cfae667acd521d33f43e9cee19e91e61deba808e3b729f7069336a495b5be7d7

Analysis

max time kernel
294s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

alemania rara.png
Size

266KB
MD5

16845b431419257b1ce30827c608a645
SHA1

d9b5de2d448185162ca607c9b703afdf49e035b9
SHA256

cfae667acd521d33f43e9cee19e91e61deba808e3b729f7069336a495b5be7d7
SHA512

4653927a57f4dc1dbdf37e9173a04d68a31f88d53e7e61c9b170ba5a0714b089affab14bf78cf54120e6f819d0a811eaafd0800b49830dcfcf486dc6063f0a75
SSDEEP

6144:wP8AXpimdTUV6NhWVCQkYeAbKhRgZ/CILmkGikEmaUnrPWhBjEX:cfKMvYpbKOfZ2rePEX

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
104	discord.com
171	discord.com
193	discord.com
105	discord.com
106	discord.com
175	discord.com
199	discord.com
110	discord.com
136	discord.com
191	discord.com
103	discord.com
164	discord.com
177	discord.com
186	discord.com
197	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
564	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 4864 wrote to memory of 564	4864	firefox.exe	92
PID 564 wrote to memory of 1068	564	firefox.exe	93
PID 564 wrote to memory of 1068	564	firefox.exe	93
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 3456	564	firefox.exe	95
PID 564 wrote to memory of 408	564	firefox.exe	96
PID 564 wrote to memory of 408	564	firefox.exe	96
PID 564 wrote to memory of 408	564	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\alemania rara.png"
1⤵
PID:4480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.0.971500511\1890625436" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ede2ca7-2969-496a-a50c-ecafe7447b69} 564 "\\.\pipe\gecko-crash-server-pipe.564" 1960 1ba8a7d8458 gpu
    3⤵
    PID:1068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.1.809717249\570531357" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2344 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28af394d-edf1-49d4-8756-60b36d84ade6} 564 "\\.\pipe\gecko-crash-server-pipe.564" 2360 1ba8a4fc058 socket
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.2.456669828\1258848580" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3100 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {edce04f8-c19a-4ae5-90de-17335137177a} 564 "\\.\pipe\gecko-crash-server-pipe.564" 3116 1ba8a75df58 tab
    3⤵
    PID:408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.3.1764125693\1955715371" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6094d713-fea7-4ee6-b5f9-a40e3c0af18b} 564 "\\.\pipe\gecko-crash-server-pipe.564" 3608 1ba8ebb2c58 tab
    3⤵
    PID:1600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.4.1515065123\496529802" -childID 3 -isForBrowser -prefsHandle 3976 -prefMapHandle 3972 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4e4f6dc-be48-44e9-9d49-abeb5de3488d} 564 "\\.\pipe\gecko-crash-server-pipe.564" 3980 1ba8d3a4558 tab
    3⤵
    PID:1232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.5.919469310\329120312" -childID 4 -isForBrowser -prefsHandle 5008 -prefMapHandle 4700 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef525d3a-e86c-4868-af99-58d92e1921b2} 564 "\\.\pipe\gecko-crash-server-pipe.564" 5044 1ba8d3a4258 tab
    3⤵
    PID:4064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.7.268542667\423061604" -childID 6 -isForBrowser -prefsHandle 5380 -prefMapHandle 5384 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8532c30-0a07-45dc-aeb5-07a43b9bfbf1} 564 "\\.\pipe\gecko-crash-server-pipe.564" 5372 1ba90558358 tab
    3⤵
    PID:2756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.6.1138393673\1600955858" -childID 5 -isForBrowser -prefsHandle 5204 -prefMapHandle 5208 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8458077d-5e9f-4bf0-a7ef-8708bfa7988a} 564 "\\.\pipe\gecko-crash-server-pipe.564" 5060 1ba90557a58 tab
    3⤵
    PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.8.482806764\2082399494" -childID 7 -isForBrowser -prefsHandle 2712 -prefMapHandle 5904 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67d654d5-79f9-47bf-b7fa-4e48edca0f2d} 564 "\\.\pipe\gecko-crash-server-pipe.564" 5908 1ba921e8d58 tab
    3⤵
    PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.9.122346117\722038724" -childID 8 -isForBrowser -prefsHandle 4756 -prefMapHandle 1688 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe36b358-390e-4fba-ad95-f8022d5c2b59} 564 "\\.\pipe\gecko-crash-server-pipe.564" 5420 1ba92394f58 tab
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="564.10.580944316\2119010790" -childID 9 -isForBrowser -prefsHandle 1676 -prefMapHandle 3632 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaba5970-aaa0-4299-a4f1-b966e7ed275d} 564 "\\.\pipe\gecko-crash-server-pipe.564" 6296 1ba921a7558 tab
    3⤵
    PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x3x6afp6.default-release\cache2\doomed\17049

