remcos | fa9f629254a8bbe915bbd587c0c060de580a18992103858a1d16686de8bd717e

Analysis

max time kernel
808s
max time network
790s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WaveSourceInstaller.exe
Size

469KB
MD5

e468b718e67495ea73c85d8258059adf
SHA1

dcad70f5c39ab85f900ef1288067dbf51eaeb503
SHA256

fa9f629254a8bbe915bbd587c0c060de580a18992103858a1d16686de8bd717e
SHA512

b4eb6cc848b5ebfc6bab7e1cc033ec468bc8cf2fed72ea912f9fc60d6eaab75664f4627646960dccab2aceefeab9c5acbd2fe1b57d992c62358929b4d840dedb
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSJn9:uiLJbpI7I2WhQqZ7J9

Score

10^/10

remcos wavesourceleaked defense_evasion discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

WaveSourceLeaked

204.10.194.175:4444

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-46FS9Q
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WaveSourceInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 10 IoCs

pid	Process
3312	remcos.exe
388	WaveSourceInstaller.exe
3632	WaveSourceInstaller.exe
5232	WaveSourceInstaller.exe
5456	WaveSourceInstaller.exe
2252	WaveSourceInstaller.exe
5612	WaveSourceInstaller.exe
5492	WaveSourceInstaller.exe
5776	WaveSourceInstaller.exe
5964	WaveSourceInstaller.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	WaveSourceInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	WaveSourceInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 3504	3312	remcos.exe	87

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\WaveSourceInstaller.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveSourceInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaveSourceInstaller.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	WaveSourceInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WaveSourceInstaller.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3312	remcos.exe
3312	remcos.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3312	remcos.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeDebugPrivilege	4672	taskmgr.exe
Token: SeSystemProfilePrivilege	4672	taskmgr.exe
Token: SeCreateGlobalPrivilege	4672	taskmgr.exe
Token: 33	4672	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4672	taskmgr.exe
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeDebugPrivilege	3832	firefox.exe
Token: SeDebugPrivilege	3832	firefox.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe
3832	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1432	1068	WaveSourceInstaller.exe	83
PID 1068 wrote to memory of 1432	1068	WaveSourceInstaller.exe	83
PID 1068 wrote to memory of 1432	1068	WaveSourceInstaller.exe	83
PID 1432 wrote to memory of 208	1432	WScript.exe	84
PID 1432 wrote to memory of 208	1432	WScript.exe	84
PID 1432 wrote to memory of 208	1432	WScript.exe	84
PID 208 wrote to memory of 3312	208	cmd.exe	86
PID 208 wrote to memory of 3312	208	cmd.exe	86
PID 208 wrote to memory of 3312	208	cmd.exe	86
PID 3312 wrote to memory of 3504	3312	remcos.exe	87
PID 3312 wrote to memory of 3504	3312	remcos.exe	87
PID 3312 wrote to memory of 3504	3312	remcos.exe	87
PID 3312 wrote to memory of 3504	3312	remcos.exe	87
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3512 wrote to memory of 3832	3512	firefox.exe	119
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120
PID 3832 wrote to memory of 1504	3832	firefox.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WaveSourceInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveSourceInstaller.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\ProgramData\Remcos\remcos.exe
      C:\ProgramData\Remcos\remcos.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3312
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {217c6b80-c734-4b65-b506-6e02318eaf8b} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" gpu
    3⤵
    PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7086e77f-f598-4be8-a6cf-a35821e14537} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" socket
    3⤵
    PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3004 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {157dc5b9-892b-4bc4-9789-3070c82c8fc2} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" tab
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3972 -childID 2 -isForBrowser -prefsHandle 3968 -prefMapHandle 3964 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e4fc3a9-aabd-4790-99a4-5e72ce8f0860} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" tab
    3⤵
    PID:1660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4972 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5000 -prefMapHandle 4996 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {128c4f65-ac3e-44f6-9991-7325c5237d9f} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" utility
    3⤵
    - Checks processor information in registry
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5000 -childID 3 -isForBrowser -prefsHandle 5260 -prefMapHandle 5256 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1cb36acc-e98f-4c4f-886b-87124601a2b9} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" tab
    3⤵
    PID:5508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5480 -childID 4 -isForBrowser -prefsHandle 5400 -prefMapHandle 5404 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4a412f0-cfc6-4b6a-9372-4dfdfa37ff48} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" tab
    3⤵
    PID:5520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 5 -isForBrowser -prefsHandle 5676 -prefMapHandle 5672 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6577bb1f-f110-41d9-b619-90e543e97775} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" tab
    3⤵
    PID:5532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4156 -childID 6 -isForBrowser -prefsHandle 3596 -prefMapHandle 3588 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6617f5a-69c3-4f8b-aa02-f8545792ded7} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" tab
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6108 -childID 7 -isForBrowser -prefsHandle 6180 -prefMapHandle 6160 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c02be78b-3760-479d-adbd-83b7fb240565} 3832 "\\.\pipe\gecko-crash-server-pipe.3832" tab
    3⤵
    PID:5348
- - C:\Users\Admin\Downloads\WaveSourceInstaller.exe
    "C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:388
- - C:\Users\Admin\Downloads\WaveSourceInstaller.exe
    "C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
    3⤵
    - Executes dropped EXE
    PID:3632

