e72fed4e409007f32170aeeec9b3a66c189f419ac63134f49d061903e26b44ec

Analysis

max time kernel
153s
max time network
159s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
23-03-2024 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AVR0RX/AVR0RA.exe
Size

288.0MB
MD5

c3afa0f2a2250d4315ccc8e1342bc988
SHA1

77ff25f46824bb45eba911051850d9c918aa993a
SHA256

ee3a3ba814d5cbf925a7cd5bd5f10d78141b62226cb93062847e613af0a42384
SHA512

c39cc71a9a07ffbbb0b0551d62ddd3cb9f1fe63728024e071d669461bd0cb7b13cf7b1d17766bda80c948846b820181e47ccaf06234534613cb94893d4e542e2
SSDEEP

24576:mYeXZFoujwyyHYSAm3JKTQNmIdlAQI2Srmy8Pk8NnhAA+ZO/pHkOR45Ykz8kUn:7fV463JWoDde2L1Ac/OOqSkC

Score

10^/10

collection discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Crawford.pif

description pid process target process

PID 6024 created 3396 6024 Crawford.pif Explorer.EXE
Executes dropped EXE 2 IoCs

Processes:

Crawford.pifCrawford.pif

pid process

6024 Crawford.pif
4712 Crawford.pif
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	pid	process	target process
PID 6024 created 3396	6024	Crawford.pif	Explorer.EXE

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Crawford.pif

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crawford.pif
Key opened	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crawford.pif
Key opened	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crawford.pif

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

219 ipinfo.io
220 ipinfo.io
Suspicious use of SetThreadContext 1 IoCs

Processes:

Crawford.pif

description pid process target process

PID 6024 set thread context of 4712 6024 Crawford.pif Crawford.pif
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
219	ipinfo.io
220	ipinfo.io

description	pid	process	target process
PID 6024 set thread context of 4712	6024	Crawford.pif	Crawford.pif

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exeCrawford.pif

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Crawford.pif
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Crawford.pif
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2504 tasklist.exe
5796 tasklist.exe
Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000_Classes\Local Settings firefox.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

6084 PING.EXE

pid	process
2504	tasklist.exe
5796	tasklist.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000_Classes\Local Settings	firefox.exe

pid	process
6084	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Crawford.pifCrawford.pif

pid	process
6024	Crawford.pif
6024	Crawford.pif
6024	Crawford.pif
6024	Crawford.pif
6024	Crawford.pif
6024	Crawford.pif
6024	Crawford.pif
6024	Crawford.pif
4712	Crawford.pif
4712	Crawford.pif

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

firefox.exetasklist.exetasklist.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	2552	firefox.exe
Token: SeDebugPrivilege	2552	firefox.exe
Token: SeDebugPrivilege	2504	tasklist.exe
Token: SeDebugPrivilege	5796	tasklist.exe
Token: 33	6124	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6124	AUDIODG.EXE
Token: SeDebugPrivilege	2552	firefox.exe
Token: SeDebugPrivilege	2552	firefox.exe
Token: SeDebugPrivilege	2552	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

firefox.exeCrawford.pif

pid process

2552 firefox.exe
2552 firefox.exe
2552 firefox.exe
2552 firefox.exe
6024 Crawford.pif
6024 Crawford.pif
6024 Crawford.pif
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

firefox.exeCrawford.pif

pid process

2552 firefox.exe
2552 firefox.exe
2552 firefox.exe
6024 Crawford.pif
6024 Crawford.pif
6024 Crawford.pif
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

2552 firefox.exe

pid	process
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
6024	Crawford.pif
6024	Crawford.pif
6024	Crawford.pif

pid	process
2552	firefox.exe
2552	firefox.exe
2552	firefox.exe
6024	Crawford.pif
6024	Crawford.pif
6024	Crawford.pif

pid	process
2552	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exe

description	pid	process	target process
PID 2552 wrote to memory of 4120	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4120	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 1736	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe
PID 2552 wrote to memory of 4916	2552	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

