4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7

Resubmissions

08-08-2024 08:06

240808-jzjppavelf 8

08-08-2024 08:06

240808-jzc7xavele 8

08-08-2024 08:05

240808-jy2twavelc 9

Analysis

max time kernel
431s
max time network
432s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-08-2024 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin.sh
Size

132KB
MD5

59ce0baba11893f90527fc951ac69912
SHA1

5857a7dd621c4c3ebb0b5a3bec915d409f70d39f
SHA256

4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
SHA512

c5b12797b477e5e5964a78766bb40b1c0d9fdfb8eef1f9aee3df451e3441a40c61d325bf400ba51048811b68e1c70a95f15e4166b7a65a4eca0c624864328647
SSDEEP

3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\Registry\User\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\NotificationData	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c0031000000000002598b81110050524f4752417e310000740009000400efbec552596102598b812e0000003f0000000000010000000000000000004a00000000005dcc9500500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\109927ded1c6f8ce79192bc804efab8f52e6924d16476236eef82a1631349d91.zip:Zone.Identifier	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2748	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	324	firefox.exe
Token: SeDebugPrivilege	324	firefox.exe
Token: SeDebugPrivilege	324	firefox.exe
Token: SeDebugPrivilege	324	firefox.exe
Token: SeDebugPrivilege	324	firefox.exe
Token: SeDebugPrivilege	324	firefox.exe
Token: SeDebugPrivilege	324	firefox.exe
Token: SeDebugPrivilege	324	firefox.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2748	OpenWith.exe
2808	MiniSearchHost.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe
324	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 4184 wrote to memory of 324	4184	firefox.exe	85
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 2416	324	firefox.exe	86
PID 324 wrote to memory of 3704	324	firefox.exe	87
PID 324 wrote to memory of 3704	324	firefox.exe	87
PID 324 wrote to memory of 3704	324	firefox.exe	87
PID 324 wrote to memory of 3704	324	firefox.exe	87
PID 324 wrote to memory of 3704	324	firefox.exe	87
PID 324 wrote to memory of 3704	324	firefox.exe	87
PID 324 wrote to memory of 3704	324	firefox.exe	87
PID 324 wrote to memory of 3704	324	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bin.sh
1⤵
- Modifies registry class
PID:1524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2748

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1960 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1880 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {087c7c38-3cf1-469b-814c-c9a9260fe2d2} 324 "\\.\pipe\gecko-crash-server-pipe.324" gpu
    3⤵
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23517391-5f57-4ade-95b5-30ec44b773f5} 324 "\\.\pipe\gecko-crash-server-pipe.324" socket
    3⤵
    PID:3704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3216 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 3116 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c17d5b8b-4a8b-45d8-a57f-a7e3cb984c1b} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:3472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3484 -childID 2 -isForBrowser -prefsHandle 3512 -prefMapHandle 3408 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14ec89bb-7af7-4cc9-9533-8c601b59a776} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:1680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4248 -prefMapHandle 4296 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9122ac46-0651-43e7-b023-56d83af6b319} 324 "\\.\pipe\gecko-crash-server-pipe.324" utility
    3⤵
    - Checks processor information in registry
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 3 -isForBrowser -prefsHandle 5368 -prefMapHandle 5344 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ee6168a-b84c-4f66-9875-1bce2fe9ef9a} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:1156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 4944 -prefMapHandle 5388 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {473eefc0-1cc5-4b9f-a717-336a138afb3f} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5756 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8be0993-4466-4d02-b812-ea05b965a6b2} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:4656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6088 -childID 6 -isForBrowser -prefsHandle 6080 -prefMapHandle 3988 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ace11d06-243e-44e3-9cae-e1f93dfc91a3} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 7 -isForBrowser -prefsHandle 5404 -prefMapHandle 5444 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46ef9509-a848-4368-b55e-0645366d21bf} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6420 -childID 8 -isForBrowser -prefsHandle 5404 -prefMapHandle 4216 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {388b4da7-a539-406a-9427-d910427579dc} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6300 -childID 9 -isForBrowser -prefsHandle 4436 -prefMapHandle 6288 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e34afd05-89be-4473-82cc-65f50d3af889} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3540 -childID 10 -isForBrowser -prefsHandle 5436 -prefMapHandle 5332 -prefsLen 28282 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81676129-440b-421c-9ad3-62dbc34cf4fb} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 11 -isForBrowser -prefsHandle 4132 -prefMapHandle 6452 -prefsLen 28282 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4daba943-0a94-4abb-9449-d0f98f1fc467} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:4788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6324 -childID 12 -isForBrowser -prefsHandle 2632 -prefMapHandle 6708 -prefsLen 28282 -prefMapSize 244658 -jsInitHandle 1044 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c7b657b-c5e2-44ac-9be5-2ad75d61452f} 324 "\\.\pipe\gecko-crash-server-pipe.324" tab
    3⤵
    PID:4440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
3b47000d7f29464297e8205f4319b466

