nanocore | 332d4b20d1759170a5f2e41efffd8abaee444dc61f0c1cd968d008b65e7588fa

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26/07/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test2.exe
Size

202KB
MD5

fd101a9effcd2f6c4ba232dbe819c169
SHA1

71fb24744ac30b54ef31e3b655d9bf3d62b5e80d
SHA256

332d4b20d1759170a5f2e41efffd8abaee444dc61f0c1cd968d008b65e7588fa
SHA512

147e95073372b47a24083c8df621bbcd4d26fe9066cae6bf4fa7808fb1022f540342f3939dde75ed95777a199da2c91730f1a994f3bffabd3f2c579c9396aff0
SSDEEP

3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIS8FzhzRWEV9UWlv38SAX:wLV6Bta6dtJmakIM5dMFAyUWlv3PAX

Score

10^/10

nanocore discovery evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	test2.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
94	whatismyipaddress.com
95	whatismyipaddress.com
96	whatismyipaddress.com
97	whatismyipaddress.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test2.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3612	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
3640	taskmgr.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
2908	test2.exe
3640	taskmgr.exe
3640	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2908	test2.exe
3640	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	test2.exe
Token: SeDebugPrivilege	3640	taskmgr.exe
Token: SeSystemProfilePrivilege	3640	taskmgr.exe
Token: SeCreateGlobalPrivilege	3640	taskmgr.exe
Token: SeDebugPrivilege	2108	firefox.exe
Token: SeDebugPrivilege	2108	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
2108	firefox.exe
2108	firefox.exe
2108	firefox.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe
3640	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2108	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 3612	4748	cmd.exe	78
PID 4748 wrote to memory of 3612	4748	cmd.exe	78
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 976 wrote to memory of 2108	976	firefox.exe	81
PID 2108 wrote to memory of 4184	2108	firefox.exe	82
PID 2108 wrote to memory of 4184	2108	firefox.exe	82
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 4356	2108	firefox.exe	83
PID 2108 wrote to memory of 920	2108	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test2.exe
"C:\Users\Admin\AppData\Local\Temp\test2.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3640

