Analysis
- user interaction
yes - max time kernel
598s - max time network
599s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 03:34
General
- Target Firefox Installer.exe
- Size 1.4MB
- Sample261102-d4y3aaex2y
- SHA256 10fad0789a16665af7073fccd7fcb1879aed624312db99f598b80c4f43f565fa
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 44 IoCs
- Loads dropped DLL 64 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 56 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Control Panel 4 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Runs ping.exe 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 12 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\58f509A.tmp\Firefox Installer.exe"C:\Users\Admin\AppData\Local\Temp\58f509A.tmp\Firefox Installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS40281EC8\setup-stub.exe.\setup-stub.exe3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nspF6B0.tmp\download.exe"C:\Users\Admin\AppData\Local\Temp\nspF6B0.tmp\download.exe" /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nspF6B0.tmp\config.ini4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS89D731DB\setup.exe.\setup.exe /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nspF6B0.tmp\config.ini5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies Control Panel
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "4432" "\\.\pipe\gecko-crash-server-pipe.4432" "C:\Users\Admin\AppData\Local\Temp\\" "712" "20261022150525" "724" "768"9⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies Control Panel
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "1276" "\\.\pipe\gecko-crash-server-pipe.1276" "C:\Users\Admin\AppData\Local\Temp\\" "712" "20261022150525" "724" "768"8⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -reset-profile -migration -first-startup4⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -reset-profile -migration -first-startup5⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "760" "\\.\pipe\gecko-crash-server-pipe.760" "C:\Users\Admin\AppData\Local\Temp\\" "712" "20261022150525" "724" "764"6⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 1944:26056 -prefMapHandle 1948:307257 -ipcHandle 1992 -initialChannelId {7de6d431-2721-4540-aaac-2bef85ef1e4d} -parentPid 760 -crashHelperPid 0 -crashHelper 2000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 2200:26056 -prefMapHandle 2204:307257 -ipcHandle 2212 -initialChannelId {832d6709-3fdd-4d6d-a0f4-3d27902b72cb} -parentPid 760 -crashHelperPid 0 -crashHelper 2232 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3008:31783 -prefMapHandle 3012:307257 -jsInitHandle 3056:161360 -parentBuildID 20261022150525 -ipcHandle 3044 -initialChannelId {42c028bc-6efb-4d48-bc52-7fd91680bf79} -parentPid 760 -crashHelperPid 0 -crashHelper 3932 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 2480:32559 -prefMapHandle 3032:307257 -ipcHandle 4112 -initialChannelId {9cf253c6-72c7-4dd9-82a5-36184355a0a4} -parentPid 760 -crashHelperPid 0 -crashHelper 4120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2968:32711 -prefMapHandle 2636:307257 -jsInitHandle 2640:161360 -parentBuildID 20261022150525 -ipcHandle 4072 -initialChannelId {a866fd09-478e-4671-acc3-8a1126e71929} -parentPid 760 -crashHelperPid 0 -crashHelper 3964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -sandboxingKind 0 -prefsHandle 5348:36521 -prefMapHandle 5352:307257 -ipcHandle 4392 -initialChannelId {84e0159d-7ece-4dbf-b0fe-52b9a2f6e229} -parentPid 760 -crashHelperPid 0 -crashHelper 5288 