hxxps://cs1[.]cognition-solutions[.]com/media/images/CognitionLogo_White[.]png

Analysis

max time kernel
511s
max time network
578s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
14/11/2023, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cs1.cognition-solutions.com/media/images/CognitionLogo_White.png

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	firefox.exe
Token: SeDebugPrivilege	2312	firefox.exe
Token: SeDebugPrivilege	2312	firefox.exe
Token: SeDebugPrivilege	2312	firefox.exe
Token: SeDebugPrivilege	2312	firefox.exe
Token: SeDebugPrivilege	2312	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2312	firefox.exe
2312	firefox.exe
2312	firefox.exe
2312	firefox.exe
2312	firefox.exe
2312	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2312	firefox.exe
2312	firefox.exe
2312	firefox.exe
2312	firefox.exe
2312	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2312	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2336 wrote to memory of 2312	2336	firefox.exe	71
PID 2312 wrote to memory of 4528	2312	firefox.exe	72
PID 2312 wrote to memory of 4528	2312	firefox.exe	72
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 1660	2312	firefox.exe	73
PID 2312 wrote to memory of 4752	2312	firefox.exe	74
PID 2312 wrote to memory of 4752	2312	firefox.exe	74
PID 2312 wrote to memory of 4752	2312	firefox.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cs1.cognition-solutions.com/media/images/CognitionLogo_White.png"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cs1.cognition-solutions.com/media/images/CognitionLogo_White.png
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2312.0.1804256477\607913263" -parentBuildID 20221007134813 -prefsHandle 1668 -prefMapHandle 1656 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b093378-8213-4059-a331-bcada1e1b2b0} 2312 "\\.\pipe\gecko-crash-server-pipe.2312" 1760 221119d7858 gpu
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2312.1.1011395356\1549883598" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 21797 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca678bf7-8489-4f89-997f-b9c0809c2927} 2312 "\\.\pipe\gecko-crash-server-pipe.2312" 2136 22111903258 socket
    3⤵
    PID:1660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2312.2.2125303258\1683760491" -childID 1 -isForBrowser -prefsHandle 2868 -prefMapHandle 2864 -prefsLen 21900 -prefMapSize 232675 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {191678d1-326e-4902-a5be-7099ce64a7f2} 2312 "\\.\pipe\gecko-crash-server-pipe.2312" 2880 221159e9b58 tab
    3⤵
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2312.3.1116224547\719919526" -childID 2 -isForBrowser -prefsHandle 2704 -prefMapHandle 3384 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {29cbe039-ae9f-44bf-a18b-f752ec47d824} 2312 "\\.\pipe\gecko-crash-server-pipe.2312" 3028 22116e29658 tab
    3⤵
    PID:3632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2312.4.869033032\1864522347" -childID 3 -isForBrowser -prefsHandle 4624 -prefMapHandle 4464 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa1d2a82-619c-41c6-bd30-d0f43c330286} 2312 "\\.\pipe\gecko-crash-server-pipe.2312" 4628 22118235b58 tab
    3⤵
    PID:3512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2312.6.940529346\594624295" -childID 5 -isForBrowser -prefsHandle 5036 -prefMapHandle 5040 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dde3e72-79d5-4cbf-9ece-df223dbf5bb2} 2312 "\\.\pipe\gecko-crash-server-pipe.2312" 5028 2211873f258 tab
    3⤵
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2312.5.1383598109\33473952" -childID 4 -isForBrowser -prefsHandle 4844 -prefMapHandle 4848 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1228 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11cd20f9-3915-4d56-985a-099fff0fd289} 2312 "\\.\pipe\gecko-crash-server-pipe.2312" 4836 22118232258 tab
    3⤵
    PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d25hmlvg.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
3058f9c347a3adc38b786d7bffd62af3

SHA1
1cf6fcfd6f0233ae43f80e2e668f78f1a74b3c71

SHA256
0b4e392798f2d653c223403fb9e4e3bef36c2de49278fc6c1d803bdec8dc8f21

SHA512
032ed7070f9fe745191962849f5cd88e34a59d225fbda1e6fc07397685672ea3d93cc9345b771eac72b077d47f02d1de8944004d85bce3a3db9af48df6a7f582

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d25hmlvg.default-release\cache2\doomed\2888

Filesize
8KB

MD5
012e5ad7ac4c607eedff3772d60b5f02

SHA1
b721f25272c4e51dcb9c8f6165128febc637232b

SHA256
d9232268ea17f8e23a39e6a6bacc27dbf027cc7a49650f3bc131fd93c347ee2b

SHA512
c23ccd8423f86cea9218852beba88916d7abd621ef8ee2750d913d26c52be8e0ee646406a32c093c903c7dc71f5f92258a86b381e83cf68a56d0626dd50bbb0b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\d25hmlvg.default-release\cache2\entries\577A586685F8D27BD5B926CE96132B84424D8EA4

Filesize
13KB

MD5
55772d0587020408a9cb1611822892b7

SHA1
10a169ad455e1a348bf33263d43b0f4bdeb5827e

SHA256
785dfdbb681182486c170e0deae35dc6a2c7da9fb8bdf853b6a94603992efcb9

SHA512
192a3b63200f076e630fa33a87b0a094ecd9eae663a2188cb4c8601012d0b0bfc0a0b501879e71b7e86e180e953b68ce8a40f8c61b1ab66716ab469b14e27ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
4e84bcc545dc9a4e957100b5d443241d

