hxxps://in[.]xero[.]com/U2FGRgKV3ngh3Rl27BYBn2xX0TcUg1i7wzESUyzK

Analysis

max time kernel
270s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2023, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://in.xero.com/U2FGRgKV3ngh3Rl27BYBn2xX0TcUg1i7wzESUyzK

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31037409"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000cd9d03a9a6c1e4a9466005e7bf98c6b000000000200000000001066000000010000200000006f42104afcc14104330677f682231b20066237839daa8f0accffaaa8f9cf8d07000000000e800000000200002000000045fb1b18029082186e4053bdb6e08e2cc114e89b2fd58065f4639b5975e2bbf620000000488bf3a7cf0581453851185082013ac5bc3c878900372bff4d5d5d90ee9a23aa400000008e495e440baac427a557067d64e1646d8f831f4c46ea4acde8cbbd54da46fd25c424f8eef4e4709061a7b8f7bdb8e56156778bb4cf7a1decf13e939fe5258951	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B7E31482-03D4-11EE-9F77-EA1737350EF8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\xero.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\xero.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "31"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31037409"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "38"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "67"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000cd9d03a9a6c1e4a9466005e7bf98c6b00000000020000000000106600000001000020000000c189cb23e72daefab2c646f78543e0206e914e62bf2ca6d1dec8d0038e75184c000000000e8000000002000020000000fec431f6aae6f1dcae2c5a38d309dd7d83df8c2339b9f3f6057721056a3a052220000000209c1fdf0213315785c65c87fd8f91a88f6c81198808894544a98fd0b16665ea40000000a3ff2ed83df8d950464c77e81cd85c492f600a628bbdbefe475bc2d156b2cab97719c5c0225b8d1f2d79be59e9c9f7ef1380c7bdfe05152e1f30d9e1b49217bc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "392757241"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\xero.com\Total = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\xero.com\Total = "38"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "53"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31037409"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\xero.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2366055413"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\in.xero.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\in.xero.com\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\xero.com\Total = "53"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\in.xero.com\ = "38"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\xero.com\Total = "31"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\in.xero.com\ = "31"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2354648636"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\in.xero.com\ = "53"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002e4790e197d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308c3690e197d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2354648636"	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1675742406-747946869-1029867430-1000\{3737F9ED-CDE7-4EC9-9CD1-70948FA16D17}	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4068	firefox.exe
Token: SeDebugPrivilege	4068	firefox.exe
Token: SeDebugPrivilege	4068	firefox.exe
Token: SeDebugPrivilege	4068	firefox.exe
Token: SeDebugPrivilege	4068	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4052	iexplore.exe
4068	firefox.exe
4068	firefox.exe
4068	firefox.exe
4068	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4068	firefox.exe
4068	firefox.exe
4068	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4052	iexplore.exe
4052	iexplore.exe
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
4068	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 1332	4052	iexplore.exe	84
PID 4052 wrote to memory of 1332	4052	iexplore.exe	84
PID 4052 wrote to memory of 1332	4052	iexplore.exe	84
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 1936 wrote to memory of 4068	1936	firefox.exe	95
PID 4068 wrote to memory of 424	4068	firefox.exe	96
PID 4068 wrote to memory of 424	4068	firefox.exe	96
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97
PID 4068 wrote to memory of 4444	4068	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://in.xero.com/U2FGRgKV3ngh3Rl27BYBn2xX0TcUg1i7wzESUyzK
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4052 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.0.731159088\388490959" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33abe64f-aa80-4705-92b4-b097a708f892} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 1936 2f83e206858 gpu
    3⤵
    PID:424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.1.1374109042\2024259234" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b53d047c-0853-499c-8ff8-1d63dd19ec26} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 2316 2f830272e58 socket
    3⤵
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.2.1655670342\1602546006" -childID 1 -isForBrowser -prefsHandle 2832 -prefMapHandle 2812 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {662740bb-f87a-40e5-bc92-c71a57f775f2} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 2820 2f83d181e58 tab
    3⤵
    PID:1564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.3.1892251855\1610793968" -childID 2 -isForBrowser -prefsHandle 2452 -prefMapHandle 1460 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d66494f-3de4-4523-91ee-be75cb46dbf1} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 1076 2f830263858 tab
    3⤵
    PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.4.963109255\2068233068" -childID 3 -isForBrowser -prefsHandle 4032 -prefMapHandle 4040 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b0c3785-1d00-4507-b113-aae1b3952d31} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 4108 2f83026d358 tab
    3⤵
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.5.1286551759\878041597" -childID 4 -isForBrowser -prefsHandle 5116 -prefMapHandle 5108 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4deefda-1df4-4d14-9692-d51ee37fefed} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 4984 2f843a11158 tab
    3⤵
    PID:2364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.6.1968316211\1368571666" -childID 5 -isForBrowser -prefsHandle 5244 -prefMapHandle 5160 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {532c530b-61ea-4be2-9d41-135e6055e0da} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 5236 2f843a12c58 tab
    3⤵
    PID:4760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.7.407021320\784213820" -childID 6 -isForBrowser -prefsHandle 5332 -prefMapHandle 5336 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5b3992a-00ba-43f6-98ea-b9a8a2ecd16d} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 5324 2f843a13558 tab
    3⤵
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.8.1353834284\922985526" -childID 7 -isForBrowser -prefsHandle 5944 -prefMapHandle 5928 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed7539b3-6049-4eee-8fb0-0c66047ac905} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 5956 2f844cbb358 tab
    3⤵
    PID:384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.9.1086718403\2091396265" -childID 8 -isForBrowser -prefsHandle 6116 -prefMapHandle 6120 -prefsLen 26674 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {439ed4e3-f488-4dd3-a5af-55eaa778604c} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 3924 2f830271358 tab
    3⤵
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.10.1582651104\495381808" -childID 9 -isForBrowser -prefsHandle 6224 -prefMapHandle 6212 -prefsLen 26674 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7712adad-8f97-4791-8677-def09a1b1a38} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 3700 2f83fa79b58 tab
    3⤵
    PID:3400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4068.11.594187509\1522816500" -childID 10 -isForBrowser -prefsHandle 6228 -prefMapHandle 3700 -prefsLen 26674 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {168785bf-650a-492e-aef1-8a075edeb56e} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" 6232 2f840044658 tab
    3⤵
    PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\1CL260PK\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DGXO08BV\in.xero[1].xml

