hxxps://nighty[.]one/

Analysis

max time kernel
176s
max time network
201s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
15-10-2023 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nighty.one/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Nighty.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3988	firefox.exe
3988	firefox.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
220	Process not Found
2076	Process not Found
1868	Process not Found
1884	Process not Found
4632	Process not Found
4776	Process not Found
2220	Process not Found
3252	Process not Found
2728	Process not Found
4244	Process not Found
2452	Process not Found
4968	Process not Found
1944	Process not Found
3328	Process not Found
3988	Process not Found
1740	Process not Found
3848	Process not Found
2440	Process not Found
516	Process not Found
4016	Process not Found
2688	Process not Found
204	Process not Found
1796	Process not Found
3984	Process not Found
1548	Process not Found
164	Process not Found
5116	Process not Found
5020	Process not Found
1012	Process not Found
4480	Process not Found
4056	Process not Found
1844	Process not Found
4868	Process not Found
360	Process not Found
3100	Process not Found
2196	Process not Found
3748	Process not Found
2572	Process not Found
1668	Process not Found
2632	Process not Found
4572	Process not Found
4596	Process not Found
4612	Process not Found
3324	Process not Found
4236	Process not Found
2208	Process not Found
4008	Process not Found
4084	Process not Found
5104	Process not Found
4624	Process not Found
4428	Process not Found
1800	Process not Found
4568	Process not Found
4028	Process not Found
4956	Process not Found
4980	Process not Found
4628	Process not Found
2388	Process not Found
4060	Process not Found
2324	Process not Found
4456	Process not Found
4312	Process not Found
796	Process not Found
4884	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	firefox.exe
Token: SeDebugPrivilege	2720	firefox.exe
Token: SeDebugPrivilege	3088	firefox.exe
Token: SeDebugPrivilege	3088	firefox.exe
Token: SeDebugPrivilege	3088	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2720	firefox.exe
2720	firefox.exe
2720	firefox.exe
2720	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2720	firefox.exe
2720	firefox.exe
2720	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2720	firefox.exe
3988	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
3088	firefox.exe
996	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 3820 wrote to memory of 2720	3820	firefox.exe	70
PID 2720 wrote to memory of 1668	2720	firefox.exe	71
PID 2720 wrote to memory of 1668	2720	firefox.exe	71
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 4492	2720	firefox.exe	72
PID 2720 wrote to memory of 316	2720	firefox.exe	73
PID 2720 wrote to memory of 316	2720	firefox.exe	73
PID 2720 wrote to memory of 316	2720	firefox.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://nighty.one/"
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://nighty.one/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.0.1921151751\1620276258" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20858 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27b1aabf-a63c-4cb6-a5e9-aaed67d5bfa4} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 1796 2347c7d7158 gpu
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.1.1424738392\1817567865" -parentBuildID 20221007134813 -prefsHandle 2160 -prefMapHandle 2156 -prefsLen 21719 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc19a115-2b97-4cea-b5b5-42f5395362d8} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 2172 2346a370158 socket
    3⤵
    - Checks processor information in registry
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.2.2067654007\943569813" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 21757 -prefMapSize 232645 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfb718b4-3707-4d38-8ccb-dc0773925b49} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 2968 234024f2e58 tab
    3⤵
    PID:316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.3.520859484\621206450" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 26402 -prefMapSize 232645 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30905a02-ab04-4ef8-ac86-4939455f1390} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 3572 2340321bb58 tab
    3⤵
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.4.189962165\187169206" -childID 3 -isForBrowser -prefsHandle 3688 -prefMapHandle 4420 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c046075-9ea5-470d-9e5d-cbb44796623d} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4380 234040c4b58 tab
    3⤵
    PID:3024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.6.1362201228\1410654948" -childID 5 -isForBrowser -prefsHandle 4812 -prefMapHandle 4816 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72fb7e39-d6ff-46f7-8972-676aab757a65} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4804 234043a4258 tab
    3⤵
    PID:1652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.5.1557344216\1842955458" -childID 4 -isForBrowser -prefsHandle 4460 -prefMapHandle 4560 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a70df82-8a56-4600-a651-32463e6f6e05} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4344 234040c3058 tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.7.270302638\1569017361" -parentBuildID 20221007134813 -prefsHandle 5512 -prefMapHandle 5508 -prefsLen 26461 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d2dfb39-4f43-4846-a8e9-be6cca279dd7} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 5516 23405439c58 rdd
    3⤵
    PID:504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.9.1518981823\1533495119" -childID 6 -isForBrowser -prefsHandle 5752 -prefMapHandle 5528 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5326f09-f4c3-4bc9-ae17-8b89bc76264d} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 5756 234060a5058 tab
    3⤵
    PID:1884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.8.823899446\1521739203" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5608 -prefMapHandle 5484 -prefsLen 26461 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9929962a-3564-4d5f-bb16-0c570858c3ab} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4804 234060a6e58 utility
    3⤵
    PID:1824

