hxxps://success[.]construction[.]com/preference-center?ehash=2c351d5cff55db2410334d0eaf565a95a2d782f36e2acb8e9f9476f37b3cc3ca&email_id=3342473177&epc_hash=cwJ9iseIutwwc44MXVPIS9Uv_uLV52xLtLpkVcPqF9Q

Analysis

max time kernel
298s
max time network
197s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
12/01/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://success.construction.com/preference-center?ehash=2c351d5cff55db2410334d0eaf565a95a2d782f36e2acb8e9f9476f37b3cc3ca&email_id=3342473177&epc_hash=cwJ9iseIutwwc44MXVPIS9Uv_uLV52xLtLpkVcPqF9Q

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	firefox.exe
Token: SeDebugPrivilege	1972	firefox.exe
Token: SeDebugPrivilege	1972	firefox.exe
Token: SeDebugPrivilege	1972	firefox.exe
Token: SeDebugPrivilege	1972	firefox.exe
Token: SeDebugPrivilege	1972	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1972	firefox.exe
1972	firefox.exe
1972	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1972	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 4484 wrote to memory of 1972	4484	firefox.exe	77
PID 1972 wrote to memory of 4288	1972	firefox.exe	78
PID 1972 wrote to memory of 4288	1972	firefox.exe	78
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3972	1972	firefox.exe	81
PID 1972 wrote to memory of 3308	1972	firefox.exe	82
PID 1972 wrote to memory of 3308	1972	firefox.exe	82
PID 1972 wrote to memory of 3308	1972	firefox.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://success.construction.com/preference-center?ehash=2c351d5cff55db2410334d0eaf565a95a2d782f36e2acb8e9f9476f37b3cc3ca&email_id=3342473177&epc_hash=cwJ9iseIutwwc44MXVPIS9Uv_uLV52xLtLpkVcPqF9Q"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://success.construction.com/preference-center?ehash=2c351d5cff55db2410334d0eaf565a95a2d782f36e2acb8e9f9476f37b3cc3ca&email_id=3342473177&epc_hash=cwJ9iseIutwwc44MXVPIS9Uv_uLV52xLtLpkVcPqF9Q
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.0.446205635\1902286880" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1732 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce25d678-2e45-4619-be25-2a872af9a43e} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 1832 234da4ce458 gpu
    3⤵
    PID:4288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.1.1677340498\1580986855" -parentBuildID 20221007134813 -prefsHandle 2204 -prefMapHandle 2192 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25d936f5-d16c-4631-a640-f560bd1861ae} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 2232 234d8ee7558 socket
    3⤵
    PID:3972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.2.1114601886\79655501" -childID 1 -isForBrowser -prefsHandle 2884 -prefMapHandle 2888 -prefsLen 21601 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcd0069f-ae84-4342-8ef7-035de30723e4} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 2984 234de508058 tab
    3⤵
    PID:3308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.3.389844126\1274856986" -childID 2 -isForBrowser -prefsHandle 3552 -prefMapHandle 3548 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ad0f91a-9ad5-4cec-8c6e-526d280adcee} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 3564 234cd06fe58 tab
    3⤵
    PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.4.1424477650\1006258000" -childID 3 -isForBrowser -prefsHandle 4736 -prefMapHandle 4748 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {298937b6-3d84-43fe-bd88-45b45620b234} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 4744 234e06b5b58 tab
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.5.1282071751\1356990219" -childID 4 -isForBrowser -prefsHandle 4756 -prefMapHandle 4784 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e203cc5f-a28a-44c7-a54f-6f5e21b7664c} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 4852 234e06b6458 tab
    3⤵
    PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.6.1496121337\1877218753" -childID 5 -isForBrowser -prefsHandle 5068 -prefMapHandle 5072 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1056 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3691e66-b60b-4859-9a88-b3f72dc5f695} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 4952 234e06b6d58 tab
    3⤵
    PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
2.4MB

