d448bf82fe056ef4c4ec5801013519e5c1ebf73bdc6bb59c5ba289ab4d913506

Analysis

max time kernel
527s
max time network
591s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2023, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

main.py
Size

58KB
MD5

21be12aa96af4acf0a6c227a738b8dd6
SHA1

48fd18c4fb4eb621bc30d2cbd49ca3b9b02286cc
SHA256

d448bf82fe056ef4c4ec5801013519e5c1ebf73bdc6bb59c5ba289ab4d913506
SHA512

9967387b1d857aa38a709c24f137be6190430a4db2e49816038a3bbe432eaecc699b203ba0326f5af3c7809bd584d917040012f4b57c7bd3630edf77b9ce4264
SSDEEP

1536:AQfeAdInSDZXYbOOoyW7dJc/OwZV++nMXPUF7UXUKLl5vmLcEz5iIx:AjAOnSDZIqOoyW7dJc/OwZV++nUvmgEJ

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "9"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\python-3.12.0-amd64.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5848	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5796	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe
Token: SeDebugPrivilege	1356	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
3052	OpenWith.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
1356	firefox.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
5796	OpenWith.exe
1356	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1344 wrote to memory of 1356	1344	firefox.exe	96
PID 1356 wrote to memory of 3772	1356	firefox.exe	97
PID 1356 wrote to memory of 3772	1356	firefox.exe	97
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 4136	1356	firefox.exe	98
PID 1356 wrote to memory of 3296	1356	firefox.exe	99
PID 1356 wrote to memory of 3296	1356	firefox.exe	99
PID 1356 wrote to memory of 3296	1356	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.py
1⤵
- Modifies registry class
PID:4880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.0.1306400189\838020812" -parentBuildID 20221007134813 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 20808 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9781a044-497c-4ce1-ae31-df4a78bb4182} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 1996 1e00edd8e58 gpu
    3⤵
    PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.1.71396687\1975848278" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 20844 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77c46e51-b0b7-4a8e-9177-9bc59c4033e4} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 2396 1e00ecfbd58 socket
    3⤵
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.2.1721394260\2131852191" -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 3144 -prefsLen 20947 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59af3f9f-94ee-470c-a695-764ee69a8a49} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 3232 1e012f14258 tab
    3⤵
    PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.3.1864272004\1459196892" -childID 2 -isForBrowser -prefsHandle 3176 -prefMapHandle 3504 -prefsLen 26126 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ac23804-76df-4202-b0a8-2bfbea4eadb4} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 3068 1e011905358 tab
    3⤵
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.4.532272182\1439629933" -childID 3 -isForBrowser -prefsHandle 4632 -prefMapHandle 4624 -prefsLen 26185 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b591161-c5b3-46a5-9889-b18393725928} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 4644 1e0140f3258 tab
    3⤵
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.7.1940637312\1694744905" -childID 6 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 26185 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7809a667-8818-475e-a6f0-cbaf75aa1702} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 5436 1e01526c358 tab
    3⤵
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.6.1706320074\1030668962" -childID 5 -isForBrowser -prefsHandle 5252 -prefMapHandle 5256 -prefsLen 26185 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83a07aad-5944-4aa9-8317-10117775ea9a} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 5244 1e01526b758 tab
    3⤵
    PID:3584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.5.388449977\1200127262" -childID 4 -isForBrowser -prefsHandle 5048 -prefMapHandle 5104 -prefsLen 26185 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6608a16-086e-413d-a354-932c7f001d8e} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 5112 1e012f17258 tab
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.8.705026301\253317153" -childID 7 -isForBrowser -prefsHandle 5844 -prefMapHandle 5840 -prefsLen 26266 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {766f29e6-4fcd-4e31-b513-3b2042416464} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 5852 1e0168ddb58 tab
    3⤵
    PID:3736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.9.493160519\1778687903" -childID 8 -isForBrowser -prefsHandle 4440 -prefMapHandle 4876 -prefsLen 26825 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9b8b962-2927-49d7-b5c5-6595bb9add23} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 3148 1e014c15158 tab
    3⤵
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.10.1612483866\1947481178" -parentBuildID 20221007134813 -prefsHandle 7072 -prefMapHandle 4876 -prefsLen 26825 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86ce8723-4262-4404-a892-e34f15f05fd5} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 7096 1e016b25658 rdd
    3⤵
    PID:5820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.11.1595548089\887874755" -childID 9 -isForBrowser -prefsHandle 7112 -prefMapHandle 7124 -prefsLen 26825 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49b68db1-d6ac-4369-b132-ea93a96f57ab} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 7224 1e01853f758 tab
    3⤵
    PID:5836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1356.12.1382569856\1005248461" -childID 10 -isForBrowser -prefsHandle 5588 -prefMapHandle 5604 -prefsLen 26825 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00eca690-cbaa-4781-b6ab-72957743e403} 1356 "\\.\pipe\gecko-crash-server-pipe.1356" 5580 1e015918358 tab
    3⤵
    PID:5748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5796
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\main.py
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g08zjpxk.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
97706640dcfb332a73d3bb74cbddf7a8

