hxxps://www[.]google[.]com[.]kw[//][//]url?q=querynfvt(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal[.]com[.]br%2fyoya%2fjuhoog2daaxrq1qtjroxbilw7a6pzeymmebug/ZnJhbmNlc2NvLmJ1cmJlbGxvQHdtZnRzLmNvbQ==$?

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com.kw////url?q=querynfvt(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fjuhoog2daaxrq1qtjroxbilw7a6pzeymmebug/ZnJhbmNlc2NvLmJ1cmJlbGxvQHdtZnRzLmNvbQ==$?

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
3680	msedge.exe
3680	msedge.exe
5628	identity_helper.exe
5628	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	firefox.exe
Token: SeDebugPrivilege	3588	firefox.exe
Token: SeDebugPrivilege	3588	firefox.exe
Token: SeDebugPrivilege	3588	firefox.exe
Token: SeDebugPrivilege	3588	firefox.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3588	firefox.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3588	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 2528 wrote to memory of 3588	2528	firefox.exe	82
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 712	3588	firefox.exe	83
PID 3588 wrote to memory of 4420	3588	firefox.exe	84
PID 3588 wrote to memory of 4420	3588	firefox.exe	84
PID 3588 wrote to memory of 4420	3588	firefox.exe	84
PID 3588 wrote to memory of 4420	3588	firefox.exe	84
PID 3588 wrote to memory of 4420	3588	firefox.exe	84
PID 3588 wrote to memory of 4420	3588	firefox.exe	84
PID 3588 wrote to memory of 4420	3588	firefox.exe	84
PID 3588 wrote to memory of 4420	3588	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.google.com.kw////url?q=querynfvt(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fjuhoog2daaxrq1qtjroxbilw7a6pzeymmebug/ZnJhbmNlc2NvLmJ1cmJlbGxvQHdtZnRzLmNvbQ==$?"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.google.com.kw////url?q=querynfvt(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fjuhoog2daaxrq1qtjroxbilw7a6pzeymmebug/ZnJhbmNlc2NvLmJ1cmJlbGxvQHdtZnRzLmNvbQ==$?
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6eb9364-4175-4756-9ec6-ccb50d0aa33f} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" gpu
    3⤵
    PID:712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2464 -prefMapHandle 2460 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a7ec152-733a-4d06-befa-5822f8390236} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" socket
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3328 -childID 1 -isForBrowser -prefsHandle 3316 -prefMapHandle 3324 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34a456cc-e08a-4eb7-b441-dad216995eff} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" tab
    3⤵
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3808 -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3800 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01eb742c-9af8-4e48-aaa2-591a5e010434} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" tab
    3⤵
    PID:4848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4524 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4740 -prefMapHandle 4736 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9463eb41-a58c-4663-969b-53c401899096} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" utility
    3⤵
    - Checks processor information in registry
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5336 -childID 3 -isForBrowser -prefsHandle 5364 -prefMapHandle 5360 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9160fb67-683a-41ff-af8f-55722710ab37} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" tab
    3⤵
    PID:928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 4 -isForBrowser -prefsHandle 5392 -prefMapHandle 5336 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcdd5753-a62a-4c6b-8936-071247f7b2c2} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" tab
    3⤵
    PID:1532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 5 -isForBrowser -prefsHandle 5716 -prefMapHandle 5720 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f05f9a8-170b-40bc-a068-e116530bface} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" tab
    3⤵
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1288 -childID 6 -isForBrowser -prefsHandle 3336 -prefMapHandle 2952 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64541206-e280-413b-b46b-9fe81dd64c7b} 3588 "\\.\pipe\gecko-crash-server-pipe.3588" tab
    3⤵
    PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xdc,0x128,0x7ffee6d646f8,0x7ffee6d64708,0x7ffee6d64718
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12090269189557349515,7492510738895734934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
41KB

MD5
503766d5e5838b4fcadf8c3f72e43605

SHA1
6c8b2fa17150d77929b7dc183d8363f12ff81f59

SHA256
c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

SHA512
5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
09052012addae158dddcad0136c364d0

SHA1
370f58fae08ebe28cf6324498cc4203ade2fc9a2

SHA256
495200d80fefcf23661980a870b2cc935b36e7850b1a5e01f1e7803fc708c691

SHA512
2a4d9d2692303efe333f4e528d6d9654b96adfb38197792b59eab2aa7fd7a3b084a1e7dc028dc31ba7cfdb94c8be85727f484b68fb543d6266da8e6b96a422af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c7228af4b9a3ecb274ce3e0da5cf50f

SHA1
0294ff20d165152bc9cb5dd3347c4016f0a08382

SHA256
688861170125e6a28ea9c810f1d09df4d48d191bd3037e9c99007a3feb850ab3

SHA512
b14228e0645dd0fc801c4f0d20fceb2fbe52d53e9cb8e5e41baad3336f6b7b7f3512b05f8f306f9eaf7a503d23b39cb5bddf88e40d1e38b283660fd651879e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eeccf5daf4b84f38e480baf1a28a31fa

