b5de8e9aa0e722a3d7adab5c2d1cd32a18b64d2c5f61ebec3ec92b1b621b718c

Analysis

max time kernel
274s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DESTRXXXXR.bat
Size

7KB
MD5

55199a826827490429bc1132ba752c8f
SHA1

94202f0928a52d6ba5036dce2914d461f06c9560
SHA256

b5de8e9aa0e722a3d7adab5c2d1cd32a18b64d2c5f61ebec3ec92b1b621b718c
SHA512

137e5b088ad4a937d013b4aa7278d02b57d03c7ab3c5e97fed47ec517c7b2237c4977056a12ed8ebd22f25a022bbd831f38ac609514094fbaf030a560651a2c0
SSDEEP

96:N4lnYqO584DlKk5DYmNDVbR3xGuru1m6XRfeogPtRBA7SZ:RRHNpbR3xT6hRvst2SZ

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 33 IoCs

Processes:

firefox.execmd.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "batfile"	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

firefox.exe

pid process

4572 firefox.exe
4572 firefox.exe
4572 firefox.exe
4572 firefox.exe
4572 firefox.exe
4572 firefox.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

firefox.exe

pid process

4572 firefox.exe
4572 firefox.exe
4572 firefox.exe
4572 firefox.exe
4572 firefox.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

firefox.exe

pid	process
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4932 wrote to memory of 4572	4932	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4372	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4372	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4968	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4564	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4564	4572	firefox.exe	firefox.exe
PID 4572 wrote to memory of 4564	4572	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DESTRXXXXR.bat"
1⤵
- Modifies registry class
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4540

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.0.134171428\370674982" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edf71c7e-ac8e-4356-964d-9deb9de3fa4f} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 1960 28407fd7858 gpu
3⤵
PID:4372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.1.1485762622\776810802" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2344 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {077b9b6a-a59b-465a-8992-87e7ba3879bf} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 2360 28407cfc658 socket
3⤵
PID:4968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.2.1867584301\2128946063" -childID 1 -isForBrowser -prefsHandle 3280 -prefMapHandle 3276 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {603a8d6d-e5c4-49f6-829a-89aea413104e} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 3096 2847416a258 tab
3⤵
PID:4564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.3.1435822961\116008007" -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 3592 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06caef56-0270-4588-9fe0-1930e6e7ee02} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 3608 2840cd75a58 tab
3⤵
PID:4328

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.4.1824084212\1847588770" -childID 3 -isForBrowser -prefsHandle 4740 -prefMapHandle 4736 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cdf4e5b-b90c-4975-82be-1ea44eedee2b} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 4420 2840be4dd58 tab
3⤵
PID:5328

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.5.813589065\1289758703" -childID 4 -isForBrowser -prefsHandle 4436 -prefMapHandle 4452 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e84c2ce-b157-4a7a-8aea-5134bc811eac} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 4856 2840c295b58 tab
3⤵
PID:5736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.6.1822910284\1562288901" -childID 5 -isForBrowser -prefsHandle 5168 -prefMapHandle 5172 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {075baa01-592f-4bae-aa97-eb9d6e30dea0} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 5160 2840e30d658 tab
3⤵
PID:5744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.7.1287848182\1985004888" -childID 6 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24acb295-f00a-4b63-8470-a6a34245d5d6} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 5348 2840e30c758 tab
3⤵
PID:5752

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.8.1715505510\1908570614" -childID 7 -isForBrowser -prefsHandle 5828 -prefMapHandle 5824 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1afa7d62-8462-4c8f-a05e-9fe7839bbedb} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 5776 284100fb458 tab
3⤵
PID:2672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.9.479671700\1500075014" -childID 8 -isForBrowser -prefsHandle 5992 -prefMapHandle 5996 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37cec734-cd43-4c6b-9063-2f24f3ec2079} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 5984 2840bf05e58 tab
3⤵
PID:2984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4572.10.1811360053\2068901126" -childID 9 -isForBrowser -prefsHandle 2900 -prefMapHandle 2868 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b8bf96e-a608-403d-9ea6-59a64bfa5d43} 4572 "\\.\pipe\gecko-crash-server-pipe.4572" 3748 2840e17e858 tab
3⤵
PID:5196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\13026
Filesize
8KB

