Malware Analysis Report

2025-01-19 00:38

Sample ID 240503-l3vbpseb23
Target https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y
Tags
microsoft phishing
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

Threat Level: Likely benign

The file https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y was found to be: Likely benign.

Malicious Activity Summary

microsoft phishing

Detected potential entity reuse from brand microsoft.

Suspicious use of SendNotifyMessage

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-03 10:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-03 10:03

Reported

2024-05-03 10:04

Platform

win10v2004-20240419-en

Max time kernel

18s

Max time network

19s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y"

Signatures

Detected potential entity reuse from brand microsoft.

phishing microsoft

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2828 wrote to memory of 1028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 4236 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 3604 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 3604 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 3604 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 3604 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 3604 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 3604 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 3604 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1028 wrote to memory of 3604 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 25457 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {905e9357-9da9-4560-b867-b56aada49176} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 26377 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2efe9223-51ec-4740-b51d-3885f53bc6f3} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3412 -childID 1 -isForBrowser -prefsHandle 3324 -prefMapHandle 3184 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03168ffa-6099-4b7b-94c8-6dae73662180} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2752 -childID 2 -isForBrowser -prefsHandle 3496 -prefMapHandle 3552 -prefsLen 30867 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a2a7bad-b327-4e42-ad5b-23e66423e939} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4240 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4232 -prefMapHandle 4228 -prefsLen 30867 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05802143-7801-42d9-a318-8eb4ad9d5e44} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5400 -childID 3 -isForBrowser -prefsHandle 5428 -prefMapHandle 5432 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ad93179-bc11-4174-9d42-7b43888fdce3} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5628 -childID 4 -isForBrowser -prefsHandle 5548 -prefMapHandle 5556 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {961b2194-5dde-4333-a4ea-10293ce05a75} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 5 -isForBrowser -prefsHandle 5836 -prefMapHandle 5832 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4102053e-7b5c-40ab-99b6-84ec17143ced} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6136 -childID 6 -isForBrowser -prefsHandle 6108 -prefMapHandle 5760 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1328 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79c79258-0c39-4081-91de-b8b7c93c49c4} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" tab

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
N/A 127.0.0.1:52266 tcp
US 8.8.8.8:53 action.azurecomm.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 20.85.207.172:443 action.azurecomm.net tcp
US 20.85.207.172:443 action.azurecomm.net tcp
US 8.8.8.8:53 cosmic-eastus-ns-54bf029fbc75.trafficmanager.net udp
US 34.117.188.166:443 spocs.getpocket.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 34.149.97.1:443 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 35.164.250.149:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 cosmic-eastus-ns-54bf029fbc75.trafficmanager.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 e11290.dspg.akamaiedge.net udp
US 8.8.8.8:53 e11290.dspg.akamaiedge.net udp
US 8.8.8.8:53 172.207.85.20.in-addr.arpa udp
US 8.8.8.8:53 149.250.164.35.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 techcommunity.microsoft.com udp
BE 104.68.75.132:443 techcommunity.microsoft.com tcp
US 8.8.8.8:53 e8318.dsca.akamaiedge.net udp
US 8.8.8.8:53 e8318.dsca.akamaiedge.net udp
N/A 127.0.0.1:52276 tcp
US 8.8.8.8:53 239.249.30.184.in-addr.arpa udp
US 8.8.8.8:53 132.75.68.104.in-addr.arpa udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 static2.sharepointonline.com udp
US 8.8.8.8:53 assets.onestore.ms udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 ajax.aspnetcdn.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 part-0036.t-0009.t-msedge.net udp
NL 2.16.43.238:443 static2.sharepointonline.com tcp
NL 2.16.43.238:443 static2.sharepointonline.com tcp
US 8.8.8.8:53 e13287.dscg.akamaiedge.net udp
US 13.107.246.64:443 part-0036.t-0009.t-msedge.net tcp
US 152.199.19.160:443 ajax.aspnetcdn.com tcp
US 8.8.8.8:53 cs22.wpc.v0cdn.net udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
NL 88.221.70.210:443 assets.onestore.ms tcp
US 8.8.8.8:53 e10583.dspg.akamaiedge.net udp
US 8.8.8.8:53 part-0036.t-0009.t-msedge.net udp
US 152.199.19.160:443 cs22.wpc.v0cdn.net tcp
US 151.101.1.229:443 jsdelivr.map.fastly.net tcp
US 8.8.8.8:53 e13287.dscg.akamaiedge.net udp
US 8.8.8.8:53 cs22.wpc.v0cdn.net udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 e10583.dspg.akamaiedge.net udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 160.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 229.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 238.43.16.2.in-addr.arpa udp
US 8.8.8.8:53 210.70.221.88.in-addr.arpa udp
US 8.8.8.8:53 www.clarity.ms udp
US 13.107.246.64:443 www.clarity.ms tcp
US 8.8.8.8:53 x.clarity.ms udp
US 20.114.190.119:443 x.clarity.ms tcp
US 8.8.8.8:53 clarity-ingest-eus2-e-sc.eastus2.cloudapp.azure.com udp
US 8.8.8.8:53 clarity-ingest-eus2-e-sc.eastus2.cloudapp.azure.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 184.30.250.70:443 c.s-microsoft.com tcp
US 8.8.8.8:53 e13678.dscg.akamaiedge.net udp
US 8.8.8.8:53 e13678.dscg.akamaiedge.net udp
US 8.8.8.8:53 119.190.114.20.in-addr.arpa udp
US 8.8.8.8:53 70.250.30.184.in-addr.arpa udp
NL 23.62.61.99:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 99.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 20.42.73.31:443 browser.events.data.microsoft.com tcp
US 20.42.73.31:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 onedscolprdeus21.eastus.cloudapp.azure.com udp
US 8.8.8.8:53 onedscolprdeus21.eastus.cloudapp.azure.com udp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 onedscolprdeus21.eastus.cloudapp.azure.com udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 clarity-ingest-eus2-e-sc.eastus2.cloudapp.azure.com udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 8.8.8.8:53 onedscolprdcus03.centralus.cloudapp.azure.com udp
US 8.8.8.8:53 onedscolprdcus03.centralus.cloudapp.azure.com udp
US 8.8.8.8:53 x.clarity.ms udp
US 8.8.8.8:53 clarity-ingest-eus2-e-sc.eastus2.cloudapp.azure.com udp
US 8.8.8.8:53 clarity-ingest-eus2-e-sc.eastus2.cloudapp.azure.com udp