Crawford.pif

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crawford.pif

outlook_win_path 1 IoCs

Processes:

Crawford.pif

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Crawford.pif

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3396

C:\Users\Admin\AppData\Local\Temp\AVR0RX\AVR0RA.exe
"C:\Users\Admin\AppData\Local\Temp\AVR0RX\AVR0RA.exe"
2⤵
PID:752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Timely Timely.bat & Timely.bat
3⤵
PID:1740

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
4⤵
PID:5396

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
4⤵
PID:5804

C:\Windows\SysWOW64\cmd.exe
cmd /c md 14
4⤵
PID:5840

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Senator + Ass + Layers + Combination + Ali + Gnu + Fallen + Settings + Fairfield 14\Crawford.pif
4⤵
PID:5864

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Scientist + Tons + Cheese + Prohibited + Degrees + Photographs + Lexmark + Nutritional 14\g
4⤵
PID:5956

C:\Users\Admin\AppData\Local\Temp\14\Crawford.pif
14\Crawford.pif 14\g
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6024

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
4⤵
- Runs ping.exe
PID:6084

C:\Users\Admin\AppData\Local\Temp\14\Crawford.pif
C:\Users\Admin\AppData\Local\Temp\14\Crawford.pif
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:4712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.0.740810687\1759374469" -parentBuildID 20221007134813 -prefsHandle 1644 -prefMapHandle 1668 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68f6929f-4b78-413f-bc0a-4a4ce4db3758} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 1764 249d0fede58 gpu
2⤵
PID:4120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.1.1672319115\772996623" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64404d0c-5be0-44fd-8c0c-2f4f05bb5d06} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 2120 249beb72e58 socket
2⤵
PID:1736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.2.1176997086\1371869470" -childID 1 -isForBrowser -prefsHandle 2704 -prefMapHandle 2564 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {389abc95-e06d-40e9-8ece-f43ccec2d93e} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 2840 249d5283558 tab
2⤵
PID:4916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.3.613126314\354905539" -childID 2 -isForBrowser -prefsHandle 1552 -prefMapHandle 1536 -prefsLen 26044 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e53769d-0e52-462f-b94b-925e70d22f8a} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 1244 249beb71958 tab
2⤵
PID:3868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.4.1658052740\342152776" -childID 3 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 26044 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {822bbdaf-ee00-4fd9-8f07-502409df88ce} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 3624 249beb62858 tab
2⤵
PID:528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.5.529739849\1939459939" -childID 4 -isForBrowser -prefsHandle 4876 -prefMapHandle 4880 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09f4cb8d-65be-4c5d-b667-dcb9d117d06d} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4892 249beb30e58 tab
2⤵
PID:776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.6.872988161\818682739" -childID 5 -isForBrowser -prefsHandle 4440 -prefMapHandle 2628 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c85fa611-be71-44f0-8487-0a1213952a1c} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4916 249beb72258 tab
2⤵
PID:2348