Filesize
88B

MD5
7239cf583b8adb1ceb9414edbc0f6cda

SHA1
1ecf03844c79aef1e4185d189f5627ed93c4aafa

SHA256
5f6fb58ab3f3b91b7013aad88e09073fe1b51184f3ded8cf04e4d61f44a0ddf3

SHA512
18a8e3d04190b15360a88d28eae0906467e2b5600e60687a7a1c0a4d0e336c18596d34d4d8772dcf1321c5b9de359fb8986c65636ae5a58c56f3f0b92617aca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DGXO08BV\in.xero[1].xml

Filesize
88B

MD5
7239cf583b8adb1ceb9414edbc0f6cda

SHA1
1ecf03844c79aef1e4185d189f5627ed93c4aafa

SHA256
5f6fb58ab3f3b91b7013aad88e09073fe1b51184f3ded8cf04e4d61f44a0ddf3

SHA512
18a8e3d04190b15360a88d28eae0906467e2b5600e60687a7a1c0a4d0e336c18596d34d4d8772dcf1321c5b9de359fb8986c65636ae5a58c56f3f0b92617aca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat

Filesize
585B

MD5
9cefa6d3cd09d40e2260df940376b38e

SHA1
43184c27c377193da15df8a54f148c7467d61a20

SHA256
35edba125e082d1cf5c72d2f7a85c65d41ee42182a4dd2ec1bd42165e5dd6bf8

SHA512
0c22b9c24ed040893da15df62db0626eb631676b5093c09bd04b94c129944d6182845fa9bae45a0ab56707a7ba0f7ae9f35bbde2a7c0c23319415abd404cbb42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\favicon[1].png

Filesize
477B

MD5
171f07bd0491bcc586b2fea0746bef76

SHA1
9f31c9cd20517a8c8b518b87927cead1182a3ab8

SHA256
a9f1e33004e0c43b01f9cf26289636b459d016b5e9c290db1368517b241cbb5b

SHA512
b950fc75a527bd8c2bd50b75a5a5ab5234f44c14cb06361afafd07863ad867b5784b1c6bdd75f9aa68afe96aa9facbafe2246712a02d172025d8d48b708cca5e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
135KB

MD5
42c0efc489e49bd8a76ae8aaeb794f57

SHA1
c092f3bf63e07f809e39df67c3b8fdb1e5b70b08

SHA256
58fdbf01d1c6dd2264a1e7981351cf34783593e94bb4cfaa07c25dcf8ccf8461

SHA512
f060a8870c2eeeebc5a000c32f3e64c1236f327c48dc42d346e42d48914fd66b86d8e71477ad9bb90a9a2576f3fa6f1066177ad99f40097502ddbf2e5bd031df

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\58D46C4012E4AD3623A4EA72BB3C1CDD25B3FF87

Filesize
14KB

MD5
9c770baae3a125d81f0d3416be387ce0

SHA1
d49f0e8a061c69903cda3bcee045983b4e9d2967

SHA256
3df9df9a293f146c8cbae20ae0bd610c93ccfc0770ced1d8b8b5b0536cbd6c1e

SHA512
08019f62678e84cfabc9ae99428cb74b985c87062ce950151f94c15118411a8076d29dfd698f4ec7d07dd298b45f5552c68fee445e50ce61742a693658d0e84d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\917E41E135032D6BD66E5D6F84F0988D37234A33