Files

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\datareporting\glean\pending_pings\a4a320ee-f12a-41a1-bcbe-07bf2bc47bf6

MD5 e63d2056d6a73b18fd6f38cf649c9ba9
SHA1 1b89914867fe964246726b30e52c173cbf4734bb
SHA256 f318523afbfe0b6c8af93140b64ff5503b1bead1673ad4fe3702317b36101d6f
SHA512 f53d88373992eaae5e45096e37dd5825b1e81a829fcc8678a47c470c7ef99b4875989d7f7f4774f9461dddef42ae3b5e551cdc1dff6ff0c49766166d87d58ffb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\datareporting\glean\pending_pings\25911cb7-c318-42c1-8c86-18af3ef9c26b

MD5 76b9d4b6cc35926c3c0d72b69dcb6b0e
SHA1 10dcd416be62e0ba36832e58d12270095ea91bc3
SHA256 24faaa608b6f846c67e756ad9e4ee16acacbb3c9c0abff74fd6778233c685f39
SHA512 611213416329a4646c6160db0ec63ef836d0002e7e40d2fbaae345272ae97a031414e0366c3b460c531ac1bf6ac175c5765387c7b31517c389fd30d1dcf2b189

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\datareporting\glean\pending_pings\18ca9050-014a-44ea-ac6e-f865cd6a5366

MD5 46b69a51628af3f356f50a7bfc4c6223
SHA1 e67804fd686c0274817eb3cc110f5a78be5eabcf
SHA256 ea9d4762423d5e577413d471db54de1fdd3cc8d2cfb2f6bbbe650950d1106b8c
SHA512 b8e56aa2813298e2c952eff80ca0ea9610bb1fd24d88ad1f9512e2686504629309eaf99715fe272a68b9cff0e892ac5dc670ecbca902b278c5309709e74ff921

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\datareporting\glean\db\data.safe.tmp

MD5 6859aab18b5cbe01b130828dce1b07a3
SHA1 631dc1e11c73e39018839ca7aa778fe087312951
SHA256 3acc20b4259015e4d2ecaa797ae4ca5c7cc83acb0149deb3842a99309b52e72c
SHA512 bdfe1df822352d7470567aad45d055e0228d38524291d04e88248d3f46e0d963164a5f5dca7fd862a58f4fafa4982cc4249e72a61d51bff13a18657721cd12dd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\datareporting\glean\db\data.safe.tmp