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.7.836502876\553989938" -childID 6 -isForBrowser -prefsHandle 5028 -prefMapHandle 4892 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b0f198a-fb6e-431a-9531-cd850543ddf0} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4916 249d375f858 tab
2⤵
PID:4160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.8.1134431807\148259477" -childID 7 -isForBrowser -prefsHandle 5420 -prefMapHandle 4076 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dc94b70-9cdb-4f61-a307-1f8f82d41d60} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4100 249d369da58 tab
2⤵
PID:2456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.9.1837146345\1578626558" -parentBuildID 20221007134813 -prefsHandle 5416 -prefMapHandle 5632 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93f87fd1-ae77-4d44-9a62-121820774684} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 5532 249d87f4958 rdd
2⤵
PID:3428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.10.1923640240\985454106" -childID 8 -isForBrowser -prefsHandle 5796 -prefMapHandle 5792 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d4bafc7-2f60-4a62-8262-78d689b0b8b2} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 5804 249d87ec158 tab
2⤵
PID:1976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.11.183587237\1415900995" -childID 9 -isForBrowser -prefsHandle 5816 -prefMapHandle 5808 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7cf34fa-eb59-49a2-8f10-0deefa6b0f0b} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 5832 249d895ae58 tab
2⤵
PID:3916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.12.195041883\1188532238" -childID 10 -isForBrowser -prefsHandle 4864 -prefMapHandle 4860 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c43d8f0-1b2d-4c4a-8a33-fb263cfa8ad6} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 4700 249d76e9858 tab
2⤵
PID:5220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.13.818254171\351896798" -childID 11 -isForBrowser -prefsHandle 6260 -prefMapHandle 6392 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7b19d96-4b24-414e-ae1b-0ebabbe4c621} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 6440 249d9f17958 tab
2⤵
PID:5812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.14.1901344646\610756447" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 2848 -prefMapHandle 6368 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cad0a76-2d6f-4ba7-9f6b-9fd7481011c1} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 6104 249d85c2758 utility
2⤵
PID:3580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.15.1078447378\1077733726" -childID 12 -isForBrowser -prefsHandle 6624 -prefMapHandle 6404 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8fde585-c4f4-4539-b835-80fab1998210} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 6652 249d8f69d58 tab
2⤵
PID:5096

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2552.16.480534575\1998650398" -childID 13 -isForBrowser -prefsHandle 6792 -prefMapHandle 6796 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {509504f2-93b3-41fe-a69e-109be8d6c172} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" 6780 249d8f77858 tab
2⤵
PID:5680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6124

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eqnlllhg.default-release\cache2\doomed\1705
Filesize
7KB

MD5
6462122dcd6e52a984d5090528a858b2

SHA1
3afdb685478c08c476786d798a20f8ec012cbd4f

SHA256
624e48a3780eee2428e043ad1023c0819e68e322650a91a50cfcadb44cddef4b

SHA512
af3af435a7bed424a7b317bc584836f96943a350ba213d2024fa57cace3a121a0fbf24835f3a5eb7fbc4b501ae28e51cb94e0811db670ea3af79c60a2d71f106

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eqnlllhg.default-release\cache2\doomed\18470
Filesize
8KB

MD5
455c92ac851f56de9a8ef6aa4dca45a6

SHA1
a2e737dde1cb971ba4d4c5fd9eddaca991029a58

SHA256
d350ad1b7c39cacc8e979716cc6bca8ab144aabdb44cd9c17756c63f4c8ea3c9

SHA512
1c53819233c66fcdad91b7a92dbabd2a3e394497d43f3f6754424fb15cf59634bf1274bbb231675e649f25f6f166f38d2d6e2d79bf41fc429ea3667e8d67a0d0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\eqnlllhg.default-release\cache2\doomed\22996
Filesize
8KB

MD5
2dbca85ac7fe20cbb6dc058ef51704c2

SHA1
47dbc387d8f98dd9ca5e99224ac9421c1c3cd5bb

SHA256
3f1b1d07f988d3818b5a723e86d8a47d29d5cc77c633f921556edf57b991b3ae

SHA512
039f97a3f8ff88d261fe9b5d7356a6e2cd90d45209f883aa17114603303a194dcbb001c80adaa35065f96ad600cb757f380d137e6fbb84588cc9806bc842d86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\14\Crawford.pif
Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\14\Crawford.pif
Filesize
768KB

MD5
38dd7321d00597bad90eca703e3e94d5

SHA1
da67896b08485b3a7ba138d129db3c8f34604342

SHA256
f6d818a159f01e88bcac4a2df06b43ec440f3406bf36aab032b9a81b58691602

SHA512
09a9c9809ef7280193e7ef4d905589bcb2214718cf36e8f5e13f973da7169961c495bfebe632fbe195038780c12dbb2aff71f942f50e192c1a7eca0eca3d8846

