hxxps://cutt[.]ly/www-roblox-com-games-6284583030-HOLOGRAM-Pet-Simulator-X-privateServerLinkCode-586425554071435303059157964372

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2023, 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cutt.ly/www-roblox-com-games-6284583030-HOLOGRAM-Pet-Simulator-X-privateServerLinkCode-586425554071435303059157964372

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9D50F2C7-D078-11ED-BDA1-6E9A6C474791} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	firefox.exe
Token: SeDebugPrivilege	4560	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4560	firefox.exe
4560	firefox.exe
4560	firefox.exe
4560	firefox.exe
4560	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4560	firefox.exe
4560	firefox.exe
4560	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3944	iexplore.exe
3944	iexplore.exe
4560	firefox.exe
4560	firefox.exe
4560	firefox.exe
4560	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4288	3944	iexplore.exe	83
PID 3944 wrote to memory of 4288	3944	iexplore.exe	83
PID 3944 wrote to memory of 4288	3944	iexplore.exe	83
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 772 wrote to memory of 4560	772	firefox.exe	90
PID 4560 wrote to memory of 2396	4560	firefox.exe	92
PID 4560 wrote to memory of 2396	4560	firefox.exe	92
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94
PID 4560 wrote to memory of 5112	4560	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://cutt.ly/www-roblox-com-games-6284583030-HOLOGRAM-Pet-Simulator-X-privateServerLinkCode-586425554071435303059157964372
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3944 CREDAT:17410 /prefetch:2
  2⤵
  PID:4288

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d60e9134d93046498c26dea7a3281e1a /t 4528 /p 3944
1⤵
PID:3284

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4560.0.450459146\1820731665" -parentBuildID 20221007134813 -prefsHandle 1812 -prefMapHandle 1820 -prefsLen 20812 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2f60f4c-2540-473f-bc7e-5cf74da93e87} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" 1940 26926bed558 gpu
    3⤵
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4560.1.1260643933\111445612" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20848 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71d03c7b-bbaa-4159-914d-15c80ddde67e} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" 2332 26919d71f58 socket
    3⤵
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4560.2.1089502818\1463226350" -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 3036 -prefsLen 20931 -prefMapSize 232645 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df15dc33-da4e-4ae1-a1c5-2d9c8e05daf4} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" 3048 2692a8f5b58 tab
    3⤵
    PID:8
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4560.3.525210228\383127724" -childID 2 -isForBrowser -prefsHandle 3272 -prefMapHandle 1660 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75e7c6b7-4758-4315-a546-d3752cab20c4} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" 3472 26929180f58 tab
    3⤵
    PID:4160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4560.4.77885143\1730179612" -childID 3 -isForBrowser -prefsHandle 3868 -prefMapHandle 3864 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2bd25c8-8ce8-4765-bb2d-aada8ff799e7} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" 3888 2692bc7f258 tab
    3⤵
    PID:3048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4560.5.1892901273\1014794443" -childID 4 -isForBrowser -prefsHandle 5032 -prefMapHandle 5028 -prefsLen 26579 -prefMapSize 232645 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61f20d53-5050-4a82-ad62-ad7f7f85f2a1} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" 5020 2692c44b158 tab
    3⤵
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4560.7.672871727\1261484692" -childID 6 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 26579 -prefMapSize 232645 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a36f91a-070e-4d8a-98be-cc49f6bb1bd1} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" 5192 2692c44ba58 tab
    3⤵
    PID:1108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4560.6.1295330342\952641197" -childID 5 -isForBrowser -prefsHandle 5044 -prefMapHandle 5040 -prefsLen 26579 -prefMapSize 232645 -jsInitHandle 1472 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3703658-852a-4ab3-b443-34fe7f051292} 4560 "\\.\pipe\gecko-crash-server-pipe.4560" 4384 2692c44b758 tab
    3⤵
    PID:3352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\activity-stream.discovery_stream.json.tmp

Filesize
155KB

MD5
e046c30a59ab2654d2c5688a93c36ca7

SHA1
a406babea1ffdfc68a28f05a38e8e5b4a315de2b

SHA256
403bb71edaf7e6d92edf785c2aabd5b5bb0ae0fc0201e09f4fcd5b34823444e6

SHA512
6679abaf372e27e8dc794b1980921df1da69307f28d4e729e2e65d1ff0d6dc80422a968208ddfed9f0a40bbac05efbd97c6dd92c7af63ff3a183afe4170c64b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\13009

Filesize
9KB

MD5
5b5f958282c302038fa62ff974b9cbee

SHA1
00294275aaab9839e43e4c1ebd59875b432d1bc3

SHA256
509cfdd893efa9149ffdb6a0eb1d980c0f65fb84330af6e62cbfaf041ef1a512

SHA512
41eb48baba3c3e01f6e1f36a694b88e6949e3bd405b1018b14dbf314b8edd58eb67115200dbebb8712eac5ce44935f2583c957fa7ef95b2d280d9c1ded0b4110

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\D5594A2648EECD01993B5C42919BA64ADBF56052

