hxxp://crm[.]avifors[.]net

Analysis

max time kernel
272s
max time network
249s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/12/2023, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://crm.avifors.net

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	firefox.exe
Token: SeDebugPrivilege	2876	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2880 wrote to memory of 2876	2880	firefox.exe	28
PID 2876 wrote to memory of 2560	2876	firefox.exe	29
PID 2876 wrote to memory of 2560	2876	firefox.exe	29
PID 2876 wrote to memory of 2560	2876	firefox.exe	29
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 2632	2876	firefox.exe	30
PID 2876 wrote to memory of 1424	2876	firefox.exe	31
PID 2876 wrote to memory of 1424	2876	firefox.exe	31
PID 2876 wrote to memory of 1424	2876	firefox.exe	31
PID 2876 wrote to memory of 1424	2876	firefox.exe	31
PID 2876 wrote to memory of 1424	2876	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://crm.avifors.net"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://crm.avifors.net
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.0.820580606\1947785137" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {165b0aba-dbbf-48d3-8da7-e3c5819e88a7} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 1292 10bd7558 gpu
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.1.559957988\1350320008" -parentBuildID 20221007134813 -prefsHandle 1496 -prefMapHandle 1492 -prefsLen 21799 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {946d5c7b-c43b-44c9-b4bb-61cdcdc75729} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 1508 e72b58 socket
    3⤵
    PID:2632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.2.1271845309\220432728" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21837 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7c15358-3b3b-491b-9fbf-075652b53917} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 2104 10b5a058 tab
    3⤵
    PID:1424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.3.911476171\808112935" -childID 2 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 26482 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3875ff2b-381d-4f2d-af91-68cc6825a26a} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 2916 1cba0858 tab
    3⤵
    PID:2200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.4.1244964577\449172104" -childID 3 -isForBrowser -prefsHandle 3732 -prefMapHandle 3708 -prefsLen 26622 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b12b4f81-cb52-4951-9530-3b21d2270a1c} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 3636 1ede5b58 tab
    3⤵
    PID:1092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.5.837483793\1607867325" -childID 4 -isForBrowser -prefsHandle 3840 -prefMapHandle 3848 -prefsLen 26622 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55c0b9dd-0698-4bc8-92eb-1e208fef23ae} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 3764 1ede7c58 tab
    3⤵
    PID:1152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.6.750058026\952936427" -childID 5 -isForBrowser -prefsHandle 3968 -prefMapHandle 3972 -prefsLen 26622 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a76ac94-9c3d-4762-8905-e9a5b880ff93} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 3956 1ede7958 tab
    3⤵
    PID:1456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.7.1040067184\1410198016" -childID 6 -isForBrowser -prefsHandle 4172 -prefMapHandle 4176 -prefsLen 26622 -prefMapSize 232675 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8180d7c9-d44d-4050-80f3-e64631ac1b10} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 4160 1fc77558 tab
    3⤵
    PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\04e2bwzs.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
ebf917e4e44b8857744a9d558f487f49

SHA1
a430f52bdae40bf1115b7892eddf4665645d0777

SHA256
99d932dde1e1a5b7f3dd3686d9eefee6cab71461146344188d6e8bc5b5b91a5d

SHA512
1df3db5a6b9c62101ee2d5f0509334c86a748fb2ce10122ee2d93464dd7edc8fdfaeeba3f3854b237edda1d2c2e6558bc9350582e9c78ca189a1dbe46b8bd39c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
67889ec0565f6ce4759c580ec52c8710

SHA1
ce78c28055ce807e5e6dc40b18dfb88ae3272b4e

SHA256
d2261a752b1dfb923b0deb08bae61b2cde36e467e5a22339f34a11ecedd95141

SHA512
bc35a3cca667017e69b84cb8a242b6a4bd66e220ea2b9c68f29ee32663da2e6017843cb4591f7577e69ea8e1df88f0ece567975ce8a0ee270761d2470f8be525

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\bookmarkbackups\bookmarks-2023-12-12_11_SmzfewnDrd4YryNqfWpLeA==.jsonlz4

Filesize
955B

MD5
534940894eb40b987bbef3626386383c

SHA1
1eb1f87c32b361ada2bc09535ef65fcad894a37d

SHA256
e7be22339e423fb60f04706504da99d4ebe5cbeaf5cce36d39889305d6ab6122

SHA512
cabc7a1061924eb4334b5dae4c25b4e633181f5309d7cd9aa66302a19c8884fb4d9cee2d72e36cb99c1bcc4700ee2a4a093e303e58688e555e231d63a33da05e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\prefs-1.js

