2d539ef4e6d2451a044d170e4b72e73d932da6914d64c971dfe1fa5f68a5513b

Resubmissions

15-05-2023 14:07

230515-re9pdaeb6v 10

15-05-2023 14:07

230515-re1rgafg34 10

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2023 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd54a34dbd7d345a7fd7fd8744feb5c956825317e9225edb002c3258683947f1.elf
Size

250B
MD5

f1ad5cb9025e6e0065b307fcb0a66515
SHA1

9302a3b403494c49e8e24b839ee6e13757c3d5f1
SHA256

cd54a34dbd7d345a7fd7fd8744feb5c956825317e9225edb002c3258683947f1
SHA512

c505a87ccab5211d8097aefcde96d027fdda83b5e7cfd4c4bd9b6305e60f724f55fb3b34bb00579987ba05b98af1b22e154f4fb98c0d300d3f9fc7858e086d27

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 59 IoCs

Processes:

firefox.exeOpenWith.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

4532 OpenWith.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe
Token: SeDebugPrivilege	3752	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

3752 firefox.exe
3752 firefox.exe
3752 firefox.exe
3752 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

3752 firefox.exe
3752 firefox.exe
3752 firefox.exe

pid	process
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe

pid	process
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe

Suspicious use of SetWindowsHookEx 36 IoCs

Processes:

OpenWith.exefirefox.exe

pid	process
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe
3752	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OpenWith.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4532 wrote to memory of 4584	4532	OpenWith.exe	firefox.exe
PID 4532 wrote to memory of 4584	4532	OpenWith.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 4584 wrote to memory of 3752	4584	firefox.exe	firefox.exe
PID 3752 wrote to memory of 3516	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 3516	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 2080	3752	firefox.exe	firefox.exe
PID 3752 wrote to memory of 556	3752	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cd54a34dbd7d345a7fd7fd8744feb5c956825317e9225edb002c3258683947f1.elf
1⤵
- Modifies registry class
PID:4660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\cd54a34dbd7d345a7fd7fd8744feb5c956825317e9225edb002c3258683947f1.elf"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\cd54a34dbd7d345a7fd7fd8744feb5c956825317e9225edb002c3258683947f1.elf
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3752.0.548238486\732535712" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {302f3aa6-b47a-4d80-a530-6b52c1506481} 3752 "\\.\pipe\gecko-crash-server-pipe.3752" 1916 1e713816858 gpu
      4⤵
      PID:3516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3752.1.1928828151\2003035535" -parentBuildID 20221007134813 -prefsHandle 2328 -prefMapHandle 2324 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {752660c7-ad66-4c66-b7a6-86d3f1312580} 3752 "\\.\pipe\gecko-crash-server-pipe.3752" 2340 1e705a76558 socket
      4⤵
      PID:2080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3752.2.709197236\378947333" -childID 1 -isForBrowser -prefsHandle 3144 -prefMapHandle 3156 -prefsLen 21789 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fd4e9ea-3f6a-4c27-ae77-799b970d9d33} 3752 "\\.\pipe\gecko-crash-server-pipe.3752" 3124 1e71664c258 tab
      4⤵
      PID:556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3752.3.1479505801\75387246" -childID 2 -isForBrowser -prefsHandle 4052 -prefMapHandle 4048 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d23bff03-3709-418a-93fb-f4bea19a6301} 3752 "\\.\pipe\gecko-crash-server-pipe.3752" 4064 1e71793e458 tab
      4⤵
      PID:5080
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3752.5.444487918\126879517" -childID 4 -isForBrowser -prefsHandle 5092 -prefMapHandle 5088 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ef424ad-5fe7-4401-8777-b99945c08bb3} 3752 "\\.\pipe\gecko-crash-server-pipe.3752" 5104 1e718ff6d58 tab
      4⤵
      PID:1068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3752.4.1939675813\643483896" -childID 3 -isForBrowser -prefsHandle 4884 -prefMapHandle 4852 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93985722-df4c-4c28-aa47-254a27320ef2} 3752 "\\.\pipe\gecko-crash-server-pipe.3752" 4872 1e705a69f58 tab
      4⤵
      PID:2420
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3752.6.566793966\1045694539" -childID 5 -isForBrowser -prefsHandle 5300 -prefMapHandle 5296 -prefsLen 26753 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {614e4c95-5c96-4ca5-ad88-55c5379d2715} 3752 "\\.\pipe\gecko-crash-server-pipe.3752" 5312 1e718ff7c58 tab
      4⤵
      PID:1000
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3752.7.983786925\793564400" -childID 6 -isForBrowser -prefsHandle 2876 -prefMapHandle 2880 -prefsLen 26953 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {244ea054-2fa2-411e-8ed4-719b150ada57} 3752 "\\.\pipe\gecko-crash-server-pipe.3752" 2908 1e705a65358 tab
      4⤵
      PID:392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
aafd710b6cbd96eefad5aad2e042095f