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:3612

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:976
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.0.1964176918\292025311" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1648 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbfcf6c2-e554-4849-972e-3e8342a895a3} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 1764 225d8bd4b58 gpu
    3⤵
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.1.810730339\812322222" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29fc6cb2-0e22-4d28-87ff-b899bfd035cb} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 2120 225c6872858 socket
    3⤵
    PID:4356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.2.1014190305\482253538" -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 3064 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64cd6f69-8e06-4403-bef9-b37f0a55d804} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 2648 225dceb0258 tab
    3⤵
    PID:920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.3.1695014656\1644505170" -childID 2 -isForBrowser -prefsHandle 3364 -prefMapHandle 3360 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {415a66dc-b247-40f4-8c22-acf897891459} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 3196 225db3c7c58 tab
    3⤵
    PID:3100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.4.1203429206\497714065" -childID 3 -isForBrowser -prefsHandle 3440 -prefMapHandle 3380 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e99eedb-b70d-4dd0-bc0c-1341fc82eb85} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 3456 225deab8f58 tab
    3⤵
    PID:2828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.5.1159040193\1100719115" -childID 4 -isForBrowser -prefsHandle 5060 -prefMapHandle 5028 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4ca8f7d-d2dd-4fe5-af51-404444e84ff2} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 5104 225df11a558 tab
    3⤵
    PID:1808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.6.1731773437\107934143" -childID 5 -isForBrowser -prefsHandle 4932 -prefMapHandle 4936 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cef9fa0-fb2b-4182-8dd9-21ac4143475d} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 4812 225dfc93358 tab
    3⤵
    PID:3776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.7.1673824550\90411593" -childID 6 -isForBrowser -prefsHandle 5384 -prefMapHandle 5380 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {171b581f-fd0d-4b92-b8f6-adc56ba89fa9} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 5392 225e0211658 tab
    3⤵
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.8.876067536\599682555" -childID 7 -isForBrowser -prefsHandle 5328 -prefMapHandle 5664 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2a2df81-d3bb-4163-b33a-a5df8709347c} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 5676 225df174e58 tab
    3⤵
    PID:5136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.9.1562120548\1827222527" -childID 8 -isForBrowser -prefsHandle 1540 -prefMapHandle 4664 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {533cf46f-3735-4085-ad57-97e7cefe686c} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 4980 225db40d058 tab
    3⤵
    PID:2564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.10.1338990647\881090048" -parentBuildID 20221007134813 -prefsHandle 6740 -prefMapHandle 6744 -prefsLen 26689 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14fd5e43-08f0-475a-98e1-579851d3574d} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 6732 225e27e0258 rdd
    3⤵
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.11.876765547\934326647" -childID 9 -isForBrowser -prefsHandle 6584 -prefMapHandle 6576 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f39250b1-aaad-4cc2-b025-e839bcc2de29} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 9716 225e1bf6058 tab
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.12.1513809676\1315248996" -childID 10 -isForBrowser -prefsHandle 9708 -prefMapHandle 9712 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a74da990-f49e-40c5-97bd-1f8219bd4bca} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 9692 225e2ed0b58 tab
    3⤵
    PID:3572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.13.1947400059\297035385" -childID 11 -isForBrowser -prefsHandle 6580 -prefMapHandle 6572 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86affde2-d060-4c35-b894-c62a8cc76e34} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 9472 225e2578758 tab
    3⤵
    PID:6084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.14.306306774\535739030" -childID 12 -isForBrowser -prefsHandle 6320 -prefMapHandle 6316 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f2fb2fe-93cf-4e1e-ac44-9071ba086af9} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 9456 225e2578a58 tab
    3⤵
    PID:6088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.15.1447479869\878880392" -childID 13 -isForBrowser -prefsHandle 6340 -prefMapHandle 6336 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16a85b2c-ecdf-4df3-88a2-8ffda4645771} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 6476 225e2b0b358 tab
    3⤵
    PID:6056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.16.1639497106\998342329" -childID 14 -isForBrowser -prefsHandle 6272 -prefMapHandle 9764 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4abaea57-5297-44e9-9f5b-9c4802094d43} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 6284 225e3e6f558 tab
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.17.1351348109\952331417" -childID 15 -isForBrowser -prefsHandle 6572 -prefMapHandle 6288 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c80694ee-4f00-43c3-9ac2-f3bbab78b7f9} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 9712 225e3b4e558 tab
    3⤵
    PID:868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.18.1363482472\1386686197" -childID 16 -isForBrowser -prefsHandle 4280 -prefMapHandle 4360 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce190458-9b95-440e-93d2-e3afca66eb36} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 5912 225e3e71f58 tab
    3⤵
    PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.19.872960141\998899730" -childID 17 -isForBrowser -prefsHandle 9948 -prefMapHandle 9944 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d578647-1433-44bf-a63a-67eb621de72b} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 9960 225e4420f58 tab
    3⤵
    PID:5296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.20.904628962\1450435953" -childID 18 -isForBrowser -prefsHandle 8924 -prefMapHandle 8920 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {94c68285-c16a-4971-bcaf-c652102c1aed} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 10112 225e46fc958 tab
    3⤵
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.21.1151808830\1964507079" -childID 19 -isForBrowser -prefsHandle 4656 -prefMapHandle 4312 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04f3a7ab-37a3-4d5b-b146-ca0f8e8f32d4} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 4352 225e41a0958 tab
    3⤵
    PID:6104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.22.1293757122\680411147" -childID 20 -isForBrowser -prefsHandle 8608 -prefMapHandle 9012 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77d137ea-5fa0-436b-95ff-f0d710a4af7d} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 8720 225df174b58 tab
    3⤵
    PID:6736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.23.83304137\654508529" -childID 21 -isForBrowser -prefsHandle 8596 -prefMapHandle 8600 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21515066-844c-42e5-8916-d37156967f86} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 8564 225e2ecf958 tab
    3⤵
    PID:6744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.24.419728858\1425582677" -childID 22 -isForBrowser -prefsHandle 8584 -prefMapHandle 8588 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9aab113f-aaa9-4ff5-ac96-4cb9071321fa} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 8544 225e3d8c658 tab
    3⤵
    PID:6752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.25.1349818462\1158720798" -childID 23 -isForBrowser -prefsHandle 8176 -prefMapHandle 8188 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0183703b-f7e1-4599-8f78-8003f62559d1} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 8112 225e17f6f58 tab
    3⤵
    PID:7128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.26.1857699080\1485772077" -childID 24 -isForBrowser -prefsHandle 7884 -prefMapHandle 7936 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22b6d250-ee05-47da-82d7-8b0eebb5af0a} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 7956 225e38b7258 tab
    3⤵
    PID:6968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2108.27.1566068267\597610584" -childID 25 -isForBrowser -prefsHandle 5976 -prefMapHandle 7884 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bffea405-bb65-4065-8f9b-943d28f2dd55} 2108 "\\.\pipe\gecko-crash-server-pipe.2108" 7664 225e5605958 tab
    3⤵
    PID:5284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\23259

