hxxp://cogensi[.]com

Analysis

max time kernel
218s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://cogensi.com

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	firefox.exe
Token: SeDebugPrivilege	1028	firefox.exe
Token: SeDebugPrivilege	1028	firefox.exe
Token: SeDebugPrivilege	1028	firefox.exe
Token: SeDebugPrivilege	1028	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe
1028	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 3256 wrote to memory of 1028	3256	firefox.exe	92
PID 1028 wrote to memory of 2208	1028	firefox.exe	93
PID 1028 wrote to memory of 2208	1028	firefox.exe	93
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 220	1028	firefox.exe	94
PID 1028 wrote to memory of 2772	1028	firefox.exe	95
PID 1028 wrote to memory of 2772	1028	firefox.exe	95
PID 1028 wrote to memory of 2772	1028	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://cogensi.com"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://cogensi.com
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.0.590403992\576619698" -parentBuildID 20221007134813 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45aaefc7-101f-495a-8c9e-2b4b88eaec1b} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 1796 229c6f17858 gpu
    3⤵
    PID:2208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.1.1373627698\1274197825" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2344 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eecf58fa-4847-4b33-9b6a-fd76597cc5ab} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 2368 229b9472558 socket
    3⤵
    PID:220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.2.1773570470\361706914" -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 3136 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7df239ec-9ac0-4ceb-baca-508fbffdad07} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 3112 229c9adfc58 tab
    3⤵
    PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.3.1598739822\2015586562" -childID 2 -isForBrowser -prefsHandle 3848 -prefMapHandle 3844 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ba4269a-0e77-4326-962c-dbce61ab3101} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 3856 229b9460d58 tab
    3⤵
    PID:380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.4.1765710114\1923715015" -childID 3 -isForBrowser -prefsHandle 4768 -prefMapHandle 4764 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e46356f-5ff2-4d68-b6bf-2bfccff94440} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 4776 229cc0dc258 tab
    3⤵
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.5.1697327766\2061194216" -childID 4 -isForBrowser -prefsHandle 3124 -prefMapHandle 3112 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a0e318d-7ab8-44fe-b3a7-de4028c9ff04} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 3092 229ccb8f458 tab
    3⤵
    PID:3900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.6.1986398232\242703281" -childID 5 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a85cbb9b-222a-46b8-a19d-f975aa4f2dfe} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 5124 229ccb90658 tab
    3⤵
    PID:3052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.7.308901206\888655195" -childID 6 -isForBrowser -prefsHandle 5216 -prefMapHandle 5212 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41f8a3ed-da15-4b8e-86ef-faf006ab242d} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 5340 229ccb91258 tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1028.8.1910356169\17678118" -childID 7 -isForBrowser -prefsHandle 3272 -prefMapHandle 3276 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f31dd25c-614e-4717-8da2-37f9b22cb639} 1028 "\\.\pipe\gecko-crash-server-pipe.1028" 2892 229cc395658 tab
    3⤵
    PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\4D8117A7EBA242C4A007DFBFA5A52F4437DB83AE

Filesize
210KB

MD5
e5c774a30d48a003cfb888110324a1b8

SHA1
338345dbb46d647425314bb225c46430a521d2bb

SHA256
cf63fb721fe247e741ba8353a1d7232b04133b3b88835507abbe3b9f36de12d2

SHA512
aee013bf2dbd7df76224a1301a365af254800d70f7179432507ab83b6b79ab8c6f8ce4c0b8811b2fffcb694f9ebfd53e9f27113135afaa41d279fe39c233d202

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\6109543212AA62158992DBCDC58D27799731E28C

Filesize
60KB

MD5
8557722991a490e4c24ac8dd8326f31b

SHA1
fb25cb975b04c1b0609974d711c6930c6014c56e

SHA256
90c49c5c63d8ae2e9cc783e23e182eb38724f885f75fce2cf696f813a3ffb170

SHA512
0e1d53db1d9d887c379f516f6109966a9e7300ca8466c6f61b514269cbce1f48b94453473c9c4b71662e72fed5759aab654fdbcf4e71283e17837c424f5d3889

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\97EDC232C00073B6AA2E9D2C88C91D43FF384B85