SHA1
eb93814a2b7adec55d801ce7574ddc6712055607

SHA256
40ee035247709daa88e01b8590c6f5eae2dfe84a86d8c1f2ab1f28ee6b6b8810

SHA512
1ad1a45e521a416f290bdaf7844bde48d43d40c8b6f83e924dd71abfb9c1a7ace5591ced80517f76cba383dbf0506d1f7b700736a1b0db35ed937fd83a0a5cc5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g08zjpxk.default-release\cache2\doomed\23333

Filesize
8KB

MD5
ebe8ce5c6c14ac9235fb12f03e5e7103

SHA1
d8cb6940db376a728347bf5aa57982ba496a2aa1

SHA256
ef32d60d009a1b1e6d35a727c456708271a29140febb51cf203c9377c37ef71b

SHA512
088abfe3bf58f334ee278f2a8e15bc9d194aac1b5723b8bb255dbf4f4c9265e0b373c939661136f6e42bead13ad4a534a77f9e55027549c2c494c8359577ff48

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g08zjpxk.default-release\cache2\entries\3075465069720A038E625719CA279264FEFC1A7C

Filesize
114KB

MD5
5c9ce0993cc1069efce8253d56de076d

SHA1
5b93989c1b3f7e3cd2db38f340fb505a8937fa80

SHA256
3861a6e5885dcc202d6e9b1eb7af8dd8d5611d169ef30581ad769701e64f7390

SHA512
9545a3074e56531cfea1eeb45b8464032470aef98aba2da3b4e4a80f363427713a4ae7fe0f708062edb274676b3ee890dbb2efdd8e5f99e7baa645dae032ad16

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
6cd2effc0863e71ad0c6dc0149c44545

SHA1
8210131aae48f61f4a04c75713c95b0d4a4cb504

SHA256
a2e581580114af241d618ffe586f89a3410f6201526a980413f5e53d8589f0e3

SHA512
dcd01b87cb5c2a0dbb33d8feb2b8c52c6d2b6c81b79a23d3d27b224a4e1c908bdeb2706425563b15184b0bc0ceeda4ec4c192b5d309eea2d471fa03388969f5d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
10KB

MD5
a313953c140a47f8af71a86a103e1d0b

SHA1
58188cff36344b14aad4c9dfd0528f89787d36b1

SHA256
428392bc6b3012960658e4bdfad369c34907e97bc611e7e713190edb0ad735ac

SHA512
01b4474a01aefbe0d976919cc734cc1b20b89e6df25a14da5e0d64541b7fc0a27a72cca2b5fcabc74f54b069afbee882be3396511c7a564efa725a373c204e85

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\bookmarkbackups\bookmarks-2023-12-02_11_+Elq-HrNVDQMleoLV9ExdQ==.jsonlz4