MD5
2a3fdf1b012011fb06dd93d6dad0fcc5

SHA1
3249a5b272c6261efa9ea296310e2eff395c9312

SHA256
32abb405396cdc2e0d26435d53f69572251118d07bf9f31652f490e49451cf02

SHA512
3582ccc0ab3afc30e453fee303cc686d7d01f14999256691816915cbbf912424d503df6c9c6b41d3cc087f34f1375bf6204e93aed96be7db2f815c2e735daa5e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\1338
Filesize
8KB

MD5
705d27e9fe03ac074c64bbd7e1c59832

SHA1
9792dfd40506c1635f4592e4263ca9e71ad88794

SHA256
02bd45421af4361173819cfaee7f8ca68c34ccd726dddecac1660ee22c4b7cb4

SHA512
b426c0142aeb6fc3d7340a9316e14ed0b89a6f3df6c2ac29f2b1efc8d5916ef10bfa50964b3983d6810901d33c8eaf0b88b44b539399509ee383a9d766dc2ad3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\15887
Filesize
8KB

MD5
2561a76128c7940a1c351a4a99aecea2

SHA1
d5b5798e6a4bdd091a390da865d9adb060b1753c

SHA256
5cedb217fbf238d15633d8901fb37dece8e0f41f5d3a3702c2f87635b5e5f459

SHA512
a72d737d4cbda1eae9d0a8c1b5b50b3d8257b3cee694d7c41bf2e611a81e639f3460d05cfcdf827c8b20feba3866a91897bc848942c9e4cf97636f78317229cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\21127
Filesize
21KB

MD5
c6f8f3fc956ff920bf378cf780464dd8

SHA1
61507d58538b70963c41a32c4759612b979c15d2

SHA256
efcbdcd0576e7403e91431f8a3d28011007ef5155e11772f47f5a15d97511022

SHA512
b60ed792a512987f5d35992ab2b19863ec7a3d3ec041b7aef014be9aa68ae743e80821d443cf815b52ca2cd1baab68daa15414a7fb384eebb84d12024207588b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\24833
Filesize
8KB

MD5
588aad07d6efd5a9be29307ce14ec646

SHA1
685ece37db43c88bb26689f2a5728f5d883b6df9

SHA256
956bd9a318b6c80453c0347cd88570372e3e6f257b59e35a784467d849e0af99

SHA512
60943314a5da67d698d23f881d081e9d37bdf40300f7e0087c531c9c38297e821ce7af82921562b703c146d84458e2f0bf6aa9ddf89745ad366f146e893f985d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\24938
Filesize
8KB

MD5
3e2249c60b48b5d56e668f552e2b9471

SHA1
8af9aad61d3706f4c771b50f85cf0aa34152cb9d

SHA256
b5524ded88d8c393f89c0c5fd314f32abaa1ce827fc4a7a79284ed18812cd9a4

SHA512
4a18e250004a7bd8a22069b1036822bcc5a8b715c5bcd45b45a237cf626e0c8ced3174c66b27b5815544750e777c0f9d5b0c4703477a7a8b4b2c685c11f177d9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\2903
Filesize
23KB

MD5
065e94424979b581a88ef49e26a4da65

SHA1
d1ea22ccaef600b38c08f189e739f36018ad1fb6

SHA256
977495e3146516e9c00a2bed7bd31d86630ade1550f25d01ae3150e3f4b707af

SHA512
71c4f41a260e6742d6e06e202cc58f224c6855b494b7107119f9638512f24e74d386df5cf9e2242ad97261e3b071311f6337e99695c396c18e1a245adc63e1ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\5749
Filesize
8KB

MD5
7a17d78136bce440b0f93b56787bab64

SHA1
4a8480f23d97f7fb78c1e53c363c08aba3562c3e

SHA256
c0fb36399ea6dea11ea1b00fe3c822225e1c959dcd1dfe3b3d17acbcc94c6149

SHA512
57fe042333c88064a5300458831311e3ffadfe73ff9a3611aed9b3c2ec12b5356587cb609f9e2cfc01e47391b9e5d99d3a6ae5eecd9f3b439c9e5fe9780dffe7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\7235
Filesize
8KB