C:\Users\Admin\Downloads\WaveSourceInstaller.exe
"C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
1⤵
- Executes dropped EXE
PID:5232

C:\Users\Admin\Downloads\WaveSourceInstaller.exe
"C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
1⤵
- Executes dropped EXE
PID:5456

C:\Users\Admin\Downloads\WaveSourceInstaller.exe
"C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
1⤵
- Executes dropped EXE
PID:2252

C:\Users\Admin\Downloads\WaveSourceInstaller.exe
"C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
1⤵
- Executes dropped EXE
PID:5612

C:\Users\Admin\Downloads\WaveSourceInstaller.exe
"C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
1⤵
- Executes dropped EXE
PID:5492

C:\Users\Admin\Downloads\WaveSourceInstaller.exe
"C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
1⤵
- Executes dropped EXE
PID:5776

C:\Users\Admin\Downloads\WaveSourceInstaller.exe
"C:\Users\Admin\Downloads\WaveSourceInstaller.exe"
1⤵
- Executes dropped EXE
PID:5964

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\remcos.exe

Filesize
469KB

MD5
e468b718e67495ea73c85d8258059adf

SHA1
dcad70f5c39ab85f900ef1288067dbf51eaeb503

SHA256
fa9f629254a8bbe915bbd587c0c060de580a18992103858a1d16686de8bd717e

SHA512
b4eb6cc848b5ebfc6bab7e1cc033ec468bc8cf2fed72ea912f9fc60d6eaab75664f4627646960dccab2aceefeab9c5acbd2fe1b57d992c62358929b4d840dedb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json

Filesize
18KB

MD5
289eeca1ff2dbffd3a0cf2d8c41c6cab

SHA1
0f2b36a5cf61baf0c0a28394ee3361088cbaf934

SHA256
7756f24a574bcb46a8090ce266d977468f7c1ac6aa05137d0aa5825e34422760

SHA512
399c95948d5191fa5ac34d6c98cabd4fd29db6c1bd070ced37952198795d4dd8e1302d1e6d2c351db18385304928e7424bf81449a9ff00e0dfe61d915c3c2c43

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\7B3517DD0088CB493E43CA8924C574A4EB6AFD11

Filesize
12KB

MD5
c43a78d4422887dc8b7cc85c9d3d6891

SHA1
620830cf318c23298a89ff6705a025143c325519

SHA256
d460f4cd51fa38bc45165841fc132663f558137cb1cfc2776365dcbc61274914

SHA512
ca5e6c2bd56207822ecbf3c44e08baf47ee434398a058bdf4f31c52c0e330fa82236785c064c5d0fcaee7b0c1b921cdb62632858b49546c1693452f8ce984753

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
386B

MD5
1ec6289c6fd4c2ded6b2836ed28cbeb5

SHA1
c4e08195e6c640eb8860acc03fda1d649b4fe070

SHA256
6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2

SHA512
20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\60S0KBEJ5D6693V6ZPEJ.temp

Filesize
9KB

MD5
d4f42a5c57efb378244b2f69b9f22ce8

SHA1
cc8f82bc8d3dc459279f5f0fdd2451128d5641eb

SHA256
a15344dd789f0d38abcf2da39bfeb2d00c67a5af8316c92756401709cec57836

SHA512
6d90b9d3330a8e7651d982334ce1a1e9cb9600d86a0d8b3532065421ed000030f24073ec7fa689b7b3e4dac264a92c4768ebd2e8b698cf7e84d48e99d83658ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
6KB

