e1595d1e70a4139982415bcb74e569a9204e41080f7c57fd46665fdf8eb047ee

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

7KB
MD5

c5d2b8d0ef88ec5df489c1b6b6d24da9
SHA1

283b7d856b838ddead45319e58563a6b781df594
SHA256

e1595d1e70a4139982415bcb74e569a9204e41080f7c57fd46665fdf8eb047ee
SHA512

f3e074b18ebeec47a60701a566753c4f86033f53c4840642eb8a11a93bfbe97ce64d1772666cc126abe2155ca82401b8c66775e1e4521e3657530cb764feadfd
SSDEEP

96:gW7u2O18uv/2isu+OD91EODENODg1mXOD5yO74vZRiBvuL0+vPWdcOYatPhh8WEl:u5bzM0el8svudOcUWw/U9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00cc8b9841e7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000009b03627784dadda389c2239df01ec914738b4fb8714c1bf4297d5dbafcdf09c0000000000e8000000002000020000000830e6cb42c8fbaf980c3a5fdcd9eb6264d646448c9cf829f20496b99b246f6df90000000d9b0d62daccdc1de23a3328823de2406a10ed4f8e6e24c3983d6e9a9c68d7683e70e26a169df36b98b98e6043a6a6473fdc8406a2fb3057d637b09b98f2ce65acc477ccc56aa8e20f57eb3836b5b47563f3a4286864c299804e9deecab9a6aa4afbb4341b9f0a96f3cbfea028cc64f59a3ce9b2cbc350e34980b844e6943c6cc7fc9e2a1f1020e6ace8d8e309fb41a67400000008a4a09b965e2779135bd9299b4acc142e1a137a8994b88f050ef06bf1a480e5d1c74bd12905110af873fb8afb8b2cd6ae3db813a962f7f4bb7e164716a532d8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429029023"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000a568d1ba0bcf47bd1cfad993859c142f667d4db4ae1842dd9562db2cb4cb68bc000000000e8000000002000020000000d26daba3a1f5d4c2c006b00caf55c865882943bf1222a1d72db6233255c9c473200000003a272c2723f4f90a2715873d76a636eef40f3a8d4b8b2641b78596e521d5d78e40000000787dc36d48c191762e8de425cbfafd71b4cf3e1c31640847a58bd973c8f313e67aef44656aeccef140ccb577956280d0b99183810b2e92c0374648fc369e1c53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4040FA1-5334-11EF-BB94-CE397B957442} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Bonzi.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	firefox.exe
Token: SeDebugPrivilege	2568	firefox.exe
Token: SeDebugPrivilege	2568	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2708	iexplore.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe
2568	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2776	2708	iexplore.exe	30
PID 2708 wrote to memory of 2776	2708	iexplore.exe	30
PID 2708 wrote to memory of 2776	2708	iexplore.exe	30
PID 2708 wrote to memory of 2776	2708	iexplore.exe	30
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 3016 wrote to memory of 2568	3016	firefox.exe	33
PID 2568 wrote to memory of 872	2568	firefox.exe	34
PID 2568 wrote to memory of 872	2568	firefox.exe	34
PID 2568 wrote to memory of 872	2568	firefox.exe	34
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2860	2568	firefox.exe	35
PID 2568 wrote to memory of 2020	2568	firefox.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.0.1828388172\1424586473" -parentBuildID 20221007134813 -prefsHandle 1256 -prefMapHandle 1248 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7cb6b07-1dc5-41da-b687-332d314951a9} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 1332 4306458 gpu
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.1.1799254556\206576514" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1508 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a73fcc7-bc4d-4308-8f58-f294eeaa3548} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 1532 f131458 socket
    3⤵
    PID:2860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.2.2128970908\1196742968" -childID 1 -isForBrowser -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77196fe8-3b3c-456d-b7c8-462c95247244} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 2088 18b2af58 tab
    3⤵
    PID:2020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.3.1882602739\1463860076" -childID 2 -isForBrowser -prefsHandle 1696 -prefMapHandle 1692 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b11e9c1-6751-450e-9de5-879ceaf01fc6} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 648 1498f658 tab
    3⤵
    PID:3000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.4.234779938\1521162324" -childID 3 -isForBrowser -prefsHandle 2852 -prefMapHandle 2848 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a349d42d-88f1-4650-b310-8426925c56a0} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 2864 f62b58 tab
    3⤵
    PID:976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.5.1199041516\509834688" -childID 4 -isForBrowser -prefsHandle 3796 -prefMapHandle 3772 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {447f0b3a-6b04-43e4-afcf-4db56fe82765} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 3808 1fcac358 tab
    3⤵
    PID:776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.6.1808160417\39079937" -childID 5 -isForBrowser -prefsHandle 3928 -prefMapHandle 3932 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27cedbcd-c47f-41b1-bc81-3472a5af54be} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 3916 1fcef258 tab
    3⤵
    PID:1600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.7.51296894\184072373" -childID 6 -isForBrowser -prefsHandle 4108 -prefMapHandle 4112 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d8c6353-ff70-4bb1-81a7-65d42a5153af} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 4092 1fcedd58 tab
    3⤵
    PID:1984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.8.1874031362\756088536" -childID 7 -isForBrowser -prefsHandle 4344 -prefMapHandle 1192 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8d85002-5c73-4472-8b71-2c140f791a60} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 4356 19a9e558 tab
    3⤵
    PID:788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.9.1826417989\1229493526" -childID 8 -isForBrowser -prefsHandle 4084 -prefMapHandle 3808 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {676d6967-e390-4e38-ae3a-a283ee8966a3} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 4304 f6c158 tab
    3⤵
    PID:2388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.10.402682098\316296660" -childID 9 -isForBrowser -prefsHandle 4008 -prefMapHandle 3908 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c67c35c-ad99-4b57-ad06-c3c1a01a3c82} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 4056 19a9fa58 tab
    3⤵
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.11.557500250\815783273" -childID 10 -isForBrowser -prefsHandle 4424 -prefMapHandle 4524 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d373aff-67a1-441a-bb02-21c09f3f0e64} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 4380 2304ae58 tab
    3⤵
    PID:3640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2568.12.1851728486\1208102444" -childID 11 -isForBrowser -prefsHandle 4312 -prefMapHandle 4044 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c078b6c8-37eb-420b-9f6e-cbe88c71ecba} 2568 "\\.\pipe\gecko-crash-server-pipe.2568" 4396 23ceeb58 tab
    3⤵
    PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67f3bcc33b89de6c04eb443a33b2274e