MD5
2f3a89a16107a3747278b4573305ee67

SHA1
b516a98dcdd212fa03355ce353bf1549e508846a

SHA256
468f4e54c8eb393ae09d71096298d6d1da22745d909b1fd3d94d9ba90524d609

SHA512
7b6ed03d6ecc00fbb3ccbf2b8fdef8a6a132ad7decf29caaa041b6a17e580309d74228a3e76ad4ec86857f230f209094316fa1b7554f3658af7a8ab7d39bd887

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\9335
Filesize
8KB

MD5
660970e1dd3812b102359e83a9700e6c

SHA1
284402c6a1f65353abf83bc38b6b154330fd6168

SHA256
4ec9fd363c05300a06078236a26c54d81c8f3ce40ea491726b1777a23320e3e7

SHA512
529ff3e6e65da05831e5ddd76a0cb0a431e758852a1753c0cf3037ffbe1d8895ec189294ed2ce7a231885a81a4747410f66acf2bd632fde06fcd3dd3e3909d8f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\9767
Filesize
8KB

MD5
59db05b103ce3d5b8979bf9615565f51

SHA1
0c8f4b8e61337f2f3bcdaad753814c0b62734614

SHA256
26861b9cf1af186f173357cfa29c38876d367142e40b000c14fe425c012eaa93

SHA512
3b24c49e4db7a8ee11d593e091fc3c9743e73c79b5e13ea8d22063ba1d35518c096e1c37312f98b28c859e3e179e01aaf6438b34b2f064117f1497b4f3d563ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\369D03B6BA33FF53DE7508F48EEE850A9B1D60C0
Filesize
18KB

MD5
21b5adf128e87d7341afea8734ca3c65

SHA1
703ea2f2c73839760e26f2ae6c52f1d878ff6404

SHA256
902e88f6c2a41f76a93c71a7477a61a340e61ea60da9d6bbf33a069ee0ecfbd0

SHA512
f07dd669dfa3d3c7a899c51b6bcee98a6c87f10fd97d7d11dddeaa7c31aa3f8de3c3dcb1d8d0372f35b294bd6f70896a6f08913a7db99baf7e347c573b012677

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\3FEEA6F78794333B4ED222689DCBC32565AEF867
Filesize
62KB

MD5
afc4873d3ca6d298c9f0cd05b2d5be9b

SHA1
a055bda347fa95ce8f440fa35becc8630312a0b5

SHA256
224b99691b1c5eecfcb63815623d827afd7ce655c40e57f2cf5e0037c40feb23

SHA512
19796c47cb5b7bef6437df4c34b78d74f58565bc841c131744c32cd46ef5d7900ea7e58204ad3d8fae6ee9a434969066d6a9f4e2db0fe613a3491d9e8d1ec3be

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\6009D9363C9A4A1CDBCFEDD5465BAB05DD7A5490
Filesize
14KB

MD5
97b744657361af47ca99f268ea37b486

SHA1
224cdb0f89bd7383d1f0fc915fb3af545bdb3479

SHA256
a0eeb9f21396ae405fd0ef5fa5f4daef0e112b099301439ebbaa0532135652cd

SHA512
40e187f9e11a09a15c6d7a2e1702ef438297e56bd832493847ac0ebb3b05fe326282afa7070c0f02caeb204149bf0f313f80fdd40e976ed7d348597905485b55

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\7927624400A491B800C9793C2AA6837866AE86C0
Filesize
210KB

MD5
af55bf22f4dc58ebb24cebdecae6111a

SHA1
05e9e2783f7b9da2ecc212fc6d12be16f8a4b204

SHA256
e4bcbf7d22bf4da9538ec66d4e97cb84ec38cb2a9ab8168201e03fd53a1d07af

SHA512
a8180596d8a357fa42006ca446b17c8ae5721424570189ea2e4005a0b380019c3189565ee868d639f7ba4493267cdf81e327777468ff47faa239ef7642260743

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\A776522A1E2FBBBA02BDAC8E196E6EF63A8B726A
Filesize
79KB

