775f4b278c1d8b551d9dcae70468cafd0fb3ab4afdaaab505efffb062a93c520

Analysis

max time kernel
161s
max time network
167s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fx_cast_bridge-0.3.0-x64.exe
Size

12.0MB
MD5

05d4e616cb0fd940734ee8a9a67e957f
SHA1

b90224355aa19a4d3613f35ae141466c8043d90d
SHA256

775f4b278c1d8b551d9dcae70468cafd0fb3ab4afdaaab505efffb062a93c520
SHA512

b89c3c2dbdc0e75fbd060f655501ac6eebe929281c4d7f7ff0b569d8c851ae25adf78ecd02a031e17bf39cd774f8682ae2175c514d67a3acb4cc765ef3d99552
SSDEEP

196608:x7VB1lFT/VJjmUYs3LXeSPlrC/OXrv7hxoerSeJNh3xzRJr3KN/+e+fmrotFXlTf:x7v1ldqCjP0ODciSeJPK/AvLeEijy

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Executes dropped EXE 1 IoCs

pid	Process
468	mDNSResponder.exe

Loads dropped DLL 12 IoCs

pid	Process
1808	fx_cast_bridge-0.3.0-x64.exe
1808	fx_cast_bridge-0.3.0-x64.exe
3044	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
1696	MsiExec.exe
1696	MsiExec.exe
944	MsiExec.exe
2748	MsiExec.exe
1776	MsiExec.exe
464	Process not Found
1964	firefox.exe

Registers COM server for autorun 1 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
18	1976	msiexec.exe
28	1976	msiexec.exe
30	1976	msiexec.exe
32	1976	msiexec.exe
102	2468	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File created	C:\Program Files\fx_cast\dns_sd_bindings.node	fx_cast_bridge-0.3.0-x64.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\de.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\Bonjour\dns_sd.jar	msiexec.exe
File created	C:\Program Files\Java\jre7\lib\ext\dns_sd.jar	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\it.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pt.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\sv.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\About Bonjour.lnk	msiexec.exe
File created	C:\Program Files\fx_cast\uninstall.exe	fx_cast_bridge-0.3.0-x64.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\nl.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_TW.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\mDNSResponder.exe	msiexec.exe
File created	C:\Program Files\Bonjour\mDNSResponder.exe	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\en.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\nb.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ru.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\en_GB.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\mdnsNSP.dll	msiexec.exe
File opened for modification	C:\Program Files\fx_cast\Bonjour.msi	fx_cast_bridge-0.3.0-x64.exe
File created	C:\Program Files\Bonjour\mdnsNSP.dll	msiexec.exe
File created	C:\Program Files\fx_cast\Bonjour.msi	fx_cast_bridge-0.3.0-x64.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\fr.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ko.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\dns_sd.jar	msiexec.exe
File created	C:\Program Files\Bonjour\About Bonjour.lnk	msiexec.exe
File created	C:\Program Files\fx_cast\fx_cast_bridge.exe	fx_cast_bridge-0.3.0-x64.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\es.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_CN.lproj\About Bonjour.rtf	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\dns_sd.jar	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pl.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\pt_PT.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files\fx_cast\fx_cast_bridge.json	fx_cast_bridge-0.3.0-x64.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\da.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\fi.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\ja.lproj\About Bonjour.rtf	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f779c31.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA73F.tmp	msiexec.exe
File created	C:\Windows\Installer\f779c34.msi	msiexec.exe
File created	C:\Windows\Installer\f779c30.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f779c30.msi	msiexec.exe
File created	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI9E54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA01A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f779c31.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIA0A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\Bonjour.ico	msiexec.exe
File created	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}\RichText.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B0163E6D0340BE4183EB2758E9BEDD8\DotNetSupport = "Bonjour"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ = "_IDNSSDEvents"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID\ = "Bonjour.DNSSDRecord"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B0163E6D0340BE4183EB2758E9BEDD8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDEventManager.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ = "IDNSSDRecord"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\ProgID\ = "Bonjour.DNSSDService.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID\ = "Bonjour.DNSSDRecord"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord.1\CLSID\ = "{5E93C5A9-7516-4259-A67B-41A656F6E01C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\ = "DNSSDEventManager Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ = "IDNSSDRecord"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ = "ITXTRecord"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord.1\ = "DNSSDRecord Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\PackageCode = "CA8C0B135A1130742A8EF2E2B1783A3A"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1523EA646D34FC14C8FD9E203C58611D\2B0163E6D0340BE4183EB2758E9BEDD8	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord\CurVer\ = "Bonjour.DNSSDRecord.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\VersionIndependentProgID\ = "Bonjour.DNSSDService"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\NumMethods\ = "7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ProgID\ = "Bonjour.DNSSDRecord.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ProgID\ = "Bonjour.DNSSDRecord.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\NumMethods\ = "9"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B0163E6D0340BE4183EB2758E9BEDD8\ProductName = "Bonjour"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B0163E6D0340BE4183EB2758E9BEDD8\mDNSResponder = "Bonjour"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\FLAGS	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\VersionIndependentProgID	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1808	fx_cast_bridge-0.3.0-x64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeDebugPrivilege	2572	firefox.exe
Token: SeDebugPrivilege	2572	firefox.exe
Token: SeRestorePrivilege	2468	msiexec.exe
Token: SeTakeOwnershipPrivilege	2468	msiexec.exe
Token: SeSecurityPrivilege	2468	msiexec.exe
Token: SeCreateTokenPrivilege	1976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1976	msiexec.exe
Token: SeLockMemoryPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeMachineAccountPrivilege	1976	msiexec.exe
Token: SeTcbPrivilege	1976	msiexec.exe
Token: SeSecurityPrivilege	1976	msiexec.exe
Token: SeTakeOwnershipPrivilege	1976	msiexec.exe
Token: SeLoadDriverPrivilege	1976	msiexec.exe
Token: SeSystemProfilePrivilege	1976	msiexec.exe
Token: SeSystemtimePrivilege	1976	msiexec.exe
Token: SeProfSingleProcessPrivilege	1976	msiexec.exe
Token: SeIncBasePriorityPrivilege	1976	msiexec.exe
Token: SeCreatePagefilePrivilege	1976	msiexec.exe
Token: SeCreatePermanentPrivilege	1976	msiexec.exe
Token: SeBackupPrivilege	1976	msiexec.exe
Token: SeRestorePrivilege	1976	msiexec.exe
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeDebugPrivilege	1976	msiexec.exe
Token: SeAuditPrivilege	1976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1976	msiexec.exe
Token: SeChangeNotifyPrivilege	1976	msiexec.exe
Token: SeRemoteShutdownPrivilege	1976	msiexec.exe
Token: SeUndockPrivilege	1976	msiexec.exe
Token: SeSyncAgentPrivilege	1976	msiexec.exe
Token: SeEnableDelegationPrivilege	1976	msiexec.exe
Token: SeManageVolumePrivilege	1976	msiexec.exe
Token: SeImpersonatePrivilege	1976	msiexec.exe
Token: SeCreateGlobalPrivilege	1976	msiexec.exe
Token: SeCreateTokenPrivilege	1976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1976	msiexec.exe
Token: SeLockMemoryPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeMachineAccountPrivilege	1976	msiexec.exe
Token: SeTcbPrivilege	1976	msiexec.exe
Token: SeSecurityPrivilege	1976	msiexec.exe
Token: SeTakeOwnershipPrivilege	1976	msiexec.exe
Token: SeLoadDriverPrivilege	1976	msiexec.exe
Token: SeSystemProfilePrivilege	1976	msiexec.exe
Token: SeSystemtimePrivilege	1976	msiexec.exe
Token: SeProfSingleProcessPrivilege	1976	msiexec.exe
Token: SeIncBasePriorityPrivilege	1976	msiexec.exe
Token: SeCreatePagefilePrivilege	1976	msiexec.exe
Token: SeCreatePermanentPrivilege	1976	msiexec.exe
Token: SeBackupPrivilege	1976	msiexec.exe
Token: SeRestorePrivilege	1976	msiexec.exe
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeDebugPrivilege	1976	msiexec.exe
Token: SeAuditPrivilege	1976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1976	msiexec.exe
Token: SeChangeNotifyPrivilege	1976	msiexec.exe
Token: SeRemoteShutdownPrivilege	1976	msiexec.exe
Token: SeUndockPrivilege	1976	msiexec.exe
Token: SeSyncAgentPrivilege	1976	msiexec.exe
Token: SeEnableDelegationPrivilege	1976	msiexec.exe
Token: SeManageVolumePrivilege	1976	msiexec.exe
Token: SeImpersonatePrivilege	1976	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
1976	msiexec.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1976	msiexec.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2572	firefox.exe
2572	firefox.exe
2572	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2556 wrote to memory of 2572	2556	firefox.exe	29
PID 2572 wrote to memory of 2976	2572	firefox.exe	30
PID 2572 wrote to memory of 2976	2572	firefox.exe	30
PID 2572 wrote to memory of 2976	2572	firefox.exe	30
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 2380	2572	firefox.exe	31
PID 2572 wrote to memory of 1008	2572	firefox.exe	32
PID 2572 wrote to memory of 1008	2572	firefox.exe	32
PID 2572 wrote to memory of 1008	2572	firefox.exe	32
PID 2572 wrote to memory of 1008	2572	firefox.exe	32
PID 2572 wrote to memory of 1008	2572	firefox.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fx_cast_bridge-0.3.0-x64.exe
"C:\Users\Admin\AppData\Local\Temp\fx_cast_bridge-0.3.0-x64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1808
- C:\Windows\SysWOW64\msiexec.exe
  msiexec /i "C:\Program Files\fx_cast\Bonjour.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.0.1447120924\326581225" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdccb739-49ab-4234-b50a-af8f83e79b7a} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 1296 11fd6158 gpu
    3⤵
    PID:2976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.1.283436153\14758517" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 20830 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02efe993-1c57-47a9-b670-efe9508c8058} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 1504 d6fb58 socket
    3⤵
    - Checks processor information in registry
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.2.1794930166\585430518" -childID 1 -isForBrowser -prefsHandle 2132 -prefMapHandle 2128 -prefsLen 20868 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc50c0b9-020b-4ccd-8bd8-d74ca44b18aa} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 2144 1a362158 tab
    3⤵
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.3.1350738862\218433723" -childID 2 -isForBrowser -prefsHandle 1648 -prefMapHandle 1644 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfe0cad8-123d-45d2-8da7-f06497e30ced} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 2520 d66e58 tab
    3⤵
    PID:1712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.4.1206484216\119354541" -childID 3 -isForBrowser -prefsHandle 2524 -prefMapHandle 2496 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {604d47f7-a0c2-4223-9c37-8e1cec1d5370} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 2556 1be0ac58 tab
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.5.1463806602\553602137" -childID 4 -isForBrowser -prefsHandle 3704 -prefMapHandle 3700 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4ed0b87-8bf6-46d4-9e5b-db7360712b67} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 3776 1e55ae58 tab
    3⤵
    PID:2844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.6.1144986102\609529867" -childID 5 -isForBrowser -prefsHandle 3716 -prefMapHandle 3712 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11f61613-cbe1-4fac-bf14-ee6adc96d602} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 3880 1e55d258 tab
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2572.7.1008183633\1900390796" -childID 6 -isForBrowser -prefsHandle 3832 -prefMapHandle 1120 -prefsLen 26251 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {716f617a-bed0-42f9-b580-39e35a0689e8} 2572 "\\.\pipe\gecko-crash-server-pipe.2572" 3740 d2ea58 tab
    3⤵
    PID:2364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:1068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.0.1309301215\344809538" -parentBuildID 20221007134813 -prefsHandle 1124 -prefMapHandle 1116 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a5e54c-0bc6-492d-a410-1bc3a53080c4} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 1188 fdec858 gpu
        5⤵
        