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4328
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3988.0.838134654\1548147372" -parentBuildID 20221007134813 -prefsHandle 1632 -prefMapHandle 1624 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fb0f4f6-c75c-4e94-91bb-7f33122d6416} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" 1704 270f9af7958 gpu
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3988.1.1362759835\1267252535" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1880 -prefsLen 17601 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae4d55d0-0b0a-4d27-8ba6-db568a957900} 3988 "\\.\pipe\gecko-crash-server-pipe.3988" 1896 270f9f42558 socket
    3⤵
    - Checks processor information in registry
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:4144
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Checks processor information in registry
      Modifies registry class
      NTFS ADS
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:3088
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.0.1039983962\1817044904" -parentBuildID 20221007134813 -prefsHandle 1568 -prefMapHandle 1556 -prefsLen 21123 -prefMapSize 232728 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c03fe591-e963-43d1-b9a8-1001eae8f694} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 1648 1eca9be6258 gpu
        5⤵
        
        PID:4940
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.1.2017150054\877419306" -parentBuildID 20221007134813 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 21168 -prefMapSize 232728 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff3722ec-7690-42e9-b0a5-1834a0aba836} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 1976 1ec986db258 socket
        5⤵
        Checks processor information in registry
        
        PID:1580
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.2.1892653482\344952795" -childID 1 -isForBrowser -prefsHandle 2912 -prefMapHandle 2568 -prefsLen 21629 -prefMapSize 232728 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38138c69-acb2-477a-ae4f-c65094c53731} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 2904 1ecadb4cb58 tab
        5⤵
        
        PID:5020
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.3.1413177569\1316445166" -childID 2 -isForBrowser -prefsHandle 2492 -prefMapHandle 864 -prefsLen 26989 -prefMapSize 232728 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e723e2f6-42ad-48e2-948e-05702f6573ce} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 3232 1ecaf6b6758 tab
        5⤵
        
        PID:2620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.4.80350577\1171054287" -childID 3 -isForBrowser -prefsHandle 3984 -prefMapHandle 3972 -prefsLen 26989 -prefMapSize 232728 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f277f4d-b422-4119-8e4c-2c932647fc33} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 3940 1ecb0136258 tab
        5⤵
        
        PID:1824
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.5.1228158842\1371879288" -childID 4 -isForBrowser -prefsHandle 4168 -prefMapHandle 4584 -prefsLen 26989 -prefMapSize 232728 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e6e99f9-1129-4faa-9cd7-80ad4348febd} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 4608 1ecaf4e3b58 tab
        5⤵
        
        PID:4524
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.7.720266080\1472173364" -childID 6 -isForBrowser -prefsHandle 4940 -prefMapHandle 4944 -prefsLen 26989 -prefMapSize 232728 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73c51ad3-f2aa-4461-a506-eb8ccac0156d} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 4912 1ecb08aae58 tab
        5⤵
        
        PID:1844
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.6.824217323\494104533" -childID 5 -isForBrowser -prefsHandle 4820 -prefMapHandle 4816 -prefsLen 26989 -prefMapSize 232728 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3296e187-9e0e-4b92-8efa-ac66b4faf5f1} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 4736 1ecb08abd58 tab
        5⤵
        
        PID:4444
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3088.8.373037680\1048661733" -childID 7 -isForBrowser -prefsHandle 5548 -prefMapHandle 2208 -prefsLen 27363 -prefMapSize 232728 -jsInitHandle 892 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {914e7a2b-5f9d-455f-8651-0cfa005f7492} 3088 "\\.\pipe\gecko-crash-server-pipe.3088" 5280 1eca9e99e58 tab
        5⤵
        
        PID:1868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4156

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aea055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
389fe9708ce92553be5ee2f5a74a292c

SHA1
a807c8534de4abd336cc5887a6fb2e3dc64128cc

SHA256
f2a13eb368a4d2b44e3f279fd7a12cd4a15dee5116f3ebdfeb37fcfc46f5881d

SHA512
7af18797bf5c3ae099678e687cf6625a3eba651be25dc5bdfc713112c0d23586ab901bed96324282f201752e7704b77b5b038637d9092ef95d8ec5d6d2a7cf8d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
07c1bf883d3ff3793fe332a09118c5ff