MD5 d39e87f0acdea9806da31425a4ecd168
SHA1 f12aceee8b64c7c4ef70a744f25e89d918b1adff
SHA256 61a22fe6aa698f3d61ce2a1c9baec995c3d240cb05eaf5a52fe99f5234b2dc8c
SHA512 1b0ce032b43271d9254e820309a59386f5913a8922e192235783aa3e1f06fd79367752003e46e2ffc49fdafbf2fe8e69507e72dab140e88a0d47219f11949b64

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\k6zex9vv.default-release\activity-stream.discovery_stream.json

MD5 8c46a2c8c0545e14579921b4c51cb921
SHA1 6ff2f6f27116cf654357c28951f8c92375ae1181
SHA256 3b37b071eee2d5005f2718f64dfc6b7bd98ef72debfcb9099ba6f40ede8ba46a
SHA512 4f8db7cacc21a8c906ee8ecd076272331c7a0a2c84931c80cd8ac8daffdbf7e83fd82046ad650ecaa56bb6256a43abf89c70a295756657b0c93fae2fec6e5938

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\prefs.js

MD5 c4f19977efa49fb399f155903181ceb6
SHA1 76b46b733712e730859f02423f6b2a7bebfa804b
SHA256 15d14367987dd95ba299a097315ab0a9398e0e3f5fc1e3c4001a46ce0d0590c2
SHA512 06b4625f8ce0cd133ed552383d00b21cb7c5ecbd37b9a8d250dce16a40c02346e2c43e09ad339708b4ca1723d4360d1bd97078c580aee412f3ab9d5a731cdad4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\prefs.js

MD5 8f18dde95513a5ef354a3131ef6970c0
SHA1 5956bea2b561a784e7b10dff0adf2b15d2b45339
SHA256 2b942c7ed2b16b1cc84f507b387ac94d168ebfebd0dfee01fed0826598ee974b
SHA512 6cf0b20877b88699b4fcbf3af46b00659ae061208ad955d465261c12906e07ea5f84913ae6c3a3011e00b6cd87ca31c86a8c43795d305fdacdaf566114cdc727

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\prefs-1.js

MD5 31a46cb92a9f306b2713dd94f36726d9
SHA1 a9ff0d9b5acc41faa9e9d935075657c37aac69ad
SHA256 f9916fafc31024955c4fd7f12625dc68ae7e854d48f583dc85f2b0c1ef30282d
SHA512 3da05b48d587dd6c32168c84251ed79592343081eb14448d103537eabac28ee21d02e56cb06a7f521b8610d06ff71278096293573c5471252c80290ef454dd92

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-03 10:03

Reported

2024-05-03 10:06

Platform

win11-20240419-en

Max time kernel

133s

Max time network

148s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y"

Signatures

Detected potential entity reuse from brand microsoft.

phishing microsoft

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4152 wrote to memory of 3196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 1788 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 5084 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 5084 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 5084 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 5084 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 5084 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 5084 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 5084 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3196 wrote to memory of 5084 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 25459 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2324a82-64d3-4b8f-84f3-73f8c1b48cc8} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 26379 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09c58a9b-e468-4df2-85cf-8cf695237697} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3360 -childID 1 -isForBrowser -prefsHandle 3352 -prefMapHandle 3348 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ed9f2ac-a431-4f19-b692-422a3044f513} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3160 -childID 2 -isForBrowser -prefsHandle 3184 -prefMapHandle 3000 -prefsLen 30869 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9959e13e-c30f-4a1d-8314-5c87b41b7552} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4296 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4212 -prefMapHandle 4208 -prefsLen 30869 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c9e51f7-0dde-45b8-a4fa-33d4d79ed1a0} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 3 -isForBrowser -prefsHandle 5380 -prefMapHandle 5372 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0d65dcb-2d96-4501-b325-99334c156160} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5524 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60154b91-9d2b-4589-93d8-090c335d4986} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 5 -isForBrowser -prefsHandle 5596 -prefMapHandle 5600 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91297c44-6c4a-403e-a270-86cd12725ab5} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6196 -childID 6 -isForBrowser -prefsHandle 6192 -prefMapHandle 6076 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1068 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57d1be1f-b927-4aef-aa9f-34f42c8b6363} 3196 "\\.\pipe\gecko-crash-server-pipe.3196" tab

