39b899eb2e032c099d5011348ca54c3212a0732a1df9e21fa54f9af22394240d

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2023 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trauma..exe
Size

111KB
MD5

e63902231216ab8f0251b6671e20c57e
SHA1

00dc44778b35de171f47783ab27494dcc460d296
SHA256

39b899eb2e032c099d5011348ca54c3212a0732a1df9e21fa54f9af22394240d
SHA512

8dfcd1835159197c822b3914f43bd691f4f9455e04f993b0a9b190cf1fd63088db255b59f73b98d9a18e46529bb5725481e939ea960c488ba79d52b6d730d34c
SSDEEP

1536:g2Y0VNblnigen1FQGpaika1PASjg/oVRHhbY9:g23rbZi/8GprF3jg/oH5Y9

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 5 IoCs

ransomware

pid	Process
1516	NOTEPAD.EXE
4720	NOTEPAD.EXE
3264	NOTEPAD.EXE
4388	NOTEPAD.EXE
3924	NOTEPAD.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4700	firefox.exe
4700	firefox.exe
4700	firefox.exe
4700	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4700	firefox.exe
4700	firefox.exe
4700	firefox.exe

Suspicious use of SetWindowsHookEx 45 IoCs

pid	Process
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1888	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
1120	OpenWith.exe
4700	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 548	4344	trauma..exe	85
PID 4344 wrote to memory of 548	4344	trauma..exe	85
PID 4344 wrote to memory of 548	4344	trauma..exe	85
PID 548 wrote to memory of 3232	548	cmd.exe	86
PID 548 wrote to memory of 3232	548	cmd.exe	86
PID 548 wrote to memory of 3232	548	cmd.exe	86
PID 4344 wrote to memory of 4504	4344	trauma..exe	87
PID 4344 wrote to memory of 4504	4344	trauma..exe	87
PID 4344 wrote to memory of 4504	4344	trauma..exe	87
PID 4344 wrote to memory of 2436	4344	trauma..exe	88
PID 4344 wrote to memory of 2436	4344	trauma..exe	88
PID 4344 wrote to memory of 2436	4344	trauma..exe	88
PID 4344 wrote to memory of 1668	4344	trauma..exe	89
PID 4344 wrote to memory of 1668	4344	trauma..exe	89
PID 4344 wrote to memory of 1668	4344	trauma..exe	89
PID 4344 wrote to memory of 1000	4344	trauma..exe	90
PID 4344 wrote to memory of 1000	4344	trauma..exe	90
PID 4344 wrote to memory of 1000	4344	trauma..exe	90
PID 1000 wrote to memory of 224	1000	cmd.exe	91
PID 1000 wrote to memory of 224	1000	cmd.exe	91
PID 1000 wrote to memory of 224	1000	cmd.exe	91
PID 4344 wrote to memory of 4060	4344	trauma..exe	92
PID 4344 wrote to memory of 4060	4344	trauma..exe	92
PID 4344 wrote to memory of 4060	4344	trauma..exe	92
PID 4344 wrote to memory of 3796	4344	trauma..exe	93
PID 4344 wrote to memory of 3796	4344	trauma..exe	93
PID 4344 wrote to memory of 3796	4344	trauma..exe	93
PID 4344 wrote to memory of 4700	4344	trauma..exe	94
PID 4344 wrote to memory of 4700	4344	trauma..exe	94
PID 4344 wrote to memory of 4700	4344	trauma..exe	94
PID 4344 wrote to memory of 1432	4344	trauma..exe	95
PID 4344 wrote to memory of 1432	4344	trauma..exe	95
PID 4344 wrote to memory of 1432	4344	trauma..exe	95
PID 1888 wrote to memory of 3264	1888	OpenWith.exe	110
PID 1888 wrote to memory of 3264	1888	OpenWith.exe	110
PID 1120 wrote to memory of 4388	1120	OpenWith.exe	112
PID 1120 wrote to memory of 4388	1120	OpenWith.exe	112
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 1040 wrote to memory of 4700	1040	firefox.exe	115
PID 4700 wrote to memory of 1816	4700	firefox.exe	116
PID 4700 wrote to memory of 1816	4700	firefox.exe	116
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117
PID 4700 wrote to memory of 5040	4700	firefox.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
224	attrib.exe

C:\Users\Admin\AppData\Local\Temp\trauma..exe
"C:\Users\Admin\AppData\Local\Temp\trauma..exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con:cols=0080 lines=0025
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\mode.com
    mode con:cols=0080 lines=0025
    3⤵
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c title Window Title
  2⤵
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wtmpd" mkdir "C:\Users\Admin\AppData\Local\Temp\wtmpd"
  2⤵
  PID:1668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
    3⤵
    - Views/modifies file attributes
    PID:224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\i6.t
  2⤵
  PID:4060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\i6.bat
  2⤵
  PID:3796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2936

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\i6.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:3924

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\i6.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1516

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\i6.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4720

