hxxps://mashraqdigitalservices[.]ru/index[.]html?email=investor[.]relations@digi-communications[.]ro

Analysis

max time kernel
299s
max time network
257s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
19/02/2024, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://mashraqdigitalservices.ru/[email protected]

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2826985972-2069816429-388129859-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeDebugPrivilege	3724	firefox.exe
Token: SeDebugPrivilege	3724	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3724	firefox.exe
3724	firefox.exe
3724	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3724	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 4716 wrote to memory of 3724	4716	firefox.exe	73
PID 3724 wrote to memory of 928	3724	firefox.exe	74
PID 3724 wrote to memory of 928	3724	firefox.exe	74
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 2136	3724	firefox.exe	75
PID 3724 wrote to memory of 3620	3724	firefox.exe	76
PID 3724 wrote to memory of 3620	3724	firefox.exe	76
PID 3724 wrote to memory of 3620	3724	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://mashraqdigitalservices.ru/[email protected]"
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://mashraqdigitalservices.ru/[email protected]
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3724.0.406941406\556490823" -parentBuildID 20221007134813 -prefsHandle 1712 -prefMapHandle 1680 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a87e8188-6997-4f3a-b741-6b1f3f6fe822} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" 1792 1486dffa458 gpu
    3⤵
    PID:928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3724.1.1444538648\1231182611" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf40d57b-b9db-4f60-a79d-853de4a7638d} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" 2168 1486dded258 socket
    3⤵
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3724.2.1741218974\898600137" -childID 1 -isForBrowser -prefsHandle 2936 -prefMapHandle 2932 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {245f8ee8-e28c-46ed-aed6-b5a180567dd8} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" 2948 14871eef258 tab
    3⤵
    PID:3620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3724.3.1975955220\2023112756" -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {007678f3-a44c-4346-bb4e-19f6d370cace} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" 3684 14862e6c058 tab
    3⤵
    PID:3432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3724.5.1655630476\703075044" -childID 4 -isForBrowser -prefsHandle 4884 -prefMapHandle 4888 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec56fdcf-ce59-4535-a6c3-e49002a167cf} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" 4876 14874c72858 tab
    3⤵
    PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3724.6.1667005092\673713371" -childID 5 -isForBrowser -prefsHandle 5076 -prefMapHandle 5080 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f4a70ea-4511-48ba-aa7e-5ae210ffa120} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" 4748 14874c73158 tab
    3⤵
    PID:2668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3724.4.115148433\2086406986" -childID 3 -isForBrowser -prefsHandle 4728 -prefMapHandle 4740 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1172 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {74a8a56d-5b99-4ea9-827d-8d77037cbe29} 3724 "\\.\pipe\gecko-crash-server-pipe.3724" 4748 14874c75258 tab
    3⤵
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD

Filesize
13KB

MD5
ac8d48f59b5e8a59b627213f41062144

SHA1
02f16995a5459b11d5e87c393f22e9b696457966

SHA256
faf1f270b77a398e1871d0c3a562d9c53e8aac95959007373562ddf8ee5fb4d0

SHA512
97c946b3355b70c168885e798d43b9da5c853c2cf092ccded7066c758f1869862a5cbd698eec1f0850f6ec31e2526caa2b8bdae8a1cfc7a48ac8494ed51aef6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
2.3MB

MD5
1f2787c65885db2351b31a601488261b

SHA1
507c5952fcaf5507f2c1fa9fddc8a258e1c1a7cc

SHA256
bed04168002512fdc240d30a35493f886d82458cd5b367402c8fd386ddd7f846

SHA512
ae068c85a75eda5294767dbbf82e7da0e1e1e4fcb39e2ed652dac609a551b3ee50013ccde4072b4c36457cadb09d9b4a43313daea7d8318abbad16b2cbfbb849

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
4495e983cc62a9683feaeae5757c3486

SHA1
f923bc6dc14f55b3d8a2214cadb530418d36536b

SHA256
7ef3a8f9146cb9c4176eb31b8c365dda6f60529bbf3a9c712ee049d9197c1c41

SHA512
3b764465d5ac4c83785bdf78bbf7a270c3e8f1d4c147b8dc2efdf8895ce1ab1da783cffc5033b3865c5e298ed97a04e9f91b9f03715e773ff2f01d24d7344a57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\bookmarkbackups\bookmarks-2024-02-19_11_hpR55HsqFMxFM2XNGEhK5Q==.jsonlz4

Filesize
946B

MD5
0e62dd9fc763dea539fcca65a9951baf

SHA1
1dfb9c248e3c9669899fcab87c465c36cfb7779a

SHA256
2cd76503ade56e37f2d997f73f19ac1b156cd3493ee7f33c4887949b4d51cfe3

SHA512
1c0a4be5f18271d4e3c175581a1b09451d974a72b3a249fab3c7742abfba55c90a26393ec0c7b787ac09bf37fb206f5a7b4977c797ad60bdb7dd2e79f3f3ab18

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\broadcast-listeners.json

Filesize
216B

MD5
98afe337ed29ccfb4d7d44a3a4576f25

SHA1
333435a4c8d4897e83ea3214503f9c5b10e054ae

SHA256
5ee9b018275efc67e499dd620843b357b858b1f80c23775616f2ca5054f55dbe

SHA512
0913b8c96e1a8d931a060ce1aae9d0284bf6a4a589d359842a6cf0f55e60834220599508b7f2d263006fcc378e11bf85eeb1a742a0fa9bf5ae916b59f09a9793