SHA1
874c3b22fc6383d9d8f4c40c00f2893b962b2a72

SHA256
553cceb378df5edac64f58560fb01d4610fabf20a8ccb41aad7e284872a4ac83

SHA512
5bb3e812695562f8d2905bc6fd7da218d7f11201ad6f75e99873dc54d302a523f5cd9d8516270d2e2d0af1da4a3d41aa9630b4f4d49dd00114dd4821128a1678

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\activity-stream.discovery_stream.json.tmp

Filesize
151KB

MD5
b4d1fafc074080db479d7d776f412c79

SHA1
6c0708a7a221772a380655ae5f38278b2870f26b

SHA256
fbb8614267824dd1092a2a6dcf6e2dec33a66acb0b1879ff7769564989700278

SHA512
1cc5b29371896bd4922ed793c3a511bffd8ecacf4451ad984d511a93920386286f05ca82c52a1c4f66815f42d16d98fbd0525eb71d00b0bcc2a3de347337ef99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\10261

Filesize
8KB

MD5
f6b446f9ba59cd8cc4ddb2db0a373a6d

SHA1
63a2711854c020e45a547e29112929d87d737afc

SHA256
1dc0c5ce8411f6d6e4d13682881b991812db105a4e9e3cf1fcc1380544203a06

SHA512
fd53f9a5ef5d003d0ac5edb42999ecf85a98ec5897c56450072cc3d8a1ff291f175816c55ac21bd1649c983234d692020d8e41bd9c6f3d84b314e7ea78cadd9d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\11403

Filesize
32KB

MD5
3fd8534804ea678af327be260139982d

SHA1
d8cc7eb4ff26d2cb74d7f150563c44e553c321c5

SHA256
dd6f0046edf4cf006a65ff39ad593e5f2334453f97e4d8f1b7a4a39bc9a96a74

SHA512
61661642587772f8efec49e4db1b67f7e058e4094afc68c358e8c6aa2af885a64b5256fd06d9ae82a77d612957d1428fb6018d33fb386227325db7c1d0b98582

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\12703

Filesize
8KB

MD5
11eb6d8ade7b867d6a4a1400c5687405

SHA1
ec8e8b32b531834636795d5900f8683ebdfe1a9c

SHA256
3743d6f647b44b34f17ae49f0f85093000308bacb83b11337bf270164d5d1cd1

SHA512
bd647916ea6796376313c3a8a6e87131ca711974521df1d14eeb9b6fd3bbc10421a6d4d05fc1d6abaf0f80b07c966b731c06422eaf88cbb50aba3abafcb2c822

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\12730

Filesize
8KB

MD5
8bd6833eb3f714f312c602d110b8d389

SHA1
6db50bfc0ca425b947ce16e6730cec672602220a

SHA256
42512201efbb992f98f4aef4ac247fa438687215e0a04a9e9cb68703980fc6b2

SHA512
4a6c990f882af3598bd308e1f8f2fd10aeb2cab85fb92ffad398fe31bf4befef790e96da1cf09bc76bd8fc4ca81ba5633e5efb370a6672b55ff646d95ac677cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\13736

