Malware Analysis Report

2025-01-17 22:13

Sample ID 240603-qrvwbahd72
Target Discord-Server-Cloner
SHA256 37bdfec061cde91d31d241b3b2419529b7610dab35fa3a8fb191cc6cb1c71cd6
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

37bdfec061cde91d31d241b3b2419529b7610dab35fa3a8fb191cc6cb1c71cd6

Threat Level: No (potentially) malicious behavior was detected

The file Discord-Server-Cloner was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Uses Task Scheduler COM API

Checks processor information in registry

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:30

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:30

Reported

2024-06-03 13:32

Platform

win10-20240404-it

Max time kernel

83s

Max time network

80s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Server-Cloner

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1804 wrote to memory of 2196 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 5092 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 5092 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 716 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 3780 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 3780 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2196 wrote to memory of 3780 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Server-Cloner

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.0.57740906\1953785320" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1680 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03d9ecb5-58d8-495a-a8f9-83f690204432} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 1764 2260dfd2858 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.1.1840848310\1607913230" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2d402e5-85dd-45b8-8a81-6232f9728642} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 2120 22602d71f58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.2.2073374816\1557053841" -childID 1 -isForBrowser -prefsHandle 3048 -prefMapHandle 3044 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7142a22f-5d0f-4af8-a53e-e17305ca357f} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 3060 22612099f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.3.2118822213\89336174" -childID 2 -isForBrowser -prefsHandle 3428 -prefMapHandle 3424 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe81df6c-a16e-453c-b6a0-fd2926e9f944} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 3440 22602d6ae58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.4.915665015\1181236544" -childID 3 -isForBrowser -prefsHandle 3940 -prefMapHandle 3936 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {161cbb20-8956-4839-b285-486e8582b558} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 3928 226132bad58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.5.708276055\1329322632" -childID 4 -isForBrowser -prefsHandle 4824 -prefMapHandle 4880 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15434368-1a20-49ec-ab7a-1b4057693a10} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4772 2261258f358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.6.1027308877\488808120" -childID 5 -isForBrowser -prefsHandle 4620 -prefMapHandle 1556 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {957b1ea3-0fb0-4546-88c2-72506b776ec2} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 2580 22614603558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.7.796251200\1231505459" -childID 6 -isForBrowser -prefsHandle 5144 -prefMapHandle 5148 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c695a4f5-f495-4993-94ca-dbf7bd85c769} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 5136 22614604158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.8.1947854139\1547667758" -childID 7 -isForBrowser -prefsHandle 5328 -prefMapHandle 5144 -prefsLen 26422 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {102ab0a1-d193-45db-9e2e-3d4cb797471b} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 5228 22615e9d858 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Server-Cloner"

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Discord-Server-Cloner~\" -spe -an -ai#7zMap21450:114:7zEvent5648

Network

Country Destination Domain Proto
N/A 127.0.0.1:49769 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
N/A 100.89.97.241:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
N/A 100.108.26.120:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
N/A 100.126.248.124:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 241.97.89.100.in-addr.arpa udp
US 8.8.8.8:53 120.26.108.100.in-addr.arpa udp
N/A 100.82.171.26:443 push.services.mozilla.com tcp
N/A 100.80.140.24:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
N/A 127.0.0.1:49776 tcp
US 8.8.8.8:53 124.248.126.100.in-addr.arpa udp
US 8.8.8.8:53 26.171.82.100.in-addr.arpa udp
US 8.8.8.8:53 24.140.80.100.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
N/A 100.108.236.99:80 google.com tcp
N/A 100.108.236.99:80 google.com tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 99.236.108.100.in-addr.arpa udp
N/A 100.123.186.43:443 push.services.mozilla.com tcp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 43.186.123.100.in-addr.arpa udp
US 8.8.8.8:53 32.99.98.100.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\db\data.safe.bin

MD5 f5cd80464d3e1d1c364fe609f6b3c605
SHA1 c4ab52266a61b88825ac3ab7c17b4dc809c15a3e
SHA256 dc6a17e8a5c5c0d33eb4a122ea22d9d02df979481af6c1cf3d83b251e7b93a37
SHA512 cc8dcfd05a6be2c8263b784e0b96ed0bc821f370776d3ffdd101899777b6218299a46b71f53f146b308ba686b9da459a060e54c2ce1f442336ce8e9ca4242ae3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\9b8a1f08-5e5b-4685-8202-4de605d156c4

MD5 58360dcd62b3320658bf61f207b3c9fb
SHA1 d9c33ae70fe63649df4aea50540502644de34b40
SHA256 118fa2f27dc964de5507b9b5db441ac7d448bd4bf85748ae09df54b78639be4e
SHA512 71970602d1c4499b3962cf7e67988b2ce7596b93d81e40ba77a447f63e30ee8f7a5d2d481c545e0a8ff6aa6d96ad4946dc7876596c683436e9e5f020c6d6ae59

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\datareporting\glean\pending_pings\7276e509-e7d6-4397-add3-a73cd050eb72

MD5 241a7f8410e27f2c33dcb501a8b0c41d
SHA1 735a088ab39569e788e41022d7196baed67d6355
SHA256 66e3ee62ada54385be5bd3909780cd5626152165b94238cafdebd43e8cf3704c
SHA512 72b288f4388ba2587f10bb3201db08951bccc186642befc370c4fa3e025b176d6e3c9b41047d735643e0d8d523aa9435332279645d824631bb2469c956c36817

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js

MD5 cac37ed865c365e3873764f06eaed16a
SHA1 75894faa165a968d5dfd2789b1b25cbb5e38a03e
SHA256 39f24040ff86faecdc40eb18deb695379ad13d61d0852f4f7c66bc6380c513cf
SHA512 ab06dcc917c1f48191b657512bb8335ac3e89cd209da0653aafddc05d092f7ee44ae23ecc039adaae58ecbac634e3e03042e082def64daf35beac11295e1ca89

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs-1.js

MD5 75e6cf9cafd27ebbe06255d81a195d49
SHA1 63cae53a1d9abf254de4ca35f1721d93ea0e9c89
SHA256 702bb1074400a20f3bacb0e817dc71efc1ee97a788ddf7e3ee04d3716304c60a
SHA512 9ccac6984da5823dbea37ab0f4ddbc305b9de0000a2d3e4a0dd6bef126c1ef587e8350dd75df8b80ae606024ab1f843680289a0c160865d07fc667cb5d3df323

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore-backups\recovery.jsonlz4

MD5 563b46f59fce77c6951f03e940a93e67
SHA1 d7f60ad98282247e6eba42a4a3c03ddcdc5d1437
SHA256 36d8ec9b788c0e6cc26edf0a8c71fe5bae0fd08c9edf2d81d552964954204377
SHA512 ff82d0ffd0d49675042b42900e25e484edf4bbe71bb7a4e4954bea9f81a3e9033f9115e9cad50bc972e1bcb815f9612a6726642b605ad6ef7c779224d9510c2c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\sessionstore.jsonlz4

MD5 8a2c82d79ce69eef7751de53375e2f46
SHA1 ace9aa2485fface72b26127249ea9f55f2a05e4b
SHA256 d1ef480260193565d406f1b8d28d8f686910e8eeeda4c8a4d631457ea6302d92
SHA512 4c1c175ca390bc4d493d1f25b88654f3dd1d7ec7b05e16764458ef9ce6ddd91970382581abfae892443d78fc745c08374933637dd17e56d479313f11e3db48b5