hxxp://[hxxp://ems[.]euromoneyplc[.]com/ems/r[.]asp?cIndex=1071754&mIndex=1485889074&hurl=hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001nJMLKbC50uygfKKhqj_Kqrx-iGg39RFkRhotydRKFwr7skiL9IKV0f_H5wfFr_G95sphvpfL45h2-Vr9Yi_eJQkyjTL5NY-tHYUC1ghDx1uLBTPx6YVPvlAtyJpKeqnQ3cDKuvQ8klf8bd-xi0uk3g==&c=&ch==&__=/Cfisd/a2FyZW4uc21pdGgxQGNmaXNkLm5ldA==

Resubmissions

12-01-2024 21:19

240112-z6jw2afaen 1

12-01-2024 21:17

240112-z42ztsffd7 1

Analysis

max time kernel
108s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://[http://ems.euromoneyplc.com/ems/r.asp?cIndex=1071754&mIndex=1485889074&hurl=https://r20.rs6.net/tn.jsp?f=001nJMLKbC50uygfKKhqj_Kqrx-iGg39RFkRhotydRKFwr7skiL9IKV0f_H5wfFr_G95sphvpfL45h2-Vr9Yi_eJQkyjTL5NY-tHYUC1ghDx1uLBTPx6YVPvlAtyJpKeqnQ3cDKuvQ8klf8bd-xi0uk3g==&c=&ch==&__=/Cfisd/a2FyZW4uc21pdGgxQGNmaXNkLm5ldA==

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	firefox.exe
Token: SeDebugPrivilege	676	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
676	firefox.exe
676	firefox.exe
676	firefox.exe
676	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
676	firefox.exe
676	firefox.exe
676	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
676	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 2752 wrote to memory of 676	2752	firefox.exe	87
PID 676 wrote to memory of 1872	676	firefox.exe	88
PID 676 wrote to memory of 1872	676	firefox.exe	88
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2676	676	firefox.exe	89
PID 676 wrote to memory of 2736	676	firefox.exe	90
PID 676 wrote to memory of 2736	676	firefox.exe	90
PID 676 wrote to memory of 2736	676	firefox.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://[http://ems.euromoneyplc.com/ems/r.asp?cIndex=1071754&mIndex=1485889074&hurl=https://r20.rs6.net/tn.jsp?f=001nJMLKbC50uygfKKhqj_Kqrx-iGg39RFkRhotydRKFwr7skiL9IKV0f_H5wfFr_G95sphvpfL45h2-Vr9Yi_eJQkyjTL5NY-tHYUC1ghDx1uLBTPx6YVPvlAtyJpKeqnQ3cDKuvQ8klf8bd-xi0uk3g==&c=&ch==&__=/Cfisd/a2FyZW4uc21pdGgxQGNmaXNkLm5ldA=="
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://[http://ems.euromoneyplc.com/ems/r.asp?cIndex=1071754&mIndex=1485889074&hurl=https://r20.rs6.net/tn.jsp?f=001nJMLKbC50uygfKKhqj_Kqrx-iGg39RFkRhotydRKFwr7skiL9IKV0f_H5wfFr_G95sphvpfL45h2-Vr9Yi_eJQkyjTL5NY-tHYUC1ghDx1uLBTPx6YVPvlAtyJpKeqnQ3cDKuvQ8klf8bd-xi0uk3g==&c=&ch==&__=/Cfisd/a2FyZW4uc21pdGgxQGNmaXNkLm5ldA==
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="676.0.2146438623\17103472" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c048991e-f0d4-481d-8974-7c0d9979abbd} 676 "\\.\pipe\gecko-crash-server-pipe.676" 1964 27d8dbdae58 gpu
    3⤵
    PID:1872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="676.1.1054485265\1688964246" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9980fbc-94a7-4fce-b687-4ba7263069d7} 676 "\\.\pipe\gecko-crash-server-pipe.676" 2364 27d8daf9e58 socket
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="676.2.166363264\1477500389" -childID 1 -isForBrowser -prefsHandle 3108 -prefMapHandle 3104 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4a4bd1f-e524-430c-99c8-f3714b9a2133} 676 "\\.\pipe\gecko-crash-server-pipe.676" 3120 27d91d9fe58 tab
    3⤵
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="676.3.1213212663\2116919028" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f27be29-d0f4-4e3b-b193-d27d4996ceb8} 676 "\\.\pipe\gecko-crash-server-pipe.676" 3608 27d9229eb58 tab
    3⤵
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="676.4.941945135\26278964" -childID 3 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84002c2a-dea1-426e-9670-a4e015bb9eb6} 676 "\\.\pipe\gecko-crash-server-pipe.676" 3996 27d9303fe58 tab
    3⤵
    PID:2208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="676.5.2082663753\2055777375" -childID 4 -isForBrowser -prefsHandle 5060 -prefMapHandle 5092 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1182aa1-eff1-45b5-a541-11c988b97cdb} 676 "\\.\pipe\gecko-crash-server-pipe.676" 5096 27d81366e58 tab
    3⤵
    PID:3188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="676.7.375864260\1564045776" -childID 6 -isForBrowser -prefsHandle 5396 -prefMapHandle 5400 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6cd8f40-5a55-4049-9ac1-b5e74d725502} 676 "\\.\pipe\gecko-crash-server-pipe.676" 5480 27d9401d058 tab
    3⤵
    PID:2752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="676.6.1262161343\1357738098" -childID 5 -isForBrowser -prefsHandle 5288 -prefMapHandle 5284 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1352 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2ddef7a-dd99-4907-9c41-1c0e0218019d} 676 "\\.\pipe\gecko-crash-server-pipe.676" 5204 27d9401e258 tab
    3⤵
    PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x3x6afp6.default-release\cache2\entries\77FB5EE92C576E2505C8C9FF2EC417D7727F401E