        PID:2512
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.1.775070790\2122310199" -parentBuildID 20221007134813 -prefsHandle 1344 -prefMapHandle 1340 -prefsLen 17601 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9698c509-7fd4-4647-959c-85312ae6c997} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 1356 11f72358 socket
        5⤵
        
        PID:1724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.2.1114443552\1665851272" -childID 1 -isForBrowser -prefsHandle 2476 -prefMapHandle 2092 -prefsLen 23624 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a578bd40-a602-4ff8-84d3-e1a217408894} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 1824 15b8de58 tab
        5⤵
        
        PID:2876
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.3.24893005\680519532" -childID 2 -isForBrowser -prefsHandle 2760 -prefMapHandle 2744 -prefsLen 23779 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf1fda8-c405-40b6-b6c5-b5db2a7967c4} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 2784 1bf3a258 tab
        5⤵
        
        PID:2300
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.4.168890593\389804324" -childID 3 -isForBrowser -prefsHandle 2532 -prefMapHandle 2528 -prefsLen 24861 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0836676-37b3-494b-93d4-930d80ec98ef} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 2920 1c80fb58 tab
        5⤵
        
        PID:1916
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.5.516623538\217395809" -parentBuildID 20221007134813 -prefsHandle 3300 -prefMapHandle 2516 -prefsLen 25916 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eacb30b6-831c-4920-aa9f-e5aaf857f5c9} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 3316 1ed16858 rdd
        5⤵
        
        PID:2376
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.6.508541786\1182431773" -childID 4 -isForBrowser -prefsHandle 3508 -prefMapHandle 3500 -prefsLen 30576 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de673016-41a0-418b-ada5-01fdd301c2b2} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 3520 d2ff58 tab
        5⤵
        
        PID:472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.7.505410079\2142447958" -childID 5 -isForBrowser -prefsHandle 3752 -prefMapHandle 3464 -prefsLen 31192 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dddf763-9d1a-4da7-803f-435d7fb80aad} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 1840 11f72c58 tab
        5⤵
        
        PID:2620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.8.262057271\1768483724" -childID 6 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 31192 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3a2ef26-062b-4200-a36d-765130025ba5} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 3972 1d933858 tab
        5⤵
        
        PID:1968
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.9.171664397\1586039966" -childID 7 -isForBrowser -prefsHandle 4132 -prefMapHandle 3464 -prefsLen 31192 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {961340bb-5230-4a4b-92c3-ed2819e61fd4} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 4188 15c6d358 tab
        5⤵
        