Filesize
14KB

MD5
d2e110be9a65c4f306cbc34d0574dea6

SHA1
972f21bd28cd74ce0d3207a0605817b399fbb316

SHA256
406de4bb2bfd8a8e11eda6843205cc86c2d0b6286881bdc8054f32bd9bb58b72

SHA512
b735f86bf83e2f7ebff3b28d116d06c38236509fccac20725b6cdf3f7a946ee1c0e83b23532869410ff2869bfa66b0819343598d31694ccb9ff182abe98552d8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\C2F45444F476F00C8BEA82C77C9B418F8FAB339A

Filesize
36KB

MD5
6658dde0e1bff8762f87c711a0f2627e

SHA1
981ef39d9d81bfde096d21514a48a6b3a310fd97

SHA256
77efd55121f811aee5ad459ce801f1b87eaf294e67c479f492f0358e06235b42

SHA512
b6063a334732d83a7ade9e9ff7bd8d64694ecc3a2698718c16030166b47a62ae75031b12e07c995f313e606359578407f6a79b42d98cb8c7b32f3568f5abe754

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
b8f531f85bdd8f6ee0e4f320c4626d36

SHA1
24f75e14b3c414ae8ed6d733a0f127b32f9aa782

SHA256
2707c885c16ea3549158c73fd349bee71ab5ac2738a872bdc8666d4715cca8ce

SHA512
6af5feae25d4ea403108d8c23351930c916eed04cb1fca231b83aa8235801b3fa026140a7f6a941fc4cc19dbe83bb374f77d74bcc3e4f156a2fc1d7a7cf3e848

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
6KB

MD5
72437354ca70b0624599e7183a315ad1

SHA1
fdba33e0f1d4ec06eccc60bfd4d1920992798d3a

SHA256
576c2ba19c66a780756f4947b1fdc8241d772dff020102e4c47f05319bf24372

SHA512
efbbdacba5ced8fb27439286bf29e4dfbc84cf21935516f94ec5b711874fe497d91d6db74a60186c483aa49c7998f975f4a685d7c9d85c5bd8b8a68d8e9f139d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
7KB

MD5
5956d05cdf0c9c66057105097652c397

SHA1
5cb1baec72953e0f076b6cc065d1ec52bb3d0398

SHA256
3062cee1f6099aa2cbe61a25ce906ba6c0daf1dd332071aa94c287f5baa90699

SHA512
e4aa3b7c0a1c448c91ac56892ebb70e61cb948fe9eec666ed1547ba87cee3d419f5ebb986bda905a6d50a8fc0555a92d7f388f71266278c3111c5b52c0336a7b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
8KB

MD5
4265d726710cad38b5fdf0db6902a0cb

SHA1
17df2e670a9f782b35df8be415884b5a5a88a715

SHA256
418a9b1e83afbdf67a434886cd9c9ffb84208e2d0108910774b4da30c6970a4d

SHA512
9ade4aafc4b4e4775a0983ed99ee0c978b5ee13fe1ac0719811124c3944502044b87bd9fe78390137a3decb52e8ccaf8f1ce0ab0f811d72798a6e1a961dfcbf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
10KB

MD5
ed1fe932e7968528592cde361dd719d9

SHA1
09d71bfded024384a17b3951e5694591aee90aba

SHA256
7ce76905b131a7de47c1d5991d95c4bd91e8d3c3e7453cc1c083df07af132185

SHA512
50cc1bcaa7e3580c2e6b901b5be621cfd0e34337c20f1723165c192c81e49b866e6c2f5cb2e31a3b953d0dc47653d32265ece9fd536751cdb464c084327db82c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

Filesize
10KB

MD5
cc28516d68630019d3a12ed25cafbef7

SHA1
cd9ea73f95e72046a472b419daf7ec50fde37c18

SHA256
279aca4d772d22d63882ae122b346760ec808d280bb701da1cb6e657a70c2a8c

SHA512
7676559d1bd32877505cd8cb710bdc58fedc8f9c85ab761f68e259beec5e816c33d803942d48c9aad8a23ad947bf7d0a9530a603af3413bfc3fc1cecd0e69e5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.js

Filesize
6KB

MD5
1984b45f201f1fd79d2154406648433b

SHA1
42f082dc6d4d43333688690bf4dfa7c7f8b618ab

SHA256
000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9

SHA512
e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
d4c9782d53d56fa57fbd0012170729bc

SHA1
6c87d9b2134ad3a1d36e473a8da27e174484b879

SHA256
472faac8ca7daac0f9ac3a2df16f726eacc3456fd7dfab5f5f8b8911687ed97e

SHA512
977d4d1481c6778a445adb2968995ea716b47128415d5b5d93f90143d669651da14cbb45825c187703150352c5d82ecf002fce2b01295f76664c7409fcebaf2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
f03b67f0b2fdd07e29b9cd1682b1e7ae

SHA1
45377d9ade1d17fdb519755eab4eb045615491c3

SHA256
99b7d81d2aca7a3dc44b1df695ca7d914b2d3a1a76fd8eca6b6cdc809f7d0a5d

SHA512
b559df73855fa19aee69da5666c36418e1b9c394dbdceafd1db47255cb76b247f83af41bc84903d2d400a242cd7415a40c5e83146b90680758d295abc40d0471

Download Submit