Filesize
13KB

MD5
6039eb0473a6a96d2123869939d45c85

SHA1
32fcbecafadbc83fc7eaeff97805612ed4f70e46

SHA256
fed7a26ae00e2fd3f0c2bd8481487db4d0e3a6561a6e19027c9663d490239b1d

SHA512
e84d6b57b9f3a299e4519a437395ae6be230cc06e29902bf0c5271eee436d116cbe7f3f3c3151351e1d9986e17bc1504b917690e34aa594190176ee93d2e3f87

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x3x6afp6.default-release\cache2\entries\B573808F9B4F64D3E5F0B069BDAA48EF4086E712

Filesize
13KB

MD5
ee4b300ffd4fbb44c63ad849fe65505a

SHA1
3388091098a1f09fe7335d1dee0d2f1220ed90dc

SHA256
1e392e6364ec8c91d7787b1bc7ed20447a90e8c47bff7c0299abdcf2f29e0479

SHA512
32ffd982def1b92c8c98607dc071540353c74051abcdf6af060d98d4ad835c0fd173c043cf145b31920b1056e41cdbe62c0610e9b61d8ba8ba65169161860be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
ec30930ca8dbda3faad3fda3c6177f17

SHA1
ce89c2eba186fcdeb01b09750e618f5428135753

SHA256
86d4287deb17f2340ae817d3b5092a7d8e4447e952ae82eb692bfedaa9316772

SHA512
57a89c6df12b75e3a72caed5710ac60655b9eef9c0adcb35df303bf4a3ae2f331eefacbe325566f99fd41cf90fa4f61e90d29ce02196feb386baa70ece6889ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\5a2c6a9f-1705-40a1-8877-d2d0808a75af

Filesize
746B

MD5
aabdef8fe40116b47b28c826e00b938d

SHA1
e940494cf9f2daee2267fa0d01c2a49881d4c159

SHA256
401071ef742638a2605eaefd69f161a3e65914887eb5b7a886faba905b521d36

SHA512
cb8c9f79e796f86b20ad60eb2c3f6bd4fcd6f67dffb4a0fac3ba18626dbb03151596acbbd9b3b27c0fb51f1c8fed6b0de631d1ae983b274dfa8171da5b1c7107

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\92af5f70-9c43-4bc7-9c9e-6e93e362ccbe

Filesize
12KB

MD5
d6fc777154e4fdc56851eefae201205f

SHA1
0b8d6a1050d7ed42bfb4d2c43b85cb8f59fe4132

SHA256
b936b06aecec32aac5efb292949b7bf399d1e4c3fb919115c27092e0ee7e13d2

SHA512
ec7e4f10d12153ab6c0810cd0cf87a395259a533b415361e3336d8ca443c16bfd7471a128c165d47c7eb21c0499e417ed49c57e03cca8b85d1c0aff28dadf220

