bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Analysis

max time kernel
246s
max time network
263s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

free vbuks pass 42.zip
Size

41KB
MD5

1df9a18b18332f153918030b7b516615
SHA1

6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA256

bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
SHA512

6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP

768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\free vbuks pass 42.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	firefox.exe
Token: SeDebugPrivilege	4168	firefox.exe
Token: SeDebugPrivilege	4168	firefox.exe
Token: SeDebugPrivilege	4168	firefox.exe
Token: SeDebugPrivilege	4168	firefox.exe
Token: SeDebugPrivilege	4168	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe
4168	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 404 wrote to memory of 4168	404	firefox.exe	93
PID 4168 wrote to memory of 3124	4168	firefox.exe	94
PID 4168 wrote to memory of 3124	4168	firefox.exe	94
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 2756	4168	firefox.exe	95
PID 4168 wrote to memory of 1752	4168	firefox.exe	96
PID 4168 wrote to memory of 1752	4168	firefox.exe	96
PID 4168 wrote to memory of 1752	4168	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\free vbuks pass 42.zip"
1⤵
PID:4844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.0.803558787\791779512" -parentBuildID 20221007134813 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {891b3822-09d1-49df-8c25-0b2e357a05c7} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 1996 1d9fc1f9358 gpu
    3⤵
    PID:3124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.1.194160104\2080610801" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {330ec18e-32a3-443d-816a-9fabf3e46260} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 2396 1d9fc10c958 socket
    3⤵
    PID:2756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.2.1233886063\423853151" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 2920 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd71e52c-4b48-4d75-96e0-fd8eb6862a85} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 3296 1d9821c5c58 tab
    3⤵
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.3.710065310\1153545884" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd018581-e7ce-4b2b-b50b-ff16c395ae44} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 1188 1d9e8462e58 tab
    3⤵
    PID:832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.4.1998216278\923835902" -childID 3 -isForBrowser -prefsHandle 4268 -prefMapHandle 4264 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8982f07b-ad57-4eb5-85c5-210e0bd1363a} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 4280 1d9840d5e58 tab
    3⤵
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.5.828009602\84789965" -childID 4 -isForBrowser -prefsHandle 5108 -prefMapHandle 5056 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c0fa57f-9d21-4368-ba08-c0ed27d2a74d} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 5104 1d981126758 tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.6.68994723\948137534" -childID 5 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1af5ca2a-0d85-4e19-bfe8-4b32c6bf15e6} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 5180 1d98158a758 tab
    3⤵
    PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.7.884128620\739961116" -childID 6 -isForBrowser -prefsHandle 5380 -prefMapHandle 5384 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c451babc-f0f0-4a80-aaa6-0da3e2b52782} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 5372 1d98158bf58 tab
    3⤵
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.8.43164975\1480076215" -childID 7 -isForBrowser -prefsHandle 4828 -prefMapHandle 4112 -prefsLen 26550 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {360b186a-de31-4444-a43a-b19d3e11bfe7} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 4240 1d9840d6158 tab
    3⤵
    PID:6112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.9.809697331\1649871415" -childID 8 -isForBrowser -prefsHandle 5832 -prefMapHandle 1680 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05b5a083-f228-4834-b040-d4faf0d7f861} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 6000 1d9814b3b58 tab
    3⤵
    PID:5892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.10.1939202608\1514225302" -childID 9 -isForBrowser -prefsHandle 4512 -prefMapHandle 5180 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5157724a-d75d-4d36-aa30-d4969a787283} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 4516 1d981125558 tab
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.11.1329905151\1263681933" -childID 10 -isForBrowser -prefsHandle 5564 -prefMapHandle 5488 -prefsLen 26734 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44bedc58-4ec7-48d5-8532-5a7a6255ee69} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 5584 1d981128e58 tab
    3⤵
    PID:5876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.12.2046433682\1059758811" -childID 11 -isForBrowser -prefsHandle 5956 -prefMapHandle 4776 -prefsLen 26734 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {731b9033-1249-4fe4-a167-31c80734173f} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 6160 1d985f08a58 tab
    3⤵
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4168.13.886636754\287886870" -childID 12 -isForBrowser -prefsHandle 4812 -prefMapHandle 4468 -prefsLen 26734 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53e27361-df30-4b6e-abff-7a9d41401733} 4168 "\\.\pipe\gecko-crash-server-pipe.4168" 5848 1d98158a758 tab
    3⤵
    PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:5808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
fc025a6488aa37965837563287bea6cd