Download Submit
C:\Users\Admin\AppData\Local\Temp\14\g
Filesize
2.0MB

MD5
fd8b33d08bdbb59fb396c4e638a16ba1

SHA1
9d905f123501aadb52909323bbf4d98302d9626f

SHA256
7de608c9adba13e199a27f31ce71e4b13aa55029d7b03c7aa3c9fc1fe0c2f201

SHA512
0e2da68c09a16103ac467a39c0ab6e0dd3f7d105d6f1bf40724a3ab2d261f5e4b271e502a5d7035396f03a6da55d0cb60ec2271e9f7ece3ea034046cdbc01aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ali
Filesize
157KB

MD5
52b70ce2b97705780dcf9dde1056955a

SHA1
eeb331c3865ee4c84646f0caf793e781b2234d49

SHA256
06efbe7a13a64356b46b9f9b9c20736ba999970c2864c5e27580c11e9d4e3566

SHA512
62cb93805288b0a3d8bdfa0067590f91c187f54e0916fd9c4b3d6f745c4ff4f1035d888f2724fe926c2cc98bc2f1c8343cbf77d36a7fa67fe660709c294d6b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ass
Filesize
83KB

MD5
e88a0093e0a6dd6c7ac8752d97629318

SHA1
752c316aa3491cb04858b0d0067053d2f700908b

SHA256
f2445de06b0a9c6e22cc387147f2769ff196efa07eec114b994084a42279a632

SHA512
3056afd0e0fd952d2472a9395778ece9c9f42b910d1a1c2c28bbd484f8cc98c4a3a39eea3ef303c91662a7e51ce33e19c28d7277ed3fb4e26dc256732395397a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheese
Filesize
238KB

MD5
ed4490dbfd9072d00d5fc68a733c6d92

SHA1
2b415d7078e95f20d8ce4de9ca705cc82b47aa7f

SHA256
055a3880676a88288f671f8206b29702265e3fd588bb1160800cf2f5b4702fb4

SHA512
928dd61651b1e7ba53c3ab4d73d99cff1ef008021ddd296973be17b6ac6c8d835b521f88e13639277a07d443fe4cdf3ea674610b212406a94ce8755f98362538

Download Submit
C:\Users\Admin\AppData\Local\Temp\Combination
Filesize
106KB

MD5
9192ddc46d3c91096b9387169a09884e

SHA1
ecdd66ba069fe23d7f817214b02e80932c6946c9

SHA256
f85a78fc1877f71c8be6c150bbf4d99c8b321e321a64a4881f13ecfc555b973d

SHA512
08af5a7840fc90ffeca74072f18c7a99eb4539b9436f47875b5cb3a8776f6c2d60ff210afc8c1f4d66f4582c6835a985f5a547e49e458460c8a9c4f87a35805f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Degrees
Filesize
247KB

MD5
99dc8bed5fd79252bdc5536ddc4708f2

SHA1
06270a772adec88c80dfe9f5c847f16a1c9f2da1

SHA256
1ea766825deb9f0d0d51b3f26a39842057f1cd834e8d147f89ceaa9cfa91c109

SHA512
62c5ef68c42c7673ded4817ce141d279d823d946f3e5a809fad344981b32f938c611dc6132e1be43bf356d4fcca69cde7d28fdf71bb4cf014f241034cf381407

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fairfield
Filesize
92KB

MD5
289ef11db7892b711f9000df57cf794b

SHA1
2c90df2cf52bd2c7d6a18f28494140245e25d1d3

SHA256
ee10a9a4679fec387a4955b38393fd429fc06a2d3b0914008b594cdb07e77e70

SHA512
6cd6dfd4b8110f39ed2d28b1b761e6fd9efb58b23f1188a0b62c0e3e06e42641395e62a4b7b0b393810a7077dce9ca0a03ed8d2a3304b0454e675158b3c06d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fallen
Filesize
120KB

MD5
27bce1156c8a87abffe1582475d8fab2

SHA1
e5cbabb1eff46250ebc271b6f8a5e6c398b2c838

SHA256
0defe7fa0a22258b1b33eb6f309fb6d5e81928ae946eaa9cd667cb41ce6b8251

SHA512
d2c5c25f3b7a338fc83c809a499aecde775403a9dcfa8303080ae0a023fbb64625058ed4d091e55a7a1e83cb422113d98eb8545987328155b4677b3cd3cff31b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gnu
Filesize
42KB