        PID:2256
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.10.351895713\331321974" -childID 8 -isForBrowser -prefsHandle 3528 -prefMapHandle 3300 -prefsLen 32424 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c87bc30-2fc4-4bd8-87e3-a1a58e025f3a} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 3632 1c1a4458 tab
        5⤵
        
        PID:3312
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.11.978414889\2057981497" -childID 9 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 32424 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e76fe09-062d-4a96-a238-f1fef97b094b} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 3564 d2f958 tab
        5⤵
        
        PID:3320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.12.884564559\1414149854" -childID 10 -isForBrowser -prefsHandle 4600 -prefMapHandle 4608 -prefsLen 32424 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6740aed9-8624-4cab-a544-a99827d6943d} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 4692 1c1a5c58 tab
        5⤵
        
        PID:3348
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.13.324437865\1389532161" -childID 11 -isForBrowser -prefsHandle 4204 -prefMapHandle 4208 -prefsLen 32599 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0097dd46-8d1f-4ed8-9877-cac66838bd60} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 2260 11f72c58 tab
        5⤵
        
        PID:3376
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.14.157921505\919108230" -childID 12 -isForBrowser -prefsHandle 3688 -prefMapHandle 3512 -prefsLen 32599 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01adc06f-cbf5-4029-a645-f27994006af2} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 3728 1d3e3658 tab
        5⤵
        
        PID:796
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1964.15.143360832\966793584" -childID 13 -isForBrowser -prefsHandle 4556 -prefMapHandle 904 -prefsLen 32599 -prefMapSize 230321 -jsInitHandle 840 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ab26c7d-d73f-4d6b-a200-f3935cc25440} 1964 "\\.\pipe\gecko-crash-server-pipe.1964" 4560 21fe8958 tab
        5⤵
        
        PID:3292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2468
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 33DB54C7152ED091DCC47DE9F3FC71BA C
  2⤵
  - Loads dropped DLL
  PID:3044
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 31471CA58512A3B2429E9F8118DF8624
  2⤵
  - Loads dropped DLL
  PID:2920
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6C4F8E9EA7DB1757B2780E4B4805D48C
  2⤵
  - Loads dropped DLL
  PID:1696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8927B617CEB170ADF11BF3BCA4DFF403 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:944
- C:\Windows\system32\MsiExec.exe
  "C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:2748
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  - Loads dropped DLL
  PID:1776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2508

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D8" "00000000000005D4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1524

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f779c32.rbs

Filesize
118KB

MD5
e32459d32dce56fefd6906c4fd331138

SHA1
0bb25f3b851103baab8f0750c0c4eb8f390bcfd6

SHA256
fc77b927dd50a8d2ab8c9b8036a0803a85757e552e643169e0b0f420bc65bf25

SHA512
9db6e999237d464f40ac6ec4ec3861866ec8e8c25ff8fc97be3ccf8eeab45271682904fa25cdf3d8de9f955ebcda45e20b5500aa8a077bf43ff7e49ab806c31b

Download Submit
C:\Program Files (x86)\Bonjour\mdnsNSP.dll

Filesize
118KB

MD5
40947436a70e0034e41123df5a0a7702

SHA1
6c27e1dd1c1533feb6435190a5074300ac2a9822

SHA256
5d40fd92da5ca59c1badb58ad509db6a6d613f18660a9a270a53eca85d34c3a9

SHA512
ba5634cc82f306245f9f0350bfa0b91e2f5ffc6c355b1452a95483f47e6acdb42c4e063f6c15115faf0f0630005df4fe8ef0e01539c270031cbd07a34a929704

Download Submit
C:\Program Files\Bonjour\mdnsNSP.dll

Filesize
129KB

MD5
f9d908de6b166dac9b89bf62fa291ce8

SHA1
938b53238291fc41ae852fdde51eed7a2bff0604

SHA256
d0a918ad60221623bb0278ea94cd6938744617fdbb2054968afafc2940648f02

SHA512
6643a7066974abfd5904df73ed225fd5eed4a84341b12199b6eb9a8a2ad234dba865d50f8ccff8a88002ce4c6ae2131745cf43aac88a3a0a66b596fb0d93e56e

Download Submit
C:\Program Files\Java\jre7\lib\ext\dns_sd.jar

Filesize
16KB

MD5
ca086bb31b598febd7e8d44daf14714a

SHA1
4838808e80df811cfb2bf7faf361b3cbc16f9f81

SHA256
3818abdee5b1d3d77ae4a5ace25a638b2d7d624605f8e8ce14dd6d4c6639c00c

SHA512
54188bf433a0da1b6b8f6f881af6d681a6bb629693191c7ee46f852953529cb94dfa894aca574e1cd7355985ea8d6187e7694c8144ea1db880922676f0dfe0c5

Download Submit
C:\Program Files\fx_cast\Bonjour.msi

Filesize
2.6MB

MD5
8dcf5c9eaacdaf4568220d103f393dea

SHA1
27f68596398b68ba048f95752b4eeb4aa013c23f

SHA256
53be81cc6e2dc95a1041e8f3d8f500fad4259ab20a1aac151b5fc7a64d354a93

SHA512
10f8ffb6fa5e7163f0a83190ddf211479f12e16635389b49ac041eceafd7f04c040d830065adc89b1003f38d8381851c09150a5bc8edced6ecae8ee5ae801088

Download Submit
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6

Filesize
86KB

MD5
61c7ac777f8755faa969cf9aa1ee7432

SHA1
e782257d2fac3a448b175aed5f8bf0ffec598229

SHA256
b666f30ad1baea905f7d90042fca29008a34be200a2dfe92c9a409bf77413a7c

SHA512
7448b0946a411e465e2c57cdf70d131fdbd79abf175575ad04497a7808d0d57f30836979493c38ce617ecec8c60d527e0f01a3c503c74900a54cf70d18762145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2087E0B670B77412221B4DDD6EED487

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F

Filesize
834B

MD5
cbed24fd2b55aea95367efca5ee889de

SHA1
946f48b5c344fd57113845cd483fed5fb9fa3e54

SHA256
1dc8a0fcbe260b77adfe5ad9aaac543239b2a0d9f4e1f3c2657beee4376ffee4

SHA512
c504a11ea576f8ce14de26a0617e22e71e14db0f1dadefc187ce94e4a35a83743c743824e3629899c262aae4772bb86a0ee5bb643db20645483f0c376215ec6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6

Filesize
212B

MD5
09732fce28ee3858627501e4e56c95a3

SHA1
c4b4677aa17a96bf01019f4b44788357f7131dc7

SHA256
d1878d5500af84d6eb2baff70d61b38c1a1e24f41096a5a43bccb3961156fc62

SHA512
d7826f13055faa9e18e764e9c5c5fcc05506d1ef067fd1774a70060902d82c48860438f761478e15404b1d25202c3074c767736d0dc17e3185fc8b564e0b4841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2087E0B670B77412221B4DDD6EED487

Filesize
412B

MD5
9fa8d89cb5fd1754dc6e4a2e73b9d5e9

SHA1
80f543fb916efff7796e1d0b78d8833faee62b48

SHA256
f1080e65bd4c42eac9711a591bb72985204482bc39fa7ca52fd8d28d9eedf1d1

SHA512
edb059aa25628faa7ad01dd3760a2a26f881859379740f7ed0096b8b69084e610a1dbfdf4311d16e67458e0ddb763192ef219644a65b736e67e69dcbcd715205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Filesize
404B