Network

Country Destination Domain Proto
N/A 127.0.0.1:49726 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 action.azurecomm.net udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 44.239.14.124:443 shavar.prod.mozaws.net tcp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 20.85.205.59:443 cosmic-eastus-ns-54bf029fbc75.trafficmanager.net tcp
US 20.85.205.59:443 cosmic-eastus-ns-54bf029fbc75.trafficmanager.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
BE 104.68.75.132:443 techcommunity.microsoft.com tcp
NL 2.16.43.238:443 e13287.dscg.akamaiedge.net tcp
NL 2.16.43.238:443 e13287.dscg.akamaiedge.net tcp
US 13.107.253.64:443 wcpstatic.microsoft.com tcp
US 13.107.253.64:443 wcpstatic.microsoft.com tcp
US 151.101.1.229:443 jsdelivr.map.fastly.net tcp
US 151.101.1.229:443 jsdelivr.map.fastly.net tcp
NL 23.51.70.13:443 e10583.dspg.akamaiedge.net tcp
US 151.101.1.229:443 jsdelivr.map.fastly.net tcp
US 152.199.19.160:443 cs22.wpc.v0cdn.net tcp
US 152.199.19.160:443 cs22.wpc.v0cdn.net tcp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 13.107.246.64:443 cdn.techcommunity.microsoft.com tcp
N/A 127.0.0.1:49734 tcp
US 20.114.190.119:443 x.clarity.ms tcp
US 184.30.250.70:443 c.s-microsoft.com tcp
US 20.42.65.91:443 onedscolprdeus17.eastus.cloudapp.azure.com tcp
US 20.42.65.91:443 onedscolprdeus17.eastus.cloudapp.azure.com tcp
US 35.244.181.201:443 prod.balrog.prod.cloudops.mozgcp.net tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
NL 2.18.121.79:80 a19.dscg10.akamai.net tcp
GB 142.250.187.206:443 redirector.gvt1.com tcp
GB 142.250.187.206:443 redirector.gvt1.com udp
GB 173.194.3.70:443 r1---sn-aigl6n6s.gvt1.com tcp
GB 173.194.3.70:443 r1---sn-aigl6n6s.gvt1.com udp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 52.24.210.222:443 location.services.mozilla.com tcp
US 20.114.190.119:443 x.clarity.ms tcp
BE 104.68.75.132:443 techcommunity.microsoft.com tcp
US 13.107.246.64:443 cdn.techcommunity.microsoft.com tcp
US 20.114.190.119:443 x.clarity.ms tcp

Files

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\datareporting\glean\pending_pings\f55cdc2e-a29c-420f-b88d-1fc6c8b6b5a0

MD5 55b6a1ced5a0b12cb2f3821ea4133099
SHA1 fd0adea4b55bf845d2a3fa5e9c8917b65f409895
SHA256 52012f9aad7277157898a0cd23ca29da2d3f96c4df497fd8f56f152113383e22
SHA512 9374d87a2e93c8dcb51875648811371e5c159aa3ffccf0f728adc0505be8b0c5999ea5eb02c28c5bf6d78e1e2a0010c40061cd3b2eb2e4566241cb9b5aecac93

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\datareporting\glean\pending_pings\e100f564-21ba-4d3c-b78d-38819aa456dd

MD5 adea3729215d97759742fa860bf8cc03
SHA1 549cfbabe5aaad1833ebb99210e95d5fb6b05d77
SHA256 cd7d4be2536904ad45848614b16623fbee6879095579ac3c5c501bdb09e7a035
SHA512 cb36321e8bc367432d060a1b18865a6f39c27e11f779e9d3902fe9c4c38f8667afd72754252654d72d30a08c634f8d187b4c3268c857fb860623330262cc6d1a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\datareporting\glean\pending_pings\37d6678a-3ff1-49c7-97ea-d191cfc85ad1

MD5 1efd9c5afd0b0e1c619ebbdcae00a0e4
SHA1 a611c0f94ccee69431702a28a7be9f74571805f1
SHA256 7b178bc7ffb2f2f456b4581d07dd22d9f78d5ccdd6a6a9e70c01027aaf294880
SHA512 20f6bef54944591e7a79be0208d1c9c40669d933d62b4637d20e384ab53eed3250fc3992c1793c9f709cf4a0e7bb9b647c1ae0c083e3d587163e062186eb5415

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\datareporting\glean\db\data.safe.tmp

MD5 8e4e434f00264a65e8054b0d89f8f699
SHA1 fece97e6c698e39b2e41a303952dbb993e16ad42
SHA256 3001f65436e5ab32aa16dc1a256cf03a9f68706e6f59b3760d8cf9c0ff085bb4
SHA512 388f4a8e76c8f1e5444b6a502a991f720d1da4a6a02a16c22698bfc8cfced07ac1bc3f1aa49141296bde7f999a2c3b97fa5b183324f283002252ff8609966179