Filesize
8KB

MD5
17955203a91589c13aa12abdc8382874

SHA1
363c8ae9f93414329d03533f439292a037b5bb26

SHA256
c6af7583f145a65d6d31194a2a875791c4f551fb6e46f89c88d52450d6a0e33b

SHA512
6492c2d37ce2be5c1a566d6a5e881812e8823e237d34f42720dae59874b9364637d685c7ec9d8f77e8a70023affb6d8e6a821292361dc271d2dbad5228d1954c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\27943

Filesize
7KB

MD5
2709947914ea91f725a62b53c836f5e3

SHA1
67a30c0082cb26f24d1bc5cfb35ae418aa12ab2a

SHA256
1cd0759ea13828d11397816e456a56d66b1acbd21aecb93b9b265be6aff02230

SHA512
5364ba679fb6b00517950702d6bb50fcd782a556ad0f27364d5cd05e2e22a1efeff9a1bd77e56d61910d772da58c6059e70acc0969025b3f3733d3639fd8f263

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\4594

Filesize
9KB

MD5
ea7ed0d70d0430e98dbea80d9d13abc4

SHA1
c0af16391b6b74f8bfac01faa85d8ead87fb084e

SHA256
748a8a886a3f16a47a09af9b15d5c6f827d2ecdffb141e0e767941951c747c91

SHA512
e12f147ee58b8c2f674cc9a077490ed5a4c0d72ceadcb18e2f74e40b9a969358df29038ef961656f6df5df983bda0f66c15dfb1b2600027121fefebaa88d5f45

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\doomed\9203

Filesize
8KB

MD5
910d91f84cccc6537f1246b0770ffdf6

SHA1
c9c57dbe206b4660c74415a7e49ef05e3a091609

SHA256
c6c57f14e1a6e318cc33c64db2c879fab5894a0235b86b66fa3cc00c0143607a

SHA512
ec0f8f6488a0039b83b4b5f91093c5fa51557a064a0dc702f68d4f61ff3de5240d329acff90f85b634cb6fc1413fe45dfadf822c3e9302b73c8c4342e4e69d6b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\5617C2BB77122AC13DC0FB65336A8386EC872F9E

Filesize
21KB

MD5
632f691c8466239dd05f1d39f4256845

SHA1
1ff8e1fb544025574ad211e717a89220dcfdb053

SHA256
3f8d6187177eb45c2a75f43c3f0b38bfd773e9bd2a728cb0ba7767a8e0bc5d9d

SHA512
e5247714dfb8ab0a886db901155e14603c48a0741824c91f080685e2b9f1d9232493c0b426efbbeaf9a8426a3cd60f8c0992d3586355c0a7a7f2032f96aaf970

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\7C0CFB0A7634C90390B5058A8B03381B6B3A5CF3

Filesize
138KB

MD5
879e4b862cc97b37eba94cf5068c7e58

SHA1
3e88fd627c056e65dbcd5fe0080abe946978fe86

SHA256
eac6566115da4aeaeb28af0110120734a2afbc117f09978dc20f93ab20446867

SHA512
0f48097fd5db8ae0b073dc53f7b416a3455c6620a0be09b4a43d964fc3d3c9dc9bdfe0eb259c87063d994464624132c998b67b3e1d9d34503a24b2033f98cca8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\84521F87A67B212D786971864D13B946D5EAABF8