SHA1
8b91f86abafcebf06f970757e540c6c86f67e026

SHA256
3978db6dc480dd0b320a49a71731e6f39c6c720028fee0063136d54d49a6ac3e

SHA512
ad715166e983a3cb82238e1193cfc4425b361ec68d5183a1806f2563afa1f220cfb16d7a7a8b6478e4f122235a69999d8e4f8eea1b47e3a1b99cc2de02381e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1adc03e8494f5e43029b9178d56c7ab4

SHA1
d14e5b32887be3f3cde4b19ee669e9774aebe3ce

SHA256
5be94f320efbcd10cbdb837a905be5691bd73696c47a169b06fea8bbd1dbea1b

SHA512
04f853bfc52458bf48a3767395ab6755392cb9fa3c6bea9e1d568faf6c514e4842da3ac88bac193600911b450fd56c8c23e1a7f8389671467e9bcebf7b662c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a712fac0846266e3782ea343a2b0200

SHA1
f5cba723d6998e9fa86a6b6035fee67a868c9570

SHA256
dbc1d265e074eab5412c56390031111ce7309d23a4620565d588467783f32000

SHA512
04acaf4572874281c0e0539ec31b4fa721fd35cf6e3a77ef422ea6dc75a5bad681aef8ed89bf2e64df6d8da4fb05c1421a5c93b35c0907f53b07ba90277a8cc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cbc9b2a44b43423b3c508711b18f8c6

SHA1
2c96b7a8eb77f217529ea0bbdf45a89644ec1627

SHA256
2b4d37f87dbc88ef6be3c552bac191ea1e0021d24541ad026ce6b11daa81d4cd

SHA512
c8eeddf1abb08ceef13ccca565d0493133f47588306db31287aaab5bf832c0be1ae13e17213aef0a691ae639b2b17ea830fdb2c0e4c7169970f1784c3a8db874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67de767f2749cd84f501a3df551f0353