Filesize
8KB

MD5
6c812199d4f9fc9dcedce39a81334a15

SHA1
37dcb7e4935efccc7bf18c4244faf084a4138e39

SHA256
4e3cdd69ced67c714db4a199701fc6884f98c397cba604b34c12ed620decbba2

SHA512
9870abcbdd8c63bc1f13ab2c1a48697f3a864f57478c5f09632344dee3cd1583b72c3d27e9ad11990106a8db1e4904b1a80746955d0d00f024a928d94a4c7415

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\16677

Filesize
8KB

MD5
191943fdd5905bc340c52c0db5175955

SHA1
d522de2bb45567964e7bc4b780b4efd440e68917

SHA256
43985bfc964aae7c4b4c062915edf6fb6a2af987d6cf60c9216e59595810e6c2

SHA512
7257180f5345a1d5fe626700d8c3676869f3278b8ce0aa2d8c8f45a8483a75cc40255cf1aef0e18e2189cf065a753867222c0080c16f292415445044b8381f3f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\18139

Filesize
8KB

MD5
4685502f7b06fab503890dc05cebc096

SHA1
eec5f0886d3017fe978f8bd190600251201a9b8a

SHA256
8ad1ae70788cdce10e09b2a44494b931c2281c25040e7b1b9fb0df632dffcbcf

SHA512
9ef42ec560434bdaa0173698c0a5d77875ae0efcbe7c43996d323c8608519b8d926ee58472e68bb59873eb98bff3b018151a77e746afdb0b54aff2f63788bfa2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\1819

Filesize
9KB

MD5
2b3b312b45ba6828c59f430be76888c7

SHA1
4111c2c419556832f89d254430918cbe2d788c3a

SHA256
9e20779c25c21b377047d450daf507a84a8ad611a5b9d9000e776ded62a4f831

SHA512
be180dfe1ba00a05483026a1fbb5be21c704c5263337ff8312f705e0f379a8edfb3be1ba1b71a0d5fc27e2407616319721a912c0725837a1366dbf465e65621a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\18665

Filesize
64KB

MD5
839db4952f513f162286f2cba5bc7f94

SHA1
a1699dfed470c5abe1929ff65744d9a1f7da43db

SHA256
eaeb1ec4d5e27c3369f6d513e76ba55d96cc645472910f7a203c6fc8580e3b27

SHA512
e892cc8d4a98d29a4d0dddc4395a90d3c86e2960b7ecb144e21fd2d910277ccc5a82124ae10b0947c28fa27d3b648a1b5b20f7e1fafe212ea5c68996137b5727

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\19238

Filesize
8KB

MD5
de756be32e72d4d6e1ec78c94f9d3e05

SHA1
3a1b0d84e47f13697a3e0ae187523ac89f62a603

SHA256
e7c9c062c068e506eeb333b76bddb8566a4fc691cda25ab6e5e4965ab05e7855

SHA512
b763b08a85a74f5f65f259cacea13f78f77d195c8a633d3106e2b4fd1b7e04252a18e6a291a4b26194315d4d34e2ac0062f53889b429b19da7180956cac6c629

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\19494

Filesize
8KB

MD5
c28541d8259e166e388eb883a474e2a5

SHA1
613de27f2c43701fbb15934899d9371fa6af46aa

SHA256
6ca4997e08f0d8510fbdca53708ddeb78b356a348bd1355ef3bfac0b27619f05

SHA512
ee389dfd2b2d76db0541a5e806ec3c7cc46570b891be7b84d1526e57134746068e83846debbb29277f7a7a1e3eea93ff5d44c361d6396f49cf9acabc80e4eaf5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\19574

