannelId {176adb27-9118-4ea2-b71c-495c0bfceae6} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:1288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

379ced75-30cf-4a8a-8321-21c20d02a3f5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\379ced75-30cf-4a8a-8321-21c20d02a3f5.tmp
Size 130KB
SHA256 c8330cbdb6f6b030c3d3955000d7367007659795aade9f1d03674040b6562618
MD5 b75ecc8f274746ceffd87a19a56dd50d
SHA1 badedff48ec60f440449c6c0bd1aadcb74ac5c5c
SHA512 85158ca4798a8ac2e1d9b7d9b3be73a513b95000acc3fcb9f453733197ebd84a70d9e8ab5028e056d1d74d7c85176f69e30d593f5d1d0b7b0d621557468a39f3
SSDEEP 3072:xEZ+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:SZ+hFD+7t56OD9ZfSApprE
TLSH
T1ADD31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ee7c093-e72e-4194-a4f7-b11121c45767.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7ee7c093-e72e-4194-a4f7-b11121c45767.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7f32db06-ab91-44f9-a898-68d9579e1248.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f32db06-ab91-44f9-a898-68d9579e1248.tmp
Size 8KB
SHA256 ae6c7dc2f4ecff346cbf5d43a55731114f0e4557a2b5534bb0fffdf72158c30d
MD5 7d81c3a321a761cbc121a80a557c1574
SHA1 b7e23adec4046153f75ee4339df80845fbbd8019
SHA512 71ed2ff439560ea6a373a33f31d51612d6e2ec797040e5e564cf2fbc371074e69f8616602c23aa91a0a6b549e5773143cad2bb40d7d1c8ae53f1bc379d9fccfa
SSDEEP 192:2ON/6JUDQmiUyZvyjo//Yhn5NxTqdN/U6:2ON/6+1Ljo//YhnZCN/U6
TLSH
T1CC12F938B8B8BCB79EA3AE55F08776139FB4117BD6815F94D9D92E2C05C719C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