SHA1
22746d496640791fe6b31decd6f23894fb48cf53

SHA256
c9679571fa053dd0478ec5f7cb044a8b4ac228964f503bbd9817dd888c30b256

SHA512
5bded8a2f4614234a3252c1e3a99d90f9cff8966607eeafb9b7c2a1bfc88493c1abb978361c2fa81816960034bd9f4062836c4f5f1a956a118c46042ae975c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92344b36899bef2595c6afda3ad81994

SHA1
d807062f5172854034fcc0108df70920a4c5c351

SHA256
82df7c902bb689895d2036d3e40560c57acaee4fcf579f26dfa03077ba5a1e15

SHA512
c70cb22e6740ffa492de25fffa9831dfac7776487475399a886f90c3439201528bea8017e24f78beb023405accf0bb1c2ac7f47cbf9ceb7bcd550bcb4003777a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd515d48dc5b795eaaa47588f9130315

SHA1
c7465fca869f41e5506d6485049efbd7810844e5

SHA256
7a26286ace3ceec2c854c60e9acf2163709feed05eab7cf0c982cafa629eb065

SHA512
33c9c60b8705773a1a81b86513420f77e1af7576ec37568b40cb28bc6f82e5bc2229b37bb445240d9c5f8b8a4bd72bb91132a0bbbbd1879570fda7616addfdd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
492ebc914028d0676929abc1d85db13b

SHA1
41c1089f210d3a675f55a98884b8456be8832eb4

SHA256
321de34dfff09b2929eb6e537b1ff74e7ab37315ee4196bc08c9200f09f25077

SHA512
7fb11a0924a0cbd56d31a9c80c6f23ae42ed72242b4f74449e0f09287d5a27e150099b578aa87bfc20d8ed89869bc97ffce7c223d37f6782eac27850d2e92aa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
659391762a9bea883e780d5e60dd4ccb

SHA1
3d35a57dd9044c32aa94c5c8058e75c13a598dbc

SHA256
5da9b646ca46312c1042fcdb5165c6abac19bbeed0c3637a1308667b808e24ed

SHA512
5ccb6ddbe157f61c83f66d4538de67d32ef8e055ad6a47db74f9e077ca6ece3e2f39bb561c211936b1734a8504fb94c57a30de77a90a3bf6eff308f372e85301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e5f0cb46f8add19abf5371fcf6e28e7

SHA1
d00c7382ae7830164c76c5ed17320ffa8910712f

SHA256
71522196e61f1cf968c573385715e5260ccec3a313a2f4e4894681ec72e7d200

SHA512
fea33f30b7a03a6b976a21169c438d3111862cb5ff490ba6e550df7ee59657ce7404867b528c97d384a46307cd121d450f4c67d1366f87e27b0ce5a06d1f84cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f777e2805086eb409dbca799085d2c9

SHA1
de770c08f95e364d24281cb460d1cd4688982716

SHA256
8dbf68ef0dce5802c8121db09d4620d67614ac1375bfc424fb6f58e811f8b250

SHA512
66bc5c5f46532aea5de7fcf748f0d362d63c7b19feb66a559a5c8d2ba113eb32e300788a21a62a121933994483f99d10c847144693c59f99567d465dc33f0bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
538f90f6396875005c393f6a2fd8c75e

SHA1
2f6819ef48d4256eedc114e3253dc3e112af7ec0

SHA256
b228a59020fee2604a5645d32e7fd64c4133f0db33580105927c9fa4509ed6d4

SHA512
fea6f5a9d1c0b059b314cea7e5ce6515d78a8e8b823773d4e28e9ab7efc4ad6f7d3a5d1c02d67741f93f3105e99589f854aeb5e558d89ab5d67946769436ea7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
644a102fe632420449ec0efe3189aa1c

SHA1
270a4dab2d3862820e2ffbf2d35a0ca0f9a2784e

SHA256
8c8aef9262e45041140b96bf97d7f946e453f00cb96778c21715768c3f307483

SHA512
0aa408da0229dc5ebb24d2ff8ead1e99f3cdcf6217cf039209e15b3408904ad9301239fb35b31dad60ffeed8dfdfac8f2bd8b8b9b38095e4cbba958d23ee7c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8664d23bf868efbc1d1173f9f402e051