MD5
dabf9d71f64f7f3a40a8fd7c09be498d

SHA1
2920a70c03031027d7e2a3ee36c3c519fd9f1e6d

SHA256
6093e847cba967c3f445869b9c8b50c86866ef9de9605ec08388f49250d5ec60

SHA512
b55e7c976284eccbfe7881143a2097048b03b1fc254abee5d2579c3a6fb92d7f7d9067bdff9583aef7669ecb1091b128713debd6b02d040bccab1d60fb137917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F

Filesize
188B

MD5
ad6ffe9f4ccb28d9c2fa41cb8cb86dfc

SHA1
00342cd8f27968a9552c24b17e85d070a34267f4

SHA256
d6d4f472364a4ece952fcb181ca4416c4b16d934897ab3879d29efb05b1ea2f8

SHA512
fe5ec6682f23b40c13eaf3241554afbd109a478bee0893623442de93769f7550e8bd5afd2647ec8afc3fbc06b659c0f4a2fcc4eeecc3aeb25e9a260b38b5421c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f49cf2b8990feaf9f8be7bdf436805d

SHA1
3529a8fe5a4ccb8c528228a23f0054266b023e95

SHA256
1ffe43ddd78f797e324aa7181e4dc536a1eae5da4593d9cdc996d25350e3f79e

SHA512
f82623555ea690147cb502160dc324f9cc19abc00841b77e8c1f9d24c2c99b85a2c8799154fc162f8b0f1f0b6c4a56fa3374bad58b7a452d028f66765da13e86

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
0bd723c6cf45b4a8cb971b3c0e20684c

SHA1
8bf332f90b443fb98cb228024c2e7440134728e5

SHA256
b0372d40bf0c282048e3d2946ff2e36b2a3e80cfbf38137a185792e5919b9f04

SHA512
435bd12c58c79c0679283e5cfe0a3470cf4698845e4504c41ee4ce0d1aead043979fe655df7790f8c44b9c5632b2b0704349db140c70fe12ef74c118d05032f0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\12108

Filesize
16KB

MD5
bbdeec7efe591f2fb8e4828379f28d8f

SHA1
4d1fd1c0b9003f9e7b12fbdb1ff2fb09a9b89b7e

SHA256
2b3aa09831799ab73c427027f56cd249c192176a87709fd2db62f5a9054cd3df

SHA512
3a69f736a50986cb43cba8bafb6f736180d40d2abff2622aaa02e2144332d417eea319e6825bffbde32141cb71ec222639c197a01f31f850b57828905a2b02d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\15261

Filesize
16KB

MD5
610f8f67fcef9a3680e90df26c1d21d9

SHA1
b4dbe92a16879270573513f1589075de7d9bad67

SHA256
a820f6e166bd343ad5fbadf650562c83a85e58cb889c704941397153c82cb952

SHA512
6f1681f8d450fa3c4245c9af2372fcba52492337d86155e893adfdd18193ac52cd79a7fee9c0e41d4a5a6dca1a1746cc19da145cfdbb5ac565b14e1b8c872a77

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\15369

Filesize
16KB

MD5
fce206a061c625154af12b51bcc45c26

SHA1
2224a742712917e817b88c189fb25e09855e9189

SHA256
26181d3333079c3ef1de7e8752840840d96856216f3d9ccfe64a134819af653d

SHA512
65d7c55aaba8eb2c6dd53eff6dc6a0247248752fa446b44f86326d6c7b5b2c0ae13c21018d015df126bad1937d50b50772102532d4ed51d74576d504ffc62467

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\15705

Filesize
16KB

MD5
1d67caaecd67a941108883bb80b68f10

SHA1
236e3d6e7f4965bd656f02f539dc63f366a8ebc8

SHA256
8bbe00fb022ffa8da0981a0e5eb062fa94a8fcd4b16003a94de8e6eecaffcc91

SHA512
a01064d46c1803b77d6789b3e335dd8bca5d06eea0395c429fcbef30d26c1a9663764f2ada221fc6bf6ad4727f3f59b15cfb2acc9f8ea8f1b6931c4ef655ba06

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\17989

Filesize
15KB

MD5
f38540c6756b86824b639e771847620f

SHA1
203faac373d46c3cdacc7f123637e25ccbf41c2e

SHA256
93c6676b3e97b8d5d2d989ba0121d92f78922855f4b72d3a77c29adc9f557175

SHA512
b34126933c3c5ca54edcb4df8cf8e4dba7f5458db850a5670a5875dd4e13aaccb90a3f27d41425c1f07598323b0c70d19c4c66da2fef2b6eaba7d8960610e7af

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\18558

Filesize
16KB

MD5
65742445fa6cc3f9c9f980c3865f0995

SHA1
50dd5c05bc1bcdd559a245677866ba16e049c8b9

SHA256
f767b0174e608112b3509422d2585559dba53062dbebbaa791d177e63ab5568b

SHA512
38c8c1a038dab50f2594972c41effcf3ebe36acbaaf6782665aa6f5f313f5b5ca63d9f53e8e248f0a82a7a5ec765d12d6b7ea09d3a05abb3efcbba041546cd9a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\2006

Filesize
16KB

MD5
46f90b0c374c47c70613f830502d92ef

SHA1
4864c537bf4fea5fb87dc233eaff2ba6183fedeb

SHA256
e505ba4c28b39785713e78766002712469e4a0254adf6b5b96fbacad5dffdc62

SHA512
60fa7c1ebcb74826a4848e7fee3dc0cb8214e49ae188fe85c1b2458f5255c56c3e75c6481ac57c4e459929661daedc49d7623ccb925a766855ea3597c6d40914

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\20095

Filesize
16KB

MD5
23a1306b07453f6bf3a8348d8b204a0c

SHA1
301c412f4a7c3dbc2c6ac5c42b8bc8ad8961374a

SHA256
f3a453c599c8bbf3a9437a40aeb1904dfc16319eff9ab782c585222a9705b09c

SHA512
a318c5cc2b05a9934915eb5ff32d28e09b97118de92d9683ec827aa0e2741a98f0abff5f2709fc60367e8a980462772a152a711df57a12f8efd0cf33f482d534

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\21788

Filesize
16KB

MD5
a9a6e22790a50c717e82b6513bb6770d

SHA1
b6252fba8501d778efb9e1382658056dd672dfb0

SHA256
1799a3f28425e7094484cc76d44293c267693ac3b9a7a2ca886f5035c291b84b

SHA512
67a2eb39b23979b477b751159e910ffa6d6f698918121e3a41571316ac343aab25ada8ee773a2b8fc8fff9ed72c9b1eeca679744dfccea203a816ee6ef64c89a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\2230

Filesize
16KB

MD5
f58b1742c5155f744445b414922f2d5f

SHA1
fedf7bbec17fb591357a6a4155bfe1afc54db6ab

SHA256
f6ed8a256d7e89b20432db6baf47955b629d4b227a327a2b540576342c25348d

SHA512
00ab61277ee3d2cd4d8423b8d9ffdc9f7ea7ae8ff541ac47c5fed5c06cc6f212c0743c504dedfbb3d50f9ebd7f5e9612e03035f1ed22c2b51bc738dd36cdbbcf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\2419

