74bdec0a83536cbe6a47030bb06a8a223369028b4ba9608ae1beba0107b0381f

Analysis

max time kernel
1544s
max time network
1602s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
17/02/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Luna-Grabber-1.5.5-alpha/luna.py
Size

51KB
MD5

951fec5c3c0cda1bee7f6a9250a5aac0
SHA1

5f560277ae47188a609c35bf9ca7d9577fbc727e
SHA256

89d19888f1a1e821cd40bc32ffe20dd28204c11ef6cca74cd82014786a15cab6
SHA512

5d079b4874d0576e503c80fb2238c807c9d5cc11ce61897c93e86aea8df6390b1d42cb654e4529c8b03209aa25f766703c8accc252a0e48d42408b9b0a2bcbae
SSDEEP

768:mNEv8SqFEIxK4R464G87yU/X4C+VJyj/sGDT8D79Rz1txlc:mGv8SwKQG0Jyj/xDT8D7Ntxlc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\py_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\py_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\py_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\.py	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\py_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\py_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\.py\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\py_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\py_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\py_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-392952528-2979573054-2586089985-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4616	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4616	OpenWith.exe
4828	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1036	4616	OpenWith.exe	76
PID 4616 wrote to memory of 1036	4616	OpenWith.exe	76
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 1204 wrote to memory of 4828	1204	firefox.exe	80
PID 4828 wrote to memory of 2652	4828	firefox.exe	81
PID 4828 wrote to memory of 2652	4828	firefox.exe	81
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 4572	4828	firefox.exe	82
PID 4828 wrote to memory of 1752	4828	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-1.5.5-alpha\luna.py
1⤵
- Modifies registry class
PID:2232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-1.5.5-alpha\luna.py
  2⤵
  PID:1036

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.0.1127084219\407899110" -parentBuildID 20221007134813 -prefsHandle 1728 -prefMapHandle 1720 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {184b7c86-4b46-47a7-9b6a-b09083c47dc2} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 1808 1d2187f9a58 gpu
    3⤵
    PID:2652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.1.1336777442\1638361546" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {400adcbb-b34d-4346-bef0-c28619aa7bfd} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 2164 1d218703558 socket
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.2.623694996\821281154" -childID 1 -isForBrowser -prefsHandle 2892 -prefMapHandle 2720 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e27e2e6-b5b3-4085-8b41-5c47568c8a72} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 2716 1d21ca9b758 tab
    3⤵
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.3.2074976890\573751682" -childID 2 -isForBrowser -prefsHandle 3476 -prefMapHandle 3468 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {71adbbae-90a0-4ae7-805b-6b3afc29fdd9} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 3484 1d20d75ef58 tab
    3⤵
    PID:4704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.4.246746199\83787747" -childID 3 -isForBrowser -prefsHandle 3864 -prefMapHandle 3860 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cd6072b-e14f-4b47-976d-b402937889c5} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 3880 1d2187c8858 tab
    3⤵
    PID:780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.5.558249882\1246567942" -childID 4 -isForBrowser -prefsHandle 4824 -prefMapHandle 4848 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8d3e80c-3995-4bb7-b4d8-1f63c5a1c23e} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 4864 1d21ecf8b58 tab
    3⤵
    PID:4448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.7.460173525\833129610" -childID 6 -isForBrowser -prefsHandle 4988 -prefMapHandle 4992 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b519b799-d41d-4b89-ac7f-ff4ab5e8ae96} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 5084 1d21f055b58 tab
    3⤵
    PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.6.1618713686\835085174" -childID 5 -isForBrowser -prefsHandle 5000 -prefMapHandle 5004 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db670bff-1f6a-40ef-ad20-0cbda8731122} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 4880 1d21f055258 tab
    3⤵
    PID:4800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rh49u4vr.default-release\cache2\doomed\10817

Filesize
9KB

MD5
74a524c73594fba7bf53e79f42892851

SHA1
fbd2b195dc101bacb4605fe44ce33b69d1c065b1

SHA256
cb34bb48fa4b278a291fe7ecd7495a206d5f7d81b794aae31b8db880fb9e3444

SHA512
63fea656edec3a8fb51714434fd83f8458787bb9f98af1bb46521109df83639a4ec90a5df18b5a9897025028afab231de7613c7ae432505e8ce8d6571dacc193

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rh49u4vr.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD

Filesize
13KB

MD5
474065b78b9ce28d13dc196208cf38f4

SHA1
3631a8328f106f25b93e8b97a4cce22b34bf93af

SHA256
f76f639d592ce7c47231933515da0e5796e39c5c6907d07db3334fccac1fc4b3

SHA512
d4b7e5c6884e285cafcd78fb62e452e047bf3070dff5202699c126d0cca02d8e60553a58f4f6ac14ce04cc7ed3ef6e5d522cd87f201e463fa462043fa9c506e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
1.1MB