SHA1
029a4acc876e9f13f5f35e4ecc134039295d82dc

SHA256
7135d73faca36f738f65d66ae0c9ca72e6cf9f25f0ad163c8b873616e417b834

SHA512
acf50ac701b14448c3eba69c3fd43fef092f9ef5550c4593c9abb5f6dd043a20dbc89687cf663aaae41ce2057e19a38cb9e4c4548d292951a239692cfb39d2dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdf115d18b736d65bbb90c858382c8ad

SHA1
518920244c8f037e90782af758d5f6ed5ef3cd63

SHA256
20313ece6d2f72ce32962caaf31dc2d0b31a3d867e308ce45ca0d3543b24e713

SHA512
c206d8eb078fa0361fa4be607a15e8683975a43dce2b1033ec2a98dca43eb0ae6b7cd3a96ade6dd728a38b2d9fb82a556d1ae2025c1bf10ce1cb5c5cb008d3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8674ff3bfdeeba9e85b259662ea34983

SHA1
513650ed85fbb3772154c1d9f5ea58a0aae2e565

SHA256
05c678a2e040b59a28dcb99f42b07d41059cf09998669292278a0114b60e673a

SHA512
8d9e04efe936814b77217b3267459fc8f3049f1c75490ad25793f579a74a7568de4b1297151b92caa7e2fbc05ce86455c16a7a4fb9ed53d5a8b1037298762624

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
0f66eb0b0e0d8af10fa0c9e9dbe3af7f

SHA1
0c80a09052342c8f148643a04942c685fc7d6401

SHA256
20f72b984e19f9d74cac3e5c16aa58b2aed1581c56788bbdee152803892228e4

SHA512
e33e2a7f473f0f461dfce8388a569ca145701e5dceca1230efc95fe1593afcbfc4bc44a2e4374a4a95e27b15e4f19c3646e89a427d56b0f0850b55b167e4e874

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AFF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B9E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

Filesize
3KB

MD5
7c08da0aef21fcbe721ef8e21eee10fc

SHA1
39c274108d2996413da8f77c2181098079f6d371

SHA256
7301149d08d5d6cc52621a9120cbd3f9cc55340d206fbba68f29af1732076c57

SHA512
b82cd299d621541245ee3999071dedf7b74e6f4a90040bc41a47a025fc0520fd3f144e55893f002629b664e284a7a78612af2b99283f3b7100a0e24da6b422f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
fe919848acab91c9b0dff411c544332b

SHA1
2d6b1c0fc3a1a2e04001652f99f90d5481cd2817

SHA256
7011ae8ac7e213b743233619c3fe540193c25c74856d55b7d79bdeb529ef81f4

SHA512
aa796c8420f0607799aa9bc2869605684ae6b9aab7ccc9ce3e969916725c036a0d20b89b684a0d91ffe251406e6527f51fa9e15c01c4a5bde7672cc7bc790880

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\20a60ba3-4e69-4110-992a-94d391cf14a5

Filesize
745B

MD5
4e22404b8a27878b941900f6034adbcf

SHA1
284a7efaa2378e4fbc36818d8e4cb8e92cf82408

SHA256
efe18c1669bc0273ff63a97881cbbbbd73db6ef359296cb18c0af296fb3686e4

SHA512
9ca587c3ac1ee99b33f16ebd59f3cb581353dc08670f7e3199f2586169f1d6acc93b65bfcb603dc6d50560124609491356ebd5e91fdaa0c5b77df53dfb10b3b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\9334d801-b9a2-4a46-916b-f1c9bafc5837

Filesize
12KB

MD5
667510a6e5dbee2753f2199b75c360ac

SHA1
521e179f9b69955f59fc2662ed3fc1826ceff092

SHA256
85cc4cd1a88d4b626f3962fa497301da8e10d7e84c6c1066763f1e689b1392aa

SHA512
674f7e37a61491170b58aeb58a69a7c9c7ac9b6c0242feedda08e20e3a64a0e9a2d9610cfccff70fdd75bb2f0ff6122fed255711e47dbb971cbb51a534e0fda2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
6KB

