c0e58e8fb7304ba3a7bc557e325e36c06ebcc59da3abbee28dc0af1f47815f1c

Analysis

max time kernel
1028s
max time network
884s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2024, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NoisesbigbreakV0.7/NoiseBigBreak.exe
Size

11.7MB
MD5

7efd45493dfa536fd889db8623cefb9d
SHA1

cfa8f12c23fcc3b4d8020808ec1287462aab56f0
SHA256

614a4329d78bda8282c47e50c52fa9c9e5b73c1ebff140720ace573a4bf074c3
SHA512

d32bdfcef6a80498af8077d16b6ffe16d6777e32ba53eeafd40373f1ca759db058bbe9a6fc27c02d33781b7eb3d44cf23d39a36638719ce98e4d0e27bb47cea9
SSDEEP

196608:BqmiBBeUgOrUzo4Q1s8kaPCdOjHyA3kfz2Sa4ggTkJ3gSyYxkNUyWqM5z486EHiu:BqxTOMGRAqo9

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	3528	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3528	AUDIODG.EXE
Token: SeDebugPrivilege	496	firefox.exe
Token: SeDebugPrivilege	496	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
496	firefox.exe
496	firefox.exe
496	firefox.exe
496	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
496	firefox.exe
496	firefox.exe
496	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4420	NoiseBigBreak.exe
4420	NoiseBigBreak.exe
496	firefox.exe
764	NoiseBigBreak.exe
764	NoiseBigBreak.exe
5076	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 5040 wrote to memory of 496	5040	firefox.exe	82
PID 496 wrote to memory of 1400	496	firefox.exe	83
PID 496 wrote to memory of 1400	496	firefox.exe	83
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 4072	496	firefox.exe	84
PID 496 wrote to memory of 2312	496	firefox.exe	85
PID 496 wrote to memory of 2312	496	firefox.exe	85
PID 496 wrote to memory of 2312	496	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NoisesbigbreakV0.7\NoiseBigBreak.exe
"C:\Users\Admin\AppData\Local\Temp\NoisesbigbreakV0.7\NoiseBigBreak.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="496.0.853897157\1006070259" -parentBuildID 20221007134813 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6890fc6-3869-42c3-a868-7237054d8371} 496 "\\.\pipe\gecko-crash-server-pipe.496" 1848 2b4410f1a58 gpu
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="496.1.451236313\1247136203" -parentBuildID 20221007134813 -prefsHandle 2244 -prefMapHandle 2068 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea55d015-02a5-45b0-8a57-c5a59a691bff} 496 "\\.\pipe\gecko-crash-server-pipe.496" 2256 2b440ffa258 socket
    3⤵
    - Checks processor information in registry
    PID:4072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="496.2.1811820537\2064674566" -childID 1 -isForBrowser -prefsHandle 3268 -prefMapHandle 3264 -prefsLen 20821 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90b12ff6-eb5b-4cd5-9c7a-f6f201829940} 496 "\\.\pipe\gecko-crash-server-pipe.496" 3280 2b4461a5158 tab
    3⤵
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="496.3.2021235467\286307271" -childID 2 -isForBrowser -prefsHandle 2856 -prefMapHandle 2852 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {561582ec-ad94-4ffc-9e93-20a4946948fe} 496 "\\.\pipe\gecko-crash-server-pipe.496" 2720 2b435061658 tab
    3⤵
    PID:2288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="496.4.1568113743\336541988" -childID 3 -isForBrowser -prefsHandle 4516 -prefMapHandle 4512 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a18043cb-5390-427d-9d1d-6830fd82894d} 496 "\\.\pipe\gecko-crash-server-pipe.496" 4496 2b44816c958 tab
    3⤵
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="496.5.1202063277\1814203304" -childID 4 -isForBrowser -prefsHandle 4808 -prefMapHandle 4816 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4995467d-fc23-4948-ba01-6a1ebec697ae} 496 "\\.\pipe\gecko-crash-server-pipe.496" 4836 2b4485d7958 tab
    3⤵
    PID:2372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="496.6.1791066146\368000056" -childID 5 -isForBrowser -prefsHandle 4964 -prefMapHandle 4824 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f99f542-1f7f-4339-b345-6d13f544297e} 496 "\\.\pipe\gecko-crash-server-pipe.496" 4952 2b4485d8b58 tab
    3⤵
    PID:3260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="496.7.2003882319\523779827" -childID 6 -isForBrowser -prefsHandle 4952 -prefMapHandle 5168 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd6258f6-d994-4a2e-9059-420d5885e6bd} 496 "\\.\pipe\gecko-crash-server-pipe.496" 5124 2b4489d6b58 tab
    3⤵
    PID:2472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4588