af3359ed-e9d3-4bab-a076-f97843b5d56d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af3359ed-e9d3-4bab-a076-f97843b5d56d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3ed0743-74fb-4606-b760-0460912ba655.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3ed0743-74fb-4606-b760-0460912ba655.tmp
Size 8KB
SHA256 7ab1fd54c15ba3c2ec81a89a8af25da4728064bbcf9f730908da51441b8a0d72
MD5 495e20577b16976bd192c042be6eeff0
SHA1 93a7e4730b5b0cea39738bc305bb886dcb9bc22f
SHA512 efdfa45ad4bd2fd12dcb70e4c33a144f94efa244445b0a23692407ba8fca6c5072ad671a31c8bfe7ef39c634475f08122547a7c2796c558080207d33a0cfd935
SSDEEP 96:KqONkrQsjpfbUmjH5ih/cIPURHl8h4otop5fAaDSBKP4v+Y1xf//ojdoxTeYzqsw:BON/6JUm0QmiUyxyso//YpBCa1EYU6
TLSH
T1E302D739BC64ACBB9EE3AE45B4877B239FA4107B96915F44DAD82A2C01D725C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_splssnlz.w3v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_splssnlz.w3v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 567KB
SHA256 7c49fcc218f681941410387904a9df288d0e31759d53cdc06a641a5eb3415a92
MD5 47b7a01bfacb805bfcaccffa6f3e3f04
SHA1 dd1e569072a8c6f6c1192df8f51413bdc41220c4
SHA512 12ba904748a4dcaac883e466bf79293b105d33346594bc7ff749e6a162489cac56482588d3274998e6fd11d8c0fcfd50ce4989f50eb02a503556064a8a5c638a
SSDEEP 12288:xHcsmIPYQw45/SVwSEKkrcnjVHeUtc11iiR8en/dVVscSDDS+iJaiaW4neJvH:hcshw45szEKk4jVHeqcN8U1fvSnt4mjo
TLSH
T1C4C4F1FAF7603CB3A7BE02079D9A7EED1B625222878FE0CC44675BC24557729AF64404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 5121f8ed3442b4dca8ad25a6f45497b43fbd8ef90fce62fb654e0dd969a6ebea
MD5 dd9af8d0ed67e9f06d930924a412ffe1
SHA1 4bd028212593f9481a4a81c837f3973caa5408bc
SHA512 5d35c6bd57c0ff179763635feaceca7bf9852f044cf6fc74a75fe775ff3ccbba40092d425f6018ef3725a0dad9cac20f58f353c7bad11415c7edaf739d9798a4
SSDEEP 96:TRzMM102nmWKi03T+mRQ9n4KY/Q/P6DpBlz:lMM102naLqmRQ9FPwpBF
TLSH
T1B391EA1FB57484631B31F5E62D072BA8F103B007DDE2DDB8B12ADDA289683E981D958D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 6ab4350d9d4ed3c542c26ed36d1a2625ec9d5c2f7acd3ca58ce4da8276374ab9
MD5 208b0ffac2a732e8f16fadf6145d6ad9
SHA1 eb171ebb5a297b11d9ec1096e3edf64e5a39b957
SHA512 b75d2a371d34dc3aa97117ec751095c13bf4f4a1066b659fcf78eb0de06d62678925f2d5671a71cad3fe4a2c97230ce5bc5da116c2e781ba22aec38e1dbb0dd1
TLSH
T1382157B8084C1931E5B6781A2A4FF701C6F1F256DA50AF6CDAA91C284CC74F4936252F
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 74KB
SHA256 a082484b06c29870b84925a362a47595dc7256c626ad9e797aa2da40ab82a54c
MD5 51bebb0dde285c91b82a81eb3adf486a
SHA1 61042091ee3a53566c9328fa3d5536f8da3873a3
SHA512 f0db9fc2cb77df8ce0318c172e9adb532fa30d137a5db2d014dc7061efcc1ae17d7fc4666e45ec97bbd306202d2fac9e261d72d1cd0bfcff6f2f2b75de601790
SSDEEP 768:WyhxoUa2lrPcHsSjzXbko83m6RxFq94SCvbYjii5NjJ1rv3vLv/:NhXpxUXbEmz94S+bKisNJ1r/D3
TLSH
T1FF730AA396E871FB0BA137C71C0F796B22E1418AE78A01C9ECEEC91C81CD755117A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 b0b1be706067af516b1f046525aff46adcd5d4e05f5a1705772441496c77f9da
MD5 b7cbb82c92d9f59c16bf1dd57f6b75cf
SHA1 dea20dd29f8ef6ed77c18575bbe6a16759b999cc
SHA512 5dedbf313779ded1d58c0ddcd1f618aa975036b965b2d07e1cb75e386dd5c85ccd39717de131b2975db25216a6f8bfa86b55f027f6bb9f66a0f1d4ac577ed25a
TLSH
T134C08003065E51736F511E0170CF49B4993904A03547D55567CDD5454716CDB1DC4555
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 10KB
SHA256 60c71dd8da7a45f3bfeb214f610fcb54d00a34e5b59f10dd16a181e8d3820bb1
MD5 f78d439fca09e280fff1891a803da6f5
SHA1 786695cdbf5e1657c5ad0d5672bff831391c3280
SHA512 e0a1c7bfbed274b3c72f3cc764484ac49e18207701724cf1255e4c9feeb4ea92b4d936bb9fce52909475436d52b46d931f813164fd543aab2fd80937a1115f4d
SSDEEP 192:EkI4vCUmldv78dhEp8c943Dg96gD3mL4kYZL4DDT:EkI4vCUmldv78dhWf94zg96oWL4HZL4r
TLSH
T1DC32531545049EB8294EA78BBB367D01C27D473B70845C38B4DD8FC842FA6B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 a08384d22ad7028c4b1a1cff92aec301dfa3ada1226f2b4945908c7b1fb74408
MD5 8c5143d755e104a60f631940d7f4245f
SHA1 e247f51dff14d2bfcf999832fc3f638c38187966
SHA512 8cdaa0d04be03970b21007b004b77b8bd561dc9646f38120cac5fc6c86cb5ac876495343cc85f8b76827cd8300a50564595db8ef74ea88e7e5e7fb24abe9b17a
TLSH
T13C3110A66A45CF6FE1B4366CFC154A60D7730176B67F5C8224B8C4868028F3842F6DDB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 430acee10b9181926333bd1a9854dfde40b40b9388907859e701c22386d0daf7
MD5 d4a8fb378465df1447f6449b3cc9aebe
SHA1 1cd1c3934565cdbacff55df00cb8a0c232f05334
SHA512 c96501526153d7a0392e329f74d3e28674e8419102d3ee5147b33d0a8a7abd14b8c29c576f70799636e1e789ea28acf06fa55b17311d81c98ebd5a5ad8125264
SSDEEP 96:xHa4qGqzdczv06ElU9FnVHoCROBw8h9cncv:sTRzdX6EuoCROBw8hnv
TLSH
T128A110789544CB6F65B5776CBC648831AA72013B76BF28D720E48885411CF3885F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 1255879b5e14542d1f8b0c4b570b93a3873a78e5cbb0508fcec8be20fb0fc5cc
MD5 74d2778901115faf9e62754860bfebce
SHA1 cc06fa515587382729f63bd7df8e6c7da466f945
SHA512 a6e427ead687167c6f02a223a988bca03ac05f109c7f2081d11b138a7c5707b2f2cf16d62e546bad03fdfed36d1cae2f31fd1cb23f2f6c655547a51ea01dad49
SSDEEP 96:xHa4qGqIdczv06ElW9FnhSCRHBw8h9cncv:sTRIdX6EaSCRHBw8hnv
TLSH
T156912F78A544CB6FA5B5776C7C748C716E72017B767F288710B48885410CF3886E9ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 2153294d4489e1227434213ea5b8a8f17523634398c89626362375c6054df296
MD5 93a0032ee5e1383dea565ba90851b107
SHA1 a540c83480d507db326af855a24b1d2cbdf44709
SHA512 1ed103c2a7f574c4763c3f31caa0de4c98ecc41459f2f56b556a543287d80158cbaaacc69ae87525f4ac662d9cf78039954bbbbbb95d47d01bba78b941ce4483
SSDEEP 96:xHY4qGqzdczv06Eln9FnVHoCROBw8h9cncv:iTRzdX6E/oCROBw8hnv
TLSH
T19EB121789544CF7F75B5776CBC648831AA72013B76BF28D720A48884411CF3886F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 5403022de3b6bc0f67dd679c93ed4cddc919f0a5d144350b9bd8af8a884bbeda
MD5 8244348db0c64fef77962cc3fee6cc1d
SHA1 3fdd17d92b20ab5cebc373d1a4c909a57dc0027d
SHA512 56c56e604730be1677a9c1aeb4f5c54ce78be65b77158d0b08b05632677cf973ab9414df1128b858149cdbbd31fb0e23de170e4d615a440c268bf93343397bd3
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0VZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWIyh44CfiaR/skL0H7
TLSH
T16023348D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msi_afa03da06d26ac26.tmp