SHA1
12754e3031e2d5274b7a976fbe27326c4ccc8027

SHA256
4656b373239de3645cae007d877a854878c1d349557216a5fa4407ce81b5a1ab

SHA512
34df7674ed797b57be508a2f08aac9fac326ec4386df574c7c20311919c2096e901bd57da435aae38bc7290f5a34667dc98d39aa61389365eecca32638cfd93b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
a4ad2366b66ee61c06302e3db53afaf9

SHA1
bdf18c1556ca9edc817eb4b9ead1723a43e1d0f6

SHA256
20c612696ac8318c0f2d0af15785624d01638a6f75d16eac2ed2b55ecb4e1c9b

SHA512
a88f6cdbb32707699e3e3d135e394d280139b18c3dc7cdc75d0c3b0075b4a7d4ee4d4277818658399ec206d447245f762b08c78a0526b045af9b3bddec4d5d62

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\cache2\doomed\24049

Filesize
768KB

MD5
dfb0d76b301db25bd0288c93cdba64f5

SHA1
bde2f6f0c356279d2fd8b1a0377de70e80c450f4

SHA256
741fbc59a3bdb93f69938433c6a4fcef5ef22adfc2895d6f13b573189105957e

SHA512
050adbdbf522f885f02f80ba39ca2247e198c8bd7ed6ca9c0cd915b9412516dfd6d46b9242872fd279cd9b0c4afe750f7bc0fb793883bebc88c8638f47229b17

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\cache2\doomed\24876

Filesize
801KB

MD5
3869b34b9a34a88c402328a8355f24fa

SHA1
f074c6399f5b462a4678f78ad12dce90d4c57ff5

SHA256
5c606770fcfe2d8642dac867cdf661095fff0548a848dcf1831f4ab2f324aa05

SHA512
0926aab0f5f23b2d3a9d9610aa9076e9cc24dc329dc5e6070fc82fb8f943aa5836333c5086aba0e55693ec9706d38945a3337f69212ea242b6e1e271463caf6f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\cache2\entries\003B6BE2CBC164FB647C5F681365E44D4CBAECDE

Filesize
579B

MD5
630010cc8f59a4aab0589a2d1a3d37fa

SHA1
d554f1c5fb83a350c7928aa05982397ffae22830

SHA256
3e5de3999c075c0799df8ccbdba14adc7a29947fbf968f9d2e07f958f2e5e24c

SHA512
6f3e2cb2f3891c63b7dab5a29eb934f2e76a5b50696057a4dfeb0b4efdca168de5b3c317e328d51c6a7a2b9b992db6a0335460f92bda11106aec250289e1de47

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
9KB

MD5
80fc1d9e3375d21817d11a682f114f13

SHA1
1b226a3d8e42903a15e695f71feb242adb2a6b7b

SHA256
e50fcda01daed854a9b94f54a3eab4507422266d7181379f8afa098df48a0efe

SHA512
eece66a0852177bd23294cf6ccc8ee04a66f62003839583a3f670c4683419fc2bd9f6f938faefd14c875c7ab68f848a133b60074a2f9db9221cc8388e8991ef9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\startupCache\scriptCache-child.bin

Filesize
458KB

MD5
ecc75f6374fe4c127eabaf6ba184bf8f

SHA1
fcb9bfce7df6533dd18dc516f262b5907d08cd40

SHA256
c7d9559755cf0059c53582443c969d6293545163a3c84096d9f75170ce471315

SHA512
ff5c5dc043bf0078adf070cbe68f0d1d54102681273df6cc6ba0d01d3a067ba150edb5e00f7c9d44241a31c1478b97820b593abb4535e4452ffb455660ea49b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\startupCache\scriptCache.bin

Filesize
7.9MB

MD5
437faf691ceb9806551e2d3f9a563213

SHA1
5b4ed00ff13b95ff7431c62245a24686b6c8fc92

SHA256
8b319dad4ac9223e70f619082288d96bd9700c8e96ca1b3264c37f45763b79a8

SHA512
79f5ea7918024c8fd91552b1802be982791208fdb8fc8ca86b47a0020d906e09f7c7191a40510b66c6c300b8dfb56142b6eba092c9ae5f7e210eeb2179c2ad17

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4tubnn5x.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
a68fc731cc4e5e96a544c38f05bfb880