MD5
eb8f862efe3a8372297e499651323f3c

SHA1
54770d36660142aea52eadb369038cc7a15bfc7a

SHA256
c3d820a23f8fa7fcc8ab64dc70f0c3514c912b4ab6df5efaa989434837cee82c

SHA512
5c567f76d5fc5f2b1bc05119e55f0f01bc5387c0787c1b75b8a29fa77cf379f7bc76445210abe86e427cbd6d2cd12158b86d8f9b37f90ad9a63f1d0d7978130e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Layers
Filesize
47KB

MD5
60240d3ff3c4fc4cfa38e700e7a9a36d

SHA1
44e7d78ca024bd18673fee2585433b1eeb64c157

SHA256
b40d1c8ff8ba06142be7745d03c253a009589ec5996a9767d3f0f31126d2f9d1

SHA512
3283b0e07311db67995bf4e2ef1e929988a2edcbf60ac38d17c6174e6e4f264435f58ac40131210f838cb955342b2d8a8e669060b97180578428f7e754443f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lexmark
Filesize
277KB

MD5
d2544337a00215310107ac0affecf3d4

SHA1
6abde3808f9e91ea6276056cee92f5854cdef013

SHA256
95bd4b62fbdc5883e61b7c9162ab60e76588f3665db390342256b11f0787a9fe

SHA512
df8e99c8b3459a7feeca2e801fe30a8661f3f33406e3e154e9c8b944b3789ff606447b83eaaa38cb7edf3d52b11a6ef976450e15496612f6f1b0a2c864379267

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nutritional
Filesize
233KB

MD5
cd450d575d6230a60604f6491998f7e1

SHA1
1f280fb1e9096a07d755f4b9b7ae1d9e4795e23d

SHA256
d6393a7446fb0ed8fb7fcd3e41a08a15cf233d9719883f506844702eb974d06b

SHA512
6f6739eb57ba07c96039961bfb00ed0a1132a71c8a73c12c8eea05b832d51045ec0514e38ad4bb196f06181dd6cff3d67793fd1df385d1aba5526e30bac82213

Download Submit
C:\Users\Admin\AppData\Local\Temp\Photographs
Filesize
294KB

MD5
e39683fb698236bee1c564dae1872d0d

SHA1
123c089776a5a54bdb3571899c8023c87957e47b

SHA256
8762ef1238df9f163f35208505f2b11f66ad30ca2251b83cd637601e1df279a2

SHA512
bc6ab142a68737ade744c3e454922636cfb63ba0672ff0244954744c30d41a44f3d9b5bf259a540c7458e27c28307b00d75f3368d9035b317e75669433551ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Prohibited
Filesize
250KB

MD5
17d7ad6e8dddbf2098063b7ac2be1a8c

SHA1
cfe9205a8f2dfff090801b94de5eae2b5da021c2

SHA256
857c1ff22e651ee310e33362204aac5975654a0fb19f2ebdaaf23b38faf90134

SHA512
2fd03d39ae2d4977b52d482ca6e63af8d9625c93570538bd22f362b0a7fcefbd7b4ba3d091aeecb082a2848b04c89c17561a1ae0ff50e760866ef7f7021ef10e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Scientist
Filesize
281KB

MD5
ade5b8285dc3940fe76220086413d619

SHA1
3778aa1f2528c9f7357f2d54b3363f2f551d2b27

SHA256
84f8c83bf938ffe17a8dbb2de9212a4bd677bd86e271f96d323eb8cd04f9b91c

SHA512
ae65e948867621cf8eafdeb6bc405ef7bfadcd306816a4bb7f38a19aabc0a20efd40e76dc85ce6fa971fd53b8a444b2f92ade7b5c38198931fd87d05a8a2038b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Senator
Filesize
180KB