Filesize
16KB

MD5
1e8a107dd8b0bd721f09a669963935d4

SHA1
b89c218b9a4de708c06ab7df00fb094b37f3ca35

SHA256
7c8043611eb8db61761f039fcb1916b119479cf27193aa48b3c35db09cada7a8

SHA512
2ef84ea3cdb9695fe8930770ad6c432a37172b8db1432080224dfec4881415abade61c9645c2b500da3571c8bb6fc61db72d371c3de77a4c967e5b5e6dac484a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\25090

Filesize
16KB

MD5
686f57ae5610d0be4ea9886dacbbe1d6

SHA1
9e91fdb85feccd6688260aed3a411e823a86b8eb

SHA256
ed4aac6e56d32a77ca4ea39ebde7ddea11a004287a7b8b453778a05a513a11b4

SHA512
26893341c6b474264b13dad9d96811868c53227ff40d7ee2f5e30c9586a38c35c0f6330f9f0988ceca235c7369fd7ceec88e868512207e7d517f1d2b35bead2d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\28324

Filesize
16KB

MD5
0eb0a0718111cd62b59e254d48a6dfc8

SHA1
dbf30160002aaf904a2da0c28e0dff201ffe1468

SHA256
3f3426a76880ee39b683e625ea34407a449d72f951300dcac790b1d2f354798e

SHA512
ab21a2ff28aab4ac7fb8205ecb6d7d164672f92d3d450bf00d6df1a035641491fb002956c5b931d25d1450a4ca9bc1070f47bbea83f16cb8843d0f75dceb9b70

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\28656

Filesize
16KB

MD5
05c9ed66b98daf23cd0f6f7957d1cccc

SHA1
caf1c746f5be35ef23b4c020a358dc638c468372

SHA256
b40a894a8428f2847a793b1db68315a7a28090b5950e0e1f0257a15d9eb95ff2

SHA512
001c986cf62e045b380970eaffb74ad51cb656ff906cca0a8321ced23ef88b8df7b240993eeb90778acb542af697cf2a201f9e22a5f99a5006fe0c1d662f4cb6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\31697

Filesize
16KB

MD5
29919284c265fa2331e51bb102dbd0da

SHA1
73fc7f779599ddeebc82d5b6aacafa3349edfb11

SHA256
fde9eab8a598dc682106c2a2c051a988fc48140e0808c4969defa38e85489575

SHA512
e7bfa5010f3e7f02c4dc2f5fb658fec46fad6e2f9b0a8fb4054e30d3fea4c0d613b3bbea0289268113cf0dc1ff0554c8ec45b535b0da710d86529267d366ed3b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\694

Filesize
16KB

MD5
7c9772e6a94c94d8f27ebe726dcf0ff8

SHA1
ce2ea30a54cfaba183568f0de7c37bf5d5676a9a

SHA256
d1dc59b72358c07e386587da74919f46c45776d040847a583a316107aff679c9

SHA512
dc93038a810d82dfa5071c7d1f60e71773f3894181e70c5d9349766cab0b540cae2b830e94e4d93e4a0681447f5d09723be19122ea98bfc48760a31a241264f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\doomed\8730

Filesize
16KB

MD5
6aa9415afd3ae245bd269c3232fb192f

SHA1
8e6e1154615d327749c8ba3422b2397903c0ab52

SHA256
06b180c8cd7d35d429ec1213aebcf9b28b12f1d59e9cd5ae9ff34d3d66baa02d

SHA512
8dd08fce7298def95c986181154437da41ad9fc37948103f28157ef9379a4282a1f23daab9aba6b3aff974a7f397f2872a7f5ef99c883a4a786c668e5552d1c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\cache2\entries\CFDED8F63AA433652E85B1A2609A92AB4595F32A

Filesize
149KB

MD5
f6b63e6ba796d055f007c5df3c8c3a44

SHA1
3b02bab72c1377da0d87673a551a36b895fb0321

SHA256
f53f3b1fedd3fa620dddf64d05801ccc39934efa46f065df0e6bca89c4bb5dcd

SHA512
d64c4f0300009e078bb17b4547f4a17500dc7ab55b201c10e7172a4ca1fe9994f4b8fa1a651bf50ebe2f5a7651c9e033f1cc543084f19f32c471c598917179a4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
e5bfc19a75026a0c79e8c8c6717292e9

SHA1
6adb6486ec0672b3555b1a69c6ff39544892e045

SHA256
acc605d3244014e36ab453efb875e27ff8ce121ecf34e1db3a1ffa83f5d76b12

SHA512
e4cca1c4cfe777787f92142dae2b237de9150a660d2373bb0993867d34fcd70c2f0e4a70ca1fafcd9d20f0e0b1f93983543c5d3070bdbcae8302d7f94c9cd4c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD

Filesize
13KB

MD5
8121125042aacc7a6ead3440f37be09e

SHA1
ba328a8f88cb2b80ee60f7ef7687a8198ddd78f5

SHA256
79f7f813032f79515daa920eaeaf2a06a1389a005105940bb2636b0926f89882

SHA512
98cec7f896129c854ee462828b444414b121710a238cfccc88a46051a17aa14cd99587cf017b200070b0c28516b71e9fea4539d5c2a97826c6e94ea1dfe11c6c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
11KB

MD5
3e83a52b0581148a02819b249387d726

SHA1
3d2bfbcf531ce0982c39bdc36f9ce1bb2aeebb66

SHA256
7d0c60a50e0d8cbe78614a7612ece639c3bcba814c2a32403a0d9f3e15047938

SHA512
466bdeca172b845a276e2198318be46f82c92124b31876df80aeee24b4d5ee740a944389b99879de0afbbd390e8ce0b6106de76e245a8be4219715e30883924d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\startupCache\scriptCache-child.bin

Filesize
464KB

MD5
60e9d00650df9831eff9d069fa289bd6

SHA1
eb2a4ab8c870896d5bdbfbe9a772639e0cf23e3d

SHA256
8b488a49787359a85eda28a1965baa865a72270cac1368543ae88ecbc2785fd0

SHA512
4390fe1e31df54e60f5f762534c5156285358cc3cceed50aab22335f01918ef3bd33bad76770a546ca0f60ce79f439bdf168363a250932859187b6ef5f031101

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\startupCache\scriptCache.bin

Filesize
7.7MB

MD5
b0200d529fbc8783c15c8ab683307b96

SHA1
ca51b0c62763e6cf471eb0650f1ebd70e6dfd966

SHA256
214588294140fba6c9ac894f82eff48d2d99b9d09e1380da15ebbc0bf827d980

SHA512
18c24ebb317e4c706028d4c78f3c507c2e710b65c36ce32382342d4f9ee2d5611fca3db5a4bca55e4c14069f91b0f86d2ae88c05daba0a253b67a27656345323

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gdoevwuq.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
fda1249ee54a04c69292a7c5eb6fcc76

SHA1
4b386c578879b871284a1f3c01bfeb7b814839c4

SHA256
b10ebb5db0c98ea507146aa9a3388a884dfb8fbf0aa05fddd9f7c07e8036027c

SHA512
271e01617c59ced845b2a3d8cdc2b91406e147b0d115d76a27fb8f4eb7b964992965ce1b2aec3cf0edc625eaaab593a1b6cd0aaa794589cc1672858c89fee4aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF928.tmp