Filesize
6KB

MD5
71917a691614cb670200004deea0f8ad

SHA1
5354e4adfa6c05c069b01385e777d947af786bb9

SHA256
0c5d2fe47911ccaa6dbc80e45672a744ea76a91cdffb226892f8ef7fc8452e13

SHA512
32a152140f7c2fa4b834d5af50fa8587f9b0960ac587af50f5551dae759b6cafa3ef58fced247e988fdd9d332fadbac10039cb8450b416bf49ca3a71a45ce4f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\prefs-1.js

Filesize
7KB

MD5
525fe71af6d5e75d7256b51f3daaab73

SHA1
21b1d4b61ff78d0d2de29c3ffa1494ab4a81eb1a

SHA256
1d6ebe130cac16023a9c0e000bca8ef5aae46ecb83c039499be4b627917c7584

SHA512
35ea54254d2dd90b70c60f96e5f69da071911cc8d173d562b29e8ed1d1f021f63f6895c116eb085f5761e5e7a3d01c0151f1224d951e876164dab38d0af8514e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\prefs-1.js

Filesize
8KB

MD5
baf172f8c689f52b1d425cb2ebe41f2a

SHA1
fe4c3f1ca4c50ea365d7009b5855d5763bbc6f6a

SHA256
c2f11562fefdc5aaf6e579b697e0593334989e8ac2b304003fe9197fbfde1869

SHA512
dd08f862a6de554d266b7016b6795e06a08bd937e155e17665e9529711f16a6d06a5dda1226ad7efebd9461e33e089edafb69febb551eb47898dbf93cb50a87b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\prefs-1.js

Filesize
7KB

MD5
3b51ab910eb7d9a1f53e3c780462ed97

SHA1
b05d8075389875f12bf1053f9720c646fe6716ac

SHA256
c6862f263692a89caf45db9b418317bc39d03a6ba2589111138111e6b1c76ca2

SHA512
380e449031e3a976542532d455c40dd986540d4af007e81a98cce6bf56c0aca012815e373778bd0b73fe93ce5544b0639d643ef73d3ab4486f101e28f576fb3a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
887a27e08c001caeffd1da7dc8f63ad6

SHA1
0bb56102bdd1eb305208021a1af9191a05e6fa1c

SHA256
8cd7fbd0f161792d0356e32d2f2de091e66e9b9187aa8e2d83dd9bf95479b833

SHA512
7538e1ab5752dc6172b830556ca9a89f3cbb304810e98d1fc046a2929816a17744f2514e8748395aee319ed948b0e40f50d43a20e328093f90211450f935ef32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f748a7be22caae64f1e1e371c9b73a4d

SHA1
763be3623e352c6be9975c4c2d9f771cb59bb9c4

SHA256
648e6371035d9e701d6b1e4b74b6c6a1ce66d8ac9511c60b5b459f70b29d0799

SHA512
62e43fc931dba5ae66d01a93fc1a84e03c5293176587892e9d712fa40a2e80260192ea51cc7c2dd9f046f3d355fe94429fc858442f282946a5fdba5a45f4e323

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
f01d3623c79eeaad3d01514d7e1e6eeb

SHA1
0f8dd8a0c55033acc73f1189e5a29f144af3d282

SHA256
dcf1c14d1173fe58c363e5b86f6ed3a20b35f61ee8850490dcc5d98d3747232d

SHA512
316c0dc54059061a9ab3d452f513d085079ac936a4367f7cb0dc520730307f5dadce53c84b60f9137018e3452db55a1bb6a31d6a4c059ec7ffbbd5eacae88f47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
176KB

MD5
2514a83a1360b465cbd0edfa742c24d6

SHA1
760d3ec03db1715575adc660cb29dbdc9fd5a7cf

SHA256
63933713a021ad69107b61665c9a6904b821cc78670f477026bb023e8f262d48

SHA512
b7d35d0899c1e5d3d811d33ad19da31868422a8eb43db9ce14aeb5e7aedf93c0d0317071f2be4f6e4af63828e7ed1f13186da181c8864dcf421b7bc967152d5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\targeting.snapshot.json

Filesize
4KB

MD5
66a8c39552220af9482e001ed8a0ffd9

SHA1
0111f3eaeccc626a4e9f304d412e88cb17f6805f

SHA256
1b2b87ac33d2244a7ed6d6d2f1f7d15875a1d51fe151a0874931876b5ca63fbd

SHA512
e1df83e73fca39fb6c0e4982843532c3155d68fa22b22bb76d3f9aeceec75794ecee938537d98dd8c0a7832f4645da97712a71c9970672d82ebb5cee29c0c407

Download Submit