Filesize
99KB

MD5
ced3ad46eaf00fc1a40143561e789d68

SHA1
5464c363fdf9c28b54d5a32a27d235ea28e47c64

SHA256
6ac6a53e28356849fc0e3602aa9f885ccd5558ccb1a7c78db92a878ab141fe1b

SHA512
13af7fe527f5fc3f624c50856a65611229a90d893eebb4f6c7d45710c2c9095e83b0d58795dedd00c70a4dd1a0f0f72899569b6432bdd93ce1236bc5d48c38f7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x3x6afp6.default-release\thumbnails\41a1d926ab757bceee8a56185c2ddd91.png

Filesize
18KB

MD5
67840e9d1a7d2e7afa826f88ecfda74e

SHA1
6896474982b6999cbacd0af3a4af140dce97042f

SHA256
601c61f448c22586fbd9e9944d950d5e927d832535e959575d44caab2c46a1ef

SHA512
2f8be28531ac550cee5173980d30f3e2111a152924a905d8a6e2a9371683b2f3e8d7c04569bcb9e842aa6fa91f72481046bd219cbd77ebbbacf5cfc96ebdad07

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
3.2MB

MD5
fb4b97948abf6e5b90ac36f6c094081a

SHA1
6528c350bad71f0f1a492770bb9e9b4d94c16111

SHA256
9cd09b49954b1036ac17c5da36d80c441513a1da52afa2994505f128f868b082

SHA512
f1b594919b81fd3fc07eac04e4758c73207d0e94ffe7efb2d267ba71bd9fcb48f8e6a8e5a81282f48c9ee3a39299d2a2ec9e3ae6b4dffbf4252eed09323277ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G97JONMZCOWYG2S63J16.temp

Filesize
9KB

MD5
b9019628b3022c487a619d8afb182a85

SHA1
c1d559c5e3c8c37569c7eaae493981de3d7851e6

SHA256
d167cc584f6fb3e8844f36b33d5d44ace81259ecc4b67c83f9a562d546b975ea

SHA512
7571cfbed33b04afabe116d605c6f9cc671015582b01f528a2203a3e9cb3c03eb0fc3d6725fc5e3d6b81459e23cb58489b3f7ae798f8c624447578905ba4cb6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
6fc0ed6a4f3e503b70053a56370ec457

SHA1
3e1821fccfe9f1b599384ca06d41b0c6838418bc

SHA256
5bbee737aa3b00fdf97470617b58bec9b0a564895595f38124f9d97be21aad79

SHA512
eebf3c3fcfbfb5121bcbca5032d81a49e89ea80e9281fe1681edfd181407e3216e4755ad8f31d61e41a47b59335ad369e949a462a8db91ee10967509e9562248

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin

Filesize
17KB

MD5
98c9fdc9bc928b6b532d1fcc43a3e69c

SHA1
b25316d7ecd85a6dc00c1ffc2e882668deb22237

SHA256
2124c058dbe27de460f6bfb8897ad9cd6c3f4bd4ee2281ccbdeb80794c496ef7

SHA512
628635a330e5392c929863c8a8815f5f00115e5a28cda09e5578e3336b34134c8457b841ffd7f599f9a05d5bba394282cec4685ea40ae8cc56b57de6403ad953

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\0cf6bdd4-51e2-4354-b986-5b11b8ae2b9d

Filesize
746B

MD5
79f44d8a6ad1858fc475802347679c3d

SHA1
34e3f3c226261fa97036cf0f20409149fdf7e1c3

SHA256
f0c9106d885e04c77a37d77075f28d4c5231e6133be6d159ca3b3116f508dbf9

SHA512
8e1fe25b0a9e6794c6ae947a674170e0c97fbb38192105ca72ffde2269c9bacadac3ddb8cbda95927df1b0abbca0977cb12e2553f1c740fe9a33f493fc04d8d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\0d659a66-fd87-4ee4-933b-6874c4b53a48