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4032:34740 -prefMapHandle 4036:307257 -jsInitHandle 4020:161360 -parentBuildID 20261022150525 -ipcHandle 5508 -initialChannelId {f1fc193d-ff21-4e1c-96d2-e7677d804809} -parentPid 760 -crashHelperPid 0 -crashHelper 5520 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760:34740 -prefMapHandle 5764:307257 -jsInitHandle 5768:161360 -parentBuildID 20261022150525 -ipcHandle 5776 -initialChannelId {2196e434-73f8-4bf9-a0b2-e12552fa51aa} -parentPid 760 -crashHelperPid 0 -crashHelper 5544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5936:34740 -prefMapHandle 5940:307257 -jsInitHandle 5944:161360 -parentBuildID 20261022150525 -ipcHandle 5952 -initialChannelId {ae361c57-5ee7-4d0f-9b7a-37ff233cb821} -parentPid 760 -crashHelperPid 0 -crashHelper 5960 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --ping-cleanup "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports" C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9u2hpi59.default-release-17935907067516⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c for /l %i in (1,1,60) do (del /f /q "C:\Users\Admin\AppData\Local\Temp\58f509A.tmp\Firefox Installer.exe" 2>nul & ping -n 2 127.0.0.1 >nul & if not exist "C:\Users\Admin\AppData\Local\Temp\58f509A.tmp\Firefox Installer.exe" (rd "C:\Users\Admin\AppData\Local\Temp\58f509A.tmp" 2>nul & exit))2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\AppData\Local\a8c32c\b94749.exe"C:\Users\Admin\AppData\Local\a8c32c\b94749.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c for /l %i in (1,1,60) do (del /f /q "C:\Users\Admin\AppData\Local\a8c32c\b94749.exe" 2>nul & ping -n 2 127.0.0.1 >nul & if not exist "C:\Users\Admin\AppData\Local\a8c32c\b94749.exe" (rd "C:\Users\Admin\AppData\Local\a8c32c" 2>nul & exit))2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault71df6039h5568h4f4eha763h8d0ec52215021⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault71df6039h5568h4f4eha763h8d0ec5221502 --edge-skip-compat-layer-relaunch2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x258,0x7ff87304c188,0x7ff87304c194,0x7ff87304c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,15922920403046852263,3447244559447662077,524288 --field-trial-handle=2680,i,17154314469172314873,17981735511092854363,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2636,i,9372743874248245680,10188758802883980043,2097152 --field-trial-handle=2680,i,17154314469172314873,17981735511092854363,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,818037867755820962,8379609800202327710,262144 --field-trial-handle=2680,i,17154314469172314873,17981735511092854363,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,12797311338533507797,9472348676183425309,524288 --field-trial-handle=2680,i,17154314469172314873,17981735511092854363,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "7280" "\\.\pipe\gecko-crash-server-pipe.7280" "C:\Users\Admin\AppData\Local\Temp\\" "720" "20261022150525" "732" "812"3⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 2076:34957 -prefMapHandle 2080:312490 -ipcHandle 2112 -initialChannelId {8b58d7f7-cf6b-4db0-8351-5cba649c9ddf} -parentPid 7280 -crashHelperPid 0 -crashHelper 2120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 2444:34830 -prefMapHandle 2448:312490 -ipcHandle 2456 -initialChannelId {6a01c414-99c1-46c8-9a73-0e48fc941f3a} -parentPid 7280 -crashHelperPid 0 -crashHelper 2464 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3180:35020 -prefMapHandle 3184:312490 -jsInitHandle 3188:161360 -parentBuildID 20261022150525 -ipcHandle 3196 -initialChannelId {c860e459-01d0-4a04-ac07-209377def52a} -parentPid 7280 -crashHelperPid 0 -crashHelper 3204 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -prefsHandle 3384:35020 -prefMapHandle 3388:312490 -ipcHandle 3496 -initialChannelId {be48e9bc-42f5-44cd-9a8b-75cf0c1a7964} -parentPid 7280 -crashHelperPid 0 -crashHelper 3488 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4364:35364 -prefMapHandle 4368:312490 -jsInitHandle 4372:161360 -parentBuildID 20261022150525 -ipcHandle 1804 -initialChannelId {da9ad083-e11a-4ba8-8fc6-a8da459de917} -parentPid 7280 -crashHelperPid 0 -crashHelper 4376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20261022150525 -sandboxingKind 0 -prefsHandle 5160:52225 -prefMapHandle 5164:312490 -ipcHandle 5172 -initialChannelId {37658292-b51e-4d4f-b489-a02fd7b84d61} -parentPid 7280 -crashHelperPid 0 -crashHelper 5184 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412:49109 -prefMapHandle 5416:312490 -jsInitHandle 5420:161360 -parentBuildID 20261022150525 -ipcHandle 5428 -initialChannelId {951fc2fb-f382-4b88-a46c-46c4e49cdd51} -parentPid 7280 -crashHelperPid 0 -crashHelper 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5412:49234 -prefMapHandle 5628:312490 -jsInitHandle 5640:161360 -parentBuildID 20261022150525 -ipcHandle 5652 -initialChannelId {c99660f1-5305-4aca-ab38-35dcefc286c3} -parentPid 7280 -crashHelperPid 0 -crashHelper 5692 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5672:49234 -prefMapHandle 5676:312490 -jsInitHandle 5680:161360 -parentBuildID 20261022150525 -ipcHandle 5688 -initialChannelId {ae9d23f5-6dc9-463c-b5f0-184dfa343fa5} -parentPid 7280 -crashHelperPid 0 -crashHelper 5896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 828:49368 -prefMapHandle 2660:312490 -jsInitHandle 2664:161360 -parentBuildID 20261022150525 -ipcHandle 5568 -initialChannelId {772db957-d560-4e89-8b2f-c1de976db193} -parentPid 7280 -crashHelperPid 0 -crashHelper 5576 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6452:49368 -prefMapHandle 6456:312490 -jsInitHandle 6360:161360 -parentBuildID 20261022150525 -ipcHandle 6476 -initialChannelId {c13351a6-f608-421f-97d9-9fbdf09609e1} -parentPid 7280 -crashHelperPid 0 -crashHelper 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5348:49368 -prefMapHandle 5568:312490 -jsInitHandle 4984:161360 -parentBuildID 20261022150525 -ipcHandle 5072 -initialChannelId {d9b72179-c27e-46d6-9f21-9c50465a6286} -parentPid 7280 -crashHelperPid 0 -crashHelper 6672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6768:49368 -prefMapHandle 6792:312490 -jsInitHandle 6788:161360 -parentBuildID 20261022150525 -ipcHandle 5940 -initialChannelId {b4385292-3d70-43d0-87e2-2dd569146f7c} -parentPid 7280 -crashHelperPid 0 -crashHelper 6824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7280" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --ping-cleanup "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports" C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9u2hpi59.default-release-17935907067513⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Query Registry
6Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
3Internet Connection Discovery
2System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
AccessibleMarshal.dll
CoreMessagingXP.dll
InstallationDirLayout.dll
Microsoft.InputStateManager.dll
Microsoft.Internal.FrameworkUdk.dll
Microsoft.UI.Composition.OSSupport.dll
Microsoft.UI.Input.dll
Microsoft.UI.Windowing.Core.dll
Microsoft.UI.Windowing.dll
Microsoft.WindowsAppRuntime.Insights.Resource.dll