Filesize
8KB

MD5
bcb192058176b2e6f01c8ab801ea9942

SHA1
bdf9efb7a5958c3e2a0ad9a0fb7c72a87e25ee38

SHA256
7f7af2667e5ccdccfa334838a3f21a32fad1eb4bbfe14762a20ad4d2e9e60754

SHA512
b9770b5298b66ac2efa31394a33408dc04c4ad362d44befc6238c2cf576da06901c970e2ff8b1c8e6a7e6dc5f5a5779efe45e885763b0af9a86f6ff3dbdab5a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\19683

Filesize
8KB

MD5
1fb7f8e245f8f6b209c1589a27373e5a

SHA1
d0ca86d951cfc977b0b7e9ff84e24ac172ebd1bb

SHA256
dcd80dfca03e5ea80587558d78981513495ab2143edda493a1bc6348b64d7d3c

SHA512
0280c5a60de59ede01011af2c04ca25e2a1c2046918aeae4ec6edc9b6bccf3e3a808f9489c9f63e6a18d030f481902c4b0914fccb7ef3e1b2cfe7f671d3bd94d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\20147

Filesize
8KB

MD5
5d9c5a16dca7a0229cfbd07e8390f169

SHA1
89a86680058b8bbd99aeb3e33f72f67484e870ce

SHA256
1a587eff3f0bc7b8bf06f1a57b1e4b58e28ed6b8cd1ada88ddc01ecfabbc479f

SHA512
c64b58acf42a046dd0c5b1d62810d997ddc178730ec1ce752dadc73dc0b5f49dd8bcfdeefe227cf8b868ec5f425dfb756969de4c93662ccb108e5c38497e9585

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\2021

Filesize
8KB

MD5
810cce31e97652a54ccfecd467b1ba3c

SHA1
e5eefd9f1a0a5e6b4cdf64771615bc3f0f6c04cb

SHA256
3b105b523ef155b235596518f7316f720063afb90052aebc85045f6df11cd520

SHA512
57588c39f84149675a5b15cca2f29358b35affb27ded01933bcb8afb34cc41622514e3ac4f6b412993e9a450e6fe962c502092515124091de3e57beb5003b4ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\2121

Filesize
8KB

MD5
25c28fdab87aa5395ec97e8bdf75097f

SHA1
d06780a673309a7cb56a5f5783f4c9c8b18eebf1

SHA256
fbcb419060798af6454104efb43ae7c8b61ab9079ade25a9a8839e85a543cfba

SHA512
4f41f175de5952038926555193b588f9d3d0f979c904b5b461f9ba22ce890e55974121bf8ac1572cc6f15a1b9d35e1f1066d48cdb5bd065b1d8d05babf76811d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\22276

Filesize
8KB

MD5
f17e6a6c36dbacb6d39a16524dc50291

SHA1
958f15c66899946421efab5a12c432aeeb311154

SHA256
e4becde70077d80dc32059f4362a1e81ddf61d5735ad39823e26e6cdc5f2e7f2

SHA512
0f7ed102f284595932c50fea19ea22d3fe41cb567581208b86ac6bac65740e3286d4b7a680d48aa172c91f72e7c035550b8c22ae6cabf47fe791b03f8b34775b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\22503

Filesize
8KB

MD5
07d34bcfa5bbcdb646a3f024dcf3d68e

SHA1
91eea93a1854ecd219e9b5af41634ed790149575

SHA256
00fdcaebe3301315cbdfa1d3fde50afde315972e2df8230bee4a408c4a110fd0

SHA512
1253ce37e8e550117187a2a97c2f18b9506c7f5b4f2ee59cb150ec1924b71474f98d26019f61ac9530158be991b814bf11cc00a5a9b12c8d3589434439408cf7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\22840

Filesize
9KB

MD5
1bc2a6d1045c0d12efc56ba0dacb2773

SHA1
e5372c82ec453e73b2f5739e455f6b3f6685f1eb

SHA256
eb9e4448a92f99314150c0720822cdf1974970f9d556c87de8550af5c46384cc

SHA512
6d3daed08054509864fb1d777becd6f284a8ff26bcd47ffc3c5378bcf40315b0f34e11c4a60b6f4eaf656fe3d58a8cea70126a92d71dc2dadb4e848c83068a62

