2b5578c87a15ef6eb56c60b59a72c6a20651572ceaaa78e7c14ccca5b575946a

Resubmissions

10/03/2024, 23:24

240310-3dvdvaea44 1

10/03/2024, 23:19

240310-3a9dlaeb91 1

Analysis

max time kernel
205s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EMP.dll
Size

1.9MB
MD5

071b2fd20a6439f5fa61b2252b30e0ba
SHA1

d958fc3bbafe4b37cbecffdbac038b14c595718f
SHA256

2b5578c87a15ef6eb56c60b59a72c6a20651572ceaaa78e7c14ccca5b575946a
SHA512

eb29ecc0c05e217cb307f9ad7376af989e42de74e45faaeab21f875d3d42b32611b62e43c9b9dd1fd1079cf9f54cf948efd0249bbe8341740f1018aa8781705a
SSDEEP

24576:xggMy49PwJKbSleGLyC4ti91d00vEo//KWnsYE1PmLkV6:vHJ0SjL6oN0vg/5QPxw

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	firefox.exe
Token: SeDebugPrivilege	5108	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5108	firefox.exe
5108	firefox.exe
5108	firefox.exe
5108	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5108	firefox.exe
5108	firefox.exe
5108	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5108	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 2568 wrote to memory of 5108	2568	firefox.exe	108
PID 5108 wrote to memory of 3016	5108	firefox.exe	109
PID 5108 wrote to memory of 3016	5108	firefox.exe	109
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 4560	5108	firefox.exe	110
PID 5108 wrote to memory of 5028	5108	firefox.exe	111
PID 5108 wrote to memory of 5028	5108	firefox.exe	111
PID 5108 wrote to memory of 5028	5108	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EMP.dll,#1
1⤵
PID:2992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5108.0.446391139\1701416335" -parentBuildID 20221007134813 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {142ac791-7598-4cb1-8324-991d3902b6b6} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" 1932 228668f4858 gpu
    3⤵
    PID:3016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5108.1.381218898\1468350042" -parentBuildID 20221007134813 -prefsHandle 2376 -prefMapHandle 2364 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {feec9863-1d9c-4404-80a1-75ec65c08a60} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" 2408 22859fe1258 socket
    3⤵
    PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5108.2.421684402\1312078333" -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 2976 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {698286c2-37e9-4eda-a562-d6aa611c9c5b} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" 3200 2286a9b8a58 tab
    3⤵
    PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5108.3.2075432638\1733231933" -childID 2 -isForBrowser -prefsHandle 3548 -prefMapHandle 3544 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {406d697a-1330-4f56-ac26-eed6c5d327fd} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" 3556 22859f62258 tab
    3⤵
    PID:4108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5108.4.208889868\758567318" -childID 3 -isForBrowser -prefsHandle 4380 -prefMapHandle 4376 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbfbb3a4-fc62-430c-adbc-89c9e7e72bfc} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" 4284 2286bddfe58 tab
    3⤵
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5108.5.1157242198\490488942" -childID 4 -isForBrowser -prefsHandle 5124 -prefMapHandle 5116 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00e7f1c0-d7b1-4429-b5ad-66d0bb2c73df} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" 5136 2286a972558 tab
    3⤵
    PID:1216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5108.6.271523160\177981892" -childID 5 -isForBrowser -prefsHandle 5276 -prefMapHandle 5280 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ff27da5-7547-4577-8163-86974cc250d0} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" 5268 2286a972858 tab
    3⤵
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5108.7.1048318917\520431305" -childID 6 -isForBrowser -prefsHandle 5464 -prefMapHandle 5468 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1156 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {647dad5f-2059-45c1-a8f1-50a9841fefa3} 5108 "\\.\pipe\gecko-crash-server-pipe.5108" 5548 2286a975558 tab
    3⤵
    PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\entries\E66F5AA5E3C285C270CF84BD11111C74D38F245C

Filesize
13KB

MD5
7cbfab0d767faabea25a8f3f4e915336

SHA1
fc11605399414bcf3bab87bf0a783004a53608c5

SHA256
c5c23b6f353e840d3ba80b730cea0ad1e28213569b6778c3acef53c4bb424475

SHA512
9fc5d4a8c9c460f4d9792727eeb225fb69ca8b6ead4e04ea8d1100528d9b1486bed10a5c3fc6e4d586c42f12ff99c3be6e98dd4f8d5289a9a2ca555aeb1e4956

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
6.7MB

MD5
cab7501117da80d7ec3294ac3bedb947

SHA1
f5d7b7be4742ff7eb13c57770ddd6830126c80eb

SHA256
22fb9a885c8c5426b2b7103c08f784d04d8ca88c058469a59ccefae84de24faa

SHA512
83796ae40c3485d538d88ccfb857fcbac3e2d19f81bc5d077da074ea950525b55b2d3a42c5d932088aecea42d1cf96e50c0def84d8bc63a772f43067d351c369

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
992e9d7e0cfe6d72abfa97802c14b293