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js

Filesize
6KB

MD5
a581ca1d50bd3a12606d2ea625066ad0

SHA1
63c58f99bebc422c57103ff9ad4187001872d6a1

SHA256
7a27778d32e988d1908f5617e9247f958ac915714903081924f6f1d6277632c7

SHA512
b1c61e07230d3241ef779ccb35f92ccc66949a5ed8dae96e41508399600a1d59e4378ab7afb22f78fa9c39bd95fe0f18b856327f9bd4a870b8f274dcbb28bb57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js

Filesize
9KB

MD5
2ee79931e165419e4943952c5785f877

SHA1
a4984c772d6af915628fcb0174d9686dc6e725af

SHA256
66d8b38aee384ad561d3dfac26b4619cd5b3d193152b688afb4a1ca0d7e4c0a1

SHA512
bcfee638ea95dce9b474b040848e145bed73d9523aec86ab3c66b8003069de7a4c18d195a7e20773f2857498d7e6d848b6235c01350c0c4778536b1ad3c8c2db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs.js

Filesize
6KB

MD5
d346e732d66f0ba3e6cc73fc15ab67f8

SHA1
4204fa3621d39af270bdabae57854d126db81948

SHA256
427797e5ed247eaee5a3d55b1db61ec981176045f77631c15a919d362089e4e6

SHA512
3f895cce9121cc2419b1c3c745e9dfde4447b3fe0637986311bb6d6297441f3f7529b3ab752fb6e90365bb73e2ceb2832cb296c2d352467cf97b62c6e771fd45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs.js

Filesize
6KB

MD5
99fe7943ef3e214dee86543dca62551b

SHA1
bb87140028369618fd58749cc4133e62cccf2c30

SHA256
9d4d09f0e9387f1f2e9ca3c980928214fb99c15ed8d5c3e34be2cedae1242fb2

SHA512
e877b9ddd94ea9bbab144de8483a4750c924132edffe3dcfe018b8694bc1086f387767b794859d1c196a3eaa686fde14a9ae4b615c0e20b1f1193858c440136b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs.js

Filesize
6KB

MD5
e0b0e22c1c907d28d0a1f75ccfc601a4

SHA1
6f32b8d482ad35aa91861af95556fd17076b27e6

SHA256
e8f7680e9592cc47a8e9984ee118402124176f5be3b28fd6a884fe717720ab35

SHA512
fa964d0f3d66dcbbdfec99e20963cd3cc759b672f7d73d24a95c765de6dc43e7e322f88fe6429991ac2bb1f249410c8d1420aaf25777f5e9c2cad760604a4770

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
7a5fa3aa996a15f0d4b915633b321eb8

SHA1
4e0919960e98e9155c578a96a5f0c0e88d13a610

SHA256
300b8ee1a8c769790f6a26af10f9b4bb1b659d2fbda1dc4963ab2fd14e33784d

SHA512
5756df0fe559e3f18b5f91442ba5116f43c41bb01c6f28c631a99323911d98578f6f35f7fe614ba3f4e82a075138fc4c030bca839a4202fefbd4656f98c63f4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
66f7fb08f15cd0fd60d4f82e770c3a64

SHA1
2ca52284b6c18ffe6f53b3dd9520a1af5ceb553f

SHA256
9cde617743cdd636e74f5cc2eccfdadf7cf809228e81ae642892b9b41383eef4

SHA512
29d4f70b07765e9ac2a2c9d5f0f7437c1a55ff3450479f8a8997714b308f8db0df1c9abaef9fd6236a76ac9a7a75e5f416484a8c0021820c4f92ee22d815ab85

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.4MB

MD5
f32665fd9bae5fb6fb86fc55cdd5b390

SHA1
35c350c9ec07b5d42e09a9027e0c58b13813fad6

SHA256
719b80ee66af1217fc496d4944a750c9ff1654ad531339b6063e40830e27a0fa

SHA512
3b2e37a7314c5b58ace356165424ee24b55222bbfec3d7cabad11a95369e6b83181d4b82b386d8ac0f3da55bcf7ddca4a424d435a242ae242e3159e6080c2d6c

Download Submit