SHA1
14d28e46333e235d26c493e52dba46c453e29d43

SHA256
1772e8090a1f7a4d55ace89d43daaca932949c1dea05f539007a77aa5bdd9779

SHA512
6fcf7e28062868d0bd9eed3a498e644bdc6df1b7095c3fac71273be1aae480ddb369538ace4ce717f77d669250e05ed6413565ae181f3f2a5a5a17e6ff54454f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\5811E00C1A6E7B83BE6DD256998C5C87FD613A64

Filesize
1.2MB

MD5
766685af9257f5fcf38036ee88571874

SHA1
9482b83c468104b69f1e3cc2b21872693140015d

SHA256
cb5621de59b241b53dcccddd1dd3c3f5ee820de9f5616c131aff5ad295447516

SHA512
37734d2efaee5fb1bf68fca33ab34b426a277cc7e85940d470fd32844311eed498f7d9df9f3bcda2b6905c0e42e8d805ef45f03422e0a6a4f141dc5319d280ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\76AE8CA1E0992B4900E64F2DBE886C0C11DB104B

Filesize
22KB

MD5
802355fdfbfe76bae04eebf77e65cdbd

SHA1
a4df99b2d8e67750180ee30a1a3fbcd26257f08d

SHA256
fc577cbc651e5de43b5573e16b7f35ce68ee524ec45353f88f788cf97fbae8bb

SHA512
437780e86173a337ade42f35d2075a92f37f99499d1f0682ad1317ab4bf0047320bb9c2d25f8824016bf07504a89a0d2257896036a12e962ff9563f070bd4994

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\8999BC8CB7B8114B87D8185D8CE1BBF1E6377016

Filesize
219KB

MD5
c0e5aa46d3ad9709f7380b042484dea9

SHA1
41fea3816a22d9e5ba7cc04da00f42058dfb0eca

SHA256
823ae0dffbe712e91d4dc9b680eaa81144639f1d4168ae4862bb071b798134e3

SHA512
8bf8aaaeed68f71a89328b394d01f0f472d0e1dadd7f9c8697fb555a45dabf84e971d2fde3071431ae3f174e32d68c8b018c37d4126d7c5eacd6a6cc32000cf9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\ABF8A18AC6094E0B3AB643A9375125F1422765F0

Filesize
425KB

MD5
4ba6b7392b307e203554b0d8383fdc8e

SHA1
2e3294fd47d0c4af304be17a3315bd13a88344d1

SHA256
90eb637b877b81cfe5c4e351b90536089cfb947fca98d078e04eb82f2de94a0e

SHA512
9254231f8e6c10dbffca8a492d926c88f405b7c3566872df40f781c7b34a834e1809df57e5fe645978ed3e7397db20a5034e2b58f77d031d14532a6328a1023e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\ED12D7B4C36F34C6081B3048A5F57601F018A306

Filesize
246KB

MD5
d53f5baea9045d233f3cf0e6c7726308

SHA1
287535498aaecb9200e651e257cbd0c29f56eaf6

SHA256
2330130fdb1be6edd3028c3a509c8d89e370590ba84f6cbbcd0a813aaa1043e2

SHA512
f54af4edb6ecb85a6017c35228d454d7528d33da19b065931f8145839f4fa56eb6d708895508ae7c20bd211dbe5afbefbc8eea17f62c7d356bd60b9ff814932e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\jumpListCache\EscHtANwAg7EqnwfPyo7IptqpRtX4vlqtz9BLzNaNCs=.ico