Path C:\Windows\Temp\msi_afa03da06d26ac26.tmp
Size 712KB
SHA256 d0bdd462ff336ca577a794c617bc165a53e74d9d349bb3025ff2647215d2a838
MD5 57938a366d51bd22c909bc6a9d1c0ae4
SHA1 e40f55486b55806d9d6475e74ba0e05ad5c4fbc7
SHA512 514c1ee4e93ed0ae5fbbcee0d1ab37e436ff5e7991557de7291e26ef578077a2de41b57792ed4025ac10b08aa2f340822e4556beea7f29f86a2c53baaddf6139
SSDEEP 12288:9Zk2KIdAIBkBy2aKs/epFCpCvA5KlV6pGNMHNKgwjh1TzvCPQBZfCqnnnnnnnTnM:jk+yIC7CeqCvIKlVJMHNqDZfQ
TLSH
T16FF4021157B4604E7A20258986DFFD953EF7AE26F8DF2D4506C83808BCEC745A2D8DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2340-365-0x000001D16CED0000-0x000001D16CEE2000-memory.dmp

Download

memory/2340-364-0x000001D16CEB0000-0x000001D16CED4000-memory.dmp

Download

memory/2340-363-0x000001D16CEB0000-0x000001D16CEDA000-memory.dmp

Download

memory/3732-349-0x000002596A7B0000-0x000002596A7D2000-memory.dmp

Download

memory/3844-336-0x0000000001420000-0x0000000001423000-memory.dmp

Download

memory/3844-343-0x00000000036C0000-0x0000000003C92000-memory.dmp

Download

memory/3844-341-0x00000000036C0000-0x0000000003C92000-memory.dmp

Download

memory/3844-342-0x00000000036C0000-0x0000000003C92000-memory.dmp

Download

memory/3844-338-0x00000000036C0000-0x0000000003C92000-memory.dmp

Download

memory/3968-17-0x0000000077312000-0x0000000077313000-memory.dmp

Download

memory/3968-335-0x0000000000590000-0x0000000000598000-memory.dmp

Download

memory/3968-12-0x0000000077312000-0x0000000077313000-memory.dmp

Download

memory/3968-15-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/3968-14-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/3968-13-0x000000006B000000-0x000000006B0DD000-memory.dmp

Download

memory/4236-7-0x0000000003860000-0x0000000003912000-memory.dmp

Download

memory/4236-6-0x0000000003860000-0x0000000003912000-memory.dmp

Download

memory/4236-5-0x0000000003860000-0x0000000003912000-memory.dmp

Download

memory/4236-0-0x0000000003860000-0x0000000003912000-memory.dmp

Download

memory/4236-8-0x0000000003860000-0x0000000003912000-memory.dmp

Download

memory/4236-18-0x0000000003860000-0x0000000003912000-memory.dmp

Download