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
d73c0fc6135c74caf00ccb4aa70d6439

SHA1
c65c510346422a569fa43dd6f7b21673950ffb8e

SHA256
59e16644fd667325187115c255937d29969dde5f8bdcfb8c10042076fa26210b

SHA512
fa2013bd9e95f1b7ef3913a8779329a631d67cb1c39304bb44ab3dadf2ce864aa418a7c0dc5a38aaaba89aa300c2db552d152f25f858cebe1797a86f84900abc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\datareporting\glean\pending_pings\4b4b7ace-6886-4b83-9aef-1fbdf81d9d1e

Filesize
746B

MD5
df924a7834e53b354192f0274cafcf39

SHA1
caf4a22380be271ea730152799ac8da01c99251d

SHA256
d9c019858da648e6ea6779dfb70354c3f012e5941943dfa68ada7193dd211f97

SHA512
3885c7a9f7de5bb8392e2ddd457a07f564d80efcb923bad5b002aa27bf79431685c7c322b4f361a72efb24dbaaaa80ee8196ae8cb0db1ef433484e2b354d453d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\datareporting\glean\pending_pings\586d688b-42ab-4859-b09e-f47a0dc0affa

Filesize
9KB

MD5
7c2ed044b5efe9c6d07ea992036fe261

SHA1
0f2032e5c39b834ab040db4c4c2c41de7a9a1e9e

SHA256
28571e0a856a323a61c4c93b113d4a2bb8160fcdeb4cbe50c54c9dffbfdc6eb4

SHA512
003e13efa631d5a3ea4bae17c07d4c65c3847b2bba49ee0fc8aafa0a4b6a47da92001404af57eaad23832f913baca542f6e9fdfc693a378f88dc533cbfadcacb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
2.1MB

MD5
0d76adb3e177eade43d8e41fa5aeff5f

SHA1
ef965bd16eba46d838c6b836b6c3413046b28301

SHA256
e1d2ecc90429dc39dff85a1c67ce36a019f17a5c033ef30064de4f49cb8ec82a

SHA512
814959b53e5c429a3e4ff954209ec44e685f532973acaac7577b4e3b3c542564f9379f5412063f2265c073d54aea3ebccd15921f68e32ecf7dc8e25adac86e8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\prefs-1.js

Filesize
9KB

MD5
4e8cf42a286b43c4dc3b7d84212f2331

SHA1
94822a555ff4c723859c0e72cceabb37d8e654d1

SHA256
bbb006169cf8c13e4f05fb276d5472f2879ff7bc3e7ed5a0a9bc9e73dd7c70b5

SHA512
66b8c142c242cb53c447d537ae5a49149a3fcb1a9647d918a8033aa969d064aa9aeee4ef25804591405bbb20c445233fd22d9bc383d66ef40f2ad1c712759fc3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\prefs-1.js

Filesize
9KB

MD5
d220d7a3a454c668001a6296e6cb796b

SHA1
86c0db5535e009eafb1fa34a13769a9289966138

SHA256
db97f8e1418c5e75c4503185a5d412b97cef64f4c1b9d6ee5449be801c82bbc6

SHA512
3209f1e6a61f3fc880f0f0336dddb268c187cd19251238804454a87f0db607f83a9b393a5039a257fd97d396b3ca1e6c4917b7702b3851124ae143f19ace0a0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\prefs-1.js

Filesize
6KB

MD5
9fd2dfe8c5e84d741e3f87e3dd3835fd

SHA1
bbefebe821fe6c6f3e780dc98b224148474f1906

SHA256
1b82262c41e449c16ef9457d581f15f4210d714d0ada4aeca7bfddf1a93c9b74

SHA512
707bd0503da7e3ca062e9a7e4a578052e8dedee6be46175380adc1b975886acbf563049a37a685b072bf5ec3a24ad7dfd4dbc37d6d746cfc69724caf9268f081

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
b9e18ca68746bebe69147a108b65cefa

SHA1
5f7b20791e877c3c61226f9e1a6a14d17ceb6817

SHA256
01c2efbc8680003bdf5116528b17b2260497a26d67309ed8766daaa9f6888c7b

SHA512
84eda6846b127b9745d020a59b01858c47f10249c4263763ccb9dddd094fc43cd019d6ad31d39b748285fbcbc516b4d75505a508f597c010a9f69a2c252e450b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
7.7MB

MD5
139968044b8a35221a63902ab738bb78

SHA1
d0db3f0675577579f2a6fbf2790025a258e0ea27

SHA256
10cd18bbecc53b77cdf84c5d9680e4b9493330164ddf4118b60112c982ceb42b

SHA512
0415ef90ec274dc046eaeb6d28c337e0fec22d66ef74dddb3fb88afa1eab30b097701d538040d0e844adaba6da4c406a87d88c60f1e372801a41706862453b92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jmbcz9mp.default-release\targeting.snapshot.json

Filesize
3KB

MD5
3dbea60286d19e37debe83657959e018

SHA1
bbfb3cf2e8637f39a64cd18f184fdf4a472be91d

SHA256
43bfc2da17cb9df13d866e84d0afb41743deec87b2d968653a18f798648900e6

SHA512
619e044e0475e91bec241e0d34b4caa56a96aded0d6eb61dc19c8d64a14b1ca464e2ccbdda7fafd506f135ced665a29ec440fd502afaa757827579337ee3b5b9

Download Submit