MD5
0b6b340b8a3bf19ddebc6f5af04e5dde

SHA1
d3f8fbb0fa0bc4aad0c2009a081f29fe79adf88a

SHA256
cc085a170e7d3b67da3a1411e1f8d6bdd6b0e66cce1a2eb501a38e0dfc0afa62

SHA512
16dd68cefa5ad841d493c603e771afa622c1734b2625456c19144d4a13255d274d24a62288a3901f5309dca7bbedce58c5263bac52620cd1b2d89fd8e1fb182d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\D78A14C9700D9A11BBFC28D63E6B466F2AE3438F
Filesize
22KB

MD5
ab8254ebba0a161cc6653b5fad143548

SHA1
b992e66e739cb27b45814ea9b18d9d48b74f0efd

SHA256
41794ca89b92580c8d23144b9157756bcffef527f2b8729e2dfa23924daf601c

SHA512
7bca37aae7f487503f1ec125090c0abfc194b91be982b12caf135c0180e2e8f9f01c234dc22678adb329d2896e91b5a601cb6c92c8aecfb26bb2269cbdc742ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\F8A97D65407305BDFE65A35BB3FC8A7F6FF958E3
Filesize
162KB

MD5
800dc380d7d30b320a0e5b87bfabc7a9

SHA1
003f000f4096987503b23f075b5ec5b3ff391d05

SHA256
6358b51f4d1aa770d2248c4071b7664abe4d1f5f8753d60e6cd3ed4b917e903a

SHA512
662a2f9290990f68111b56bdcdb2e3104a77b41ab2b0006385cd703d5946e6801a97711ae723f96e4d34624416bbb1c14423e3238566974e69ae51f0b68c2336

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
75d2f0a1eceeb4e2ce8fb9b017a76dab

SHA1
db459315f2fee18d3099f320d3c216bad549cdbb

SHA256
038aea019f89fa5a4b2e62429301cc38586dcda9a315b8b35f35e18e2fb76d45

SHA512
c61e8133d546259f8c54d4770dcd373d99dd06988e6a01bc004ea4729d1a3b4dcea7910f033b9c7953c7c40514d19c3db9da6330892e196f0739a74c6382df81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\18161290-c260-452f-9752-d8b5a4c280c8
Filesize
11KB

MD5
2d0bd83e14fb628733bb06e2490d2d82

SHA1
d5fe0cdb815d1d362c871d74dd7d578c2fed0794

SHA256
00f5249309609b9ffdb5cd132604b176a7fb0d9eb2d2379c702c4b327436eee7

SHA512
a5c76fe910264463593093f73f994cb9ea3f6474df2ce14911a15bf78e9d0d6f00bbef2077be011beb3c0f8f99eee414196480e769b6092b25d43d3d9d72fef0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\4ba2039f-fdbc-4a40-a650-ef97b7d79530
Filesize
746B

MD5
5581a34d1c18d5ff5b805f8d72a7508c

SHA1
bf3f79e530471dbe95de3b36eaaf50a9769f344c

SHA256
2b814f1c8c31db660e354a0e808aa7451d929ca463b20def817ba8866ad5e3cb

SHA512
e84e9590d172448bca9be80c16eb43875fc11fdf467f1261beabc090490cb88b7a1decfff7a8e20e0a45dd32c71bbefbc08ad76da9680614bc06087429924b2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\logins-backup.json
Filesize
634B

MD5
4879d564454794d1c21c26d91b068b4e

SHA1
e3ca74b195e8420a5fd45eebbcf2cf8e0d4c3697

SHA256
eccddb66beb7274b9edf6faebcf010b52651b28d8822dd5f97c5418f7801f523

SHA512
8cb736fb29a234da39a83e4c8c5f239f2e9eef1e45ed289498d236c46eec76ecca4b33349d4564feb875c02466beb11e062ff5290aa923c6b61214e8a380cec6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Filesize
6KB

MD5
d9ddf0210dfc622564b7564f8be373ea

SHA1
539d9da18f7e31377c54018108805a445080ac2f

SHA256
b63312a8a103571e92b76b048849033a4f473fadf8a0a95c5a70d7d8e3b54d84

SHA512
367d0c8773e17fe34ef6d7eb6f0551982d9a791921e78ee3b2f987b0331f8922755d0c847c6b137bb30725e85c5965e6b4ffb35cb79c79e026c5f67b5c30beaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Filesize
6KB