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\datareporting\glean\db\data.safe.tmp

MD5 b293c597854fe03d80fd195c9df3995f
SHA1 237a64c21f2921090ce0e9d4d1ce50a91ce4782c
SHA256 448753f9a261ed0c5a16691791d1f41f42d9b2f54971cf8ac578dc112712501d
SHA512 31674e99b4ff565908b5bd7a37fe6fa5dfc95154c34fc3b7d017c1fc079560e6c9d4bcb6c6799cdfc80377370502f5d441f47cd2c4bdaa22c2c054c3e36f0996

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\datareporting\glean\db\data.safe.tmp

MD5 eb004c7f3e332358d0c2d6206ed6eac2
SHA1 63adb968ab98f262b0118209ac9b4d597dfa7970
SHA256 d3b7b72f1fc096b9da4f8e9429d239fc5849a3e70bc28a17bdd3f6b84fec2f71
SHA512 a539d935e6bcc83a4d7480e2283c1674087689c70e2ef8130297b263eaed1c43ad546d82a2d9d562c8819c97ea30c5263ed9fbda977eac89034e4279ba22ada2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0zdbhklj.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

MD5 7ecff423209e1f2c1f614783e15f4f63
SHA1 67fdbe225e48ca45f91ae090cd3b095e1dbc1748
SHA256 64e4f7449ccc34d2ee790b2a481539ef653cdd606b343946bcb01e2440b79b57
SHA512 6c3f43148b3d64e7771a8c7b93bb4b8d7622ece84dba9ecd0a2869d0e12742ce47c343a0e3382f859243464cd191fd95fae0751c983d035c0f6b7b8a284467b2

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\AlternateServices.bin

MD5 beb5c3e8c4ac0586ae69c763c491bbdb
SHA1 75e938203b1cff906d8889366445f4b12f34da5b
SHA256 05f397de18619b0860f54c8ca54a6ef045eedcce0f4fcb192ac1b1fa0f3f3d36
SHA512 2baabc2537347c00f1480b5d9bdf86426458e36aea879346609c7fe2d7ca2384d9f821aa57aafb65be1fdd7c46a686e70aea5f932f5e5b94f6a60badf2f258ca

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\prefs-1.js

MD5 6afd9b5b0bd272cf74354faf75b25dec
SHA1 f857a0a6cdcc7cf491ab2f907a6e629a8bbf458c
SHA256 55d1021c3075a89b561110f0fb6b92ba97cba68ce9c68c1503edc51d6230e70b
SHA512 4dd368214c1419e02c06d6926dceffd34192b6193992d63be6e761d4dab34327e9618a00ef6cd025b6ad938ff7ae2349a00ed4f2c6fb4069ba57806df8215c68

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 8b6728d4205c33895c7d3797151cafe6
SHA1 4dbf9a8f67367e5da787f1a6481e574c3e0e19bf
SHA256 8e68dc46a59963808e567d8681e92faf49b93a53fb6ec137c71eddc0312b8cc7
SHA512 862e0a65dc3281b4f4f3684aaaf63557d2f96a13b7ba29808090172aabcca9d4102c5b41641dfd410a9f8b04e556ba79f7f564ee4ba5d4ff4b1037e1d984b172

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\sessionstore-backups\recovery.baklz4

MD5 bcb8c7321feac9cf487d43fae578c69d
SHA1 7a2b1e8b8d93cbf0ce18368cd9330b5f470d2b95
SHA256 f094c35bef47991b8b0268f4f2f52895c86670283be3d4a056b4835a63906a98
SHA512 8537b6b3ce0d84341b954190307d764d26b1484ec00e8236f0724dbb5abfccd99096a70fd94a2f5b4ddcac738078ecf0f994e7d814922d0e209822f227bbf678

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0zdbhklj.default-release\prefs-1.js

MD5 14c23f54d2930aa4b7ed949114f2dd07
SHA1 9e062b8ac690cfb6c3815564167c89e33fd4d536
SHA256 96ccb428b9dd512c6f9e337af53728640f91a8dbf99e0f8603a1a133ce1848f6
SHA512 39af2d2a91fd0d5994dc79d27f38b694f5a26a2266440e9876d58abc2a40bb7aec5830739efebaf158d136876d885bb30a8450c63d4acdd36c39c3c6541a4e99