Filesize
75KB

MD5
08c031fa82a09aae1079378669678fe6

SHA1
b109251d2fef08bd446be0c92369e6f11eb67093

SHA256
8764d060558a9d4ef24adb43201d5178033171a649ad497f79ce3b6cc8eda98a

SHA512
d133a7c02ee8e6e4a971ed4a6537c11cb58516a5ac0501672169805f7b97591d7cffd3a72133bd1df4b8d8a4f4965ddf324a83cd9be0d8af15e646a121e2ea4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF2DE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA43D.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp-z93.xpi

Filesize
220KB

MD5
a982392bc2af7fe7c3f1e5695e5fdd3c

SHA1
63207496bb49bd19654666d19f981638242defff

SHA256
cda627509a4991100f482a4cdd2db43e3312e1a781b501a15c1db081d9459124

SHA512
8e63577332c32c17a139f5402a5ae290503c1a28a99e6f4d036ba3b287e5c5d64f87fe9a1d00516615a5dfbd4c752bb20ebd12df69290ef807e47f051b7453c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\containers.json

Filesize
939B

MD5
94a3843fad8c45c48b0e07342df3dfdc

SHA1
d55b650208bda884d573afebd90830a3f4d7c201

SHA256
854ff2076f71097b030c302a1ea71d8e851d2920b9ff5fc8dc8f16c91ba95b72

SHA512
4d2a6b2a223ad81bb97195abb27685cf88453caf5769de154b373486d5245f02e0c0f664281d8e3bb33bfcdf1d6f7b3d9602303864d4e56481382adcb0b932db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\datareporting\glean\db\data.safe.bin

Filesize
1KB

MD5
0ebbc57e76a2a5d9bbce27322d46328f

SHA1
5c3dd7b64e80ba9130fecf759f48357c880959d2

SHA256
46d02c88c1b0b4deb66d70e3d2b421f5fbcda1a0b379a8618a61898bc980eb1b

SHA512
d991a53c13c381c39fda0b871e13e0006a53efc4191b8f840ca38a8e76c06570d00aaab851b98d4f57b45869a9ff99f0f80511303b12647ab8db5d88ef7f454f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
1a307574901e1113ccf904284a152f40

SHA1
3db31ddb53b23976d1a3569594f3c0f3ce124769

SHA256
6797c2dc8bdcc74eaf8e608d766dcfab699fabc8f07938c7cbc15391c75857e7

SHA512
01c4e6c39ec1b35537fee1772163240e4eac13dc59aaee1b3ee20667a687b1997971ae6b07736f0dda85e2fda67d5389b2e4e6c361f3f9e52a2267c346cc791e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\datareporting\glean\pending_pings\9affdd3c-9e16-40c8-a87a-c33b7b1e2d73

Filesize
655B

MD5
23675559e5d943f48e5b5569ed525f99

SHA1
400c5bbe0d1099a495cb66f4b1a1215954a3136c

SHA256
4c2a812cf1c3453e372e6baf99d8afe3d6c2702266f459dc4ba63b2dcb6738bc

SHA512
819337affab09f7322393daa4909b1a9ba2a0c74d0e8cd2a530ab727e976bd703c4486324fee3ae2af72fe1eefb725370bdeed0004df9d7557de87322b0e3c5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\datareporting\glean\pending_pings\9f8e9344-8b5c-4092-884e-f857e5f237f2

Filesize
586B

MD5
13acc1b74cf67b6c34ce1108865cd5b9

SHA1
d7eabea6ba76ad473d1dcad662eb7da5f96909d4

SHA256
9bbdee3f6931675f4dac15e6ddc0f181eabcf1b8c3e24311a5645dba1c391163

SHA512
ea275002c3a8fc1ad9685efccb759eae70b1c712d49cb8d88cb6f5dc56eeb4252fec8922e7ee7d1062b3b61416e9f6bfae98b416c1b2b4a1c182dbe3978f884f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\extensions.json.tmp

Filesize
13KB

MD5
c2d3bfa5f8fe711ceb0a86548293b783

SHA1
714bb306bdfeacb611c8688fec5c9330ada7b2a2

SHA256
478f6d5577ec9c68dc376308ea15e562a10897aa14b764ed2794d50970c9695d

SHA512
4ae71945b8309bdd7ccf1226b08402078c0d70755181b054a3f6774f4e3257a63183689e67f8f5dc0df65608664de2fbacbf95dd077dcd15ed8737b8c221fec0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\handlers.json

Filesize
410B

MD5
e7a65c5ead519a7b802f991353c26d3d

SHA1
34cc3c1cf9bd4912dba5fa422010934e46419fa3

SHA256
0e5ce92485da953757f615bad034a43032b220da18f8165dd85347851b56b2d2

SHA512
2a6034449ba6f5da8a77870ae665064047cea2460aeb4c8c0b62b308a403fdd30648150209aecc31ab1e50b6d9d94a1f51d3d7d50bbf35ec1b742bff2dbe788d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\key4.db

Filesize
288KB

MD5
6124315de36bbdfbfb5e0508c744f0db

SHA1
158c741546904ef9659129c3dcf06ff439e4ab53

SHA256
1dc480df5a763cefda273259538eedf11ead7201ab32bcdce7972e0d4a04840c

SHA512
11c9ac5e3ab2cbbc4e15707856263614ed5ebccc5982788bcfa8feac8eb19362cbbec98e4970fabd4cc43c863fdb43ae37398b63eb49035851b5ef6b26a0c441

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\prefs-1.js

Filesize
7KB

MD5
36caca84688f2dffd43b4e5c2abfba25

SHA1
09950fe855a64e62459d1aacd49efd6ab881b9c5

SHA256
25f9c8e5d57d61f3e7c2226950149ee99280dd6e335a50564ebab12b4756fd4b

SHA512
d16b489c9a70ba3e790d373a5902406823a35073d8360df34acf2497bd4988178e8d60e8cfa1c33eeb07d464d943ac8750ccd9c5a674354bcd228441bbc4b2bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\prefs-1.js

Filesize
6KB

MD5
ba8679c5404d81c2ada7e22106ca3a68

SHA1
14e31ba42c4fec5c60f084f5c595e78adf0845dd

SHA256
f72e8713b3babae0b1450d7df06d939ebf3b9db7f1f416260f4d2113bfd6d335

SHA512
28256a76c3e64fde9b6ebac7d56762ab937ed9a3bf4c5e47045a4740f6ec9c0e36405f536056751572a984972b84e7864d30a07f2927ad14570f124bc6348806

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\prefs.js

Filesize
2KB

MD5
93c936f2d2e4942ac61a075a4ae990a3

SHA1
bf10802b6e71ae3ff26b6b1b68fd9555803aa0cb

SHA256
da5b3627be84f975f335c4dbaca9328f67057717990bc0e66b116468a8b87f2e

SHA512
580dcfd7b58f0bff7da6b9f59aac04ca3ca3f8f2d797a7120baa4cdd430d1e48dd0d24366dd4664cefdaa0736678b8d5d9469e046d983ab004473254589addf9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore-backups\recovery.jsonlz4