C:\Users\Admin\AppData\Local\Temp\NoisesbigbreakV0.7\NoiseBigBreak.exe
"C:\Users\Admin\AppData\Local\Temp\NoisesbigbreakV0.7\NoiseBigBreak.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3912
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.0.387847087\20384112" -parentBuildID 20221007134813 -prefsHandle 1672 -prefMapHandle 1664 -prefsLen 20747 -prefMapSize 233480 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57e04709-a2ac-4066-ab7f-b8094b20d918} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 1752 24f5c9fc058 gpu
    3⤵
    PID:4076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.1.1069513107\233272445" -parentBuildID 20221007134813 -prefsHandle 2084 -prefMapHandle 2080 -prefsLen 20747 -prefMapSize 233480 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c0e265b-a71c-4699-9bf2-ef861d37bf24} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 2096 24f5c635e58 socket
    3⤵
    PID:252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.2.548380990\379054492" -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3032 -prefsLen 21208 -prefMapSize 233480 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e923e8f-a68b-4480-88ec-63cef3b29c77} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 2736 24f6049bd58 tab
    3⤵
    PID:4036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.3.2133980232\761913857" -childID 2 -isForBrowser -prefsHandle 3496 -prefMapHandle 3492 -prefsLen 26386 -prefMapSize 233480 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f21a5321-f702-481c-b20c-8068be0447f6} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 3504 24f50a2ed58 tab
    3⤵
    PID:3144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.4.204447893\1765967066" -childID 3 -isForBrowser -prefsHandle 4556 -prefMapHandle 4552 -prefsLen 26445 -prefMapSize 233480 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {306fb7ff-f6ef-4b6f-946b-89f1a918e0d8} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4568 24f63b9fb58 tab
    3⤵
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.5.468856318\677808527" -childID 4 -isForBrowser -prefsHandle 4872 -prefMapHandle 4880 -prefsLen 26445 -prefMapSize 233480 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7893ae9-8742-4349-addd-08c9600684c1} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4948 24f63fe3d58 tab
    3⤵
    PID:1824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.6.1803218192\887565709" -childID 5 -isForBrowser -prefsHandle 4556 -prefMapHandle 3640 -prefsLen 26445 -prefMapSize 233480 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83afd961-bc62-4f91-a5af-ae1898282701} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4708 24f64369558 tab
    3⤵
    PID:1020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.7.490542084\396929469" -childID 6 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 26445 -prefMapSize 233480 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {315d9388-4a16-4081-b91e-6ec1eda4dee6} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 5188 24f64369858 tab
    3⤵
    PID:700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
0c142f2f45d92e9c34ff65c096c10f20

SHA1
9936a5e5305a4b4e23c62e9381dad84c93d730be

SHA256
5ff41b429e4f79983f0133eb1b8325f53041bc1ce4e3d14e27ad37752efd9a62

SHA512
f4c7a4bc0e214d235ebc2f08bfbf4981f0042230630797d7603d608a73b6e5c51689c83030900e696d04cb12f64ba8f1dfc2bb0f72b062f6029c137f6cbb03d2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD

Filesize
13KB

MD5
ed393ce9e44b80b2ff058ab674e93abc

SHA1
016c5ae7f07f62fbaec0ca66c610127c137e1579

SHA256
acc7ba9738d7a157766a5bde51553e517b15532c929910c4dfe1091398a11462

SHA512
6b4a784f96c9b6b94301d984247978baf0e9e360f9975732f172f056b8ce78709541220ccdb27bca2aef84b3d2eeea66695ef0c89ad9ec1f9462b3053c8be732

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
9KB

MD5
29ffc192169bf575b6fd3fe5ff67b1fe

SHA1
327f9a3e9614ac0fb5097a95a87f3540697e994d

SHA256
ecba966a406e210b7525d2d7f31605172b93ca94edcfcf2f8dc20b14f1976b9b

SHA512
bbf7c99bc29ad831ddc652358f1e33158845ad87af6eef7cfe713cd1192d301e397294e2846951973977d5bf3717a261babd925ef0d1874d6517ae3adba3193e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\startupCache\scriptCache-child.bin

Filesize
464KB

MD5
b1c0b3951a7abee30fb0ab72941beba3

SHA1
3d996cedee1d6eb87d144f8e220d41740978247e

SHA256
41edcec5320de0978c90cc2563ad07fd3e1e39b00be164ec27a299885b71299f

SHA512
dc2f9b4b5e4a81d9537d47372763b7570e8dee1b25e80131548ad816c8823424e9e2e298975932ea2d36e680922312cab5e65ee6c5715ba078a4c28d11b8829f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
f995d40f328f5ba17971faba04e2cb0f