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\i6.f
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\i6.t
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.0.97515552\1348507608" -parentBuildID 20221007134813 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32b99cc3-0742-46f9-be05-8e95254e9295} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 2016 1d9807d8f58 gpu
    3⤵
    PID:1816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.1.567676764\1558825419" -parentBuildID 20221007134813 -prefsHandle 2396 -prefMapHandle 2384 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02128d50-d909-4e2b-980f-95e851616024} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 2424 1d9802e6558 socket
    3⤵
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.2.30407088\1622083239" -childID 1 -isForBrowser -prefsHandle 3404 -prefMapHandle 3400 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d83eddd-7308-4ef5-b4af-dcb77b21494f} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 3416 1d984706b58 tab
    3⤵
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.3.971726770\835966717" -childID 2 -isForBrowser -prefsHandle 1048 -prefMapHandle 1044 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41cf06d1-4c55-490b-922a-57498b171415} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 3052 1d985304758 tab
    3⤵
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.4.1801559031\665700883" -childID 3 -isForBrowser -prefsHandle 3424 -prefMapHandle 4112 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33e53044-084b-4dd9-86e3-6f2159cf9f5c} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 4092 1d985c51958 tab
    3⤵
    PID:636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.5.1729229583\2036330496" -childID 4 -isForBrowser -prefsHandle 5272 -prefMapHandle 5268 -prefsLen 26575 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {300b50ab-c096-47cf-b6de-245576c5c011} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 5144 1d98762cc58 tab
    3⤵
    PID:4928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.7.216125325\962324880" -childID 6 -isForBrowser -prefsHandle 5364 -prefMapHandle 5444 -prefsLen 26575 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4892f04-4cf9-4193-a3f4-9b8ae5fad2cc} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 5388 1d983941e58 tab
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.6.1540510289\1635556865" -childID 5 -isForBrowser -prefsHandle 5236 -prefMapHandle 5288 -prefsLen 26575 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1c39e50-b3b2-4913-a684-7ec5dab24b41} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 5144 1d9830d6858 tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.8.1580326858\1614334682" -parentBuildID 20221007134813 -prefsHandle 6032 -prefMapHandle 6040 -prefsLen 26656 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a631320-b80e-4db2-a04f-e000c84d1c7c} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 6048 1d988dd0e58 rdd
    3⤵
    PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.9.2112574237\1752145319" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6188 -prefMapHandle 6184 -prefsLen 26656 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d5c07a9-0c92-4f97-8307-eecd267ac0cd} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 6196 1d987c81558 utility
    3⤵
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4700.10.432621893\1818115586" -childID 7 -isForBrowser -prefsHandle 6320 -prefMapHandle 6188 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0756c65-35fb-4a3f-9d7f-1fdb58003c59} 4700 "\\.\pipe\gecko-crash-server-pipe.4700" 6312 1d988e20458 tab
    3⤵
    PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\p2pa85fv.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
24308305b90f8ebab79b76394dc0b26f

SHA1
dbbb53d88179dcb165926b6df587adac09f4022b

SHA256
086a2c5f85498debd6be4a687e18b252f2f67b73ae7ef74bd55195a52bb74946

SHA512
f849dc2d5c30d9520cc708eb557d72ace184813d88c0e6268d1512368998d9926b9f5a3167983346c97af2d49a4ad1492816dabb55ecc59f77dc9eb85e0b4bcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\i6.bat

Filesize
173B

MD5
0f8f70e88009593eefaa155a8e31b1d6

SHA1
eabcc3f2135e0919e9456da0a4b1084f3382d4b6

SHA256
941c169c07670650fc6c6148c1cae068b69bac209e05010594e164aafc7cdf8b

SHA512
94df468b963f3c9d133a25e1ffa57039fac01fe960f0f738552ca6440e6242ff48d0b410fe70dd05a62e4842c925c9f2b0220ca9eb9cb4ff5490ada443c9a750

Download Submit
C:\Users\Admin\AppData\Local\Temp\i6.f

Filesize
32B

MD5
d406619e40f52369e12ae4671b16a11a

SHA1
9c5748148612b1eefaacf368fbf5dbcaa8dea6d0

SHA256
2e340d2b9ced6ad419c031400fb974feed427cfabd0c167dea26ec732d8579be

SHA512
4d9792a6427e4a48553318b4c2bac19ff729a9c0a635bc9196c33d2be5d1a224d1bac30da5f881bad6340b0235894ff020f32061a64125629848e21c879c5264

Download Submit
C:\Users\Admin\AppData\Local\Temp\i6.t

Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\i6.t

Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p2pa85fv.default-release\prefs-1.js

Filesize
6KB

MD5
3d0a69a6dd29468fabf7feda5b46ea9a

SHA1
f0d10dd54809cae336730443c07d73cdeba2a298

SHA256
35a2d42db6d0981879acc5db0c5777468e1d3cb2bc0b7763156abaaf1b6e796c

SHA512
f0a297415bec652e7bc16fa81fe997da052e3762dae1e8fc4b08c48ae569882d7e317b6fad0786242e1767203b6a2fefd2db26911ee022ab18ff137482080f8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p2pa85fv.default-release\prefs.js

Filesize
6KB

MD5
1be3e1a738b7eaf059175e6bb51db9af

SHA1
13087109073ee04fe74fbe8e1e8c180b6268ec19

SHA256
1eae54f569864beec87765b180e70042b8b5288f275167ff78aebe6223b41b01

SHA512
faa27a7eb07032753b8a00e59ca7d566618c530a806b6c94f43436a3b9f19de7203834c9ad5a8866006add5f4bf727a5604c26e4a48a0d0e2e77971acb3c9fad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p2pa85fv.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
bb05c29b7a5f49b72234efa7ee2641d8

SHA1
27c27d95294197de3542f586fa4fbb00d6b580fb

SHA256
f26917419c0a40d051b1d19b46a37ba2df46ed89a9ce07bceda1204972058748

SHA512
afaefde2a537d5bcac2082ae15d90d596b04b01395643ca3b049fd3e334d3f085f43b1eb4634de384365ae2e93fe958c166561650ffdab1491fd5d935fe7b296

Download Submit