SHA1
4921184e9789771d1552d836c08d8ec67ae2bd0f

SHA256
4252e1c5ea95babc285c896c017eb6c24547d6f34bb6c22e726d156e8494fb04

SHA512
2a8c89bca0ac75dd7fb53c596eaaf4b3a072d160f68adcc377aee092b378df150a896c314149fd758ab1f36b299a017a8d400c11e7c3c1d22435a43c55a3a0de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b462f0a1c8317fdb7551f0c53e54cfdd

SHA1
661756cba62b79d4dd27847b34a44f10cffeae29

SHA256
4583093686f15af139dedc4af2ce5dfae054e5a964c616fc5746ceaebb713a95

SHA512
e05564230a7f22e970004a4f7cdd9aa91eca7a4a83e24b8b010d7506d51bee6a231e415bebfacd218a72ce732b5cdf7bf37ab7138569b3b258c2551898ee08e6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
2a079ba99969bfbf4c3d338d609b996f

SHA1
a59df23a6f40f83f3f3bb62bae62511135632b81

SHA256
ee529dbbfe4d26d7de30c1bd78a19712363cc8f9d5f0729502b40106032a9bab

SHA512
75b5698246a2ae8c4be558ac7ea85d811be74981cf04541269aa4cd33f0f5d7a0038df374c986cb6cd1f200646ed51185b324409358e1e7d5571fe587b6852c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\2DAFED1FFA4D7E6A0CA81A21A9783F5E75F52F0A

Filesize
61KB

MD5
cfca973c10c653d72badf32b8148ece0

SHA1
523ae4c6f7747621eedc02f6f19c7355de4a9966

SHA256
ac5e43ead244d12ee0f4f43179c6e81a4fd1d73d4eb0afaccb8d63806b08887e

SHA512
90a3e0a5fcebdad7bc0d7a170d0db942862aa83a04913a9be3cd8b35d639739bc2bfb2c32bb62a90be050e38fbffe730f39b5de2441e69748fe846c7715dfbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
6KB

MD5
fcaabc85703ac1b891ee0fec603646f4

SHA1
466520e8a83a3798c6f18a38ebe46f55fc1849a9

SHA256
74e98b7c189707df55defea24660a03ee44e7a72f09e805504779ad01bad5d5c

SHA512
ce55cb816ff177d19f8a2816864383efa0ba6ad7be97d66feeab55ac315d604fe77d0bd4abf05f2c3486d5e2698141b2aacff21562d8e2a839b258e46cb3e943

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
7KB

MD5
e91506bf20825fed6d8331f3466e3777

SHA1
39604df51067a0cd3e467b767d6af244370d41b1

SHA256
656917deb56370e3031427c2c22214fc6c17429a038ad15dd4ae8c8089818d2d

SHA512
339e9fdab69bbbd30198f378dd341a081c8fd994dc07fc0166f8b677e7c73e27910f4377f459df76d032f319791012e591a27525bbf234f94f0a270a3e02a591

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
10KB

MD5
cb278f82b8ac06ef015e92bfdebdbbc7

SHA1
e4792c1f3fc78da40fedd3ef507739e2e4b0e1e8

SHA256
a58a579d4e3a383420d28e688f12239ba71e363d62e1c3f80ed758654fca878c

SHA512
d57ecfd0be8386c7f1703565d7fbc3014b1b47f4bfd61631963c64f9693b43365186cd33124a0144bb9d55b80667390a614f9668957709577e2d45025d4d4e6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
13KB

MD5
451603cacb8fca4788b301040209fec2

SHA1
2784822a18ab108d280572071361bc00c515c9f0

SHA256
b5069a13b99314f465506c59ac16ee748a30b58f7b5e7c2560709666f8250735

SHA512
9273cbabb1ccd5179b5d6e31dcaf454a23249e6ed3c818647ad551ca4e7f9d371fc7b14d5c782b998aad87cdb0025d6cb4afbfa4770056bd428f0accf7382a14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
c47265a3fa70324bcd23e6fa0572a5a0

SHA1
419ea6cf61969590a3ecd8172ca2e0396b613cde

SHA256
3e1b39dd8525c8c9c7b510f398b94d612ca7018de63652060262b5864a4cda7c

SHA512
5045e5dc789fb5d0be8ea8e4a4b4ea160a27c51c2a5adbb7ab3ff569bdf1473a2783da8a8e82cfd5a31ccc3f7982ac037c80a98795a81b8cc9d3e42f16ea456e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
4fa3cc8885d3859548c3f0f9be22cfab

SHA1
ff4cb8ab7e24661cf0ead59c34935352d11fc999

SHA256
5746c76fe7059223ba0ac7a13782478565b88c1109e67f3292ee711b88eff737

SHA512
fab687694fdafa589714a2ef3c8e5433eec1d6abb54c7a3c5993c5ed2bb358539c0ce32a4b0eff6c4192b4419a44d641776d32275bc92ce404e0d86570661989

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
68e6b8a8a8a5866d5dbdcc74068974cf