SHA1
b8fd0cb7b04b9cc94f0eaa3c54b9bdf1cfc8d4aa

SHA256
6b4b52b2f53634a4f937b801791995c267e437f1aa98ab257a1167537d9806cd

SHA512
2512c24f1d2682f18f336f218936bef32aa6142c2a44b6c6ab2be11743e602ec95a947c1b3ed3ecb26a2b75c7ad41b0d06e25193fdee058c43a0025653aa72ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
98cd77a8b3ecb80b392b9230f66e4eee

SHA1
fb37ab202d6a83ba4de80746f0e57ff462608b04

SHA256
f5c4d3f3628e2038161672bea9a8b6a695c04858927cd855e7a331799d8c6462

SHA512
c438457d5d7f688bc8c4cbedc16bd9a4bc07672e08c8a9a1b17e039b8eb2977def2b6f2e53253ebe94cb56d4559e3e9a79fdf25d1871b99f854687a0765fc12a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\bookmarkbackups\bookmarks-2024-03-06_11_vLe6uWMCSKVtKMB5fDxXQA==.jsonlz4

Filesize
936B

MD5
855e8a4ca5318fdf6be69e4c899db5f0

SHA1
c9ea3424f465d45d3c49d12d967cecd9541bc5dd

SHA256
348bc7086a554e4675109d2199472c29f306d9d00432e82ae783bb7ce84a10f9

SHA512
2b38f4906308f12c14e64708dc4bd2fde8b17a658d9c20487be69fff0a1349247164472fae4b2948db20f3ec09b82ae5b013cd6286f9d4848c5ae2b97f0f1d32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
02a764bfe61a4a5c82a5714236e2c2d4

SHA1
54769bf2bbbda16a791393dd062aa8561fb382a4

SHA256
1298f6644948b3329a60d260a629a393215aaa49578d67368c4163dcd022ae63

SHA512
3e863dc2675cf7d62eee4abe1693c9ad9f530372a2027aba4171469887819307a672c6027ee3fe691f5dd477e4513fa8af47c6feca7003f3ffe14a82b08dde21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
328ed226d4a4d76604d6d8228dce8ab7

SHA1
90fbabcc1189cc528ffa49672d8997f64a125ea2

SHA256
2468718c558b1759e8510c888a4d4ee34a44a1b910af3fd968552879221bef4c

SHA512
096d5ee2ccd8fa5b38d35db31a46e090a4abee11c8f23d0cb362ca70de5e32f723292b03b19729dc46d0d794f6463720249fba8adf6181c9fef3afc672359fb3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\79aa31e1-c77e-4136-bcef-07d3b0e1616f

Filesize
657B

MD5
5c3ca2d76139cde24fbefab6944e9fa4

SHA1
70b5b2797fc892a3a54acb32ef8407bd08673db8

SHA256
e9bfc3399103f8e3b70d7316d785d0da620ded2b0c0b774e10fca42d1bb762b9

SHA512
b8c0d238d320a36acaac71390efd85b63f774526bc64347963d84602feeedec3d656c9385cdb29506588c814359c6ab8f19a90f69daad1a15b71d6aead80c954

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\f69a6d99-6470-4ee6-a582-68710f57f246

Filesize
734B

MD5
c44f8b9032f397f80da90cc941b30e56

SHA1
80a0aab71a9a69157a4f23ee95b03d4f2b2e35b4

SHA256
240b8846c98fb3635df31463f8d2eb857cdd65a994b0bbbf9c83b4c9086e96e5

SHA512
6f037314d9907b4addbe6f7d5563a2df5c7d6bebf29bbbcd392798830acffced60d18da342f153f0703be89883d81a19ad3b1da81b1e28f3c071118a10c0365e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs-1.js

Filesize
6KB

MD5
077d5cd9acddd6d2a05c9d982cbfed13

SHA1
f246d8f66388eea6c236fda24fc651875cf981f0

SHA256
439ceff6a11f25ea840273f291f3d09860d60eded7282f3d10e27ba786acc0e2

SHA512
470ed93d06966efd95aedafe2262f226bc61b0f749c741f6b6d6a4b7c7b27838032274a544e3978719f305046ede77a1bcc1cbe7ecd1bade2948ac40778acbe8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs-1.js

Filesize
6KB

MD5
720a0794bbc2f3d51a3a72900ad8fcc4

SHA1
885c30f5b8757d1bb60491443208b42021f04656

SHA256
a5d4eeba84eebce17aa90e546bd417758dfe3efdc5e83203cc636b8ff2ae1a59

SHA512
34b6d424bbd06eb0f9d313f5e739973faefcdb11a25893cf441b862138faf75332cb9ba85b9de0a171ee241eefc7623afd2c40e2d7baa280233fb723b7788b13