MD5
ad0cf777fbb5165d21dd2bd12968456e

SHA1
655369ae914224510fd03eb2da4d2f525c6405b8

SHA256
fa0c66256fa45860236f3e01ff3de25c93881a6f6685c022582454482405f77c

SHA512
c538b1194291ec00effdc378505e14ea3e1c2ceee35a7a2fffe3fc70af41cc988df81dfb77a829a18da40d688279be9de24cfa03a0ad0a72afecd816ce9fe540

Download Submit
C:\Users\Admin\AppData\Local\Temp\Settings
Filesize
98KB

MD5
f1d4f230f46b8db3da1afc03091999d6

SHA1
e8fff04788e0ecfa8478d2ce9247dd4ad1be1565

SHA256
12856580905076d1bb5661f4df2724a0e831df4d89adc036fa3dffe5c5a016b3

SHA512
d695fb9ea9a356d45234e21d37a9ce04ab86dec54eda66a53eebfc391cdaa303009e7829651c5b1b9d2cb09af0f526fc1990a5f906d408da11d08373c4aecacc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Timely
Filesize
26KB

MD5
d90b5b29db7ff765aa5e92ab4253c8ac

SHA1
ae9b10ed8306bd4b17265b31bafca11c4fa43b7b

SHA256
4d7939acb2591b6df30309e39d95ece8ab522f9561c0b3519e5f46acfa75b3a9

SHA512
8eb87cdf85c1bfc458e610c63b697f57f78f5ff6737672be029f2b52c8e7042b639a20333c1c067d2dd1f9d21b3cc1f20b01f84c1590bb3cc202cc2fa6249a3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tons
Filesize
268KB

MD5
d821eb76fea800eb71d63882a1d4a562

SHA1
b3a06695776a30565db1a8c263a954dad4c2487b

SHA256
4fc0c74eebaccb601f188ffe6267b4ab9ca6ebbba48a11fdd566b5b3a29d594a

SHA512
6809ebffb907d2c8d194e48f45412e87d68d54781b6d3b552fe95925963c85f8a7ac0f0b0dd0f3371444b11272ed71e28e8c5d033dcd7736c029edccf19b18de

Download Submit
C:\Users\Admin\AppData\Local\Temp\heidibsJ5p_5VMMBB\YpuOH_1UmYoSWeb Data
Filesize
92KB

MD5
ce732f4f447aa2f766cfbdf8a4f5e19e

SHA1
318043823c8dc77670f7dfa5b672b313321898fa

SHA256
b7cb765a763c053cded7e6e8cda3bcc581bbd10ac756abf495a265be80300191

SHA512
7ce0abbbeaf17458f864d4f39326f492320fa6e85524da3ce9d7dd991db4a10080780121dc5a6a755a515022d13f2894692fdc302385da285d8abc77738bafeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41
Filesize
3.1MB

MD5
698af2e7de3f01ab6ec24c8190538968

SHA1
1475c5f7c7a125b6275b3b408bdf76c35d276f24

SHA256
5ee46500e61e96bf9b46d808418b3fb68530da433f5ab771c8a2f9ea5916e954

SHA512
89df851aad5c70323d6317c8ef50961cfc66ec0279d4283d8815ee96e364b13f1d3036775e7d68fb145d8b5e47fe12fc15b4c6b8837e1e73c9c1132da5756d23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\cookies.sqlite
Filesize
512KB

MD5
0e4fcd66fc4c9272100763d8c1715e67

SHA1
3da010a08b16eb21241f1dbd98f82713e31182da

SHA256
9366f05a47ca57611224b84c707eac4aea98ea79c27fc921809687a9b4f4a110

SHA512
7055125f8612965866dc9626ff9e26408765f6447d28687ab764c1f0e5d8c94df486c353581e3fdb5d48c28570667dfee5c077235b3dd216281af84d1537664b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\datareporting\glean\db\data.safe.bin
Filesize
3KB