SHA1
8afa1209653f4a44357f4316a137e0e53984a871

SHA256
fdea935f135584cb3062b5ff8a8f90aa6b0463a1c4dbe685b84cf7ebc1e72c07

SHA512
67c12f8494f49d9ae4f759138481f824dc2c76fd62cadbaa5bce5744ce9da45bfe82ed2a8e3da75bd996682c36ac03df8e4f6c7fe8cef97df4145ae54d98b112

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
15KB

MD5
fed680a23a216681e11f54d3da81e715

SHA1
d754292327632baf62c96b654823642e9fe76632

SHA256
1cfb70a96b4cb7abce31b9678f854edbf430a27b6d2f1ffc9f97d3f33f2fa252

SHA512
01424e8e8af4ba170aef02e169340c7fe4e96019a7493f71f2d7eb61786cfcfa475aa715c02d526a646dccdf8327cf2134634847d604ec8bb84c7fb14a46fffb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
4KB

MD5
c272c4a7c63447d8e5a00bc506d1b1b1

SHA1
2e54fca429741cf2fe2e791c977652ee29618bfe

SHA256
3c41be2e05df93325cca94f9a565ad3648d11574f71473b9cbe4965e17045d67

SHA512
465b1cb3a91ec46f8d97a944ce424b95f2eac94f9b6b57711287bbd319dc324f0ac116c82882e270cb1d644594f84dd355f7015d4a66c4b16431d68f2bcc7993

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\0b4e89d3-c743-4533-9c4a-7eddf1647894

Filesize
746B

MD5
34d2287cd31bd56420922824c82fcddd

SHA1
f4f4025a61544d39cae598e56310846ab0b24f9f

SHA256
920d8229c3d99fbf41cd60ebf995c7bb6ad1fad8267469d53cf2aafa058cd7f3

SHA512
3db1b603bf1547cb501eb61df2d63389a270850c1353e68787f7469c83e5694f7a4ecff9d0b5f48ad4572cd7a210f4789cbea9c310cfd8b6f295eec9618ca58c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\38647b58-db71-4b40-ae91-479d706958b6

Filesize
855B

MD5
76496d959a1a9bd3222df0549e328ac3

SHA1
63fc837ce6e63632c4130e8bc0b48bf0cd54e006

SHA256
260e773fc376ed0d0dd5306760f3428f0c994e686c6ec11cb861640c8b2cd73d

SHA512
8d5186004d5e5a1dcc81ed3a8d090f4a24d18d5b1dfb1762b93510f61cfadad8db3334115df9d7591424f73fb1831a79a40ce4feb6de49fc3c42213094708dc8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\59b4f73b-c370-4fa8-acb7-a27af5fef6cf

Filesize
1KB

MD5
d6366c8efb385c1598b839022fe72f72

SHA1
7075ba88d3dde0b2b23d65851c21690f82c12314

SHA256
919342f7c15838486fadf8deee49b6a48cb5ee1a17e26ea313d9670dca3e77ea

SHA512
dbd5ed45f8ea99a08836ebb58e07a4fe6ccf7708d54efc24959d911d5418044ca0151b8aef7a26c083910d11b66bdfbe41d99a9d79d40a21667b8fc56ad455ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\f01e08e9-4656-45c2-b79d-d43e2e22d332

Filesize
11KB

MD5
658e04d30782e37490c8640fe66ce68d

SHA1
84f790e9719ad459825767cbdfc675624f85b8c2

SHA256
47040271dd914151cecbe5ba378f32b41f9eadc9426fb0371ba1151b8edb84cd

SHA512
f35e314d90778dacbf9db2f09fc0b905798c4a6c0d6c4f12c4f26eba483c8c3cf5debd8a6ed56eb8eea9d4addf2dc3d452e1d7e59928c8dd634a4ce81d4d25b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
99496d7e4c017d33e31fe62fd9331036