Filesize
548B

MD5
67a74034cc82a0614aa39a05ce698dcb

SHA1
4afb42459236e8b7dcfc8ee952b869437e99969e

SHA256
71e95d4db625517d0b9304cd9e44b563b007559817b637c9b670007cde4c03b3

SHA512
817b094d17e4e0347085a8e0a9f952a212564771b3904b3b0d57b0561c2b3fac845bc759303a55c13fbf05ec6289f4992a186e2ff7c5b997e0fc278e84a2b91d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\jumpListCache\TLNMYNb0EGp7OFeeZ9w4txNIEpq1Sm8Q54bv90uOMdg=.ico

Filesize
965B

MD5
c9da4495de6ef7289e392f902404b4c8

SHA1
aa002e5d746c3ba0366cd90337a038fc01c987c9

SHA256
13ec8c9e113de6737a59d45ea5a99f345d6cba07f9a820bb2297121b8094790f

SHA512
bb72f0cc815e7b4c44959808b153aad28dbced8d97e50f83ef90229d19ea1c4b3fffff650bf49efe562451fcae0325cdbdffc1a5c4ec5d2c7c70ae9d1a0d8a16

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
a7f391566ceb7d310b04c1376aa66a07

SHA1
eda88e9134d3de209152481c9e8aa02054d4c2eb

SHA256
8ecb81fa22792fa6bb09abc86b9b5afb50773e2c5537def45dd8ba297f6c714e

SHA512
163bad20eaa9108286367367e6a54a9ac612026954ee2466b8f88f732a992695fe160d3fb5f092976ef15c1c1b71400e577a9a4833dfa616d7c9ee6a8237033c

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp

Filesize
10KB

MD5
7fc1af6f45e844eedd1a78d89ba2813d

SHA1
bdd93c47e99e7da95f5888d01cb85550f8fae9ab

SHA256
87577decf9290f786d76c3e9885e490106a7b00dd8a9b43471ff32f9eddd612e

SHA512
e79bc304620d23981c9bc03ada331755eaf74f356f32461bced715ef6e5c3ceab947a5a1dc51ef9061427b5c9132f58b1c14cce33960dd469c066ec4458abe86

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
6db9dec935beeac94ed284eae933bb20

SHA1
9328c417b474b4b2ee25c81734e0601f2ef4ec20

SHA256
75aaf472a8839eb9dc9ec25b7ae17c3a218a5c56276b0a4a51de24bcb66988d9

SHA512
30e31abffd9730c18b96a57ba2fe3f6450b31f7e6f9ba3f438176e23cae96d08622e014161148fa14adf48506c2a61d20fb7664b44a26f5067d5f46656ab3651

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WMGMVFP2DW5LGGH894X8.temp

Filesize
19KB

MD5
94a6e8b8450441bc63fc0ddb22419983

SHA1
6e1b6f0780d45770dc8c738a8df568b75cae2e3f

SHA256
bbffa168c44b362eff409d414581e28b4a4ae8aea67931a660c5a1098a698729

SHA512
135a5cab166e9be4ba6bb5358e0f0b6d9f9b421f2dfc6fb76f010b058a4158e47042bd00499091c0855363c6e95e5268f928c651d3d6820f3f10a3bc1644a9b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

Filesize
8KB

MD5
eefeb9684ad42a97519561eaa23c702f

SHA1
fccf8bbd266f5f4ad761abd66b18b49c16655632

SHA256
bf208673fed5600fdaadbc5091bab352160688099d260b3ba67dcac67cb0aa38

SHA512
1dc630193dda4e57d9d42fdb4d1890e0a42c2806583cbd203e5affa2c3d41bf7622a04d64242942085dcce37a76117c7e5c64ec206dc3c264f3ab0fe057532a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