Filesize
1019B

MD5
b194f637f34fc14619501e6b643e6d18

SHA1
44dd8e8dabbde4133d3f0bb755fe85748b59ec20

SHA256
fa0180a6db3e96ffa044b78ea8c08d223a628544f6ca81a64a1b75b1d5cd790a

SHA512
0bca5f59c299a709affc5fcd39af2f64c98c257e71da210746cd4f6bfeee1227225c3803ddaddfcfaf07ae3b5bd5ae7295b8f227caa6f34cdfc2684228fe0ef9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
179743fd6b795cc5209f477581d1cee0

SHA1
baa987fbaf8a7229acb800b536dd1216d9544397

SHA256
fe44fe5a2165d37c7a848784a9eb6d04ed2e9480ffdb2dc1d7cb0afaa4b412c4

SHA512
ed05218fa4571e46f02e30656a5ea0cc776c11a72fdea44cd1ab6f50e6aba360b257962a14d3859dbd78850c8713f37d2f302ea203ab57d07c1c35700348df69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
a5b5c4761e8cb3e6576b390683afdf1f

SHA1
5cb8c865ca8525bc138c645be06de22755677dbb

SHA256
df6a31ebd4d5c4025a314d73f6cf7ab74c1ffaaa464fae624cfbadf4e29726a9

SHA512
0918ac204e55f374ade2dc54ee87ce3168015fb57013513ff16e94a0911c5a719c585b4a22699c43d16afe4aaa9916cb4475da79372b37dc152b5917ff6dae48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
c11a13261993319c785bc4aa0202122b

SHA1
cc3bf47cb076fcf71d174fdb445e25ad424410ed

SHA256
10944b8b2f045e6f06dfa7d2e0414f4145fc29015b3eeb424561926be13c7435

SHA512
f038707f08f7506eeaca6be9198cc26c2001db1481894692675e33fe47c21566fdd16adb50c2250c4225e2eb3e09711778cfebc9fc66e418d7b30cacf7b59e91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore-backups\recovery.jsonlz4

Filesize
793B

MD5
c16fd6f7d1174b5cba265c50f08d2d27

SHA1
f1f4729adfe044a0f6843c8da5d457c1af58125b

SHA256
635c8108d6d7b03d5961066ff6836b9015b814f008cdc206625a3fddb95dcdc1

SHA512
3f08763b563f57785a27081264ebfc4888316e8e1c3b64960b9f92a5623e40412905bdc0e1b76d56a4b5d024fa829b57195365ac652cad91f769b4581f6abe92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
0fa5f6afb11b9b487a77f5a09de6171b

SHA1
5cec7ebbd8e9da1532abdac59ab90d62d6d6b356

SHA256
5198d3c36b3ec2a4c499ae5a7cc460325b899094810dc30e01ffd1b4f53189d9

SHA512
7c51cc670935739f7fda8bca8d8a7d23db946b80fffd8518726bfc37a3bee80b966dea1bf651dd412551b4917d86a25b830e3b0c54edd3677e286e06bc154648

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
b58ea254811733119eb2f138f98b6449

SHA1
45007e676131f56c8c145acc6fa0229fbd2fbbe7

SHA256
91066518474d1588c0671b6e458a00d5cdb9fb9a899fdc29f5b26713d062c867

SHA512
db8e92d072eaed00159a90b61666614a5b5083eebfa3b26876ff492859b874bd579dfdfba9ef889fa5746a16c10883e3d1333336c4527c518f67725543ca2b34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
79aa34947cd58384c3efa259b9d94a7f

SHA1
bbefbb2fbc9c9854e8a3163a35b3f3e0fcd7666b

SHA256
e414d5f96be656e573d0d7544804bf284f28c5ea830e2982f6fe1d8b391ad829

SHA512
1c6e3fbc354c24b55ebca5af956a186edfe61559a46cd049a1934571200e4a8c6fa45f838a269aa53f08c3988e0e1a17680a4c1f11a3596a1f981cb8cb010885

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\sessionstore.jsonlz4

Filesize
266B

MD5
4fdb7f9a51ba177262d07d38c0238915

SHA1
f12c5a74467bf624164ac77ab7af517ce46ace8d

SHA256
a641f5701e0ccb2fc22a9f4323c96d899db4397fc08c63fc5de852d9aadca9d7

SHA512
fd0e72672b280e9f362cd8ba4a81c795fd741163020cd2c62a104c3f8e006883ac592951db85f364f3fece2d9af386f635b93ced301e12b4418e1e0a7fdd9c09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1a5lrcwm.default-release-1716650513932\shield-preference-experiments.json

Filesize
18B

MD5
285cdefb3f582c224291f7a2530f3c4e

SHA1
f816c3e87aa007b6e6d31eb6a4618695a7d83439

SHA256
704d28223a4320a853df4a19d48c7015cf79d56a5317cc3475b6305fa43dcc05

SHA512
8f1decf1e4b5755fce8f165daae115f45d6890985c9c4bbb33a6f724cbfd26db75f6da06f9ef675de20fe755da9b7f55e5ee37124296a12a520a393da159bd58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\AlternateServices.txt

Filesize
163B

MD5
b34e9d1cf82a06d7d95004eb614f710f

SHA1
dd0af21c48b9706ee203ac75648dabf913f9a5a2

SHA256
2506166458088b523c76b88a25906915ad820367d55c4ddd1158970875ee2e7a

SHA512
1df616363c1e902a6a65259f8b34d450b5eeb086b53adc330521f484877567982a509843b7c10d7e27d032f353f8b304132345d05618161122d29ab50ba637e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\SiteSecurityServiceState.txt

Filesize
324B

MD5
6ce478c6a00100d574fa6e44a96c6169

SHA1
40a4c59267ba2d0efc25fc6bfdbbe4014829f1c4

SHA256
a11c649569e3d7fb8b08b10d38f5f0e2ddfeb9b6fccb33c2d4f5ab592b88c745

SHA512
268c69b87f444d5084133ce43dae0e2b1f9d8f9b6803788a39e5b7a051d8b49f2ee09546b9db10e00e2876c86d61268a7d2128fa56a8334018d50083cda438d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\db\data.safe.bin

Filesize
4KB

MD5
be0058564dbedb3b50ab45cf245fa579

SHA1
6907b519d4806372f81f2dfc3067c36248e35fb6

SHA256
1b0a925b9b8b9a1904f627b727599fa6edf9cdcbbc907427e24563c743e9abce

SHA512
9fdb3127e80dbfe199063368797ccd44eacd62eaf79d874142552dd29d66faf567752428b82e1e1213e60deed4766da55b311044baa8e03e22ea0ca8f56389bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
030ba45c3f7e59a2c27a6b6ba1563ec5

SHA1
dd285bdb9797ba1a4d53b358d677964a2ce11454

SHA256
76605294170d9548ad723cfedb5d9121fa16a652b51161846cf63f9d6acabde9

SHA512
e7c29d27d5144aa4736530da1bdb9b833971542892bf82121acb1530bf5544275829221d3c6b5d44c1ecd69202b77bc80b1f0f8a436f4b1422fdeddaeea54837

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\pending_pings\27cc863a-eb19-41ee-a07d-dc26cc559fd9