SHA1
1ad54f1759b3809ae2296cd1875a78fcb724f280

SHA256
f22b8795808c82f2bde98286e12297be0e1c06896828dee5dd1990a9d2b918a2

SHA512
2d35f2d36cffda4dd2add0eaf2c7838f831306b465f8520fac4c2292f78bd432aaeac8a1017a89ed3e9d3b62a6bf16f59c583e4c5670f90b1e02235f5ded7efb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
776d23f860b5602d84fa49fd346a0444

SHA1
6dbc6e926a49f251a53da5e74db978bdad0ba32d

SHA256
988b509ac7f4a4c0e603eeeabf060cc15308faae3b684746f4701319a78f6bfa

SHA512
d240d4289210b27bacdcae5dc168b837e1baade7a8885671e70518a58b77d3f2050b3d09369b6bb099c54bf8c7ffef6b4671c5fae9b7ce20c055cb9e393be4c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
fdb366761bbf6de8770e1683dc552aae

SHA1
32f1f56a4f4f0597c276cb5442e06ac1706025ad

SHA256
59d472c89ca7127bf28713bf200d05e7520378fcc5e39bdeb685a41f04b49331

SHA512
4d0df81287b10eaae967da8073b347447a02d0ca3b00477ef4798d1e51a7f3ad52ed9b8e471759cc2a355da81ba8a178d7488bf5635781a6da4c3f3550d9eed6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
dbc541ab59f2b2efeca0cfbc50c1ac64

SHA1
06522fe0e0d16c0aed83fa45350a0f314876d3ff

SHA256
9852c3ea4406c7fc1b9a5641ed2f822eff28c437ae3f1be7237adfd6e318bf68

SHA512
acff5ad61ec862349b2e1d3f8716d71387037e77fb954e7320d7b1dd9574271a8654083e1c2bccdc0dca944b82c16afb21c677ca546715740eab130ae05c1323

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
c417e6535613e1372aa6fc0fbda38767

SHA1
9b041ca2c5adec3b11b1f769dec3b6627aca2848

SHA256
c63695c4e838085e539bec988f4d5f499cc62085f3a92972f065c52842b7b637

SHA512
3bf6cf3e2dc2e18b982e9153746e94031bca089c2cbd20217d1b518eccabac10f72fac2ae1cddcc606275cfb603ba261b89ffd223bd1c4f5a60596df8d84d2e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
cdb5151cc0fa899b652915bb096b711b

SHA1
0e7c2f8dcdeda8bb093756873439f881fc8f8fc1

SHA256
2de81da6c30ac5ec93616aa2395e4675da707ebbdb173badbbca092518052007

SHA512
b86a843788eb15e04b0b69ad87faf60251abc926b3ff6a5ea6cb3d64e7ba028e1a66369f67b6a4afb45a7821b18bca6e2bbf896f71eb6b54e86f221a0f3c5771

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
20ea10894d2f80c98cd8d31d3849f647

SHA1
aac13d2ad3d71f9e974e19ee01dbf1059758af05

SHA256
478307cc0566f35820ce5e4cd31b0e34172c44e53a0398f5a106aa114bf34fe2

SHA512
26f8580191d5995fc29890d541d5b2e7f6df071cfc57dcc46c58e7dc23ba647faa64653319bedc4385387f114850f77d0c1144eae6347976a1f9a7b539de9293

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
460fd5950dcf8fbdfc30f42a5ad0f3c0

SHA1
3c4e7b7ba0214f7b4ed06fde243ef9cc1f182076

SHA256
0d585c2ce82c15963a144fd7208b84beefa74ef73cc1d302329cbffd07186339

SHA512
de5a4ccfda95fe7b1c953dbbc7d3d23c5f0e3883d9d14de8d2ffc887dc4f6bf469ce1f5be79e3c25d837071749d457202e2ed007a67b255a3477eee91f3e492c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
45101703c6fb2ce4fd244f58341162b4

SHA1
590108612f55e7195e80f4ef06e4f41b56a2831e

SHA256
cc61da1348f88b2e997a2964183be92442ecca9d0f9d90fb2faa714d608e5b95

SHA512
5090972149a9092bf7dab8720c4d03b50e3b204fb0c2ad02a8029cd69768c9f7a944171f9295a559343f921012d7e5f9f9b3ae6fddf24230068ab1482a8290e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a7f75828888536982e57e4604535d993