Filesize
14KB

MD5
25e2f0631a16339f7f69f5bc9e19e484

SHA1
dfae06a2b966f92042ea6145d2225207480a495c

SHA256
b991469bec2fbaaee705d8551c5ebca2aa41870bfc1afe762699ac72003b42a2

SHA512
04392ac08d26c6cffd11f4342c58f9e48a0b08d846bcacbfeda2baecd6da53abd81ec25fb2c84aee1ab9634fac825bd4d0e99ba153dc71c4a5f1e21387f0651e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
f0fd6e56e7db738263c082a536acec17

SHA1
e790686fdad6fb054267d4d2e5f7b58132d047de

SHA256
0790d146d28025bd0276448c3c812cc86c48545f761ed4b8c342f904c8244e69

SHA512
a233c39c91ceb03b80892ae4264071983870bcf5a590b46b5eb53a9b7a83b379f12b14f7588671370466f34c8e19543db832e432a39f0efa9a795e6f83f318be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
09559944f99f2e031b9a64ca10210bf1

SHA1
06c5046a340f0a4b210e763add348b7516966ec6

SHA256
98564e9b8ebaf07f93f74b04c64f594989e29abe2a95d60a4c0a6e8a0399866a

SHA512
f7a6f188d0775fd923940091734d1c572c0d95bda1fe674e4a554c87cbd50711663708168f553e26406f48dcc6be1594c996e9ed5f84aa31823bffb8b7d8b067

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
e89d808aa28985db865b188f27f6c555

SHA1
dab9140889f00dd8a9f0d15ec7f85da62bd5847c

SHA256
12a8e3b231de1be0cbe032f6f103ee29a45ee74cb82e2414cd039ae2d58d04d1

SHA512
4b7f20e3e8c20f2d45b39d9fd48043b6095e9e744b3c63bab7fdaba3173ec046e6be1ee71bd8852ff661e0503a34d13d5e362da68f93470ef6b2a1c52508409f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
cf28439caea303a9e5a78c2d7a6edb68

SHA1
14b20dd2352ce14278fb74826f67d93df3fa341e

SHA256
1342018f8bb57ea30962902335e459a9a2f132ae52ae0dcfef46a76afd595217

SHA512
43564083d803e72d01cf31e084e74ca73f332c5e10bca77769a938cb942ce20917aa70c3dc50af724493efab5c3c714d78b6337c7e4a7e47c1186fece95a60c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
fc7adea09317e5475c0c0f9da3073894

SHA1
2b3ee9a94d1db28e1c0d9f1632ecb9e24efdcd49

SHA256
d87572aa1648a2c4a2664e75d5fc2f7048245844684947bf7f72d92c5a73cbb1

SHA512
9af7c4531363bb8e568717e384ab8befed07b1593e29b18ad63407beb8155cddfe981ecae4641e14f9b313684bfcc235b516ebad42126b465eefe7925e643d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
7KB

MD5
c8119656a6664bf9e4d101629aed2856

SHA1
da3644c10a577af0339ff07f77d64135b689b43e

SHA256
ceba03e600a9f5f23316756c68c9f890be497afad8996e02526c094d276670ba

SHA512
1d69a068dec5c9659370e6e6ce618bc22fb575e407f7785f399b944aaf283ff60a9b3a497254b1b990331dbf3878bcca2ba545dd4f35a2de90a1a6ffed3935ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs.js

Filesize
6KB

MD5
9971fa8fa89a208685d3e30835832fb5

SHA1
5d9972a3bdbd4c18b3648597d2fd9f9fd6e30300

SHA256
13417a67a65fecc73ad5acc94d17d8a6fac3b0a343daf12d1cd2d126b9198084

SHA512
02b107e0d9449fa2d4d3655a880fbdeea4477205fa6c21aaf641c3d358353aa437cf040ec842107f973253bef767e48b9a0267dea5ed2d331aa192ef540e3b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
08e804a49856af45b6296f083e08e7f0

SHA1
5a4c38d55b6be0ff6a423bfe461fcddbe135325b

SHA256
7d736a9d74dc80954f02b179f192af2b71565ecb4b167d8201fed9a1206e21cf

SHA512
1051b95177a80bc20ffb483b086e96eb1237e62ed4a0fcd0e1a1da9e8bd41f733574dcc5866fa3dd8b86b8aa98d9bcf18e6397e80304f66eb32cb93ebc3f2b92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2745a8923aa01a162fb1510c424cfed7

SHA1
98916f76a83a019ce9d369087c58bd2ea88b8227

SHA256
31a098973ea30946226eddb6962016cd37a6ce4039ef61e3a46324ec9cc839e0

SHA512
e19d1e79fdc091268034e6ce2ee0f6e7ed844f0bcafa5b7d130b5b2237789619ba063208dc62f3f62fd2d22d94d5b1b1557f6842d83594e15dc72db5d05b56d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
8e4c82ab42d612e573b852735818d2a2

SHA1
ffd199a936d082d5c9fabbb232c8ff578a4f37ef

SHA256
9617ebbecb699ecc4b5025a141c74fba304d40af1bd0375d8e31c439dc02e6f2

SHA512
468646adfb3dc3cf4683145d87865ed701fb30027837be6a808f6c278dce356b39ed7cd463e0fc1937c46143e20c4384100c72686419f039d5c10964b4ece7a8

Download Submit