Microsoft.WindowsAppRuntime.dll
application.ini
PrivateBrowsing_150.png
PrivateBrowsing_70.png
VisualElements_150.png
VisualElements_70.png
blank.pdf
kit.gif
confused_fox.pdf
crashhelper.exe
crashreporter.exe
default-browser-agent.exe
channel-prefs.js
dependentlibs.list
desktop-launcher.exe
dxcompiler.dll
firefox.VisualElementsManifest.xml
firefox.exe
firefox.exe.sig
TwemojiMozilla.ttf
freebl3.dll
gkcodecs.dll
clearkey.dll
clearkey.dll.sig
manifest.json
install.tmp
InstallationDirLayout.dll
lgpllibs.dll
libEGL.dll
libGLESv2.dll
maintenanceservice.exe
maintenanceservice_installer.exe
marshal.dll
mozavcodec.dll
mozavutil.dll
mozglue.dll
mozinference.dll
mozwer.dll
msixcomserver.dll
msvcp140.dll
msvcp140_atomic_wait.dll
nmhproxy.exe
notification-helper.exe
notificationserver.dll
nss3.dll
omni.ja
onnxruntime.dll
pingsender.exe
platform.ini
plugin-container.exe
plugin-container.exe.sig
postSigningData
precomplete
private_browsing.VisualElementsManifest.xml
private_browsing.exe
removed-files
softokn3.dll
helper.exe
shortcuts_log.ini
update-settings.ini
updater.exe
updater.ini
vcruntime140.dll
vcruntime140_1.dll
wmfclearkey.dll
xul.dll.sig
Firefox.lnk
Navegação privativa do Firefox.lnk
~avegação privativa do Firefox.tmp
~irefox.tmp
update-config.json
63af16e8-1dd1-491d-b388-eb6415de69a6.tmp
856db50e-b14b-4a93-bfb6-de0037cbeabb.tmp
settings.dat
settings.dat
2c7efbf8-3134-4e88-8eda-e1a50ec290e3.tmp
59698b72-797e-4195-9948-2f58df1604ae.tmp
9a3103f7-c182-4ff0-ba39-dc0090a66bf9.tmp
d5146d3f-6ce8-4cbe-8264-17b68584b133.tmp
0de31305-5b1e-4cac-92fb-f99789a5d260.tmp
2b9bdbb7-c9b6-4674-9288-36aecc5f4ecd.tmp
bc6dad30-4f14-4248-ba10-77a168c3da4b.tmp
cd919bc0-afc6-4759-a6ce-4e02f926fc79.tmp
activity-stream.contile.json
activity-stream.contile.json
activity-stream.inferred_personalization_feed.json
activity-stream.shortcut_cache.json
activity-stream.shortcut_cache.json
activity-stream.shortcut_cache.json
activity-stream.shortcut_cache.json
activity-stream.weather_feed.json
1016
10695
14197
15363
17927
18517
21978
23048
25261
3514
8021
0DF1910635AC42D0B73BD533B0E353F4D1886CFE
1A73080F0B703B85DF9AFD4BB176D11B32B19D9A
2932D0C1C6583C5CD6463893157FC11DC6DAC903
2BFD8D909EDFC3EF4881456E221F5F7E624683EF
34399D0DC9EEE182D43D28FA59E940A60D2EC5A6
389150E321210B8F44644470F2AFA5D1FD94C172
39176050567F9A715E43223DDB3D5ADCE74BD005
5436C2AFE61FE0D43F6FA87501BF0007DFEAB73A
5E6836E911E6EF4EC48EE4FAF7325AC9C3F084E5
60DE463018278BF2FF2F94550A7B42AA508C9046
6371731148D27272DDBF63029959D82DC610B5BC
645C4E78F98C77EF002EDA79E769566093E65B60
65BDB7F8AFD935743668D5081FA30B2509F10100
674428298D9D82708E897F48B47391D2C393D82D
6B4E3D892E71DE3AE65A5E4CD7C1A7673624CC58
764519617C2C5659AD7AFE6C6E1C980C18038DD8
78932B72B94278961159E3734BA7997049B86464
80147EDF87F948C87FB82CA9B18479CC99164F21
93D7DE13EEF70008A9397CB5DDFFD99FA685FC4B
9A3AEB0E4F757F5AC8487F158B5427500E56D13E
9A3AEB0E4F757F5AC8487F158B5427500E56D13E
9E17C0DE29F0C60E825ACF80AA21CDF640F42741
A4EAFF6248B3FC75425DB653AF511CF8135B6D7B
C56FABCD31A284F49FCF12DAC9FA03DF9AB9FFFB
C5EF654C2E6A832A4A3B2B07EC2C11134F613D10
CBEAEF65C1F53B54B6058E24F04AB2A00F6E0390
D0C6EEF9EDB3FD24A0AA4AFACDFF9858134CFEF0
DE569CD19FC7A26F0DE131A04D7FC51DDDBB1C4D
E0B0E3E88C885B95E1A53200EB7455BB61E30D78
E2E80CBD6FAD2B40FD8A5D1269FF1702BB276BC9
E4BD5FF6EB0682F51D863DA9079CBF09B8A26945
EDB10879D1C2E01C4E818047D59FA5A4DC48C6BE
F8FE944141E4826E1B34A7B0D9B75BAAF30B26A2
FCFC4EB206C124A57717BF516B6D5C0D899698DE
asrouter.ftl
scriptCache-child-current.bin
scriptCache-current.bin
urlCache-current.bin
webext.sc.lz4