MD5
d5950b72095b8cbedc64ff54ca665ea6

SHA1
29f2cbdfd4ff59d4f8319c9302eef799363d5de5

SHA256
f820a5bbc0d592d3a34116073513fac1bc89f3a0c4b3a62137b6919f3b39a0a9

SHA512
bb49dcbadeede43d99a1328dab0ee131044a4b7f4dc86a30d57e4b99ff68905da4454a1cd1bdf889a060dd9844487b582eb48cb7666dbb1357748e8e3be1b1df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
65b7ee195b915632884aef957f9c2d93

SHA1
ecd15c726d529d9ed2b686ebbe2a2695f4f395be

SHA256
809c5e83db4b1febc224c2f0392ff2e9e47e2da2270beba03abf03b3653a4271

SHA512
4c7a4d8293ccc227e0da23ccebd2f5f547efc0e31602f0edb0c9c573e8be07399664b4a46c64bba957a4d8732f046e80d32ce75385559373c48791f2bf6b42ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
dfe3b31a92da177310be5c8d5822144f

SHA1
916c9fb06d027d609e096cad65567b308c296f82

SHA256
bad4e384a93ef73912df809d8716d96cfa3780e367aec88cfd5da4b06ad19af9

SHA512
e8aa17dba155f0327d11a37e6c261b2e6a046b78f1f4b4820b7f7e6dc1c1dd99fc33a87b5b34709ee14060c4e0569a521d159961d3b6b7ef573523597a43ad0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\bookmarkbackups\bookmarks-2024-01-12_11_89l--Wt1R2LXEc2xdxrIng==.jsonlz4

Filesize
939B

MD5
dca540197238ae500d11737a3d6db09d

SHA1
1428be3d7d152c781a4deff78ae8c1a5f498fb74

SHA256
12c3b71dcd23eb2b0fd6be28a568e22ef989de13924bda6861852648c0dec6b2

SHA512
b0e8341bc9a7f5c44fd0edbcca48a194c9730134fffbbc62cca7a08e40e33acab953a031628fbb570fa1e60b8e10a1fb4ba75eea4c87943c045ca2d647bbdbed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
7e084cb31a50823067ea394bd8416aa6

SHA1
1b74048c8d29e15075f3ee02e223605868fe878d

SHA256
1409d7241f4d2bf2f0d693ed7fcb307cb12c1a2dec609a4df2a54f7006c66e53

SHA512
f2ad93f8e196849900052b3498f61b6451b459834fb17ade700f70aa3c12783dcc2f5a43bbbbfa6265b340695d4f5d13c57d1914f1199ec03349de3447985e19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\datareporting\glean\pending_pings\893c43e8-c24f-4ee5-9481-33f59eaaee7c

Filesize
746B

MD5
34df823140e1366e7f73a3f90c32d4bf

SHA1
77abe98f2a53e1ca8fef0f9e3f3ff8a6144f0644

SHA256
09ebec7930895e00da62bd1ecaf26c8222c139f67f16e7a1fb4537adf4fa3792

SHA512
e94136f6dfa3b1694d6b63c098a8daa75a2bf10902b064de203eebb25ccc60c2fd09d089572b421419f1338af19987d39a1972bb115d645f5438da24a998ec4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\datareporting\glean\pending_pings\d5f1cf64-deac-4f26-b9be-c7ccd59726c7

Filesize
11KB

MD5
b355ae48cc12240de8e4e8111e887370

SHA1
5fbb0473a3f1ca59652988686bd40e9428c25a66

SHA256
ab39b83db9f9cfa490933b2ef51f5b89d0d1545be8d3f4ed0e06111927af1144

SHA512
5e63b79db24f30b5abfe1d31c42ce98df49cf2aec036e54d2794775b3b4a79437d0f626a88fb99f6054a8ef7e8a8cec023f1b1d80fc25d48dde63e72912e5faf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
2.4MB

MD5
6f850b064602a9c3b9735ae4383b17f1

SHA1
e62978d21838ed4b51555b93208973536615c001

SHA256
bcb5af52fcb845e53b0797efe43ded6b6bffdb9db959a62412b30470e3066e7f

SHA512
c88ef27c76db3512e3a8723cf8bef343fbcdf260a28c5454671877b0f787d1732c6512ae95e99f8c379c2d0a976c947b388ba1145e31c1737be4d4376784e39c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\prefs-1.js