Filesize
855B

MD5
174fd2da3c4787e001a4ff909ada953e

SHA1
81f126faaf95203fbbb0eaa5d08e29e442fe3bf3

SHA256
e2b0442d4fdea2cd6cec106411f548ac74a4c54efdb873bac59b6009357e826e

SHA512
58b8f463771d5f50b6202a244c5fdbcb4429f74d72422c93faf3c2e8c091f966eac501738a174189cffa1a15ebeec39465724a3d847ab3f0c485fbfe1fd4bd27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\7afa4e52-e31b-4ee3-aa1a-4a76106692ff

Filesize
936B

MD5
802ba793e9d6f4dfe9d6929d128a878c

SHA1
18f374d37f92d69e36a8cd945b554855f0637d2b

SHA256
9708cc1935faac7dc3d14053e11b9bbf16afff4aa2071cd85414a446c1732c76

SHA512
1464b7ac063bc996debb0d9c13cccdadba8e02b1cf06560dc5fa6b60cea7d2279f36747401d76a883b2fb4515a2d8e7149a04afc466c5ba8af714c4f779dd2bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\b757b405-e5cf-4cca-afe2-2b9ad240f8e2

Filesize
11KB

MD5
d950ab95c1c7b2027e6f16a675ce033c

SHA1
72e286533d874f8c4d906debf49a5431709357ce

SHA256
4730301f8591be77893c4cec6afa31c7e301368f5f6be37e107d082bd5c1eea7

SHA512
7cedc3d5f6d02dda7622a3c2d5efab534564b667e5f04a98c028ce029b895f20f646a3335b2a898f86effbe2444329e8bdfe4208bbdb0cc7a71ef3c7ec5f7588

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
5.1MB

MD5
ab350de9070ad80a2638193f5b23cc02

SHA1
2d6aff1bfc58dfa0ab755825dadb1d876a022f1c

SHA256
626cf802dfb368bc7798355b06ea069228e136ebb24a7fc298e2c4b0fe9279ff

SHA512
6e58716bdff6168742b8f16ee333a75212ebb359adfb8b3fedad6340d2608c55853df64fc8406f30176a4cb0ac25c311c261a47546cd2ad661053ac606487871

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js

Filesize
6KB

MD5
b0a149c898699efac03ef79e116a8cc6

SHA1
a07346ce075a3c8e6e5a7efbae181ceeb939a3cd

SHA256
13a287e52a0a1ac565f6e9bced21ceb1171640813c10a4b603761906f629933e

SHA512
19fcb2f613b69a1220f5703951840fac9f6871f1fa551e9be6730fee41db402993e20ff113eb6d7be9cbd095c7b510fead86656c8529bd23d70443b74edae4c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js

Filesize
6KB

MD5
8785f4f8767cfa8f4c83475614a5269f

SHA1
7579b0a01dc0f8e729fae392c9d2e84b017a8620

SHA256
553860f0fe4c672cb120e185831927334a0cbfb47a347ae4d5490ee99e0eda4a

SHA512
2f403f08897d22837336d52943b32dc2e5d7bf22b48f8e2bb18c93458ae3f04028e3d00627a094d52e139047474992c9fcb168e87210d5489871d3d200285e29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js

Filesize
6KB

MD5
a1b92cfeda6170914478b98a9afc5702

SHA1
a53e16e205e0a79505d8ea6f8f1efec32fcf69d8

SHA256
c1621e4ca6e1874751297e38280b459e67ffe653a7cd1f18aa7767f1ef664913

SHA512
becd72a7479b5f1d0b4f78cfc83eabf4cc1c9d03706fd767d655745123bbb20390b97a354b9e3e9ff4bf96425202ffde459762efe1ce14e95cacd58ebdade1dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs.js

Filesize
6KB

MD5
54994043253a44a29917c5a2b28c3336

SHA1
61482e749066cd61e94cc9fef1be1e9b74ae29a4

SHA256
578a44f8e899d1b791a3c34bff3c2a9bbe03b4c35f345ee511139c4b27d9a669

SHA512
c745b454df667f2e514e58302d6ed78663bc16999a0e618aa3dcf32ebe03f089da7a3d720312ad4a07a95c4f1900d992c7283049bdc7eee13baa4a9fd4e054d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs.js