MD5
e0f97a420991005a48f14ebefdab7185

SHA1
6bec61945673f17f8886f05c4b53c493c4609721

SHA256
a684d66b9ec90c981d5349f69ced924cbc723e1e3c6d3eb2082eb156a7c60c54

SHA512
e9a703044055e1b3cedf7759fc9208f3f160e2205d5fee1f6cbb81f757007e39f4b31e92ff4f354398af707d3fa13884dec8f83b2a51b78e673e0b880a806c12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
7KB

MD5
39d2e7ad32cb21bf1291989c652e8934

SHA1
43d9bd42cf07350dfae6403f02311b96c410f6ed

SHA256
0739d0dd00868dff0e88f240519a048d580a34a978275d195092e419014bd725

SHA512
56a1e429b08366c9b99ca13240bdf263a65161bb178f39ed327976439fd0da180d2fa44db9722d80eece54ee6403ca19eaac7b4cdf1265321723a91757815ead

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
11KB

MD5
862d66da86670f22bc7fb336373d5ab5

SHA1
8f234af5e9132c584508f0470ad8b0a8a4cac77d

SHA256
bb1ca6548efb96a77a0f6ea367e58df964035cfb7590df7a4cac507888abee9a

SHA512
5ef47273d708b67a8cdbc6b9e954548efe0cdbd39b1e1a72b7b02334edacce8ca5338b634f9c68e430b5acea870f63ca6301f14ec6d00f091ab5b811f053fce8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\bookmarkbackups\bookmarks-2024-12-18_11_0dYJilnRbTPf8ChZMtb1FQ==.jsonlz4

Filesize
1005B

MD5
336df4886474cd5ec4a4eb3a44da6dda

SHA1
ec52bf0091ce5b0df4c1ebe5ab5b465d82c49281

SHA256
8c1c352caceb2738dd16ab151a5dbd7c3521613a243ce4cbc2d7292321c26e16

SHA512
20a9590db6267c5f74993d9339526345c2b113b31cb2fd9ad98ec448c7501dc6eaec7e5f811c6ab24e08b61353f636d99734960df8bd862088eba4e1ded4ce75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
6c7ea82fac22f08ef845bdf358935e18

SHA1
445b0bbc6aa327a10c72138fa34d0874a61cf19b

SHA256
1f9c2d236825d5b5e2fb40772cb0ea0d05518b23c7e0454a81ab3090bd8ab572

SHA512
03b4dcca7e528f0c29764efc761c39d4a8fdb2907371da23ce26d7ed57bb6fb6b67e0c5cdc0392f4ce7911a11f7b849654c188bf29c2e30e8be35450222c9270

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
3872dfef2683437121690a9823e77772

SHA1
e2ca596270ffeda65866e977b6260b11ca31b4e6

SHA256
08856d227b67d2eb947fd6031f791754988a4257595793778eaff34b17641af6

SHA512
d6c971ed8e16c07666d856f45ee4cc41822f5e905184319d11d5a93bb1ebaddaa6ffb3c18adceb2d8a38cc8b4c427049b6ae0a31b457ab7886d8b2cf299e6a2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
35KB

MD5
d9fad4f369e87378c26bd2a222181ada

SHA1
83a2fa0815f9a1adbfc429d4d4923dadd9b353ef

SHA256
7a7b2bd9cb5bf4fd7cf765d86b94978bfb3de776ee40c00ef0a4137f13d903a7

SHA512
c83efa2fb23dcf5777548b4a325acfaf1a385f34b55fade9a9dde8aab33b41e568eed827e4b355a1c42b28bec10f89764ef870b7f610b913ff65feb2f2d068c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
c812d772e90e21e1dac136fa08f32245

SHA1
adb3c58a0a741cd1df84737237f1b1655536c600

SHA256
642b02045b543bd36ed968ee81de53cf92f4bb9abd7049b37b1eccb77c9eb22f

SHA512
08b868d2602f6b794e72ba4a7e6ab481bdf1b7dfd9bd597c6d30ee939193ed660985ce841c0aea4223f9450180b1b6c97a21521178c1a480c66af27d84041ef6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
4393ce3e0f5d49ffb68b5224941b98bd