MD5
14455114c9ebc3ebb817be9937e6ce53

SHA1
6efdc0c2d44bffa40c35b1e55c55649b107a3397

SHA256
f03341d76f7e6ec80145589d4a47b77345dcd494386c6b779dbca6f1eb93a3ad

SHA512
ed133dd68ec1ef073c28f188aa3e36536e56acefa277cc700e47ecaa53a0d3d82d1dd347860b563ca79847022097854de40f6939e6ff1b8adf0309c45ccf25d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
3bd0316a231dcf10f4e5b8ca4e27acc6

SHA1
6ad58ebe87176db681d8286bd18f0c22c63d967d

SHA256
0f9b313c8894236a88832697331c4975f2a1e2353962d9a39dc8d7c02ff3c3a8

SHA512
3e6563041cef0c21a30ec09b0c2e7fa0d95b9962955edb846e58af6e647c95502f9a28a7341be7e9ba3407573ea419a38c6c84323877e92471d3df64d06ace03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\datareporting\glean\pending_pings\2fe277d5-1729-463a-85a0-bea4d678c57c
Filesize
746B

MD5
16559b8e08ff59485c313733a0a576d4

SHA1
bd3e411ef66eb60b8b55ac60c3f8c71924516ae5

SHA256
f705dbdc64032fcfa15836952953bff10d5e8360ce8213e1368e7eb702d6adc1

SHA512
ce3e73c0b8481afed0bf3d8e6363abf68f9cdebea02764312289f2ce9b5c15ba1060426537350bc237c1906ffe54b1cf00159347e875160c85f296e6dede222f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\datareporting\glean\pending_pings\b9f4792d-0034-4b00-bfea-066dc1f26fcf
Filesize
10KB

MD5
77bc32b1c17429c6c267ffb12102fd0a

SHA1
59c580d24a5a513341976d327d0af3ba51475232

SHA256
715f23e7f7bf514a1154949c23840bd5bf5e76c964f37399774bd7cf8817b144

SHA512
047304d0fb5a3d87e30b5fd44701227803f9e1934351367a948acdf74f90e01fba100c3004c06c6b951db474fd96f22e79aa0b5504ea8a2af28efc06bb624820

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\places.sqlite
Filesize
896KB

MD5
72706d5bd595fdfc482efcb7a6b3ef09

SHA1
e2d1bfcd3f317dca2a7a0f4dc14a589970b8877a

SHA256
58555f261b330025f5d7060060ac56a876e30703560b055fe22de63f071eed23

SHA512
da4b94b039f7ed4e5f6e3494ef96f122a8693e1cf0c946701c6d85454ff3b64a2efe988f88a80e429e8ea8981c9ed757671ff407b2a74566ba01bd0c88425fa2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\prefs-1.js
Filesize
6KB

MD5
a95015a810a19c572902abb656b7cff2

SHA1
b20c9c80410120afe581a40585d482190fa64bde

SHA256
f72bcd35b2c88cf59d4afe30bf3acb7a5bc3e9058feed6c88626666ad375bce4

SHA512
58b38438f8524b9b659e877837772ff7b46334164fbae1c7f66321aef74b26b0a14d9b60ac0d9bfc1e55a07a6edee3a1a112f109ef8c020f8b1919d430d6902f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\prefs-1.js
Filesize
6KB

MD5
18381974dabbfa977670c31088580d4c

SHA1
84858790bf5c8cde82c1baa9ab255e7c9455aa81

SHA256
2bd917574f0200f9e5f8e7878a33982a4a9c7772377f21c81df9574cc1605ce3

SHA512
d86d2d57eb7efbbf6229fdd345b5699da81ad5001ce0b2050abe6baca436333aea9c86d1810359d676b927cb39ce28c39b077f127047418681a03f94aaa6e903

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
2KB

MD5
f7dd97a821ad8c87248a184891d80b3d

SHA1
5078208a5efe17f03b17fb8ff0ab2534ecfee4b4

SHA256
34ed3adf62984ac4ed05ecd1f24ea33e6d2e771756dca292f15b865949fad7b3

SHA512
e558eaae2abc43fa9b5cb97cfcabb1689d7b64112b786900ec1642e509ba04bdfdf20b793db8d3a72d7a1313ecf6c713c2fa1c8a455f861033dff8d3b73402aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
a77ed087d46b652a40298ce7c15c6b38