MD5
e253cbda16f05dd63324992ad592ee4a

SHA1
12d7579663157c3fa83a8b60fb9ba3afd2b5a3b1

SHA256
e91265e989a5916265037da39d2ffb3fbcdae888c9c74dc6601294d6073fe98f

SHA512
85fe3f00ab84a1345a377e5d1e43031dc7ffc84a0ed05b38ee35a39ebfc4db7552183dbf2ace0509495c7eafb383185848c18a56df8b217d856c7ce50c596501

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
66445f95cbfa64cbd5e569b903e70aad

SHA1
9f1a54c69c91daafb8859fa134d0f018817118e3

SHA256
ce159f37ee179da912a2398bfe8be6566cb3607c6e5e6e985ec9f002a9939a2d

SHA512
9e315e6e09ae29e1bc7d69f75b41bb57934dc44d0d7110e6075c791cbd6cfa6a8f105dcb017af5ffb7fdc77eb7b4f240fa438e399fedb986768feeafafcff51f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
8e3b862582bf98953dabba277d802b5c

SHA1
1a92a4120f35debf05886100760c8beb789246b1

SHA256
ce3076f8b3f8701e3753c5057df40273b2f0a89fbab17380e183354d5fb12070

SHA512
eaa324d01d729e754b2df95385d4a45d1b7eebb8090d814306f9f736b96b99ff4476095675c4fb270099690adcfc022e2fb5c0fb2f60aa9a184c010aeaaeed5d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\bookmarkbackups\bookmarks-2024-02-17_11_z3H3agxPdJqVqohc-YgwkQ==.jsonlz4

Filesize
951B

MD5
94c7e9134b54dfabc7791cccd3b1c372

SHA1
8f6e597efa88ff69ef1ed8f3da9e41c3e62cc448

SHA256
1a271ab7ea78f01a26519ebeb2ed9178131cf3d84523b2414a17d626588770db

SHA512
0c8b989997e513b9471442c04a1d65497bf502a2b6a959ca87bf4b8ab87966ae1a68faf9bfb7d04adc9299b4b1fac4f6cc21f2b00de793adcb2b557d6c53aad3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\broadcast-listeners.json

Filesize
216B

MD5
bfa7762ddea56217bd7b1a971de32977

SHA1
da24972ae720b2af85ba63f65cb1c727864a5b04

SHA256
8c29081c48f72689be172d397d64b57d844afb799cc5f3ca219df250bfa7d827

SHA512
ab851ae40070c030523dec59593b6ac7226f99656649a86541dd4358c35a0bce28f218efd98e8afa7502ead1b110210c514612b6d9f2b894c14c06be95cc7987

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\datareporting\glean\pending_pings\97bdb4d3-4d8a-46c8-a682-44f4bd0a84eb

Filesize
746B

MD5
0f3aee7068542dc6d6790ed110be92f4

SHA1
acf1820ef3dcdb6a9d0dd7c7956eaf3eeff9455e

SHA256
8e11f663f4426f27efb3a5ebcc598f54ed1f0ea6249fb149312c6e989116d519

SHA512
76ff51b09cac998726f18a3220841c70ecf09b66e5f4d52d2a7aa62aed6accb333c108ee766d898a41fbe7cbc7f2c687f246820ba04740c342e24e7d4f9f6704

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\datareporting\glean\pending_pings\b655366d-69df-477d-a16e-cbcf1bcf87a2

Filesize
10KB

MD5
96ba291c7375df481025c9d64f1b011a

SHA1
2a36df24646edc09b0c6c4981cb066427267ed74

SHA256
73d072fc2211c166bee1048b234ef72e32f4f776b89850438a12d04bff56caa6

SHA512
7311eac7bfec691518adaf1032f19606bb012bfab50c1449e3fa56d53fbb4c4a077b52c89ff6ba1bbe6716bb8ecb66303984d700c9e15e5e42add50850506f94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\extensions.json.tmp

Filesize
34KB

MD5
35e833f1ba43911c851ef4460b5c9f21

SHA1
542af79dcecd63058320dcf60fa687cd858570be

SHA256
ffb5abbad70b46db5982d8c83cd9afe089bd71ccae3f290063b8e72167990377

SHA512
4ced56fac6db283b90eb1a57a00a5e969e3a0c69b446ff4a82a49c28acbd1a6d7211c91ad856688f93a4ff95792dd5c515ee2da9040975f0fcaed88e7da7ed33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
448KB