Filesize
12KB

MD5
d394cbe9f42aa731f1c5ce154269b69a

SHA1
195b1aa375ce7c99ea9943c4fd469c0c7eb60bdb

SHA256
6889eb17ed6601114d34e42b440186687ed34bce22640a16a501657079ac839c

SHA512
f2dddf25431d49897463754b87784e01d6d3597b6401f5946d0b9e52fbaf32f7d51c3a25419509795b89fab44c16900316ee4ef979473d0cf6f762f5c6dded95

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
57685cea1961e640c0c1fe3971a0742d

SHA1
a35dc70535af07afd0e9836f00c74c1271d5f7b0

SHA256
826f7447db71fef5102091f39074d240b69d0b1bbb7926eb1d635a1bf4ff4fc7

SHA512
a70c5d4abf85bf45658d64f1c97d395f7891081a111770cfea0bb9a83150662eaf6df7ef8f845dba8bc494a250e8520d6cfffec2479e970f25e22686846943d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
f8c37a5811bbe21a71063b4bcf26cc8d

SHA1
46c6f91fb10675c1e75592509a60481e8e64f4d7

SHA256
ca58cac7cf8a695bf2cff886367d3656ef1f30dfe2420591edbd37131ed4449d

SHA512
c403986f31411059912fce650fbb0889bc4012399a9b5c17e1a32546cef6bf25f71bf616d6d97637aca32ea767297b9f023fe5b0979643d597772ee3cc348f42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
73KB

MD5
1d2d929da1bfc91b1aa17c6d65f82b97

SHA1
4d295316c8310d235955c76939e2ffa6757e3d55

SHA256
5003ad122777c782251e5d23ae7bb701d9cfffca05e02296bd2b8f4ef61d59f2

SHA512
5d6498cf9e355fca50ca8c2944fb08a57bb030a6da5c5ac7b7898aec2538f8e55e108a5be9dd166cce8feab2b44edf52a1b60ad6435e44d4ddd5f2c6f369ff75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
11acaa8c79e2f5bc5654b38a31977485

SHA1
331fb82a153e90c1d2f222ae5f7a73f67f626018

SHA256
7bd609c720012e58d9a2679af141c65f009abe09dc8d3af64f3e538660b81e6a

SHA512
189faec3461cb0fe2716896cfddff3adea93cd21ddbe8b8be9b3d702b003938cce2550bc1247f5b27675603976ef96178f8136d6c290285099e76a799cff3579

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\27695d90-9297-4a5d-87e6-c1700d5bf58e

Filesize
671B

MD5
5c2b38f5e4fc73c1312873ae99928bdb

SHA1
2ba7e00259d380905002a9bc247dc022bc0abc09

SHA256
5ed53b2fb574aa9c6c17cd02b72db4fd50db7efb66d59317a503a8067d78799a

SHA512
a451a3b2752936e7eb4bcbd74deaaaa64f609d32825206d56912541ebe943331213db2a988cae3169ddd9f89b9b4351d3727e4758a29a62f9d15b37657fe61d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\2a26019c-4ae9-4c47-8675-29ed54e184e3

Filesize
4KB

MD5
6ee5e60e9bfae59e2ea6faf2db401bfe

SHA1
d5f01fb6e9e4d345f22ad213a0401bf759dc87a9

SHA256
9d5807bf3c4782606be1f598a7337deceb219be8530ae85d03ee1ad403ce927e

SHA512
a06812d8cdfb3088a28c305a10562fb1ac60cd9b9e7e45663eb3e3dac5367044c7a79a6af46b2b0d08481004c788a144076e45a84c072177f5a1b4f7ae05c27b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\6d5050de-aba5-4602-8eb3-9304befaf523

Filesize
982B

MD5
f5c96f00fa551fa6273b0648fdcada5a

SHA1
d7674eb9da6cdf10e8ef6ba75da71b34f13e44dd

SHA256
6a9d45caeec92ff208222e4951de0be4e6e8005ec4c8f9907f20e2622ed5f84a

SHA512
6a1daadfa36f4ed5ea7bcbd74f5f183d758d7acd7229f3b8b210970de0fd32480a0c83f93d4993d957b8863d7ac74fd3adf1247dd9dfca3d1c04ea372916eaf3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\d448aa74-9768-4afa-b6f5-c89841266edf