SHA1
75336197ea2016f5cb743959596dfe8273769aa4

SHA256
42b9d6ba15a2780d85dcffc39ea71b0489905a02877453ce5aa1233bddb06d09

SHA512
3e45ef0727fb62834ef94bde88f0b6f6de11969b15b1dac850f34b25d4b21d1adfa43468d47eb2f761125186587fc0a032867bba831f5cf3e1841858c61924c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\44542cfc-63cf-4cac-a5a7-4b02c8e64d94

Filesize
982B

MD5
ec3a79a6d423f04fedefa9a4e9785140

SHA1
33b8d1a870379cfae68dd349ef63e1606a69c263

SHA256
83d1e4e4de1b8f946cf9b385b05b73897612ce0672bbdbe0cb9bb2f949d760d7

SHA512
d7a4a7071f74686dd8331755dd84df1c5c881914b8d653d297f6690719de425f6481f2fe13859202ba1af73727ad13fda2138b8b123efc780e2aceaff2824001

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\4f31e58e-d72d-42df-a9c3-1b1097b3b963

Filesize
671B

MD5
b02056fcc18af229451074c247359f08

SHA1
305dda4ff56422ba17e5f3f355cb756fe4df0e6f

SHA256
11dbecdb396cc61c4b7e3bf7a9381c32d14585e0bb6f527213388cf7a12374a7

SHA512
e6eb57d7e8b02479bb4a0dcd3427d15bf0a2278228e364eb6d67aa2dad0365b81d90bf442f3976bf6a8a8bcf2615f44a397f70a323e9979645e59cb91bdf2b21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\deb3ce9a-c5dc-4a54-8040-c78783ce450a

Filesize
27KB

MD5
aebef8ada59bfb39f6e15893816c0b5a

SHA1
7df966c312b6fb5cd79b517f953d6fe1befd02bc

SHA256
02b3f80c25e3fd690df29edae5a4f392fdb8f4bd24e47c04d424861aec17d260

SHA512
bd0baa23ada01e7264b282d583f2297521dcfae40f321998aba46a96a84ddca9169c98adc461a2bfee99ca84b3766f817821a8db34b24153d82e75d737c05a2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
11KB

MD5
438b7a7ac587e13c3a5a885058e94101

SHA1
1e1ee21d5525a8e959d2625c219cf156433a9dda

SHA256
1197e0ed9a4d72136945e99d3eb6dd5c1bae9221d56e6a2efe7b12e970b76aec

SHA512
98fed7c8fcd87c25325c266557dae1b1cb53e675c3edfc8166c76fa28f837268307dd6063afd8e813495a2b8d94e9b9109a3a7e94199f77e482024754313bc1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
12KB

MD5
9f00a5cdc9328e5a8353588e61ba8947

SHA1
aed112b6d65e1a6e5786550dd006e2c27a77685d

SHA256
dc528e793d27f601375a2b050a2bbd54a565d09c96b5ecbf8704bd84e29f1f22

SHA512
6c13698650290db721ca2ce6d12354cf85a20eebd9a6c901f3a9eaa8edbb26e13f001845482c51608398e92895f11a8cb703274bf5698b9e964ef2e287d04f15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js

Filesize
10KB

MD5
1ba2c3cf93679a8c39b9d9c0adb66759

SHA1
6cc1c54ef8a2670f303d04ec04ecf84ad9dfbef5

SHA256
a2dc7ab41484afe0d95e159fc0bf7221a800339127807f5f0ba407093609816d

SHA512
b77b5fdeca7182c8ceb733b918b5c064459269063b343e01feaccb16aa49ac5774c06317212d4071d32273673cb042e5c2a4e9e5b59bc19f5fa495649238e0c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js

Filesize
11KB

MD5
64ad6c767c1eee983c1106b9af390c7a

SHA1
c872b57dc148442355ff74310b088a1cbe1a423e

SHA256
2c3fa316fc8a64f776f6770455a2a92206e51199249894f5c78e051b57c8dca7

SHA512
b712fe147373ac96b7aeaeecfe5031619c0734e4e825fa18c686a32d4bc96ca59bdf19606ea7b544759de989df93447df5d56eb071cd07f94f63a68965468a94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
f46b9ff6567ec0c633c907e834b61658

SHA1
aa9ff76dbd4198440d45c4d37fe4ec3027fe8411

SHA256
ca9f7878d4f85e2622083682578f6dbe6b45b4e661ba87170639576b04898d33

SHA512
04cdc4e3c541fd5bfb4502b78b796503fbf8cb4428ccc47ad4426219d631c162903c963b7db8751b3a45f7e59452cf3530f912c372bcf31ef8d759169581aec4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
5704019a2a9baaccb5d21423ae08410c