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\22952

Filesize
8KB

MD5
32a51bf0e9782e974a24662746226ac5

SHA1
1672c5e6a557f5d4cbc35f3838e2a0d45a96e057

SHA256
23bb16c8b87dca33c06fa2552bd4e790e6a1ddaf089536498705485f7b0cb0b0

SHA512
6e893bc5ef307a352d34619cf73ab1935f2ae9912f312c0e5a2b8ab0893ec06524b1c7a74d344752a7652adc54517241541bcdad268bb1cb75be029085557dbd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\26474

Filesize
8KB

MD5
04b34bac20175bfb0d15c871f7130c85

SHA1
045f40ecaefa969c78bb13d3be8c54e94d857481

SHA256
9422f526c910867ee233e9074812fb87a30c19179d5769396cff7627b9a86cf4

SHA512
1fcba31bc9331af44be9ceec16194ad5c6902e7adcdaee385f5477f88db7b64396a7f2f98e0f41b441285e501fda12aa2d106500a9c0cd30cc72e1dbcf49362f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\27573

Filesize
8KB

MD5
a2001bb7819f1ca99f1f6aed70c45083

SHA1
dcb0e390e1a8e9a9ca6b0aa9ec44e5c3bf8804bf

SHA256
4189c9be46e461d4790c8ee3a17676f9f50898aa66774f4309c3ab640d04fb1b

SHA512
18327131def32e3aa47ae05b0ed4a82b556d8dc222d540a0ac8d268bbd365c157d924855b809b09e7a09b41bf5df160359911bcf230d732a14937312bc44d17a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\32185

Filesize
9KB

MD5
ee92d49e521d89bfd48219b361a25fdc

SHA1
7b19e9f52651f78449a3b1af5156599c78c3cf98

SHA256
d91c7c667de2d503e8ba042d598483ed6984f791e947fce16371a2b934341adf

SHA512
235bb09c0bc3deaa8a272291e6184883098f49127c2bdec2b9bd35df154a4134e3bb04cd72a8857a774034b884b81a3ab704c348f8c2f673d4da28d0cac41daf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\3243

Filesize
8KB

MD5
48f090d33c50a5d4fbd172dfe1433318

SHA1
cddcc64a74ef90cd2f207b78c5f1ae1fcc372331

SHA256
929df0b9dadb330891fb94a5c103a7c92bb6831fe63ba118ea7bac37267021b1

SHA512
2f2779c960d6958a8256256330d8d0197955bff99689cb7383c1f64e39438cb867cc86d0ba76e153be3e634fb13e3d9b2c3bab255149a1cafc7ff015aa00c7a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\5390

Filesize
8KB

MD5
1237847889cd7430929f9aa24d74f994

SHA1
70711191b07402a9e8eee4223fb0ec5026ed710e

SHA256
89128ccc3113dc8a5b46c17163833a9a45df22c4f5492fc9c911cd01dd1dbba7

SHA512
34e24fa10388a31e27ae37d2af42da055d9a7b5cfd7ee1a0ea22a22ccdb451f53eea88b88c36260c2f1cb687240dcce8dc67d8f55297409789dc92256f62d4c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\5649

Filesize
9KB

MD5
16f0100baf8b0d4844cdd1472a39973e

SHA1
8f43d808461fb82f239f80e2b22db42ea3e3c14c

SHA256
3d1e65bf8456d2481b5425e604ad7783d2c42f7734eea8dba60a1b644aaf9d1a

SHA512
c6d6c9701eb646d1c2b25c253676d1eb9c39ec8b687261c0bb90527df0fb5f7ba654235d1aca43b03eb4c29b39e9cc48fda00c091c9c122daca0bfbc95e923f0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\5850