SHA1
f379bf75eb4a93c1f913b3ab2c4a70ffcc612cfb

SHA256
a4ac13eaf0be84ae1ecb2b33df877f6c9c2ba83ca77a2fa218188ab8ef5d8c87

SHA512
6e80e89eb5676ee2edd947cbbb8949a7b227fc39af22114a0fcebb773aba0a0a542bc29f6430bcd159420341cfb15ee30a05dee1ee999d4c42aaae0cb4bf361b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\AlternateServices.txt

Filesize
1KB

MD5
8acc77b07862f68d49b0fcaaf6992282

SHA1
6d5e023ce6f76c93f8afaac4cda48652761928eb

SHA256
dc68ec64a48af7a0edae9ac60797b5c9f20b42c11472c58a9a43d79804f241b5

SHA512
6e674f3e30f285a32e7ba71e33e1c748c81625e318c72727b2c6096ecc95c4560c1de302a5176ddf799a5c8107c77f81ba7784b5c2bb6a6d8f41130f8a55ac10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\SiteSecurityServiceState.txt

Filesize
381B

MD5
4a0dde7fd5ac6241bba1f5d335b2aebb

SHA1
69c021cc0c0febc3a4e2927f96dd3595a03be09f

SHA256
4e5e3f042b826a89d722e1ce0e80c556ef14588e7a953f69094ea4b59cb83e7f

SHA512
fd8c9f28f882e238897ad99c57a1d9419bb023bdd7b1ed604c79ed8e92e4c6108e2126178bfdffffe90ee1ffcef58cc9f75b936d38d8a3d7e5389907e007cae8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
f250c684a241935c2794c30ae164ae52

SHA1
ea384bb1ba6744718b3bb8180800365d19887692

SHA256
ff08fca842608945bab874f225d809065a58d1eda82f37f80f727bff95bc00a7

SHA512
e16698db5705fb140ab0579c4ecbe51ba7fd2d494bf987c23bc5c46294e84749a3f1b43d0ef43fa75e7ce0d1b67ac3c22421717506be6fedb4dac49e2e7870ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\cert9.db

Filesize
224KB

MD5
f287f49590a4201dc454f0c679ea3e89

SHA1
7f1343540dcea2a1e4d1bde11d94d85cf5cd4ea7

SHA256
fa1f22140d8970794732d761d2091ef22c589234cdc10696a2ec2aa2098fad05

SHA512
3814dafc862c44633e5f5d3b1960da2bea18d5ec70cdcabf1faeb2b802ce0fa239420ed251d475c8ac96600ec4762bb0ada765e30b8240f1d579ebcdf34aabea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\cookies.sqlite

Filesize
512KB

MD5
c5a5330832c85c4dc5d464368b83b39b

SHA1
7ee0834503ec8faf0f930c284761c9b4dbe18919

SHA256
a79b99ecf9a2088e2aee7d051ffbc71849c96fd3457d757761d0e32b7651330c

SHA512
30fc50d92dc60f3b593a9440659591eea299d46db545af37415bb7ea61e4dd4ca9ed56fe8945ae242ad518f91f41d5d088a143679cefa8392814d6aa70b4bda5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
c58234a092f9d899f0a623e28a4ab9db

SHA1
7398261b70453661c8b84df12e2bde7cbc07474b

SHA256
eaec709a98b57cd9c054a205f9bfa76c7424db2845c077822804f31e16ac134c

SHA512
ae2724fc45a8d9d26e43d86bcc7e20f398d8ab4e251e89550087ace1311c4d2571392f2f0bed78da211fcb28766779c1853b80742faa69f722b2c44c283569fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\datareporting\session-state.json

Filesize
161B

MD5
18d921bc1768a5c4a07d60b12b295b43

SHA1
8088914eb06d0c3e2f7fab70449ce53e099151a0

SHA256
d689ac83dcf6bdc6058d70027fffc3bf601833ae894ae0ddacd07f90eb36d6a7

SHA512
740a27f59fcb0304326ccdad66b9e0a27521da9a976adee11d6e572ed1178b9d2af79f5a7b262c06fa8fd2f95a8046fb789f752af302dc5b9263e7f6f0766400

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\places.sqlite

Filesize
5.0MB

MD5
a53baf84e8473dc8411971f1f25783bd

SHA1
c12f333cb5733a7e2be8076cfd694b56b6c973d9

SHA256
b88124dfa7965f69dc7b0acdaa3f9c79b4311670085b9a5a40a5ed82af61ffa3

SHA512
6253a352ee6abf4b3d582d7c3797e09fa5c567023ae7f33887c169088b1f8d177700df40f7b834cef0e0e668709d481e08a19ea2ee5c1b136ffa98b180b4720f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\prefs-1.js