SHA1
a2b1dce7807b44372f1ef1ac9c8a356e691b1be6

SHA256
c19c8bcfacf75593dc8087d9aae0f7738ed8f2d6770db0c609c9797eb0f02d36

SHA512
63ee701d96cf0d542d6bea83845eb957b7da8fcc88b72dbbd71dc1a6b7fee2e25e49fdecf663d9ce1a66c9da22137f3cd8fb37b67a6a5fb55343434f1bd379e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
efe39dffbf3f86f73be01bfbcef40dd7

SHA1
d800d6065b795c57191c0cf1f10538b37ab99a8d

SHA256
71df4d7e47bbdd9c8e2d3e8fae88974534e52898804f4ec3675f772a32042df4

SHA512
b29d854f7dfbdbbc5acdbd65d45d3a84232ef52fcf145a81d0bc31c4a256e0d82a6acc10b52cd46795151aef5088de2af1638f25813032eb2d891d3f8bffaefc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
69bdde65888ced6ccedda852bbda742e

SHA1
2c1a3fb372523ea89d9629b34327040ed436ab2b

SHA256
1172a14158f8d510bb49fe181ac66a9e1c99a60fef2970af9d5753b379c788a2

SHA512
5b085bc03c639b30e29d8053f62f885e5096744306e451eef26c4c48b74c260e87f5b467a4eec8bed230fff4ca1baeadfd2a3e8dd2da187007673d5a5c338acc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
9dd4b18310b4817da21b455db7dbd1a0

SHA1
6057928dbda66c30b9536af06026e9af9a1cc647

SHA256
6ab2fcd056cb38e0b5c7b5b41800e52e40f473f9339bbd098949e00ad54af015

SHA512
0472d5d059a90357e0d54dec89f52105f957139fbb7ee3fe3a76d9085100482d99f828f9f35e196667ea8b3876a405b4634184f7488aaa06a9d1d02d76d45041

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
c8658d528b61ed9929394157042cb3fd

SHA1
2ec7c04b527d7548e99364cc5961a96da9e101bb

SHA256
03a2feab3cb746ef0d084cf56392ac589b2944355bd94797a7eb7953e36b06c6

SHA512
77a751113031620febe193f539f781c49d82fefb158c54c17ea7854dae12f64766edcf5af143ae48848c492c3ecc10372dc9b9865d49b45c7844b0a6ca17efcd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
600KB

MD5
fae2c17a007169d997fb5f94a6f40599

SHA1
cfae1e079c3ac592b503ced789d98031847dd24a

SHA256
7f718781e4a32884e052292deea240140507701575da8c459a2f97d6498fd241

SHA512
92a64b7aafa81f8cc01afc2960bc5c47197e3c1398bcaa65a8ef2bae8ff3bdd25fbaedbe00f1291bd4eff1b191beedf4303327334dffac7225bb65335bc8e8a2

Download Submit
C:\Users\Admin\Downloads\WaveSourceInstaller.z26tO2In.exe.part

Filesize
7KB

MD5
bf77224fac2e0b66c65f5885465fea2a

SHA1
60eb23f07f63cc9b85d63ec52990d40eab62cbf0

SHA256
622821fc5226c61e85687d1fa19161170c59bb14da89821513c6ed85f3c96ccd

SHA512
2cd137a0b3889883c85a75ec9d0fe990e2eb409c0d401d6b2ffa71711ecd8d992e566f4f48bc808801c18ee98617684401af3debe65cc562a940c547342669c2

Download Submit
memory/3504-655-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-10-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-385-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-23-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-22-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-21-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-20-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-560-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-561-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-19-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-577-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-578-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-805-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-802-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-801-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-791-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-790-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-789-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-788-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-8-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-771-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-770-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-594-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-595-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-603-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-620-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-619-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-16-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-630-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-631-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-14-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-640-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-641-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-15-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-653-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-654-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-13-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-656-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-11-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-12-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-679-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-680-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-681-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-682-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-702-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-703-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-386-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-712-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-713-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-9-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-768-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/3504-769-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/4672-587-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-588-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-590-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-591-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-592-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-593-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-589-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-583-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-582-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download
memory/4672-581-0x000001EBDBF00000-0x000001EBDBF01000-memory.dmp

Filesize
4KB

Download