Filesize
82KB

MD5
5f262c42800ee9bd3c128186171d4ce3

SHA1
ed063183252b166dd9c95b08ff83773964cf3df0

SHA256
0b84ec554a22090f028d4dbcc871cdf2c013b41b28a633e91f699cab8721dbd4

SHA512
5bb0dbfb965ce328daee051657f69713a0661a3166c0ae01cb3e1890e28bee23f8f5c4644250fa90e5e033f0cb524f8f75b08207171145397b71ad1ff401b58b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
41f4a07c23b59d5c2d9d9b75d9255a01

SHA1
2647f472913fe7aed16a1589ab5ee5ad718e36d4

SHA256
05d38f2ed4c06ea2cf9cf0526264ba812795e5b07695be913f4d3fef9e10b7ab

SHA512
0d3ff9857210819633ec002410d1d68b45aefc2ee4062536bd353a0e65cc22609ff06fa79e4cdd3cb1e0acf9d35b2262caf5d1d8eef2c537c82fc0d9ceee1102

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\0cfe067e-f05a-4286-b848-0d922dffdc13

Filesize
746B

MD5
e1a07cf2968d5d4bc8f45762388ab937

SHA1
e0287425ef2adce176b3c12a4f2a4bcfd9a424ee

SHA256
63ad3df9383fdec17a10f489f16e56092b6604f51bb76143816fef72ec238cfd

SHA512
f4f005c8ed98db6c580f2d3f034b2ee65820bac7a7cdb0169466d7480c2d9cf383888278433744d61d642721f8dd9f9e1fb1eff77febc8ad3a3be7825da930cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\3f2d7a02-0fae-4df8-b784-6f6814a8dff0

Filesize
11KB

MD5
b01f7c257692a67789c249dfc4e8b353

SHA1
77a2c70fc98595deac57b06e96abdff11c654d9e

SHA256
16838ab3b3a315570f8c242ef851d0218ade320f064ff1493bdf6da5164e1557

SHA512
6b7b1abb1ec9db6543cea5e3a9b69c63a0d525a2b752266b5d9de01b230363342650ddb165b3b75023a98fe2a7c5bc6291eb303ccf1ee247b7b5498ec81ea97d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
a504151a4acd920955dbc7b92f63867a

SHA1
add81cfc7de76923e8d0a8d19f250263e2c942b0

SHA256
bd107802975984e826490eac96ff5f809edacf9e589545ae1c5ede23cd7b4789

SHA512
3f6a5d1e83bd40e844f15441bc6ba4f83ab981bda03caa8080b4b3810fdd753ba9ed99b42259c8c998536005efb1078fef803cbd27d5d12ac416caf62358f756

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
ff340cb41fa20277fcbacffa1cbc9b91

SHA1
fe45714257e8a54e7ac0a085a56cc3b8f2066486

SHA256
46e57c66b95c763c6e14473f9f8ebaf090f46d59058b2c6c895663c94b6c6c1f

SHA512
dc00c487189f1039311eb25ec3e3ffd2ae4590450f46e90827c1dbf4a14ac23e454e0b0ae0c256457f50c25508b98da7f21d0c1593e6e8080a8892fc64a12e03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
7KB

MD5
fbdfab48e0229c06e4a8732324380e04

SHA1
36ff187446ec4b53e72c620a7cf1844d03735841

SHA256
f29b65109f9d7e5149287717cbab823a981ddc6c89d1e6d694622e15e581bd6a

SHA512
15345c0a01368b3d05038913dbce784548e9353c6cd7443a45a4da2ab3dfc80ab8e5e2221dc2efebae2bd064340d4fc447fa059eb9ff8ccb80a2f38b9957af7a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
8e0a3c381d7e67c57384a02ae111ec01

SHA1
97a5d8861d4e7f800d7466bf37c21f7d094a3ed3

SHA256
bcb3b1833e05eb421158c9e3d3a8cb3c0df78308b143840179aa29373116adc9

SHA512
2cf21941b25b49abc0d5c535e88c4509ee9603db7ec0c2e54b8ac1699598bc41656241e8ce9f2e2bda80cfb007f58af3561fd027b0effb43708625dfc8a04da9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
8bd0b4b5d07784c2b93fc706d52e68d2