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs.js

Filesize
6KB

MD5
e113fa63832085c3ca1c5c3e83158551

SHA1
22d677c2aa423e92cba1f2a1d39dce76676ecfb3

SHA256
a25b51f91d9bd8d3237e520f9677e1b4ca70b977b42f771bee16e73c13e49534

SHA512
ec4b0f80ceb28a3cd85d65b971cd053c686607859585938e681c213ab25cc37a910f34ea46afb522271387c959458726055a310ce7008f0600d9898253f4a6f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs.js

Filesize
6KB

MD5
10b3f7af7a9dfa7de4a77459334e7f3b

SHA1
e4ad15d417f2d9a2c63e9710d5df48076170b4fb

SHA256
4b000174ecf20c023f0d9ecf051d8ca85e898c0e798879f50eb807d68c49f254

SHA512
59b10069fc452abd2c2bc93bc61ce534b423faaa7e7a395fc0f40d9a2b3173fbdb8a696932c2db28dd57141c8c8197d6ec4cfa24f067e450301435885d36c432

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs.js

Filesize
7KB

MD5
f18aa151bc7c96a7b9298b97cbd2cc97

SHA1
f3ce58f9a93e3e920b8f19acdb809a0ad18bc845

SHA256
c1e1fe2709e39c853d9d0928fc718e0dce55e0c7faa2222f2ec872498d2d8f57

SHA512
d1d36a1776b579383dafbc726cd55ee5b953077dc96b1998e7b98d30cf433cba0b14d8262ead1b3593aee4a3f52db04def6198d17eb105b2bb6bc5fd7e709c32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\protections.sqlite

Filesize
64KB

MD5
49397db0486dc59d607907a086f40c9b

SHA1
08742ce9db9569062def08e99eea8470702feb7d

SHA256
890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

SHA512
fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionCheckpoints.json

Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
82bce218ea74f9b2f697d4347bc8da22

SHA1
5c2dcb7ea887904cbbf6043cd1fc759a94a938d1

SHA256
0f1feaacc5538f4657067b911b420cdc9fa84c3e3812eb1995ee1adb354c5d23

SHA512
7a6770bacd448f6fc9244d56f765cb480e6dd6b9b5aa5a985883b1fed8b5b5b9b9d6db1b3b4c61afea9997605e09053dd1e3964bea567d737b4425f21a3fe1ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore.jsonlz4

Filesize
887B

MD5
16bf78f3492113f6aba433cf4b0cad40

SHA1
8c76175ceb9d410a74a6f5e6903d898275d2e47d

SHA256
d7134baaf25c1f12b6db0f583833bb1b66885d0a89428b3ace0c41c51b9ad6fc

SHA512
998bdd2b37eae4ee04eb29acbfffdaf462a95e883d9595cb22c4f1a222e309b15cdd15cc86325f019536bc7cf8a5943f02b430393a0982ece65d2ce1a4e03285

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
970117355c247d41dc6c11c53749903e

SHA1
a86d1b3ab1d059409c7fd513f8d7314e32d19728

SHA256
bb09654deb5dba97435416df82993ae40828c38ca82656333f458f6d76b921cb

SHA512
3f8e8ba3a76e21c4fb1eb6eb3f2013759310d97405c63d158e5d868bc42dbecf25e42a80da096eeaddd473973a824e38bffa853aae865d4b1f98ef8f839d3394

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\targeting.snapshot.json

Filesize
3KB

MD5
209922072b1f766d036d27840be9f8db

SHA1
436fa952fd1ae5f2f4ae537c774f5146e3c71244

SHA256
828318e525bfb95ff57e9cf3ea658441e08776e8d7ad149bfc06d57cf9e29215

SHA512
38ab99b3fa6e6ded7905bdd8faa23b65a5bf85376d07363b3f47281dcf7fb899654baa61991349455d2e52d99d1e1c3a64376d7b90a7602428bee170b506448c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\xulstore.json

Filesize
217B

MD5
0c8d2affca72687940bfda3c73b943b1

SHA1
1d29b78b6c4a57ae16cda5acdd3fcdc817fb40f1

SHA256
51818b82ba606d41839fe0f3d3669cdaa244174d8b764426cbc5d9de601b2408

SHA512
15c6d606c92d62758c73dc344296d1445947d85e34b86e0d578890e3b72ad0baf7f8b59b5bb8060a52b00f4168a25915b1a52ce0fe65245e51f08604bf90c5a2

Download Submit