Filesize
26KB

MD5
3a3dcc24f08c2531e47d3dab20b1ce5c

SHA1
0ad255d5a967dd9ed449c4f7304b6af53c487a2c

SHA256
274fcb211190d22d3cb1f5b68951c674f91cbb3bcd4b4f484b2a92375aefa093

SHA512
b9d4b38c5bd7f16a5e6ac09d6637a154c38b1f3c49e0fbf5351c953287b1aa4ae51a0ff7e639da9abecd31261fa72fad43f47010934c2a4629003e7b223d6509

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\df4cb21e-2df5-4759-9fda-753764f4c8ca

Filesize
847B

MD5
893dd49b7dfd219d33720eab93b0233b

SHA1
47c035181b9efb045259363e915f0d621469b7c2

SHA256
37270fb95bcef08205463a97d7ccc96d5ea55dc7f55fb1f2c5f08dc540571e0b

SHA512
cbbc9ba6c9829c7c79248efc3e61fd1ffc3cd47fcf84348f929667edcf99cad9ae56bcb0ff41e61469237220821694e4e4470f82bd2d506026316c33e305aa6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

Filesize
13KB

MD5
88445139e6438d6f8fd21d772d16c674

SHA1
2ec817efb19ee0d20c67f45a345643ef81184e46

SHA256
2ef85c5e3c3eb16857bac0177bd68ef536af939cd1973d551058067d1b22b36b

SHA512
91b340d587c02190ef491e67305c89a3ed5d99a2e10e14c17b824f5e0eb46df3b274768b1bbb2c3799aa0e524a65cc917492bb3f92b68486b8cb0cb406012f45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

Filesize
11KB

MD5
e46613766250e383edb99f75e6ecb7e8

SHA1
f18c696f2835637b7e00509193c983dea5f94046

SHA256
9bd3ec76a1afa8b7d9119964ba5f4a50787f29cfea736f7ef023bb4baedb97c9

SHA512
1a515d2b1b4fa8c3a77111d4419ac877ce6d56f5e9a787b3c7c16bdcb79726ada544649bc0260a4013a6b9800a5c225550488994d5a4e10627f9825802814f71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

Filesize
12KB

MD5
cc7ff151b598c400006bcbc91250a657

SHA1
3a105163d43f4e533fa05a3047110f6a21e8d8d2

SHA256
d8271431f96f9dccb22bdf580fc93ec7f65cacbc5b2d22eb34a9d71474489e24

SHA512
53f227735599a898f3c8a9c632a83908e46616b702a79c7d0b5ec4535d333d3baa9271277d57bbb65251c18ce4f80f3083484bb83216c8976d2168d86a55d119

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

Filesize
10KB

MD5
9af30f627a468e18849f6145d7137c96

SHA1
771174afb7ac46a2ecc0ca5e84678d7f5622e8a8

SHA256
6f853592ece0737771d9a2b2a19680d958c38a44d9a799ec08d4ba86a3eba980

SHA512
b56519bcab6adacaddcc526f8c46e8f90d624be60bf68cebad71b9259395d165293100fd1e1b8ca4a10a4d20190845568d64d4247ad97e60dd87f5f7538088bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
09c19e6084ac7d058e940062c9e02e7f

SHA1
7fea377853233710b879cd893d31f62f981eb069

SHA256
b3e99538d35edaea49642b3dd590104cebea6250c50c62653f1ea3bf8e512ce8

SHA512
98f8e43dfb5d4f65867f9a8906dda45d45732be296a9977676b74635f715d76b0e7d15753d87ac1724223d35ccf805c8f08b0e121c2a9c878ad7b4d2325563be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
0e709aeb8ab2d0c4338380f7cd1a88de

SHA1
edf93184f619f15bbf6c511d9054e73ee3201500

SHA256
3b56468993c8bbb6c1fb03b87537567deb321f1a943851d0145af6fd7591e262

SHA512
8520618a8cca126ac5adc4c975f28a146d0acc71b5f965bc51ab756d70e57baddfc6ad276a92fc77ffaa3d5e9ae8b31082aca08718800547044a29f344cabf04