Filesize
6KB

MD5
8ac6dd8493c71820ba77e5f8eb2c9c4d

SHA1
94423249d8b89c52f67256cf2e062de9aaadf3a6

SHA256
1e9bb15bff8a65683d1151da05ba12a96c71fe921d962083bd630450c14961b2

SHA512
8f66569414749303b21fc2298d48ccda5a594c96dc34df2999dff06e4c5d144df2a2691de05696edaa37d8e09712e3bd1fc66cb035806101c5f1402867e73172

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\prefs-1.js

Filesize
6KB

MD5
c98d2126f9a556275c7a30c9cfb0eefe

SHA1
a3072fbc983c005bfaf983fc9cd9818af6b76702

SHA256
cae758023f171ad8b11b36e32c6c238f60415f96122ff522bb8842dd08c085e6

SHA512
31311b094e0111b237c10984e227deabe6026feb01e5d27d30c2cbf90e9e94aeab0502d5f5164610dc3fa4dc6c6c78b4a72ab669e59079b4a810637d6084a284

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\prefs-1.js

Filesize
7KB

MD5
9e7e2c021931f6f61f42316202ead6e2

SHA1
74e44668fafe19e5f665e5cc586e4e7a410b43bf

SHA256
788a141dd68c7de171b40b0d7ce9ad2ea0ce7e0f9ad2369d48afa8915e4ca556

SHA512
2d015cd231c6b5bba70ead67857fd0f2a4a92527174862cb7f1789317bbd382753db30cba1bec625bd803efa77fa90a496acd7eff30ef05189d78d51510e3c46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\prefs.js

Filesize
6KB

MD5
c7f1dd331d211678412e233b35084181

SHA1
7e8c5ca5cf10db07f5797ee40378e7d70e261f43

SHA256
b5547d8067872817670513604fb240bf99ea50cce464233621968faaafab9698

SHA512
abeda7004da8435147f245eb09c0d4aa167dea1115ea033ff369631dcd349f10441dc8bb165b9f83b7e8984db0fdf81e713f0ec14d704816f03dd3ff032e5689

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\protections.sqlite

Filesize
64KB

MD5
49397db0486dc59d607907a086f40c9b

SHA1
08742ce9db9569062def08e99eea8470702feb7d

SHA256
890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

SHA512
fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionCheckpoints.json.tmp

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionCheckpoints.json.tmp

Filesize
212B

MD5
29ce37dc02c78bbe2e5284d350fae004

SHA1
bab97d5908ea6592aef6b46cee1ded6f34693fa2

SHA256
1bfee61e2f346959c53aa41add4b02d2b05c86c9f19ffefe1018f4a964bf4693

SHA512
53a9eb746e193c088210d8eaa6218d988f3a67ee4cb21844d682ff0178db040932404f5ce2f3cf8b4576313ba0ec33c04ca288c3412bfa5df7dd8230cc2068bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3132c7bcdd4b08fb3d65b09119671a93

SHA1
518e9676048b1aef7e3cef988f7dd34a28df4a14

SHA256
f30ddd62a1181ffdfd7f921c511e528af2b383f157ab0969aa9f98fbc693e83e

SHA512
81a7eff819bf2f5c93a6d8e6bb3423b246454c81b7ec399835d9bac6cc8567ec301d87d93e8bc19a4a459d9a8c7ec128fee94221a6934d7d7fc762adbc84ef36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
36626b8d5869991408b30949ffd34bde

SHA1
c36ee705a7f6a869cfbfc8a4db48d3ce89d168d8

SHA256
f7b55c186fc7df534ee732d904bc885ae8128c134050df360d388c3624309078

SHA512
b49f3bd07fb5f1496dec49c5a55b16c4f61d49920305e388552b0374382a7902c87f4fd6cdb1361fc9c6e9abdf294535b4920671f9b64524a4759c1188f7e2f6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionstore.jsonlz4

Filesize
1KB

MD5
e8fb94fd5ccf44cc1859869b8811ba47

SHA1
e4466c421c283c51f7d81d425c864b9c98c31e96

SHA256
98bf24df6cb2fa58921396c311d6dbb29e6e26fc9cd2681bee48b4b72afd49f9

SHA512
390925e9764a17e80cfb8cf7602a81ae78b16ce1e4851df44ec3ce3442c9f1d1145d5e62e8ed3a934bfb0e0c16be57b4339a36e4136fe19f42fd39be3ae5f826