Firefox Installer.exe
setup-stub.exe
setup.exe
b013350e-0420-406e-b7c0-a8ec2a12e285.zip
AppAssocReg.dll
CertCheck.dll
CityHash.dll
InetBgDL.dll
System.dll
UAC.dll
UserInfo.dll
WebBrowser.dll
bgstub.jpg
config.ini
installing.html
installing.js
installing_page.css
profile_cleanup.html
profile_cleanup.js
profile_cleanup_page.css
stub_common.css
stub_common.js
AccessControl.dll
ApplicationID.dll
ServicesHelper.dll
ShellLink.dll
components.ini
extensions.ini
liteFirewallW.dll
nsExec.dll
nsJSON.dll
options.ini
options.ini
shortcuts.ini
shortcuts.ini
remote-settings-startup-bundle-
tmp-8tt.xpi
tmpaddon
tmpaddon
b94749.exe
8HG7F8Z4YUFA3JTQ4HH7.temp
EW54NKQ29U9J4CYVGFT7.temp
Y816FV95CMAP452X2NOR.temp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
AlternateServices.bin
AlternateServices.bin
ExperimentStoreData.json
addonStartup.json.lz4
addonStartup.json.lz4
addonStartup.json.lz4
broadcast-listeners.json
broadcast-listeners.json
containers.json
store.json.mozlz4
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
068fe303-c5cc-4d1e-a1bc-00deab0a006a
0b955558-fcf2-45ad-aa43-044454f151ad
1863191c-61fd-4fc1-b0ee-e3329b7d36ee
206c217c-6112-48e3-8683-d904550d9fa4
246dea6d-4509-40c6-a664-4176854037e0
2a501740-2b45-464d-999d-d9494c2a7d66
2e35d38c-602d-4a4a-8826-b49be89fbebd
369b0183-821d-427e-a523-8e623acf6213
50fb8227-aef1-41d6-8774-001e5e92f02a
72d8482c-5eff-4fd2-87e9-0ca2baec0628
7a179784-8fe2-40a9-975c-623ddfc1876d
9c63d1f4-96db-4a39-837e-fb7986ea551b
a32ab474-9729-4223-8acf-45fb3e1dbb5d
ac98e5f2-a3d8-46eb-a99a-c1309961d9d2
d4d6b727-51fa-4c2e-800c-19a8e258e36c
d7fcd605-57bc-417a-8cc1-32ce5673be93
state.json
extension-preferences.json
extensions.json
favicons.sqlite
gmpopenh264.dll
gmpopenh264.info
LICENSE
manifest.json
widevinecdm.dll
widevinecdm.dll.sig
handlers.json
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
search.json.mozlz4
search.json.mozlz4
20261018-0-default.filter.delta
20261018-1-default.filter.delta
20261019-0-default.filter.delta
20261019-1-default.filter.delta
20261020-0-default.filter.delta
20261020-1-default.filter.delta
20261021-0-default.filter.delta
20261021-1-default.filter.delta
20261022-0-default.filter.delta
20261022-1-default.filter.delta
20261023-0-default.filter.delta
20261023-1-default.filter.delta
20261024-0-default.filter.delta
20261024-1-default.filter.delta
20261025-0-default.filter.delta
20261025-1-default.filter.delta
20261026-0-default.filter.delta
20261026-1-default.filter.delta
20261027-0-default.filter.delta
20261027-1-default.filter.delta
20261028-0-default.filter.delta
20261028-1-default.filter.delta
20261029-0-default.filter.delta
20261029-1-default.filter.delta
20261030-0-default.filter.delta
20261030-1-default.filter.delta
20261031-0-default.filter.delta
20261031-1-default.filter.delta
20261101-0-default.filter.delta
20261101-1-default.filter.delta
crlite.filter
data.safe.tmp
data.safe.tmp
data.safe.tmp
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
sessionCheckpoints.json
recovery.jsonlz4
recovery.jsonlz4
sessionstore.jsonlz4
data.safe.tmp
usage
usage
.metadata-v2
1657114595AmcateirvtiSty.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite-wal
targeting.snapshot.json
targeting.snapshot.json
xulstore.json
1451318868ntouromlalnodry--epcr.sqlite-shm
2918063365piupsah.sqlite
trace.txt
trace.txt
trace.txt
memory/3480-842-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3480-194-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4612-114-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4612-9-0x0000000000400000-0x0000000000446000-memory.dmp