Filesize
60KB

MD5
a3ef39c1698e6b6d45dfd370dce50521

SHA1
979f5530ee71eb403ad5cddde5a8a54f4e3af1a9

SHA256
f53915b06d9c7eea2153b294c568bc447cd6d0dd8c9ecf90207980d2528f01ba

SHA512
b3eab0fa358e199cc9c3e7911f905c9819034d40b963861b41cc11cfdca012234ff48dec01d41eaef8f77eb3d5111bdd4a2fbb467957e93bf96fa985f31e204d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
32d2aa8127dad320427c90fa7f73a9a8

SHA1
852c0f741afcb78b27e9dbc67f0fa8fde3431c48

SHA256
6a5982b21164fe5d2459cb00b97a1aaa923b09f26dc9b1b0910f948e5a3ecc4f

SHA512
cf4fd33a8c6096915020aec8d2021b1387496c3382e697569da833707eb0acaf999d2187a8d8540668d181d99fb5c1335cd664ee4cf8db50fc0ae18375664c2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\3458f23c-8d13-4079-ad46-2f5d191fdf2d

Filesize
11KB

MD5
2850662031de3523f0545aba1788235b

SHA1
97abe1fddaed11ec1ae983de6ba90354b8c8d5e7

SHA256
659f02232ec25ee1d15281848209c21bfcef960841e40c71244133d336ce4035

SHA512
fb536ce5167c30c20184bc3b403a0b6d8c8fadb641a4899f5096fa5dd3b0e33d34736fe6fb814f4b831296f230120c76a4cfa79ecf6eabec472768432006abc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\59bd2371-1407-44f9-b0e0-e4bad547b537

Filesize
746B

MD5
e556c97765c3fb6e416501c23904b8dc

SHA1
eb00c3dc89513ac5985e5c770fedc8529a0e2275

SHA256
1809c88b09916f4ad2b0d7edf966cf8e79a84769c9a2846718f8f83b78055db5

SHA512
3bc15e801c428548c00699940d05c9138754cf2fdfcd767e98759ee7c296b118ecc9acdeb9d79080ff62b15882ea83fbc503af16c90763120dc33beecc4d58d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
c77906b6497b3a553a8c623ce11c1542

SHA1
41136ee6ba9d32fdb9ec4b3ed48f4607c1fdad4d

SHA256
8eb4eaf89533c7be8e4c9c7c63d0ecaf3cbfa10b4ae33161b2bdf6ea4c68044b

SHA512
80695a154c1a6011466b933d517636a4c6571cf938c9ac4079e657e639f885db537c158ffd6751fe1f903bd214d4ac479b3b7c7ac3cd4e437311454759780d6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
e4ab81b6c10ae1c8bb04b85dcdb24f57

SHA1
600d7f863a078b4e8542ea965d47a0b5282ebbbc

SHA256
fa96c90770f1b9fe2dcf214fc3edd5baac8a18a2452bedfbb256a8e2e1fcfba7

SHA512
140fb2020abfcdb39f043d723cace53fd765850b842c11e52b07e457b2e344e62a4be45f0cc0f7edba85606330378fb02ae45fd98701ea99aee22976be389726

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js

Filesize
6KB

MD5
3ea7ed29b9f11888b33a6a1c23ae3b45

SHA1
06bd524fd6d33d11db962b4f09e84e1cc8aabe70

SHA256
4b611643dca82213c3cc2c1e70b9bd9685b80e86e6e99c6b16ecb8cd91164be6

SHA512
21590f49ffdb3f3f1cdedd371f821d62e2698498a652e0697adc5380d2b6ecb3dc773349aae4ecf6ae9e5a03672b63b899e7416322ad23ba0950d404c00cfba2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
187KB

MD5
9072ff659d7b48f170ae866a35307192

SHA1
521c2a8a239ce054704483baa4477e24c97c8a5e

SHA256
f119756c979abeef95483716bec1a3e447a7608a96c9e99a617454ade9665c59

SHA512
c7f531619f40569b1d9f5716c40d942cb166fedbd3fd8ab91c9e832c06d188442a0d676170f9a015eea92cd8aad04b6bb90054aeed63b5aad2ab6a3b2fd22a88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
a1732098c82e9d02f4aba8369faeefef