Filesize
954B

MD5
1352ebf1572a7e5c9ba2564a430d0a39

SHA1
63c79dea1d7b49c8173b9aa29bacb999a623e989

SHA256
f6090dfaa7da86a7a3e3bcebaee0666fd53ab6ba12728cb6ab91589d9299d430

SHA512
8a930a4fd88ee251c983ad806bdb81478e151505f40618727bb66c44ee3c3df32f613ca6d0b0d4a976c16db0d864c512a844b2e988869dd8660d31a4e8997221

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
d1d53a65edaba3806206a0f4d967f470

SHA1
8abcb65727c08d69ac48e9dc8ae5e57bdccc065e

SHA256
2f0c64cf661a61dd74bdb160b75d186a3362ac841fe6fb2f3a0550b794d3cf4e

SHA512
7e8b8c5d3ae6818a75bdd237cc1a820eed8b08284caee897ac09ce27b1d89b7937d97e24fa3d3c28e94528284a30879cb8597c610b08760b884b1448cd7a78c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\datareporting\glean\pending_pings\0e6a2829-ba6a-42d3-93eb-6ffe2fed829e

Filesize
746B

MD5
6b043625869c11e5193f948fc36153cf

SHA1
467679596de26846500c9dbfef7b85e0d9efa5a2

SHA256
6d90fbfb34b22787c4a91f14b9a576a9efdffb324177e6aa8d904ca2575d451e

SHA512
72b472e6160bea43b72794c0839cdd75f17077ea34d72a85a8cfa00872eebd02b6074e9940d13269192885137864e7003bd9d53de788d11abf6ab9de46e5b62a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\datareporting\glean\pending_pings\9edde9e1-103c-4393-8f60-219631a78827

Filesize
10KB

MD5
bab092ca9eea4bce12f5f3097fd95615

SHA1
bd6dc4ad7342eb1989e51ab91f6af79664c034e0

SHA256
5ea7c0970f44f2bc3ed9bc641d258c4acd485e2ec183f42cc9d432393a9fe5af

SHA512
2a8edbfe78c4459a3b2150f25f870c295e7de36584981a5fc3102aff5ff6ae3ea0888e587b7d7c9d1c6469cadd742f1235eafc3abcc7229caebb8d20061e3b6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\prefs-1.js

Filesize
7KB

MD5
3f63ed80d806d2c35d240efa7899c65c

SHA1
4ec1b103fefa084eecf1157c3e0a396949e3c904

SHA256
3d751fec51611c2ec9edd334edc83fc3bf62a321044892b6d9702508809ba0de

SHA512
58c739d31547b32138d93109e67e2c5613f02a42684b128d831ed6f124d3aad976ae93b716abf305cd33521011fdedcbd464cb675919c63826824157dbe3183c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\prefs-1.js

Filesize
6KB

MD5
a284d821dd8cafc02a0d56059ce81e21

SHA1
2986a7ce58661e36328c644e37e194b718478934

SHA256
bfd46822f68ca766df03c2917072b5c6df33fc940a1d5f8a8936b47e039cc150

SHA512
21ccbd7c86f856aeb60cbd9c24e8071d6a03d1ab9f5e3ab653c4e6a6dd61f0ad24b106a806f4e6e5d959c221dfe444b007db5292b09bbe446813d97a1857b70c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\prefs-1.js

Filesize
6KB

MD5
b55f5aaa3ac024ee5fe010ca81bda7c8

SHA1
a2ba7d82c462d75a7056518366ae00f4538739f8

SHA256
67a808d86d3459ffaf919b6488b442cbe300fc192ffc21a0643edaa8e1b81666

SHA512
46c1ecf770b8e2f587cc8cbcb19eee842b73406d8c14979c98d479e7076ef99a6f946e236101ef9fe4aac78a5b3b5b94f9d1e0c6066dbe164bc0811fa5a1b45d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\prefs.js

Filesize
7KB

MD5
9ec0ba1a4a6d6de8ea519ed9478ce1ea

SHA1
7e7db274752c8496d2459535f2aa2eb0840dbde9

SHA256
6fa93cd69df1fc29b3e2a51e46031f48ca291586ae2ca6355945f267d090ab11

SHA512
11aa1178a82fe1cf98bb832ef8537a0205908fb19408acf491a185909c65f8ae0c46ccf629eb46cd54a87a4718a3fa468b39a26704ee1cdf5ee4ffca6c255a3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
3d095b2c791127a8ecb656d61c055762