SHA1
ed1b2555a1d98e97ca164eaf63e718c24a907de0

SHA256
207dd2c1425dabe7c28850523cf9df292923c67acbdd9dad8153c995b3bfa6a8

SHA512
d3921f21bd40a65d21b5007d34d13ae4d7b0463e0fc3e1dceb00183c92de0a2e5c55789821a9bedaae473e9ba9cf340502330a1b2310b11651996a5cffb8f907

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
6fdcce1ce9ce1401ca8d795ed4701608

SHA1
f1fbe45ef4df851087daf9ddaec156281c5718b6

SHA256
bacf0a4561b0955034eca772b655cdc1cfaa8dd45760273a36545ba0b761870e

SHA512
01be6311ebb9324dbaa4d797a45afc9d404d7e4c06489305d4f14a85a9899882a2567cc11c1b2a36f664e7255c863b3847cc2b2f69fad0730dcfdb7fb3954a2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
e1c1d1d25ac6dffc42daee0ae8f72cb4

SHA1
b6664f5aded5026d0b695afe1e6ef0e8b53dff04

SHA256
0c083136b778ac31408e646dca5d49f0e92fc7e723a16de6af5757bd7a306fbb

SHA512
d6eaafa4337bca5204b31dbd749167f1ca7948c9ea23a969749606d08cdd22db9486c328dbc517826ae47da493b23c3e1ab929e7a8c06bd12a455d69317f9693

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
7bc31627bededd08716871bafceae990

SHA1
56404ec786e97a2d25feb6359d816d30d3e6bbc9

SHA256
b04a28b2420f6d1db9a08d7bc940f6a032cfe6185df5ae19aa6a656e601295b9

SHA512
8b0341c40caa25ac64c7b9f7240845b2766fab94508b6e6b826a10b078dd94f8b775f91aac567adb600b8ee025effba82613e0a631b2b7fb44ae0c5b7e47092b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
34957c19ae2a75ed1317ac224f5c9272

SHA1
1158b92185acb6e5236a4b094921f8c66d6b88a6

SHA256
4cb5a381e8cbed1278bf5596e95721742260ead36ee631d014814feaa0099582

SHA512
c653dbc2148e8200093a600191e26fa1a9a2bb2c0888235fad8ea6db4926022b083cb1856ae130f1894e1313a6ac1eff0f427137b492323ce20f51c71a96d7a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
7b20ceec2c188d02b6b1706ba07ed71d

SHA1
7ce7be7a155bc6132d03b77cce975d7d9a547cf7

SHA256
70325ea3f0f3a1072f01227a04ae0d98ff6911ec00caca6104ecf2360e33b1d5

SHA512
da22098527a5f7a6663083fb86b8379bc5e1543451ed32f422680aadc752ffd51282cc3354fd37020334503c9b9acfaefb034a7a3262824991377fbcc2154168

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
dc5c3767799c1bd6aaf9d5ab98bb3bce

SHA1
568b1bd5a44dbf8c00a160cdce9a4f7020f9ad87

SHA256
8f243d9abf5dd9e2bf9443629132b16bb69771479e1890f6032ea56d3f29f710

SHA512
9492f6f79183651178b85334d4925253c8cc4eee42894bd8d264c42ee9bb3556597e11a85978d3a55820b05245b9469966d92f85750923e760bfc4dc69c2df47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
fb6878257e58e3bc27bf0a5939532343

SHA1
6758b5093532143578e0496c780f8859bb75d7f0

SHA256
9a2342f3dac8e3ed564a118edad159375b3da2102c57f033a737da7a499b6442

SHA512
95190967f02475db2a0b98c88945e4b63a1c0306a060b72a67bbd54759f4b4b1ca80b0f343a64cf3239592e25450816ba3b466e920d8dd7506f65891d17bce8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
89fb414d778d11d3a12991de60301815

SHA1
1d7a63ca92d9ad28930ce2feaac8c71c3f699ef7

SHA256
935ba660008416f0b46a028a709944f11f9c2858243a2f7bc0b57aa1d96314be

SHA512
49f06dc78f2e08621ba4ed19925d8c7ed040502f13edaeedc7df3d675e77417d8b7b3c0b3feaf7f4fcef989091b363f5af1fa9258de57cee5bd904e1d7a31f9b

Download Submit