SHA1
7f04856ff293d25835104959a9fc111c60931e48

SHA256
9e0d46406f28f802e6deac84c0fc5576ea72c5d6147c3d50aecf0c88d875b030

SHA512
bd90971713b0e4941e3f9a40070e0a446959382814ba1d34990de064a06adc43a4c01c9dbfa213fdac742c0d4a95e4931b225fb59141988e97ddc2218e04d390

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
725765585b276ced5f6ffb12609ac285

SHA1
fce57316a42339dee19a446dbe54a4dacb149425

SHA256
b455c94a69a56760ddb50fe369303c0521c9b33a13c366fbe792d68cebcb8c4f

SHA512
2c643daea829c027a316ecdf4abb442d839fee4e41cc475c2b4d0ef987d9c4029b1315d3e5ded03bcaf22acec752abb5a359096dd8b8b6317398b25d0f675507

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
1865f22b62556611191173a7fe1454a0

SHA1
1a47716f83de6d58f954efe0202f753f45eaabfa

SHA256
fb4869a1bf6ad0ad9467fa603c82b9452c2e8f1b08e8e87c140ebe1959b0901d

SHA512
b45388df888df227320da4dba2b8978959b15ade3a22a235e071e42ba681f85a57bf2adb989d46ed2b4ef9ef79a309a507f7929cf264406954a933d845df0d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
40e70e77ae5ca65808df8921ae610847

SHA1
b625606401dcd68ade841680d94cd5a18be5575a

SHA256
71cc7f6d6a64312935b4d1ddde6a16c7f62a6b1a89126781e7e149ba52f99b94

SHA512
754ea029c37696aafd8002dc4be96943372fc77a7238676f345d63e56d897dd97e37d90c374ab541df3398cbd08a6580825e53b4d4f0019a06c0684224b26e0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
705fb9419c8fd26734ab9f88d9ddb3ac

SHA1
555672f9b7cc4bb5e2345b0ac9bf86eb3c1bd361

SHA256
11e4d0a58db23b28b68ef8f5de634cec74336684be0979cdac1133d2a1a6ee5d

SHA512
d74785abdace2b2b8baf9e93850f977c17848b7da7638bbcf9bb9a2af2a060d1055d9b50d8de0dd9ac844e9869a1a52db943572386646dfda8ecb7f9d6a38a9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
c47d1c7f1d3b7d61cc497036c489a406

SHA1
db8c2e9cab98b76e13906f7fb9fbc5e4c6fcea4b

SHA256
b47935ec3dc6606b52a7d5f02e78078fa9edc3c3fd9ca81390162ba1a29748fc

SHA512
a00fd4bede7fb2dbadcb46891fb76b979cb87285ed3aa93dca009f3d576c0b5d9dc8bd0383ef3ec0bae4ae65e527ed42660021f48a4d3346f3bb764b681254cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b3687270d4dea08aef50d40f9df0b18f

SHA1
b8bc619d8ad04d818d5fbc6ef90eeafc2b45db31

SHA256
d1e7f0fd038b3f050c648b086922bc70c0d930161158790d6b0729e017274604

SHA512
b94efb96a1ef51fa30367bbf6258d6af128ec2b7f34d991167608967adc387c3df5f9fade69756ddd00f5a4e34a9218f917c6bdeecb6f8c98baf3c51130778d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e9df11a77992587738185b9ecd9f971d

SHA1
fa7eddecd575675dc071a068b8ddac2063d73857

SHA256
40295d3f54e362be353a7e230b19fe26872338eb56371b7a520242472190bbce

SHA512
90c0407bb41f4b16423c8e9a8975f7d0375ef035a00eb789d503f4f11be9538a8409ac67ce871e8a21e529ea9ba9da82ebdac78608b64180eced27e2c1880798

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
b01efd0877d8bb4a5d754d6d5a5922cf

SHA1
6dfaecd4219afbb206185171c64c777e9c73ae21

SHA256
ef1ebedd446ce18b79317f09953ff8a6069f92749188b45945567c315388aa90

SHA512
6f5fce89b6dc7e6979fdb01493c0811bcd55cb945d7665cd9a23e93419a5aa28207b3f614461103f04b0406741e8020c35252fda5529e41e3e918e42fd89c086

Download Submit
C:\Users\Admin\Downloads\UwzbK8Jk.zip.part

Filesize
41KB

MD5
1df9a18b18332f153918030b7b516615

SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503

SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80

Download Submit