MD5
cc84d1bfc92516a818666f2a2e0c0831

SHA1
64b0ad7652072bd88177b75b03a5632208a11e9b

SHA256
f9fa8cd1b383e957ceb2d82725978d08cf6a968a3d27e92444fa92960c1bf209

SHA512
a4dd1a2b0fa6a2c1c4f51addb16791bb720ff7573d018c6310d7676ab0643c58aa6506cbd849165ec631e5d40f30601bfa90d8612dd716a8107dd7a03edec957

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js
Filesize
6KB

MD5
77c7ac4ffbf3f0fa843b487b2c71c841

SHA1
f06cbe9d7a44df871ec23a2150c78db6cd389401

SHA256
aa5936439eb40de6482e9927ee2151f6bbbcf40568bee3651ef4e8efbc2cb14b

SHA512
f2000f85a8f05ffb923749a40b1ad14c3891563c2a91791b558bc3ddade98ffd9d68e533757a682de9281340ad1fbf07ede7f82099bff0a2d9187bc9722ccee0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js
Filesize
6KB

MD5
d454153f97157f030cf474030339dedc

SHA1
8ef9dbd48c192f60ad2269e2acbd414bbc358b3d

SHA256
fc63256e4b001e5f4cbb92743d28b440da945840bbbe999be03539a2ecc589cb

SHA512
8b9999ecc60449b687bdd264f183ed18843f6d14f33fa192c3b15abee36544b3e81154e0762032559aca60811209ca8329ca5e305140e9e7d52d5064916551af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
89d1dd0bb6880f71cddaa5b5808bc2a3

SHA1
51f40a62a6c58159d809340346f7e61f0d15c1db

SHA256
e89b1637ff4652f38d0b29fca349e2a5246bdef45d06ae77075d306ae73e2b37

SHA512
2e1e3dd8f29365f42ce4d9b42e25d5d8c562b1d29cef6cb405f8857e9778c702db72cc18d107d657ce237e7b628b4eb651261394cbc04d8abcd75aedcde6bf28

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
965f2321b6b955c7dcb0f815cd2c58e5

SHA1
83bb3d85fb7200092c06f0613cb073cf6629bbc4

SHA256
903d35ecb310f6f71f3f63dc62eafd1b0376b4a07bcb9db02cb33c50100f646c

SHA512
86aedc15c768dc2ec4c2be0760accb198e3555fba01903c4242534b92b846258d78d48c655a32bd7f7a44266c4d071e9ddd624c8b591cdde45fecadce1f41d88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
d6700ed98edcce2fb2dc97595df13a42

SHA1
d151cc0c6ae2c2631f079ee0e4f46c0ccce0b3b2

SHA256
bd8e607ca85afb1b8a82f4cd28bf9b8541aeb2acbd7ea5471a2ccd674e4cf1f7

SHA512
99a53803960ba8f69db31d2296d164a6068b4d759e72ed17df77193efbfeae45da84e776c27a2c0b712db798e7e2d22ecc80fa2d70ab1841b5cb0f768e1018f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
1a6b7a43091eaf96e18d36eeca2cbf98

SHA1
34303a3c9a92d0883d5e5e6ef5560ebb0a65508f

SHA256
21d0d7ce8fdceb40281809a1933c6905f3af4e1f52f28ff2abd4cf01e9c3df21

SHA512
00c4abe3d9599d43b57ca564b7054cbb24b57d663e8c8929d57d097e4b0cee4c1b9b083a4f4b411358d640a9c8dbeabaa8da9bc9a360ed5db8b91fb59a5cd07b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
623e5d247d505138cf688c52b8c72443

SHA1
5d74ce352f190931e1f3526ca083c03cc727c15b

SHA256
fda89d36d15c197d8752f22bc54fb932134a1cfa1795ac58fcdd8e75c04b19f7

SHA512
1f3c1e191305c75585d5cf9e7f2c586c602e3ee37ebc268ea3efda6a34ca7c37c6dc07d56b39ec0655fda1791d4092867b9accf835d08fe02467b8ef90c6ceb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
dd614794da8d2f85f85228db42786789