SHA1
0563a4d6bfc11ac4808c21da0beb0be4a00c1a06

SHA256
87bf462c60470cee67aeda1e8a8ab0a5929b2fd011d1e4dbf70ac256252d1f08

SHA512
629c54d583c5367385ad9d4dd54b13ad189eb42979ab37143b695228eb1a085a57186d6106d42c47ca0e88b989008bc73769df93285149f94fc1382448c316b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e61a9e15307708e775c07c146ebea06f

SHA1
39c23328ff6df1078ddcb8554b3f5c746a1d405a

SHA256
27f1da653486dc8a440a28256e309a184af9d1e167f3e9351dcbd4d4a14485b3

SHA512
753abe341578bff42ab3499f0d86497ae99ebea8a272ef7407d4f39d055a7f874d69aeb89ba935e75602a882158f31a003be5931382c76ea541975d766fe52ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
187KB

MD5
ec6b6d1667dea51014586f2371c18987

SHA1
2a41cafc76c02c36f8ecf2ebcbf4cb7c603bb621

SHA256
811c0b344814a18a67602147efcfc5b80b0851cb966f9c84d009da982898a16c

SHA512
779c5883da93a1756c2cee655a03b0a224fe7e84f9bf637c288c07d32c1212ada95719a0d337959c3760fded79b6dd86f351d1708281723cdabbca6a9fd503e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
356c085adbad28655e61c1a1fe9eca93

SHA1
667e8f2b090a1c76a4a01e315b04ca438e104203

SHA256
74799b4dd4bf5a5ba3c11509848057c7a9b269215682d5e5820d94d821bf1b81

SHA512
a46a265919bc9355bcd489f26b97e6765786c5b4090f71179fc9ae614052f650bd977b1c54facc2e3c70e396638427e90d1e84539f16eb412e951de0a5ac117b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
186KB

MD5
976103b99844cadc756cfada79730f35

SHA1
7c909eda7585c1f8ab6d1ea5d1bf4c709b0a8108

SHA256
5460e0e366b143398019de1d7bff8e3662cdcaf1f2d13110bc1f7f3a33ed259b

SHA512
1944fdb0aae808147c9b42beccc861459a6d7025de4ba65629168cac10729de3e29de8427d1de581a12a0e8bde54bc4508cd8d33106671037a89933e8c0543d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\default\https+++whatismyipaddress.com\idb\993782502OBNDE__KSDISG_NLA.sqlite

Filesize
48KB

MD5
8e13152da34bb610176a55f2626f1362

SHA1
72dd8f77e32f2364a37064128d1e9f56cd4d250c

SHA256
2b7c91d4f8e0fdac272a25316a7e1c6656f247b6ed78bad4f7117758a3b390ad

SHA512
20855c6e1aec6565d115adb19480cb9c5c52ea64f124ffc6bcc8cb747798e32bc4d5c769d0e189fda10a983cdb38b0cb4c8074e74abb7213a7790b6a3b936f0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
0d0013d9708d9fef539adc917f5b87f6

SHA1
5e071e6b4d8abf007c8bb78ee948caf5bb0439e1

SHA256
f416d29cdbaa66b7d04483831d2a593a735316fafb643414a12df78da0ab054b

SHA512
851e9965a0fed9e0f5195ce655635cf13687d18678e4a9df807ab22cbc53c02cd2006fd65d93cd80b2a06d709e59122ea9933ba5cec551c6d51f5e9b4c175388

Download Submit
memory/2908-0-0x0000000073C11000-0x0000000073C12000-memory.dmp

Filesize
4KB

Download
memory/2908-10-0x0000000073C10000-0x00000000741C0000-memory.dmp

Filesize
5.7MB

Download
memory/2908-9-0x0000000073C10000-0x00000000741C0000-memory.dmp

Filesize
5.7MB

Download
memory/2908-2-0x0000000073C10000-0x00000000741C0000-memory.dmp

Filesize
5.7MB

Download
memory/2908-1-0x0000000073C10000-0x00000000741C0000-memory.dmp

Filesize
5.7MB

Download