SHA1
58a9ba28c9ba4d0a838c01a1b861ec5226226020

SHA256
c4979fa6c30a731edd4f6fb8d7eeb003c24cadadf6da7b0b1f1b2a94adc7d703

SHA512
6d989a69501aa37d974b2937ba08a5dfbe2f55b75c06236b9f4eb63f6b1a41eb80ed92f5b92b7d211755eb73ad0fb43308badec256c2aa91a53b7fda866a2892

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
8KB

MD5
2bcf4ad43ea7e65233549ea1c5ca57ce

SHA1
5a02bc7c3f923a17bc5b22bc14b769e36c495ecc

SHA256
931aa90b33996cf3b6a219e62de7acdb631c3dabd1fdbb91cb357d83bc14369b

SHA512
cf2a4895e3892d8ed658ecdfca80ae3ba56482a7c8f927a0f161e5c96ff810eee6a02aa017e3bc1912639e1642a12c7f76945d3e7f7d0fad7acd18a0a47b48f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
b441f45ff41f39b93ea6d7b85ea659fb

SHA1
5f358dd2dc01af9380fdc949f904fbc05a05c826

SHA256
bf3cf9e76185eb305176019ffdf05491b7fe815182b658984729c7270c77c950

SHA512
b69f7109fd490894c67603207a8a2a25b0653524d847eca16cecafd272ee3beeecba5d90a544ce5d3e151d6b5dcf481cf9b5f524ec8c20fa25a417c76dcad58f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\storage\default\https+++www.pornhub.com\cache\morgue\161\{a6b9d651-9297-46ec-9ae0-e9bf1a4da7a1}.final
Filesize
1KB

MD5
932479fe19d996a5e8f139bf51085149

SHA1
da374dfebb658802ee62fc8ec320c3442fc93192

SHA256
c57de29d8406c0e2534d96c4c23199b127d8ee9bb86dce5230bf8157894b4f84

SHA512
ddbc216c01474d8ccc4f73fc78d228e68600b2bc148cdf3b7d12108b9fbdce3f2c91fdddce4841e669b1a2a609a8fae927e2a551efd11877e6513f7849edc05a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\storage\default\https+++www.pornhub.com\cache\morgue\251\{973a7649-390f-4ed5-95e5-ac276b47edfb}.final
Filesize
456B

MD5
4849126d62348e96de9f534891ee372c

SHA1
04208116ad7cb0edcb2c7c754042554104172d10

SHA256
92930e52c17a5e42a09f648d090ba0e48384fe2b6f4f6b3e3fc70bd8a0e6ac5d

SHA512
bd7769637a8707a21027e442faf6911019a2c731bff17fc11b9da0b74490162ea4eba2fca41942a7c114cc75ab1941f208c1fcc789bdc0a594b5ed269f6e6f25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eqnlllhg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
d99959bdbfd0968bb5eb4975ad7d2545

SHA1
2f44acd67ef9e2176f7c07c338a50118c7d65003

SHA256
4ebc75e6b5bf1ba21a01930e75d051d0c0d4f2a1eac544a1a227e7d1d07a4e5c

SHA512
a8230c5e025c6ed61aab58d9738344d03eaf325452e100996d851e708019c0a4d446c207adcc13ed7492f51f713c876d662e4e91564dd334e81aa91c3819b821

Download Submit
memory/4712-783-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-723-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-726-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-727-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-730-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-744-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-743-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-801-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-756-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-725-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-758-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-718-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-792-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-784-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/4712-787-0x0000000001390000-0x00000000014D3000-memory.dmp

Filesize
1.3MB

Download
memory/6024-716-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/6024-324-0x0000000077C71000-0x0000000077D84000-memory.dmp

Filesize
1.1MB

Download