SHA1
832c3883d48ff37b878a2a1edd18a7c104d15335

SHA256
7291709129b03013cae77035cb56f67fa0fde0d07c8d888937145f32d53be43f

SHA512
b58f6fae61a81cf4c265220204ea28708e0a856f1a415cbe0a97cc6b7a7eb605d36d1653af2e01065d6ff37d738e590dfbb36e4b4a934a22c81f7b3a8849efda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
233633d1f90d254aa944ecf2d1d2746b

SHA1
20a038a000ddded6f76aee3eedd0a27e240bbed9

SHA256
053fea7cbad19ee3377495ad28de30d92a34e62f7a6500c41963dd8270606be1

SHA512
5e27f38f742f0ccc1c38e8d3c3e0e2c645bcf97ce97f0df2a0da96fd2ce59b9a93384b58142560c5f3d6b1ee48c1def4b85275ae2f06ca40ac466bbfde046e43

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\4fb5f12b-79c9-446e-9944-791a5cf18ad6

Filesize
982B

MD5
3b3adff2dc6615faf97000d34ea328bf

SHA1
b82894cf3b0ac8384386339719d52aeccc328fbe

SHA256
13ac53229d1888de3ef7ed8b1292c6156763da362153cc6b9028d136da78c0dd

SHA512
faaa43604828477e31eb299b6239eef44185284485af6b524696119c4dba9d7709e92a2aaba9a2a340cb6d0237040e96aede4fd9b4c663c1de7f4927da0cc04a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\c4a2c65c-b289-4665-87eb-337c93da76d1

Filesize
29KB

MD5
c4a3f13c737cb8969bb66bef175f9c7d

SHA1
7ce4148d14b31e0b5017782db4162ce9a8e8311b

SHA256
a43125e3ed4514bcbde2029ad829b2503ff6f5527d96a69aefa78526b78ff414

SHA512
b494334a5b4293a9a30962b3264a04fccd0acedfc41a8c427cdb70662617f50c1be523517a97fe7b1e3c10961b61c7833215ce997456abf008a783ed101a6da4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\d443f732-c35c-4c87-917e-1d5dad7ab384

Filesize
671B

MD5
f182e1f03faaf287c626cef13ebf3bae

SHA1
e1d1e43d4e8c7723f5d51823f968c409c230c7b6

SHA256
bae3052a3717f5564de2fd60a0d69b24a228b9ef9ae8bd7aba4c8902c6b680be

SHA512
25f5457546b46181e86b9deacc413c772d94c743bdea8666e0ce692633b72d62a1d9f4558e6e30b925ca0535d20c57967a6c382664b016a551548b2876d92d51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
11KB

MD5
d532b06039dd7d7c9e6f849bb3857e7e

SHA1
f095de7110778ed72d03c653d59c21362277edb7

SHA256
4bb6d9a3abc69d8c7d15a5d3d3a806702a39b295fa1d79bc442d77a535f1c4de

SHA512
69d71e979d84f5e5eefc7128c3da9b633076cf45a693501bf4bc84ff352690606736f4c9b1283b3ef621b7db58ba96ff1662ce1742bea08d1657738d276c77e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
9def9418fc7f9953d76eb26eb1e15cd6

SHA1
d4cfb55815d50ad2c9c41e8533334c9b6a311931

SHA256
59a903eab6a8c9e0a7799f1154926b4ffa48cb05afec949d979e8902d8bae1d1

SHA512
84a76e031f85c8ffd7dd54ed4b0f093ce19c26bbf2d45a9caf9447c52dab996cdea47a3ff5e853cba75dc6c91dda2e17d9026ef5fb57c296896342e46385ab2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
c3b7b2dac7edcffbba8946f229cc4d98

SHA1
e54fc28449f9f90eb6d70225cd7aa3eb30e7ad51

SHA256
dd73f60bc9548ec79d6a74b9f65936c33902645672b950ee2ba56de6531fd732

SHA512
dd0d6e54ff77718ddea48f25f0476da28ffadfdb3d6be9754403f7c1da0c36d0310fd073f01d6edfe6813af3bfd2879f1612cc61387f2150eb48e8d701eb7bbd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
900f9139d8374a59cfb9fd260bfbb8ef

SHA1
46ace15bb7ba81515da8d0066722bf65c4f4e207

SHA256
446c468bbd3e849c4c44edd5df8925efe1b3167c05d3e5adcd3e2ac7b85d61be

SHA512
e24596f2983ceb721591e2f682fa8c2903063f5c000911ff0ae410915ad594ccebe1c32933e518753234105a3926ff941584c3167dbce07481a0a62e601a8d1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
5369a34aba3c4ce78bb7518a82543263

SHA1
fb38f52e47d4b703e98fc2435d37747d494c4bc1

SHA256
7999ba42972f41b67ac5069f611397b8d473344428bb0996cde4dbc5245f9c9b

SHA512
813f0541180f1a1766a0ae5badfc7a46833da2ef18d238895befcf7bdb6819fbdd6e99f5c866806874995d5adc0f6c7a6f74cf67cabfae37b0d2d1ff42aaf9e4

Download Submit