SHA1
79536b92c1f9a00e30cbf66d07f3d5fc0a7a217d

SHA256
2dee91216b7085767fbbc07848023e2055c15945d73ea38161bdaad024c63ded

SHA512
72c074fcd214fb1699349fb9ba552be2b38fe3ae088324dadc78c1235d1b20c37c6bf3dba0a78704deea8ba1fd7b85a5df75be279271d7fcdeca08875e18b1bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
8b3d866afd1c70fa3b329c7d768b9ddc

SHA1
e3a1a7e00352885b430de42ffb69cbbb09c0dfab

SHA256
4722ed9ee5c696247427a4ffbf3e7cefd9a4f5698e062960a1b3c1d423339c4b

SHA512
4b0058cf5efa4f8ba3b566f613ea3086c2faabb15d8505c18f36852a16fe2c817e783cb72ebd563953d0e7537c74a82f5fe900a514b1b0d5dabf238b62e1b3d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
62bc5aaadf6ca8cda7ead8ea93548745

SHA1
4f3068c490d5c100f7c50479425b3d4746f52301

SHA256
35bd55a0b96dad9a383cf664149c83ed2d492e18b99898b395842653a8b95f3b

SHA512
d787bed9961569725596d45efb8b2ed709c68008131cb7e690ce341bc7e8dec8f375106fede6d8e32ae6b289f9d3f630665ce9b8ed07340aa6e1283d3470d097

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
06d38404d368f5623142a041df83d353

SHA1
6ced0f8f8d25b205db0852a7ab3a61baf6c87550

SHA256
7a4ed37646331b8b275e6839b05db47b66243d582c5937d5b1beae07590d4611

SHA512
820895f3a322acb4bb96a1ff6e6d646153840a652f6f63ab031aed4045e2c364742a6623630f57680979c0ccee170025db4a37a2a48e0f05d17deeca3b5eff2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
fc306501091369c076aaa2dc31cb7ef8

SHA1
a09bb7035ccce8082e90fa954882cd477fff010c

SHA256
0a7fb675435084c3d3596c298fb4374b6bce33e9d31865454ab7074a89f9137a

SHA512
705fe7589a296f6a3195d8755b00cb68e8e88967ba6ee37b5e282a503f154eb82328ff05e7c9a9630c0082baa089c38647ae71cbd39fc095692deb862634477f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
1ab3041eb9cbc9747fa94d0581dae5bd

SHA1
b65ff511cfbbb0fee8cd6b23eb69c98fc79f6881

SHA256
37d456b660b6506c4526fde0542ec11f1c6b87fc66e6af2d76290383f31d1859

SHA512
f064610e96f6063dea8b6db084fd063bb74f9b6d9a185fc3049bc98daf7c748b56f8001bd61d91845b89cd7d6ad8e17966cb14a39678f83014ceadf5a16c92cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
1d84d8af015355a3892595bee10a44f1

SHA1
bc0bda4722883ffa4a7ec21b5e2f2ef291afc82b

SHA256
617169cef2eae4f2c7a2295d43d7e5456219ea830d6a4795e05cf9126f48471d

SHA512
6ba1101f5b6c75982c0ff9269282d22427e73e96361c55410f87a617f27c855cf95b992b809db125c6d26c17279858107a3151e31db0e7782716ee1f5f740a63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
7KB

MD5
12d020e31f56f03fb033628162e87cee

SHA1
579ab6fc9f5815f6bba2e6bf83b27be7ae7a523b

SHA256
a8501c6f5ef2df01cabe0d0a793e012d461e1f93724bd644f88d4bc15ca88568

SHA512
baba8ea2af8bf01000279159123a2d0df5454fd29430f6dbff002c9f489d236a88680a76645dd3af83ebde44185f6cd4cefa9b1d54fdd09df2938f52eddbae34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
b01efd0877d8bb4a5d754d6d5a5922cf

SHA1
6dfaecd4219afbb206185171c64c777e9c73ae21

SHA256
ef1ebedd446ce18b79317f09953ff8a6069f92749188b45945567c315388aa90

SHA512
6f5fce89b6dc7e6979fdb01493c0811bcd55cb945d7665cd9a23e93419a5aa28207b3f614461103f04b0406741e8020c35252fda5529e41e3e918e42fd89c086

Download Submit