SHA1
880000d90e4180912e678ae1e2342ca18001473d

SHA256
033dd37d2923dc7bc643f6ff4e7af5b7267e1546d0790374ac995a109f453be5

SHA512
564de168174458a3e80d08134f2c6c371a4ef00ce74051d6b94bf8a419dc6c758af6feb37ea1fc665ba8343b81547099d7181835bb2ebf16f9090e113f6b00b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\bookmarkbackups\bookmarks-2023-11-14_11_snZywLmsik6+FYXlWaHcIg==.jsonlz4

Filesize
946B

MD5
2aa5ab431fae9e12a502b516be0a6954

SHA1
df598b890f786c2d48f65166f07f4a2ff22ae2b2

SHA256
adfe16641226cc27d5dbe10a3d3bd1a3d52fd73333cf72e53b90a69a188ae504

SHA512
1d0aad6acaa83d29ed53dbbe6df9ad6100ead841109fbfc3576186a767accac228e1a5e316a3d47dfc852eb62ff3660cb41b1e67f069002b1d6466ea34607aac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\broadcast-listeners.json

Filesize
216B

MD5
440b49a9fac4fcf7d2750aa27ed25c90

SHA1
9df5a6b2f28add38731db27760f160e390a94c8d

SHA256
3c31b09ec01159aa139651e8eedcfcfbf8fff3c4bca4c14f5d2f96321a76d6f0

SHA512
7ad25e3826e6f460fa52cffb25496db76f5446fcaf3bd057635dfa7f51d4ea7582018fc83027d182642bce66db797591fbe63fdd9d7fcfc16ddc6b242a354ba7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\prefs-1.js

Filesize
8KB

MD5
bcb4a512a1dc9249b7b6b0b687c36f8b

SHA1
28e0eb59ffb1c9f489400ad05212900d5aa2720c

SHA256
7c2f9b73d9e1e914119b3711e45b8df4d61749497a22bbdebacd521c1827b703

SHA512
8eac38e4121ee0d3e08d046f674bdb3d0cb2c9605d8dc955d1584d12a5158ad249c80669f67261bfaa3f750bd3b1feaaadcfa2e682519296430064f9ab1a5e7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\prefs-1.js

Filesize
10KB

MD5
adb898475d8a6769f35653c4d8dde9bf

SHA1
5504bf6ae681a8b7fb75f1aa544d02e3ed209631

SHA256
0c90a3df02e19f5f29586ca4a77cdb8fab41a4f6c096b6682790fea9c108b9b1

SHA512
8330916479ae62ba74de8af785e80943037a432cc0596ac8de2b121da7ea658f2dc967cff2dd36d19dad568283fa42e42b3f5a5d121cb6b0c75d1314a068bc4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\prefs-1.js

Filesize
7KB

MD5
6e82941d187c703a2873bf169d2eef75

SHA1
13f528288761f5faa61bfeac80d64eaad85111dc

SHA256
e92f7ee54f2be11d5d1c69a9142052c90a61a822351c2bd36d08a294127e1e85

SHA512
e879b1dc11f6a275c054c46e720e5ce1724605bb826c90bb60f432789e814357e4e8b0f92d0b9ce46b56e18ce7ad00a5bb4ec327c45e389efb979f52fd365bf8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\prefs.js

Filesize
6KB

MD5
276000f762342c006feaeb994ac070b9

SHA1
c880f3c6380b26fba870e5726e807448898ac94e

SHA256
2f5d32d1442ab64d0b1340a3f6766a2a19deb4777978beadb835f88f08922550

SHA512
02336de45f0460716035742e916a167063d7629a61652376ed7546a21c1a4e01ebaaea889824b072a774186edd607781f00a2cf877cfbed0aef4a182f82dc3b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\prefs.js

Filesize
6KB

MD5
2aacc19df48a83a471ab7317e5167327

SHA1
5d5159f778ea80f075ebbf8258774f67e6c1fc25

SHA256
d3d0fad2ef24b81a9ac9ed1db87e61846dde10abe115f8808c81c909670c4b35

SHA512
cbef76f071e16dee34bfba623a1ef71486c0c10f875904c6b5434808f427cdb03388283f64dd9f5378fc48b06b82c4da06a70afc249088b13c3d625dac3e133f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
2b1f7067a4c7537f788da2c06143c6e6

SHA1
e5bbc89f484b33688593855ef9c5811c0ec474c0

SHA256
015a4694a943fcadef47da11b7ec21703ce98421b5f67b0bea5329464bdd34e7

SHA512
d2a0fc69443bb2911658c9a250e5b6c41a8f38ead2cffffde4d54b7d0cab401a750b98b9311d828ad2c55ae738af4dfdb81f7b5dc7ade83fe2f2b12fc8a9b529

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
8.9MB

MD5
de6f1f8d4c9f8acae4a4cdc1dd962201

SHA1
f367d07ed9fec85671cd31817361a9d619c5165b

SHA256
22d3019d9428085ad9153e99cb122c18c7edebc5d955fa75fc22c01c2e9b1d76

SHA512
7901414fd459bf394cfe7b5cf76a29d905047c288a23d5e5618d2d1fa45b6c65576febd26be08465d912409930bc825f1d9aed6080bfa152e1d8d5d6e3b18037

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\d25hmlvg.default-release\targeting.snapshot.json

Filesize
4KB

MD5
1f962445e226598ff76e39cf4585b30b

SHA1
605373ce0c0197f9f3b1df80da3f8257d0ba5ca4

SHA256
aa7d3dc148257cade27ab1670eea1881e411216f2de40c7f12b9dcc88fad3ac3

SHA512
a933491f66b454cecdbd0f867d552229eed23f040e8debff31dd201cd6a173b1cc6dcd236141859e3767e7473e8eb0a058171691c049659c77366017bdca2adb

Download Submit