Filesize
7KB

MD5
9c45832d564771cf628814c2bb06b931

SHA1
30d0069f0f29b72fb8242149f8ba2aa0662f102e

SHA256
e889edf1fb9aeb4b3b5885a437ce343311a0213db65812c192b14a3c6bb94fb6

SHA512
4ed6943b845d2504572e3c6b7b5b07c173d285c734a82d703bbe465ca288bf9721e2bfdb8398f4f0ffb7a5f2a202a0938c14fde79ccfa6dee9313b54c678dae8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\prefs-1.js

Filesize
6KB

MD5
1aa818f61a4490df3e5ee4dd6bf14f93

SHA1
608d03fe51b08c1dcf973d91cab4ea6932fd24d4

SHA256
518f06bbfe9dedb0b20147511a4baf9fb3ff98896a28253306da2b9101865f11

SHA512
2cdd44b84921017d5c37ac3f364a06ed9331e0708a6a06025e1c4440cfbb7b52346d23466347cadf675b93bb78e6aab8e547c94083b0f2533064847a975e23f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\prefs-1.js

Filesize
7KB

MD5
e7ffe855a7e52c9ba6161b78225505d9

SHA1
53c8e013ad59ec04d6d2168b059a0ab8db5e63a4

SHA256
ce61cba686e1790b2f6bdc0e2c321ccf3a319801a670f1d9b235967a6cf5e583

SHA512
c79fc8623315e78e84209672bfde1467bcb8a2a10f99b8db908cce265c532a38586e3fa8b9d474e0756efd7dab59cf16819eb02da4c7aaee1cb01f779c3b4f37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\prefs-1.js

Filesize
6KB

MD5
bdbb408a5f9ce729a4d201b1b847d5b1

SHA1
65a6c1c4564d161cff33fd3626f9db1ab1941c3c

SHA256
5b7d925347852858eaa184a34c06cfae44c4093a98f54a86532c9b499e829efc

SHA512
341f97cac5b8fb959ca67aa8416faa82411f43feef6339eff07e3401d71de438b45703b65f7d01e332f1d7fabcd8967e266a8d6a38c8e4a940c320681fdbd4f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\prefs.js

Filesize
6KB

MD5
412eb9a35b13dce3b5d37fe64de5eb78

SHA1
8cb344113921313cd0add8369f6a5f3fe377f423

SHA256
f2fa3ee85fc831aace1bd21ad11f533d1e4f09349bae0bdfb2e01242a990510d

SHA512
576031a372d0a8fb42bbd462ea4fbfc183f2674d099dd16dc73fcb6cfde1d0834598ac17aa45e15e252e1c7491982785512f96914fb1be563952354bd2e472da

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2675808cf78a374822462c4814a1cc6c

SHA1
0af45f2b76ac64d08e995a3ba1e7f5d2d9283cbc

SHA256
bf81eb441403860c9423bbac53c742e1c70c23adacaf804757beafbda48231ce

SHA512
74533926415cb90e6ebea195674eda319f3c78e93d018cfe28b0ee9f2a5b30b436104649bfccac6fd50c632bd8b871fe606634141c802ddf85a43ab73d3bdf68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
8b948f1f63a52b386f8862996eeaf5d0

SHA1
8938b71ec0c27f7bc3d4c30bacdb2516051095d0

SHA256
7a0ee60f0fe26bc4ae7966538885710e30ab91a3034487b942e3111ab90b379e

SHA512
b08c7941ffe52047ae33cdbdd4d2137a3375c51f779dc63f8f96ba851f23ba21d9b1b31cad6d47c4c3f7931b560999e46ee793d00e8f9850c7db253638f25219

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4uf7yb.default-release\targeting.snapshot.json

Filesize
3KB

MD5
121cb3408e3b8b3a537e92cc160884b3

SHA1
c511518f63e28be399055b320138d72d2030450f

SHA256
dab3dc0bda18b0a5de47722104ed29e936d76457c5b2837020d73e4235141edf

SHA512
c9acfcf942eaec401a2e160c15ccb6a81d15b710d5e98eaf4f779629ee82f245bc537e2db9c9faf00cf29019735905cbf3f2bc79bf7d57c40d541a1d08d2cbc5

Download Submit