SHA1
356a4e2a9cb27f7c697301e28a83c2b7f4a5ffd4

SHA256
c9d30b9579ca8606463f00fb2fc1bb24236e407b4a190c7d8281bdf6ffca9543

SHA512
303d59950df053aa36f55fc2ba88ca278537bafe5678ee090311149b5985018135f9e5854da9acbeb520b6e10131f966790bf0084a2f08d937d2bf8e1d5b0120

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
5ab410b8df289611cde79f7f4c12608a

SHA1
43beb152789ce93d938821e68dee6176a63b855f

SHA256
3ac2bcfddb2cf8501b6351b18f148333e0eeb94f4c064183c7924cbd88183620

SHA512
8c118378a336d211a390548ef25d2133cfc723aad13596c6c7f3b9a029671de5e20e39758cf06b03ca77bf558e7e1ad9fc22fb7266c11bdd2125701b9437ad4a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
9073e6a5f09fe2e006a9a3b3d68c3af1

SHA1
2a71e50cbaa48a3f48857cbaa44930c64ce4e281

SHA256
b8652019ec4361d6eb1e81e934fb2b45dd2c92a280cab032bd201fe6e8482aa2

SHA512
519b8ab349b14d3285dd5f8087b9168a9f9b3681b486625b5a9a7c576513f5a905964f435065965ab41983c5eec8e1b3bbf441ff113e4d0db0c215f75e0aaee2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
f184b87feff7a94d8aa96171024b7911

SHA1
c91f57d5a8f21eafb01640bbcdc93e78e9d8a830

SHA256
ae3dddb41d2394e54429b52655e84d5c9065551de92e02a2189b75cb3085bd35

SHA512
ac9037bfaf6cb89ffad50d45c745f6d775806b755d964fa2efffefb335cf3fd761ff9084a4a6383b443e7e3c6760b6a4bd063e32db352275c2c63e1e476e1637

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
5c8d8e99952d334f6712a647db5d8c11

SHA1
beeb4555dc93bcea5b465a1ec24483e48ccdb022

SHA256
fb98d0b80f03869305a542978564bef60d8a8fce4bab1c68e8a06f57fd19b567

SHA512
0ca0a6aeb3d4102d5e9adf4ed9c5066d8975137f15ee40724307f57671785e115adc63fcf9ffa70395804860fa4b6cebdad68e2a2722803ead7cb05c44e5d36e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\targeting.snapshot.json

Filesize
4KB

MD5
95c1f62128200c26a777110c8bc3ae49

SHA1
f4b4e95353ca2f4b4699b4f9341760d12acef976

SHA256
c062e2471481d5ea4bc5ff37724b06b7a8b015f55ff8590f3e0a86b34d329ced

SHA512
cfee63a12444aa9ccb91116216110c24d9e87b5696c1c30e9b4eee1ccb82466de20cbdf2356b63dde7172b6adca1faf17a3d4f015e9ef1df8d6b31cd11ea00f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g08zjpxk.default-release\xulstore.json

Filesize
141B

MD5
1995825c748914809df775643764920f

SHA1
55c55d77bb712d2d831996344f0a1b3e0b7ff98a

SHA256
87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776

SHA512
c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

Download Submit
C:\Users\Admin\Downloads\python-3.7cbFtQE2.12.0-amd64.exe.part

Filesize
768KB

MD5
559083826c00150618659b50dc1b1526

SHA1
36e61497608a9a62cfa918f11920c92fe4c17d00

SHA256
8c2b1dd80fce5f70999b55575058e075cf590ffbc6e3aa084955db39100d0a15

SHA512
7f1c3970efa56092805453100dd5a9a60c5da605fbe5678ad194e98c39d5f7447798cb49385aa18e949352a283b1081e22aaa6458886f13d83dd77c35e2a1ec9

Download Submit