Filesize
6KB

MD5
c68235e35142c75b6b03ce25728341e5

SHA1
4add9dd80a781fa5c44d80066c407c95136d82fe

SHA256
9b3bf1301cc03f30c3cce902558d3e96736d72d8d209905e787887306ff23857

SHA512
ae82b31e58df0f4c33d72a26e9040dd9b192edf203c423aeccdc834ef1931a32dc652b7ed256f37e7e41052347d459a1e095b35eb2675195914dcf36d4816cb2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs.js

Filesize
6KB

MD5
52b62b61df16c9cca6508abd55cf14a7

SHA1
21791ecd9102f939fb6460ce00dc97a85d7e0403

SHA256
be7ec10c09a84c16c05baae1438a2c32c8cc729889c5d5153b5193496d91c25d

SHA512
d2abfb31dcd36ae03c04d4213cd7fa71e8ee9d8e72485020796b4222b57c35b42af7ba6e647bf74830711e87ded3c4917503eaca2547a1f1b47541f9a269ee40

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
25aa336532178c3e9047667b94c2d9fc

SHA1
cf5ffa25f1227278e4f81af2c3b68ef1c5de8f29

SHA256
266855ce728a8263a249cd5c9e86a55e4ba68bf10c468c3a7648c78162b2666a

SHA512
fec43f6fd5a6e4719c51c640eba08939b24ae81fcfcf0a7f6a23ce23e4c81a4c05bc1e8fa6a2a5f584f981b6e365afe1798b5c7d452d1abf8979a8d646faf73c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
1148c5a8f36d1d6734785814a8137bbe

SHA1
4f8504a844893c2951d9ed1ec2438f95a6c28c9e

SHA256
c8a239381624f4d859ed0ce478a919dbdef9a56223b33fd3e1e51602475c1fb6

SHA512
ce1f97115a992fc860c78a798abffa20dc2c61ad389d6e3be68645af38e393b32564c5c4af68539aa3d01a19a2ce77d36448802501f6b95dfa9a0be24d466971

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
b65dd51d4d6d0faece37bb505415985a

SHA1
55370756eb57cf64d39411846b26c9ad3167373d

SHA256
d7abe44c4a80a33e199c39112b985adc35f01ca78021086fa0b4546936a50ea1

SHA512
963a04c8ce030a98bbfa946ddbbaf6f3465d69947b80a86d13809f05cbad250c7b6f4258782ceb0d4749ec09430e12f0673c50cf1bcf54ac65b76d83cdc18bc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
a7d9acf316e70f03eaaa002cc94c18f5

SHA1
baa13bcc2a97c4dd898a80ecf9887dfab184aaa1

SHA256
be0bc4772878bc198e31765cec1a5458e28da3ad9d47b7e2c11c38e4bddc5e0a

SHA512
6d7db7535a2fbfc9b985222eeda20fb1641a338dfe2adaba12f6f38fe23148bc74568953d79dc2bda28d7224921664e783cff6207de9fd9ef44bfde60f6faaea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
d2b0cdfd8322f46a293c76b58deed8b9

SHA1
3ff4e2f61c51e2fb49e03e97dd5082a3812b79a4

SHA256
5580e1512cfe9ef04e5a8a3b6041d7a90d30b5aec0f1dd78784fd4cc96ae66f0

SHA512
18866c283b3c68c34f0b24757643494f443bd4ce7912a411cf41f161b8deda51981cc037e851e861991e1d354c6f76cb000cc1400e798fdf34d6802f5d31bc64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
26KB

MD5
2ed7d083a333c42eca396c7b05f052d9

SHA1
cdaef62c8722d952aa5fbe3af6c4f82f563059bb

SHA256
2c6ece50edbd0ac31d8f29cb978d422a78a700a40912d37359476e9a7860e15e

SHA512
7241911a028f303cdfc1731226fa19dcc968746d0b2caedf6a6439ad82808a165ef233dd2ae2a78f65d0ebc608aa354b2184253141e8efc61251428b41b600ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
32c66d355168edc7ca70086708eab2e9

SHA1
2569636b2b8e76542853c0d9b567dbc932baad6f

SHA256
c1aea2dae53f3f9ee512aa2ac0c81ef294e9b40e0b2bd15d61358bd494b5e2b4

SHA512
2cd7a80feca4c35578a9d797cad3275e9e320bacb235c2076649ba6ce9f969ce649d36cd2eefaf2b3f81444d5a3c2061f19186299b1f03266ba5ccd0f11c235d

Download Submit