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
33171a3b11a7f3896df59df5ae2d6ff6

SHA1
e5e12a7bf98f1149849045108980dcff2b5d4008

SHA256
91d930db5f5448b2c64e1ae0719961fb997fc75660e6e5dfe04a7d7c0c5edebd

SHA512
292864a89939d352c3d379a760e14eda15ef474edc41092b45bf75c43449b5d5215a010793ac1d0dd2d19f4d5d6c4b6cec64a3fd198eaec08a324a2364933c2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
e394fadf7570f09bc470d4bff461ec39

SHA1
3c219416038107714a85ba13ceb379eb4de6a551

SHA256
4154681f51d284cd50b5b6324f72be43df643670d057719c84557303d38d7ab0

SHA512
ca7f1fc937e79c5548237a4f01e313ebd95a0b76d86c145d0e42993e40623bc258e64b5d455e2f83e07489bf567b4d04176472dff687ad430e1996dabe513a3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
0d8a63055c2970aaa11ab902eed101d6

SHA1
faafb067f492cbab580e2197724a676b726a79b5

SHA256
bc5e1a0267fa9bba2fe7473dca5b5ea6e3713947818262c9deb6e654fd4c90b4

SHA512
fb6cbc16f8e4ab54ab8428c57ad6affb9d18afadadab972384efd63c3ca5aaf4a4d7a07a01e74f40858bfc281955007b6bfa88e5b91558685a0d51b39887eb31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
4bb39295ee547b1291185526863ab883

SHA1
81e227e2d677887bbd195bcdd3a8e2e45cd2c700

SHA256
c87bb09af0daa27fff62a6bdf2fbf488ee2bd4badf48597285e2213e69227dfe

SHA512
ee33ae0f6914bcb0ccc2c014c72a6008ac660aafe6133039a493866ad1ef1d7c13ac211d21738534bad01bfacbb0abde6aaa48bc41ecc9b2f199773f03cc64e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
427c431e4bbccfc8e13b7f4dd15dc950

SHA1
54987988f17e9afe9fb09358af0808de8d6749a3

SHA256
acf76d7463038307a8c201abc1a149c69f4b2aa14193923e11e3985b358c7fd1

SHA512
ed11f57e04bd4430bef1551f66b8f32e3f98bc8d962a65dedde95c389619f5e2ce304c80ba0f50f17cb0d117bcc36a3b1b582582931ecabd100c6128a661f56d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
4b5c46209e2af09df86414d4955d9c52

SHA1
62c98e56ca5da3a28c00506457f4d1b7737519a6

SHA256
700aad911f7a29c87e89f034869a1c453517e7209a327335654c0af568d13a17

SHA512
0a6bf149d3ec1af51d35b3cfb9f7171ed9f072b79161da8db80ae96b5aec1767432a545d9b61b7d35e5be8f26202d5ac97e475f7fc0148af78dece35d2a8e0dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
39777e53a2727afa31e0bf265e8e0313

SHA1
3441efabd1980659f9ee33cd254b7e96444d0658

SHA256
59293194ff2f1cd4fc67634eabe8baaa7b11e568f5ddab01d72dcfd23503f51a

SHA512
3c9b0cfd6102980f58168c9d7af238cacd63b83aeccf8d4c2484c1530602df39811045327f9248449b43b0062e9036af0edb1b3b81ddf0fe57b89603538997d0

Download Submit
C:\Users\Admin\Downloads\109927ded1c6f8ce79192bc804efab8f52e6924d16476236eef82a1631349d91.GQZZA60o.zip.part

Filesize
1.2MB

MD5
77b59807f023856af6c7a4c7478095c2

SHA1
9502ab0ed777c47e395d938f15f58038a6a7d443

SHA256
bf154a839606fe05011d1758f0c6cd036308d072d052992ad523b989e02b251c

SHA512
e7cc3a535d7d689e1894ae0c5bceccac956681ff3b338d26ce8a048d92b3b6d9f03923036c41695809ebab32c84b8996f6a8651d4f7e787835af62ffc154b687

Download Submit