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionstore.jsonlz4

Filesize
1KB

MD5
03912d86a8a62a43c1ae6b6a9d874d53

SHA1
090c95ea9a251cc8806e6c8c5a2116a13324216f

SHA256
b784c50706d37247114ec6ebb2b719b3453d9034bc66f0c4c2bb17415b9fe852

SHA512
03e0e34c7ffc662b0c0dca0203befe0a063931898a038cf2807067dd4df5d3d0576414c3a8855c84ae4c344c52ad673c53e333ef58304dea7eb4601433cc964e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\sessionstore.jsonlz4

Filesize
1KB

MD5
03912d86a8a62a43c1ae6b6a9d874d53

SHA1
090c95ea9a251cc8806e6c8c5a2116a13324216f

SHA256
b784c50706d37247114ec6ebb2b719b3453d9034bc66f0c4c2bb17415b9fe852

SHA512
03e0e34c7ffc662b0c0dca0203befe0a063931898a038cf2807067dd4df5d3d0576414c3a8855c84ae4c344c52ad673c53e333ef58304dea7eb4601433cc964e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\storage.sqlite

Filesize
4KB

MD5
6fe6f8a1540d9c6c15899391dfe7035a

SHA1
ce7ba49b26338f766dc6a08ecfecd3ee57dbbb74

SHA256
920ad60ee88f19f5afac5cf9f271bcc5addfa722a9b7874c46a3a910f28dfdfd

SHA512
406344606952afaab2ad2013092db532c11b050fdf416d693bbf62122f2ee6f679f5c561ce287edec08351f458f4965fd2942289142dd4ab9e45381c28c93507

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cnighty.one%29\.metadata-v2

Filesize
178B

MD5
d5e165a57dfaac3ca4e74bc26a273e52

SHA1
692ddb352508dc2a8d9910ab0522fa7349545bcc

SHA256
04929b6a7cf81206b4ff1b0cc0a47a221303709546756868727fb8846a1aa672

SHA512
f1a29d244f36f183da3e32e9d71889bf7129ea3e135f75e6b4f13edfd231c272c3e6214759b9593bc405351394f6416cccfa674c74224c0b92ebc948c6cf6fc2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Cnighty.one%29\ls\usage

Filesize
12B

MD5
d6fa63a1aa320a532e661cca16b97546

SHA1
31f7871786c914be3557fee917387c0449a9049b

SHA256
fe308574e435f2f80e44af2820ea80f30ba1db87c5fcbd207d1b5fd1030cfa75

SHA512
aa16c9b2f1d06a063eb7460cd17afac738343abc5e8a045bcacfcfb0f7bf9ec8d1ef5ed82a5582df46aa7f0ac80df163b3526460019e15afb6c9f9fd50bf4dbc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
c7c03dbdef0b67cf8bee3d919964d0ff

SHA1
c3e48f79af793c6867633100a5b92b889206e143

SHA256
5fdc9b3694b50d8da30c5e57643a2256bb5054564b920cbe0cd254ee0915f613

SHA512
5920198cc6c32d4833b0afeaaa64756f899ce6bc84c273b22f90c2e462fb918844cb8fed9458427cc680ba43f9359471fffaf0cb99921f8e2c5b12b2c4068188

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4tubnn5x.default-release\xulstore.json

Filesize
217B

MD5
58e240288763218d12bf235d34e5aee2

SHA1
89135494b57f590011c09668dec3b90d2c5ee9ae

SHA256
615f80e71dfde24711e7fefc1b7959f7592c5e5cf9ad0f3aecb4235b93187176

SHA512
caed2638902987aead199e73cffb90881bf245bbb616cb38c46b281d4aaaa54dc20a54e9bfe17a8d6e68847394c113fb7606e94b64f44ab0b52bf7846f26e936

Download Submit
C:\Users\Admin\Downloads\Nighty.82xUXFT3.zip.part

Filesize
65KB

MD5
c51723febf5574bd5973be2db106f2d6

SHA1
3acfd66aae0f32f190c6bba3944ec2d3bf7547f4

SHA256
d78540c96561ea9bfd7c2409b7d3320499af6f64a1703eac69c697bc214ad91a

SHA512
4be7f25577f4295956883dae706ce612e3ad3b3746d3c09a2f8a116bb50bd0eb9305dc3583635e8a773d39511879809bbe85af3f333430f5209ca0bb97e90a38

Download Submit