Filesize
8KB

MD5
2455cb60032a08f1ead316306f06aecb

SHA1
d9cc6a6d92bfe3fc338c1dc9bb01cb5ed40e7260

SHA256
fa99065d34c1c6192e2ac43f65f52dff8a733594953d88b3d954450221cb4ee4

SHA512
185d058e2bc9d7778bedb5e0246744c06fc5816032352ff13b7735742338c42d543ecb86cd40f2827a398189ccc10a8dbe330deb2532ab557ffef0d24852df9d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\6633

Filesize
8KB

MD5
ce4034cd6fb62269999c02d1195b25cd

SHA1
9fa331106502835f3c582bb606f65aa74e363210

SHA256
ae589249eb6fbedd49032eccac0a83128cb207ed59f4ded56380a2d176ca92eb

SHA512
94dc8995c2a6e54d2c1e45318a409c5b1f5319264a4a5d1ae512658813dd7059689cd946c9c91b9ae8b76ed8099e43f1f8ee0185c7c5ee1b2632fbac428dcc78

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\7769

Filesize
8KB

MD5
faaf8a0ca9dcbe60eb718d91065b04e0

SHA1
9b21e08e6adaac6178e0651cee30fe5945e0f772

SHA256
8ef0640e773c3bf27720715525f6e1639fe08212b1ed751104d1187f1b72c9dd

SHA512
e78761ab613d55a3a44f4309cd3dcab02c92378f2cb30398ba1a519b26ea9d69b3a2957eedb1ab788cf91e30298a316e3199bec01ea41e7ba982013ff2852d15

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\doomed\8207

Filesize
8KB

MD5
35c03b6f2c162bfac2fbac8d5c21254b

SHA1
30b4531b0b31ca90a62886035dc92aa9027d3d06

SHA256
61c44a2dcd3888db2d4b67c1324f539eb2fdd722116160c2818d2f36aece16e0

SHA512
411334a7bd5c7fa1b28c410477b72d1ecadaa49ae893bf4a02df65b29982d8c4da025bbd11f3cf41dccdab72cfa028780d95581f433b05df3dae7e68cab21b6e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\cache2\entries\250EE2BC03AFF526F1A1C3DB212A79DE3EB60D5E

Filesize
14KB

MD5
bd7b5e56cf6b0129e313eee90e2cf4e5

SHA1
46e05444ab62346915b1d1b886c5448aada073fc

SHA256
26b77ce207859dd9efc0c604428399b24f1ae35331677a2ce395387e1968ff3e

SHA512
1909f92353839e95cd6af6fe5e2f6d97c57507b2cc4102f15f82d6dd7f8e55c41c05f392103394566c0f22f871f000379c4ac1f9c0f988ddd48df2a5119d4d61

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\thumbnails\6c84335a2888e54e438a2c76e640d17b.png

Filesize
8KB

MD5
06e2e49b777d9b39a1c18ad12a47bdde

SHA1
83551b65af9c724f764a44cb5c8bf79d8c86a39a

SHA256
147993ebda599bc96eece8a64b9538b551c2d108b6ac6ca0941a842d1810c926

SHA512
fa0ccf913220b847908b233b7febb4b10fa94594926d6a0b30b888e3e267f8276541cd1f6c4dfe293fb2c93c17d1661f04457e10c6c1eaee927e1151c4e2e10a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\thumbnails\6c84335a2888e54e438a2c76e640d17b.png

Filesize
10KB

MD5
bb74f4d2650bd512aff26203795c1f29

SHA1
9a783bd059f9eb08150a4fc22c40635ad3817b08

SHA256
5165d58502b761800d58a4ee30b82c778c2498ca1100612c9a9f23f069ec21b3

SHA512
1f68380038b1afd376db1d816d9c15aa3ac1bcdca2679732591f46c98340a125c6c4911b720cc5d08184f2f032261ce3b54966fe1f26f76368a269c1cb2b20eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
cacc9828377e34154b2b28cd11e645b9