MD5
54a2ab0bf0d9c2fc64163cec56e46a4d

SHA1
f559fe853d3b58d9f04e083e8651ed012f586aa6

SHA256
6b89730ff8c0e321af0aa13bf6007ec08470f08b911b5f233c63c28de0368fee

SHA512
4d81a0ee50c1933986bdf41d564a88b4d50012dad07d1cd2c4cb31953ce50bd6e06a64218a6688b5c8034473046a8e8f1c348e02a12fb1a1d8ee06285ed98916

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\prefs-1.js

Filesize
9KB

MD5
60c5e502e04bab1594157ee9d66ae188

SHA1
f4347696e8b7961e51f39966c4bd3982b4cd9dec

SHA256
db1e6b1128e03778b0add132295ea69b2a3a966dac677a4612b3dd48708078c1

SHA512
16292698357c4397926528613ac48d65b74dcc02d2e1c7280a91da68765c66e77a9db522be538ee81e706be87ace2c2a6287fe99a131974ee268d8b556885f49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\prefs-1.js

Filesize
10KB

MD5
e2c2a63f7a4efe24cc68682e3db733e7

SHA1
3a270246797954ec3a3938f86482aa517d435a14

SHA256
c6868356c99d2355b5205d3fbd57bfa241e1f2bba66e57151731b04c9db9add7

SHA512
d1cf782d2158e80e574f845b999bc8d21ffd4fef425bd6e7e425f46856677cef5146511e46bcd19357903f6114849e895d4ac89095989d06d86e22f372699092

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\prefs-1.js

Filesize
9KB

MD5
37fc2711ca4b8fccc519c3b3931b5c72

SHA1
06d690ab372a547ccc9b67417aecca39a7c95bc7

SHA256
24b82cca4cdfb0921f69bbce1ebf56259da8980c5d1f12f4754668591904680c

SHA512
e34ad5f6b4ba751266ac35f46d7a475c729d63a2c0ad44b34081ca143598fc4357da915306e8f7fe52d39d364ae4467fd537f1651b6b024fe1dd9e173812f75d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\prefs-1.js

Filesize
8KB

MD5
1877a886d7e6c2f2f09cc45124df04d4

SHA1
8b284e9632bbf1a0e4e2d6f0600b235c556662b7

SHA256
ae5c878ad2ff4adefd142c569d14a2726d85e2965ef185560a99bf4986c20f9f

SHA512
0b22c8c8b5d3514088ac784c7ba6d0869ea16ef37a10fa5005d2d008fa6d3e95ba20ee2d1033c4412bebb6bf3af1d3a4723f36de412a9c6310f14e6bda6eeac4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\prefs-1.js

Filesize
6KB

MD5
81642b608402d4ba20ef24f50e9e807f

SHA1
d05ec69d36f46c66aa0b40e891d73cf74d4bf4a5

SHA256
b7b3d35792fa11a555c35e5313fbae3837181baf4407b44939dcf5f2529466fc

SHA512
14edf40888f2665073e3819159eba64414e73c13f91dc724cb4e00fc8b8944ebba23e889aa02b7da2caa99ad8176516290b632286d691227c2cc55afc72867f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
d781dc71bcdbffe5757321e581b5238a

SHA1
7bf63774db863c8ebfc14bf69fd9b3e7fbd390b2

SHA256
4437053869ddf857a1e7bd21e36b0d02b02c9fbae45a1fce8860bf95738f5308

SHA512
0a80111dc1013b89c7f1085db52ab31cef134cdf8cf066d97a02231bd913bef6ca0738f1681cdb90953038a187ea3acd91f5c3332ae90e48ed292fd899ccdbe0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
2.5MB

MD5
b4f166d464f5ab928a61ed9d459f49f5

SHA1
6cbe3afa37bc58138df446bbdf14c9705707a4f1

SHA256
470e2f987f82376b447f7cb1a674bc2c32a0a494f6fe4dc9043af16727be2e64

SHA512
15b3e311bac26e8cb93570799e36ab8b62286e241951da6390b61a4ed0be9e3fbc230d0a51f6de95acc1c80ea31b01849867fb07d56187e57ad7155d591febfd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rh49u4vr.default-release\targeting.snapshot.json

Filesize
3KB

MD5
f1ae1c8d05ff8b56f91ba10091f3226d

SHA1
199d3ad234108f7d27c22aca1f928303e8124ce9

SHA256
7c3abaa13cfe858b049a9c0238c5ca1442c5c3e56017a1443680a7f66614d8f1

SHA512
7e33f77c57576aaebfae311b3db0439ce3d304c8941c979240cf9ca9b9fc75d337a16214e688ef56c0278fd45342f9aaf37ed492adc59ea65e9d6544b0fb9b54

Download Submit