MD5
6d038d7fc87c17c73e896739d87e2588

SHA1
d0115ec27aba950b1f7ca7b70274e834350b80d8

SHA256
49e5000b036f4f175eb34650865382d76bb4834d6c3050b305af71e5e5800e8a

SHA512
c850faf307cfcfcf09dbc63463fefbfc9b6e2866212fb23c7707bd2723f248f32d60602c112fd94760646e0b8883364f578a091bdb889095028c73eb146c9bc3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
6KB

MD5
3a8cbd49462d2ce691e84f2c8d338f81

SHA1
64eedd3a95f55cba99eff3d3d2d1130dafd03195

SHA256
22cdb762abb03dd363f0dde6562d59857778762481ee3232de4170398ff24d21

SHA512
78241985044843c3fbfb2112edbe7e1a67ecb4e11fb067255f85720c2773d086c0f17fffc94f038970968ae8b51bd1667470eabf8409ba9c5209e023e708cfc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

Filesize
6KB

MD5
68e1e02f7926fd96964364e3e444447a

SHA1
7c62be1fe91b5d7414105664de68c2ea1c4d5d4d

SHA256
0b024d3731f1bed886343b4c55e575e408bcd52da3e20cd668aaf3c013ac9d97

SHA512
58263f519be3d33bd7da15955656121f38f8f64d14f870b288ecd4387450b2fda5596e2b0ce26d387a2dba51ae3471d8b51bae6bc73c9b55602d2585a9998343

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a78a5c0257fa5aaa69f8258165af4efc

SHA1
5e2d17d8772b9b71c167ab592ec62037bb508309

SHA256
d8313d8f7cc5ef4dd2dab17643c68b6ec2057ef2e4367287e2823725eadc8028

SHA512
0c291877760c58fde412c7395550515f32a32ec37c5b29fe8c92f4524e057d4fed39ff0e5eab93c521be0fa74ea469561c3c05aa78c7b0febeb1ba5c8b7fac49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
ff9f1faed224e83568a4f62393effaf7

SHA1
fe8138ed20683e1b41e98074cf0d71a02dc98538

SHA256
44b6df50e03b95350a0ff6e2240444c58699821c1eb32740fef0899205eade0e

SHA512
970dd473ec7a19792e3c8f4f37482b0461db42f2280cff7b3fc36fe96618d7c0f6f1a5bc4946da3e912bb40b2b93c48525e51897cbaf79706825ad910eb943af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
8ee0c9e688592917dbb47bcc7ad1c544

SHA1
996b21343c5f7ad6860403ad75a07eee8bb04c3a

SHA256
16e373b43cac8780eefe492aee52951007ce92b8affd756e983263130274ca82

SHA512
f8f66996af5dff3a493ebd01ee66bf023cd7fed2d426f6a686688a0c7fb3adc720d54bcd45f03ea03ef696b2bb8cc5963bba11915022f287fa088f9cd307dc99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
b757298f51aa916884ae2d97822a16b7

SHA1
c20035e0ee7d4451d04e0f6a40b10abcb3955f37

SHA256
9a8672c1ae5fb4d49789e0aa67549261367b5dd7a46c0dee15dc465d3543c1a7

SHA512
14652b4a787a1e12d859c717cd7adcda28535edda96771a9806b166cb2ba31390e4010c383eea0ea4035960fa4b4d24c599f9d786f7a1a7602415402e002b695

Download Submit
C:\Users\Admin\Downloads\Bonzi.VHuvexZD.zip.part

Filesize
16KB

MD5
d8e7c2a5590afd5fe077bb590b3e1852

SHA1
f125c958de0e4fbf110744004e46eca8e48bcb4c

SHA256
61b3e13923233197845bd5d56b4a968fb53bb3564049575a3eb245a3ecf1361b

SHA512
a9e9fdb00160eb6f56e0d9fdb10d93cc8aa7826b3a4a35acef0ab6a0490f79bca77b19267a8330435970829a91cb503169fc543f1aec24eb79268c195565888c

Download Submit