SHA1
c99653378c2a0b91a86a097bbaa1f8aabdfa3937

SHA256
4da8a4b9ef9c13a77de2ef6db6a705b386edd086d50bbb1a03df646ad0c5a038

SHA512
822c0417265db18fdbe86abfdcdcf30725a03386068bad0f7249acc4e130b7896abaa7856f7a8e9076f6cef23e7e1f9008073263467d63618f2fb4e87dea3f58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
6KB

MD5
90c224eaf9c4e99d99933f408ce46f68

SHA1
a823fbfd43ce5227de33402002ce91a406311f61

SHA256
bd55a0fb3eda32bdc5845ece16a924a3aac9bff2ac81abe9f9d9a1e9ec731bd3

SHA512
622b615892135ef33fd3e49888094693ebb315fd693baaf8acecfabe9daa7876536c232cbd24643e05a04dfa76d17fe50b39a3410db6dbc569512444e91c6409

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
7KB

MD5
cf8633f6a8ed93c397d7c541ad621973

SHA1
f0ef9ac35e722626c052b187334163d09cbcd66c

SHA256
b32064473e3a82bf4eabc8c98fe879aa61fcede8c432b1d9ca550bc54a1b968d

SHA512
f10895e0dab7023b1979ffd59da52697d4fd43ddbaedb4c40693d512e3d75eee3f52ecd98a50c6196a2d881e018dc35cbdc2b8379c5553d4bb81798f674d17a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs-1.js

Filesize
8KB

MD5
4003ebf9baa97d06a41f18752d9cbd67

SHA1
9d61ed1b0484c66b584bbfa2fa631663c521d947

SHA256
eb872186bacc992542bdeb82acb31a00a2f91615a8ba5459371f51c9e3545942

SHA512
e89e99eeff25c1134d2d0fe1b559cd2bbe51151b55f5e38122c0867a1d9a2cee54e365490b27e1082f607a589c9e7ff22c03c697ef9cc329f463d5539fc28ffc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\prefs.js

Filesize
6KB

MD5
feb8a52858c8167a58f36caa1b37f116

SHA1
7ae7f9d2721ae3c579f9e18e4fea679e8c848158

SHA256
adbc4c7b5e775c3d401ae811d5be5a69b844f5937e3d0a416d374dd5a7ec227a

SHA512
109d42ec5b9744b3561d29a9cabdcf2ffb81233935fa5c2d80c39f27b92ae55366c3c51ae3d26cc1a8936635662acbd11af89e54efac374aceaa279f13e7dc16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b261930a84c7f6bee91e043b17f9a7c7

SHA1
1c5e3be67fce3561473c1490cff0922129313cd1

SHA256
940bc83fce14ae74b39f22721581b8d532d38d4e13c499a24f532210b0744245

SHA512
f3a6abeb18884d929c6aa2cd3c42f213f99323d40223b1a9f52f5cb03420efef6d670174c5ec5a3d00d81e1da374a9f6d65d2d4c3b0fc4c5594ed2f3405b7144

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
8d6ec1f5529850705ce903ee3a7d81c0

SHA1
2a2ce0f135a75cc261e8735cf303e0b549b4f3bf

SHA256
fedd63c1b6ceb0b803b247875b93519b7c9d3f324aa59bb77da4d181889e86bf

SHA512
51dc132718212ebef883e9636d3da1d6563b426403ac672ae63df3de044cf5cafc8cc7c8b012624fa4174a4504679339b4c5e6094b577e6f565b799635702e99

Download Submit
C:\Users\Admin\Downloads\0cmTjPAS.elf.part

Filesize
250B

MD5
f1ad5cb9025e6e0065b307fcb0a66515

SHA1
9302a3b403494c49e8e24b839ee6e13757c3d5f1

SHA256
cd54a34dbd7d345a7fd7fd8744feb5c956825317e9225edb002c3258683947f1

SHA512
c505a87ccab5211d8097aefcde96d027fdda83b5e7cfd4c4bd9b6305e60f724f55fb3b34bb00579987ba05b98af1b22e154f4fb98c0d300d3f9fc7858e086d27

Download Submit