Filesize
745B

MD5
21f5255d08ae61f861bb3382ac1144fa

SHA1
bdece28c5c3dda720df821a7cc8ad13c5e5c3668

SHA256
b0c5f9d47d9d25fdd3717dd1826b5f62994a944a50635c2bea9de40a8c5081b1

SHA512
8d48629b5b59c299a5d39feab236ad87ba9c7dd7788527977832a464c31c45c765c2d7060a600f20638ee9ecfd837f7309a0afd478bbe5b3d4229997720d1012

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\datareporting\glean\pending_pings\6b0361f6-98d4-4658-bbb3-d8e7f35a6478

Filesize
11KB

MD5
a6add6710c6ba912677f651eed4f0038

SHA1
d25a4bec5593b8d1f33b83a11d7ae9ed60594d0a

SHA256
63b9d60744abb4913e16c95014ba92ae2b142ac6e00d06550216e190dab9cc7e

SHA512
aead75678ffe178f3df5a19bb66d32f1585f85e75ad8a60c07d72865bf660dc157d6a57443afb0ffde70b9c4b4d7e588d98abfd1b6958605f85f74e91ec57482

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\prefs-1.js

Filesize
6KB

MD5
c23e025b8e0347d4854ccd3ea8595ba7

SHA1
237064d92572ff3ba4f1f348fb055a0c91703b7b

SHA256
f3dc7efb826c8ddec1f3c57038a50c44510d8d9772b008e56bdede1e23e0c5cc

SHA512
63027927311f8a0e3d527ea4d3c92223ec78e7fdfa15cddb83b908c92fb36159aaf3e34374d0cf68dcb83e5e4eb57639957459362cfb233950dc4cf777d1284b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\prefs.js

Filesize
6KB

MD5
8757e535a68d342a616ea04d54aa5c4a

SHA1
fedaa9b6108f3a235d5a967c2098c53fa2955161

SHA256
8914c09399d8e4107f39c2c06ffc9bdf7350adb9cb6ed74bbb36230f5e7eece6

SHA512
35a9940f89ef90edd9b56c57ec64bc056bfb1987bccc215a4fb11da3c1e1cef2ebf855016984702bb4b0c981984ce21f95a9573576fdaa0a377c5943cc4dc0bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\protections.sqlite

Filesize
64KB

MD5
deeced8825e857ead7ba3784966be7be

SHA1
e72a09807d97d0aeb8baedd537f2489306e25490

SHA256
b9f022442a1506e592bf51284091a8a7fe17580b165d07e70c06fd6827343a54

SHA512
01d303232d6481af322137b44fef6c2a584f0643c48bab2836f9fe3193207015da7f7514fe338500ae4469651e3d9618293858ae507e722198a249257677099e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\sessionstore.jsonlz4

Filesize
1KB

MD5
57c7d037f8c1de4d7dc54f825794dd63

SHA1
7b799ced0267bf12347623713c82681bd629827c

SHA256
6c5b577a8f1292fa6459e358ea7b2d25333d58997b06627e1ae93bbcb6eb28b7

SHA512
8cb69d8fbc66eff177e0320763394794079fda10c090ae4543e3661d741a7f8058c5a00a8368c327e19dac894a055eab0a4bf23ce18ba43bf0060c2c64a2e8af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
9752a33426437e3c1c60748a48f94762

SHA1
566c32234ffdfdbd57a1c0758dfe888cd30d5e18

SHA256
b92ef2c0d54cc7484482fc7170e3f07ed74f8ef17af7d27c0f4e56e7fca32aec

SHA512
d174c60bb6271c917285296682da0d35fe1e5d27d96eb34bcf33875c458f969ae58d2d32a7d5723fa263e3cda74d93b3e032071272bcfef5fb7ec7a527bd5f87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
84915a4201d8a8e0564944a76ad800b0

SHA1
898b5b1061e0ab66aaf128107f8ebe071214eae1

SHA256
8fa1acacc57ac6b358b867004a18c6e99ac57069dd50b618689c3c2304ca1a95

SHA512
fbc253aefd6b8977297a5823e6736b68c64b45f0c9c0f4c344d23977ee31e6d798b197ceb4ed2d4dbe7392dc9459b5a8eb3fd20b4d87217f32b755c4afd03a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\xulstore.json

Filesize
217B

MD5
c64c353599fd3ad2e43607fcb5b4ebf8

SHA1
d47b687df6f60fab3f0b32dd20d54258b2b645d9

SHA256
c92da016f56b7aa125d9735490a7421c525e839d1e34c130d4f73915b08c8b44

SHA512
c5e25b4206a027d28ac6aae3fd31b9dc020febe33b7036885fb94d39b7378f3bf1d7f6df9902c372de1ea9505e7f4032ffbbf394bafc1cb87ed3b20fabae7b23

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\gdoevwuq.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
7d3f25d62d6b121dc644c5c8b346b369

SHA1
aa24e0b255cab692486d95f6938dcf746f0af2d1

SHA256
32874cc791c3d75056e14318126e5a828865ae445816b6d2fd5bfe71e40d47a9

SHA512
a8fac8f408e7479d4243ac1a48cb012ae4eff4f372f3cf5850be5d73c337a6eb2817ed816ca90b7048be831e7fd16e9842d546604a036cc3e5a41a3bfc55a6d4

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\gdoevwuq.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite

Filesize
48KB

MD5
02df71c96177897247909653e701e809

SHA1
b9015f49e51f905711e7cc6f1f587a0e4a2d347d

SHA256
6a837f6c39f1b5a109817a24864787d2f6ccc60b25e333077e67e7f8330f5ff7

SHA512
bcfe79f06935a679156cdd1d22c65a1c3eb0cbb0953212dec707234b29ddb035df910b0698a167311a3275fc3f750cd9f6066298bb6747485b51a794da51890c

Download Submit
C:\Users\Admin\Desktop\Old Firefox Data\gdoevwuq.default-release\targeting.snapshot.json

Filesize
3KB

MD5
0b89d371d507bd7ef4d9fcc9f5c4ddec

SHA1
d5dca7640fca89f8dea35d6bcdfed96143c244ee

SHA256
cd13e753461807f0cc7f4ac096902ecffb091a127dab3686144502edd21e4f53

SHA512
94911819ffbc00525b83955fe2f4e8e9c8a7eaa18f8a26ed16ff7076628497fb2f46cfbaee99ac72d332780aab54ac1b0083c6ae693e355f3a6dc1d97ad10ac3

Download Submit
C:\Windows\Installer\MSIA0A8.tmp

Filesize
75KB

MD5
6f8e3e4f72620bddc633f0175f47161e

SHA1
53ed75a208cc84f1a065e9e4ece356371cac0341

SHA256
2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

SHA512
80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

Download Submit
\Program Files\Bonjour\mDNSResponder.exe

Filesize
451KB

MD5
ebbcd5dfbb1de70e8f4af8fa59e401fd

SHA1
5ca966b9a5ff4ecd0e139e21b3e30f3ea48e1a88

SHA256
17bffc5df609ce3b2f0cab4bd6c118608c66a3ad86116a47e90b2bb7d8954122

SHA512
2fbfcff6bc25461e7c98aabdae0efb33f2df64140aaf4b2b0c253e34294e1606077ae47b000ebababb3600bd4d9154a945036c58e4e930da445a0dda765ac8a4

Download Submit
\Users\Admin\AppData\Local\Temp\nstA43D.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
\Users\Admin\AppData\Local\Temp\nstA43D.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads