1859522309d457864f8806408aa2291861952bf6f134fb3d7aa91e6582190250

Resubmissions

19-11-2024 07:19

241119-h5yv5awrck 8

19-11-2024 07:16

241119-h31xpswrar 3

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19-11-2024 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

buzzingrevoluti.txt
Size

3KB
MD5

defaf4044c88c2a5e1306136de20f900
SHA1

90734c3c8c83be4715ea845f47187fa4ea20ce2d
SHA256

1859522309d457864f8806408aa2291861952bf6f134fb3d7aa91e6582190250
SHA512

c6a84c67a531f188c67ee4ee85779f3cefff8a8199eea7263a0d739ebe931f17af0809e4dbe665e524f68055eabeb0f50e03a6cf349a793e24f1c43cdfcab021

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 64 IoCs

Processes:

firefox.exeNOTEPAD.EXEcmd.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Key created	\Registry\User\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\NotificationData	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1732 NOTEPAD.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

NOTEPAD.EXE

pid process

1732 NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

firefox.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: SeDebugPrivilege	132	firefox.exe
Token: 33	3772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3772	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

firefox.exe

pid	process
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

NOTEPAD.EXEfirefox.exe

pid	process
1732	NOTEPAD.EXE
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe
132	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3612 wrote to memory of 1732	3612	cmd.exe	NOTEPAD.EXE
PID 3612 wrote to memory of 1732	3612	cmd.exe	NOTEPAD.EXE
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 916 wrote to memory of 132	916	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 3504	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 2464	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 2464	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 2464	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 2464	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 2464	132	firefox.exe	firefox.exe
PID 132 wrote to memory of 2464	132	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\buzzingrevoluti.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\buzzingrevoluti.txt
  2⤵
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1884 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5fb3158-4024-4b71-b7fe-11a465326e21} 132 "\\.\pipe\gecko-crash-server-pipe.132" gpu
    3⤵
    PID:3504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2344 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5264062-7d65-4fcc-bd01-04ae7a1c692b} 132 "\\.\pipe\gecko-crash-server-pipe.132" socket
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1484 -childID 1 -isForBrowser -prefsHandle 1428 -prefMapHandle 2952 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3503d4c1-4c37-4b41-9fd6-a821224ee1e3} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2668 -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 3592 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d0c7076-7ea3-4679-8f78-a5b32412944a} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4608 -prefMapHandle 4636 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {320639ce-7779-4f50-9fdd-b713a001c6b0} 132 "\\.\pipe\gecko-crash-server-pipe.132" utility
    3⤵
    - Checks processor information in registry
    PID:1028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5332 -childID 3 -isForBrowser -prefsHandle 5380 -prefMapHandle 5356 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89889141-7d96-4826-bd89-0e9bf7e76fce} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 4 -isForBrowser -prefsHandle 5612 -prefMapHandle 5616 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28d70082-6a07-48d9-9cdb-745d9e6fed2f} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:2112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5792 -childID 5 -isForBrowser -prefsHandle 5872 -prefMapHandle 5868 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3a3ea7b-413c-4225-9e23-f8a057026ffa} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6148 -childID 6 -isForBrowser -prefsHandle 6136 -prefMapHandle 6100 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ad77f38-814e-460a-88ee-c828b284ae50} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6332 -childID 7 -isForBrowser -prefsHandle 6344 -prefMapHandle 5272 -prefsLen 27919 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4416233-12dc-4e48-8119-613c4b787f33} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:3024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6508 -childID 8 -isForBrowser -prefsHandle 5656 -prefMapHandle 5648 -prefsLen 28103 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7b71d9a-32b6-4b68-8ce5-dcec433d2c84} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:1488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7012 -childID 9 -isForBrowser -prefsHandle 8256 -prefMapHandle 5976 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88263c22-2c9b-45a9-ae22-a41bc4a515d9} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:4756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8324 -childID 10 -isForBrowser -prefsHandle 8380 -prefMapHandle 6948 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {200cedfb-b9b2-4ef0-b627-d963c31d52ec} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8660 -parentBuildID 20240401114208 -prefsHandle 8648 -prefMapHandle 6676 -prefsLen 30972 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88e6bc32-2d51-4cde-b56a-5e7f96dbd6e7} 132 "\\.\pipe\gecko-crash-server-pipe.132" rdd
    3⤵
    PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8544 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 8676 -prefMapHandle 8672 -prefsLen 30972 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a7151c9-4830-4874-8f83-7390b8bd1af8} 132 "\\.\pipe\gecko-crash-server-pipe.132" utility
    3⤵
    - Checks processor information in registry
    PID:4132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8844 -childID 11 -isForBrowser -prefsHandle 7092 -prefMapHandle 8852 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14d7b62e-bbff-4faf-81fc-8b3c4f2ce6a6} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9156 -childID 12 -isForBrowser -prefsHandle 9132 -prefMapHandle 8364 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3aa33fe-3b82-4ab3-982f-1a969b80035c} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9452 -childID 13 -isForBrowser -prefsHandle 9444 -prefMapHandle 9380 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c3ec883-b0a6-4324-91b9-a59bd3a0686a} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:5784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6660 -childID 14 -isForBrowser -prefsHandle 6412 -prefMapHandle 3332 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba5aa45c-d71b-44b6-870b-b8767eda8f08} 132 "\\.\pipe\gecko-crash-server-pipe.132" tab
    3⤵
    PID:6120

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\er3umqpr.default-release\activity-stream.discovery_stream.json

Filesize
26KB

MD5
cf5d089833e631fafdfbdc684c9e268c

SHA1
921ea201777630f1d42b161597ea368081fbe4c0

SHA256
eaa5cbd294a1449544d946dc566f1d2b744e6cb6ce4b7f0edeb86f934d09fb6e

SHA512
69ddafade2da01c99dc2b6f9a70e1794a80ac3666f3960fbce01e67ca027aa448bddc59b3b88565c072ebe3d6c06d12ef549840748776b344a0bfb36f05f877f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp-mmy.xpi

Filesize
246KB

MD5
684257b2a46611b9f5ad4f5e61f4864e

SHA1
7cb883275e0f3c34708126e6863ccdd3c4dc4ffa

SHA256
b826e443438c880b3998e42e099d0e1949ff51489c788b50193b92ef80426c6e

SHA512
7d855b96ba79424a591d6ef802f118b3fab50bbc402de6534bc821bb1364a0dde24e9bf8d80702dd1d69b9b99972cc501420b9ef7dcadf28ef5e6a8aedf77e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\AlternateServices.bin

Filesize
8KB

MD5
5811527c4c7879d7b7a2976ba1f6c650

SHA1
cc6e63cb3cd8c33f38cfc425e84edebbb9c3732e

SHA256
3c58613b9e54563f097a118977f231700056b83978ef44aa6277750bc28ed4c2

SHA512
8759116e785c75249d76fbda99a8659878500f40deb7ddef897f9edfca379649773c141dad51fc2e02c25fa404b6ecef28e869cce6a791cd9308f6683d843358

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\AlternateServices.bin

Filesize
12KB

MD5
d8a4b7e18b5f1723f26cce92b1c65715

SHA1
547440cabbbf85821c24165206208983c2263e43

SHA256
bd5df301d6fe102d708a0e330bd6d2e22b74404322bbf1b40d05c6e8aa3ad4b8

SHA512
44462cad33ee91ab6af0bfc28bebf6f4f7a9fee63133aa654dc4e0edbb53874fa4211ce3e08529bb8014396ade5ccb77c2a64f9c24cdffe023d8949f8ee23688

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
1f320b912172df110ea523584d1dce4f

SHA1
02913ba1da16ef7a5b2b5b38fb748ab038016455

SHA256
3fbf6282999d2f19c602893a9c15ea4b29bdd81de70ba6265df208a1e1c0faa4

SHA512
f0a1db857d40a9b457f4ae83d3e73bc8acfa0e0ad8e0ae6833bf5bdc1a3b97f1d7d0f4dc3b9beb0a7046307ef53fb75631a73b8f13bbaf4c1c05ebfc2fc12d2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
73a876c4d63e456a51bd9a80445fbe67

SHA1
c1b827e8db5d7f6e2b1c18d1c4e4e74a77eebdda

SHA256
b3ef8e70d5df661e03a9313b8b3bcb861c10936a45673f86d47ab25fe7b606dd

SHA512
3d455fd88d031039b438f299ff5b2adc8f8a3e4ef16086b7058e8258b113b3f5db912fc815b48a708bef39b854d624aa9299bc1eb466d1ed678410e13949951e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
bb7127c0450366374b03036b497fcf4d

SHA1
f64d901d8b29d05ea96b330ccfac57aeb7c74be2

SHA256
413427e48ac3cad273930010164350048ce8b25efc0b1e0857c097fe1107e222

SHA512
e56c8dd3af18ac3bd9d0fef3b1bc6665580547acd5c11ca961011a062b8db6d6c46cdcb496303b20fa085ba6ed8297769aa133da5411f172c0db63c679a55faf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
33KB

MD5
6d5ac825d1ec9bb17456f1621bd43864

SHA1
3089c8d1e60f2eda01d7d10f6d1e7173368c0bff

SHA256
4c3d7962a26b426d7841d7f6278883d2f33248f4b594773b6fb5a7c0f16c7a42

SHA512
cdeb6c765d6f6cf8447a0d49defb80bc8c9535a15733d2fa04940a5b0956abb9e87ceb79d24c0db23fe14fadcdab6103e224037dd97100d16828be4c279e6db8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\datareporting\glean\pending_pings\04ef6141-ee3e-4fe5-949c-920dc8ce4199

Filesize
982B

MD5
56ad906baede3e6ad55f1da0db805adb

SHA1
5cf010f5629c78e0932cc65cf858a5d961019eec

SHA256
41b33f3dd03b0899eaeb3bbcf9c13c6ec19735467ee04e18804c064ca5a65175

SHA512
59ba8f0dc8f6335f076c5f61342c5c213adbf490414bd84c69d44bef0e41c3d011125369cca59065bee02223468961fd32a0871316c68b99ff503bb2cceab016

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\datareporting\glean\pending_pings\4e97958e-3f63-4357-b5fd-5599dfeeda78

Filesize
671B

MD5
0cfdb50c7dc08a2bb90d7762f8b73b64

SHA1
0c6a6a268892a83373fe0f683cbd079ae03498d8

SHA256
200b47dd08e03f12cdc12417ac4760df1e3957fc1db2717a79f6cf53f0632b06

SHA512
2dff220fd7fff5e264269a6802117814513a701ba6bf5f28c10435fd58d75433874e43990cae57c7643175c9cb743b7072f191a65a5dc8b968a590bf0cce6236

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\datareporting\glean\pending_pings\d2cd8a26-2912-414d-8200-cc566f0f2c13

Filesize
25KB

MD5
78edf25f8c998335538fa04ac2e9bd6d

SHA1
f2b0608819cbbe8ea03f06df89ea808a2f32aff2

SHA256
21c6e684e311d53815a2f42e0eab6763773b74eae329e623f205ce15203d71e0

SHA512
2c8d91a5aeee0892a113b34a41c5cf0fe4435869df1ff1ab0dde6aac809e3740d4259d1e984920242c04170744d3346c642ee80ebc86cc28ec96227d4b965cbd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\extensions.json

Filesize
40KB

MD5
7931b4d64c7d3475833c22854652fb8e

SHA1
c1a6edd435a87fb6b70a40ddbf62550d3afd920d

SHA256
ed8e969bff307ff8f1b58785e73c11585fb968d36d178e268e1832bfe7d7df4a

SHA512
8ff8642b3dc1272928f0decfc5964c884dcfa97d84a490c49a376d98d003d1021ad2d77c0bfe4c5fca3098d80d9390f4bce490ea9a6ed333ca0d6a68fab895ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\prefs-1.js

Filesize
11KB

MD5
d0554b32afd5fe02dbb26e671e27eed4

SHA1
35c622b2043fe0f5aedd5f4b03e9badabc093e7a

SHA256
95f60fb562fce174eb2a011d7ff4629c8e54552666ea0d05c9cb32fb993487fb

SHA512
6f47c6f5262ed7fefea967ff5f001cfe1d5c4f4b29265930ec70191a98bc58999348455fa8b320ec972c878ff1c2e3892f22523ffad53fa14624e5fc1697a7bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\prefs-1.js

Filesize
11KB

MD5
64aed2937c3d12bf1015ca9a4380dcd2

SHA1
3a1808db4d81b6d0c0a4bfe5f9f601b00b7a05c0

SHA256
e01b94201adf0aa661d697b727a8229ed8f5b05266d1b00141766b3c4835bb83

SHA512
b31144b6fe3f5a2c8d7d7658e409fac4a0a2699442a0cbd53d34cf5c237d866ebdb0be8d4243e31f0ef4b26023dfdeb7f5e40be0ca26b8aeb00cafc277f96e1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\prefs.js

Filesize
10KB

MD5
83be6901c4218cb23bab65375b491d85

SHA1
3344455391b70e8c196f3bea938c742f5d5e3597

SHA256
13ea0f63148542eef74096937a848466bb43ece9358b57808799af48f092fe45

SHA512
635cb79fd3b416aea68b60f8c4338572c7c2320f83cf41267fbcc52b6c1e51910a9bdb8f6d926f24aace526a789fb9179f49d94c39ebffbb978df28ffa4ae3a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
a97882e3aaf1361a398dd578d5e6b5fa

SHA1
efd5a00130b9038e98a5343e9f85026fac3ac89b

SHA256
1db84d9d74eafb19f3fc2f83042d2cf8f66effe7d041c0d29c946257bd4d3b79

SHA512
e4121936888be7eb7b798b92e38b4bce45cab3680622ad2950147863ca086de0b6995361b440f891648188c4c6a95631c48fb841243fac0b19daa986ee0a5116

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
0ea9494565239ab8591e9c509c326990

SHA1
c405ae2e5fc8b5148dd6671b40d1829b9e83c7a7

SHA256
035adaa6bac3a834c79182ab210849859637598d55cdcb07c0cddfa57b4a3660

SHA512
467ccb48608b8112c4ac7aa16e996b4487196f9f8aab296a9a722990406dab449d3ea337dcfe5b6f1a054721e04c9e13c691b16a18d2dbd837bab8ae57adab55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
04fa328076bb9989f7cbc27e5a3f35ee

SHA1
ea899eb9559522982e98c2527acd3159829dbe8b

SHA256
562d237b79fd814a70e732904acac7c9940080f6a0654133b304b55dc10b8aad

SHA512
e91a1e63219d75cdebf751631186082438c1732883bb97392c68ca71c73e6b5b3049ae93a03acb0ace0a1f00a5ebd6769c690a3ad32bb8ac55b21c7a70cb1881

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
f9d6c4c7e5ac0fd6bbcfeddf93361fcf

SHA1
92977a5512fb2cedb007732ca0523ba958a71ae6

SHA256
1a4782ba726c4ff3edf91840922c93a785c793ae3db877166fe9ff0fc3b62801

SHA512
ddd267b46943ff01faf639251597b5b13ca478d8bd26bf6815dacede01db07afcecb7b645690952144d7744d68887377346ec672dd41366e047875a2d759e01c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
ee3b9ae4f3fa1355e46d906b63fce196

SHA1
2a0238384fc1a05ac102ef9cc1811c8928bb8a48

SHA256
6de13c9eeeca9fe061d5c332a3b8111ff3f9cf8d56dccf60c68113f35eb615b8

SHA512
75731008d74c1ec73055b5207c5f20677e532bb87c37bada5af33c78c612e38e0c5253b5948b304ac320b73dab1e68d02d7a0c8522bc319f46f2cf4d6e126b49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\storage\default\https+++www.xbox.com\cache\morgue\155\{5467ee8e-38d3-432c-bbaa-4a53db0db39b}.final

Filesize
88B

MD5
6ccc34cb23f218b2e5d5fb8426e50743

SHA1
997830ec19abf60769b5f9446a6c6e4b22a8b8a8

SHA256
f0d8a1a5ebbb99c0698ff696f5bac8d29c66677a003a0e50e4902d1f1e7a0750

SHA512
188aef3dfe81da69c682b5eea5fbe9d4b7d1cb84140820036b8d689a51ceb5849c84e6e5e5d99da87340081f39c135a13a55a472756d93b93588f96995466f56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\storage\default\moz-extension+++fe96ef52-c7b8-49e4-8766-0c38132b9f3c^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite

Filesize
48KB

MD5
3d8941ecd193829440f359ab864fb9eb

SHA1
55185407599f65e595b791a7e53b637cd576b4b0

SHA256
2138512417ec53dbafeb0a7b08db8a7f0dbf780949fbdfcac43b6afa4f1e74d8

SHA512
0fb0595a431b5229fe9c4afed998a98c1321b54f5c2f5ac7b9a8f1902d2b36fb44ca879e7157d9f0d3ea79987ff8bdc5fa415bda7d3bdeee10d072ba2745a006

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er3umqpr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
384KB

MD5
9ee1b93269bf94892086ef58f9d4a7f5

SHA1
d7e1a2749cebdbe4696eda65f161c797e57d204e

SHA256
4f10b2a6bfdad26b529a8a2acd2b6a038f6bae1689e5bb7d058a3dc6cfee1089

SHA512
dde1cf36a326ab4d1ce7deb6e083c3fd915bdbeb7335d5eeb9bfc8ada3897a80b213a83a2378fc519ab4bc842b23a82f3325b2c06b4a4146e0b4cd4e252d76e2

Download Submit
C:\Users\Admin\Downloads\buzzingrevoluti.txt

Filesize
3KB

MD5
defaf4044c88c2a5e1306136de20f900

SHA1
90734c3c8c83be4715ea845f47187fa4ea20ce2d

SHA256
1859522309d457864f8806408aa2291861952bf6f134fb3d7aa91e6582190250

SHA512
c6a84c67a531f188c67ee4ee85779f3cefff8a8199eea7263a0d739ebe931f17af0809e4dbe665e524f68055eabeb0f50e03a6cf349a793e24f1c43cdfcab021

Download Submit