SHA1
31167c342c27ebcb94215fc1434a4748e8435fb4

SHA256
2544d5bb6ee098f6fcf23b6e18d2da4c56e795f63ca7168e968ec36cb9433194

SHA512
aabcb5e25777dcf9aa5bad406b5e5dc687808737b6103cb5cd9a826fcbef1a6845fca038ca5f85c0cbe31c33b6944a1e9fd67515a44fd3efc4997370a2bd91ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\1dd19b7a-29f1-4b93-8db7-2bc97310e199

Filesize
746B

MD5
a9365707350053827970eee3b7c1e8f3

SHA1
e5e3bb7186d0da621fc308bfde948d5243b0dd3b

SHA256
bb88bf09364b3aa800f349fb6abc965502613d4049f529b13131f55fe45bf628

SHA512
f911ff8295752aa5026ed8b4bc8f19d4064d72f964961dca5ba124f3e5f2964314428a6f9ed719381c56512b0825ab76764a1e06bcd89ddebd50d60ae15e1936

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\f191a7d2-0e41-46df-889b-40d36e252fa0

Filesize
11KB

MD5
8bdf80732577935575df8fa3e197a68f

SHA1
58137b10140856f85793e4464abe0f7bc53ea032

SHA256
6e445e98fd95b756f9be6b37d186c4a8d95875b4bef7dcf8bf9b331344acec5e

SHA512
bebd7ae34f23168f2470d73b95c7444d4083862953fa83cccbc6b538a3afafe76d1bf0f7488c1e81bd950c52dc6fa149dfff9f8e488a3063fefdc6c43ef81d20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
512KB

MD5
1fe00e5224ab04202da8dce79d3d2c96

SHA1
74b26cd22ebdf6cba0d47b4ebe905fb1bfbb009b

SHA256
8c76624c70abc61eebfbd7973b9adc8d4613eb0f443da22a17489eb472b43feb

SHA512
94ebed84aad6569cc90f4e646208d997bc5b2c58ec3c3687cefeda26e1a93393ae9e82a98a86e9b0fa68e0a17e374d88614b31fe6e108f091cd82ca276d78aeb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
6.4MB

MD5
c6c8c90185ee11327031faeb144f2d6d

SHA1
df583cc8003f63bb7a39fa49fb0f63054156c72c

SHA256
dbf7c50ce1f303b80ad6bbbae5451a2aec8cdc87b29083424f5acbf32875e7a6

SHA512
3329c36d49ddb7c872ac77f24f60479f73fe7980c3f6f01fef95e93760dae4f1ab95287fab2c67ce9cb6030960bde93773f2dd3f9edd8090c8d9b9d5af863d38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
9KB

MD5
a23af0cf2611562b515a10352748d044

SHA1
d2173b041ebd8752d680a9c05555b70956762a1f

SHA256
67154423dbe1ac9372c591d91d3e5f337725f4c985d41365b9860ae9cb84f380

SHA512
9d8f7b60544098395623f1d35287e7ccb57f24e3de6bcc2d751ab955cba4878f9bd4bcac9b07fc87493c9d605974c3e2f77c2dbd7b3480bba42183efd06fd1e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
ca05c699b3530a9f490ef550034ac10a

SHA1
01459fa7e116e8ba5313e00d02e1f76e1d09798c

SHA256
bede05fae42d2128d62878c235aeb3e307a18003c3115686e56f976e26fdf2d7

SHA512
340f00378a54a007b8be1f5be33afe77dddf942aef591d8c83c6c6ff7be77486e509101ea12a1f990809b0c7caabb208fc025f5403f3602e771b8c8c323f283f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs.js

Filesize
6KB

MD5
942cf6acabbab839aac8f4ade994207d

SHA1
536636f10b16a033e3bed22b1474abec503925ec

SHA256
4dab65a474a5944cf2dfa720c28c767a5f402bbffb3f4a2f6d64430ecaf3babc

SHA512
85606f15af91f353d7fba43246fbbed819de47a2ea32efd6695d5b98ab2d766c37f9c2ce51b1d10248f0f17cc8ddf48c5c95a1ee011847eae583ef05ac084f64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
68004ce7dd4bbb78fc0cf217579903aa

SHA1
afdf271b546e5b9d0765f1526641a3d9d6a493db

SHA256
5809249281890f33a5daecff90949e4826b9192db8b437ce553d021d2942ae9d

SHA512
394896b8b5f09ae1d48afcc3065abe5b53285e9dcd775fb5ee1182edfc7286e032ac3ae12eb9e2d83fc57016ace4ba0e9587dcc2af3bab6646bc57bf2c116942

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.3MB

MD5
c01b964cfabc9eea30b939829d3f7ccd

SHA1
1c2dae093170adff4ce85b9062f1cefaa0c6f17c

SHA256
25ae11a6025f3448119a637afb237ddd88633b9e26b5c37bd5cbbe3d1eeaf710

SHA512
afc0276ae5361ce64c268579f7bdb47bf2216c48b4280bc1c92eb6202cd7c3de2ab6cca64a53f92ddd366b2d9d900c5ebb67ee23accb001850da13a94cdd717b

Download Submit
memory/2992-0-0x0000000013000000-0x00000000131F7000-memory.dmp

Filesize
2.0MB

Download