Malware Analysis Report

2024-11-13 18:50

Sample ID 240430-x6fs9sgb86
Target https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:1ff4c079-4f7a-4eec-bc42-b5e9175000a7
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

Threat Level: No (potentially) malicious behavior was detected

The file https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:1ff4c079-4f7a-4eec-bc42-b5e9175000a7 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

NTFS ADS

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-30 19:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-30 19:27

Reported

2024-04-30 19:33

Platform

win10v2004-20240226-en

Max time kernel

329s

Max time network

326s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:1ff4c079-4f7a-4eec-bc42-b5e9175000a7"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\Tax Docs.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\Tax Docs(1).zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4140 wrote to memory of 4752 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 516 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 516 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 1176 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 2096 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 2096 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4752 wrote to memory of 2096 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:1ff4c079-4f7a-4eec-bc42-b5e9175000a7"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:1ff4c079-4f7a-4eec-bc42-b5e9175000a7

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.0.156690121\870916455" -parentBuildID 20221007134813 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85c549d5-42da-4995-b1a7-5ffd4eab45f9} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 1968 184680d4558 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.1.1885902484\433214569" -parentBuildID 20221007134813 -prefsHandle 2380 -prefMapHandle 2376 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {828555c5-d3a4-4c8d-aeb7-2597627b190c} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 2392 18467ffba58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.2.547521243\787072985" -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 3156 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2d6242a-bc5e-4c91-b514-7b20ac3efc45} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 3172 18468063f58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.3.740363501\1426633099" -childID 2 -isForBrowser -prefsHandle 4024 -prefMapHandle 4020 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f79613d-3021-4450-9648-041254c44f49} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 4032 1846d437658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.4.1200817005\888730890" -childID 3 -isForBrowser -prefsHandle 4880 -prefMapHandle 4876 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27a3ffe4-43b7-418c-8283-cceeba70c849} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 4888 1846d42cc58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.5.1602450327\1705337726" -childID 4 -isForBrowser -prefsHandle 5176 -prefMapHandle 5180 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a96b265-88c7-4a40-ba37-ac58af1a8958} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5088 1846c8fcc58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.6.1736519798\602373165" -childID 5 -isForBrowser -prefsHandle 5292 -prefMapHandle 5296 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c5acd8b-5647-4743-87ae-662764b1c572} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5372 1846f527358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.7.1933830877\1420963395" -childID 6 -isForBrowser -prefsHandle 5740 -prefMapHandle 4688 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baaf94d0-4b46-4938-9428-0157b922055c} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5640 1846b185b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.8.503014579\1272628791" -childID 7 -isForBrowser -prefsHandle 3912 -prefMapHandle 4332 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8182ffe1-9e2b-40c0-8ca7-bff97917f65c} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5148 1846c307158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.9.1090972595\1091672838" -childID 8 -isForBrowser -prefsHandle 4872 -prefMapHandle 9860 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a0fb0e6-f607-4718-8121-a7601175daa7} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5064 1846f87a858 tab

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.10.1504092858\1314114914" -childID 9 -isForBrowser -prefsHandle 9340 -prefMapHandle 9328 -prefsLen 26821 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {509563f3-7edd-40cd-9096-011bee410b47} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 9256 18472afe558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.11.1723734974\1521887699" -childID 10 -isForBrowser -prefsHandle 8392 -prefMapHandle 9412 -prefsLen 26821 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae52db9a-b693-4b91-876c-6cde459b8af5} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 8384 18485ff8958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.12.426589140\362049208" -childID 11 -isForBrowser -prefsHandle 8208 -prefMapHandle 8136 -prefsLen 26821 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8cbe664-7fac-4f1f-979b-97e541978efb} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 9328 1846f525b58 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.13.1275506330\292378829" -childID 12 -isForBrowser -prefsHandle 5884 -prefMapHandle 9284 -prefsLen 26821 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95fe5d0a-0bb4-4fde-bb59-9f59db02f7da} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 9292 1846f767758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.14.1866335466\891718349" -childID 13 -isForBrowser -prefsHandle 5876 -prefMapHandle 9556 -prefsLen 26830 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92084c4d-01e3-4237-8eb3-5f8ea47bf6db} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 5064 1846e888858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4752.15.360588018\530218373" -childID 14 -isForBrowser -prefsHandle 8972 -prefMapHandle 1432 -prefsLen 27530 -prefMapSize 233444 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d35e153c-cc1a-45c6-9239-f504f58ca84d} 4752 "\\.\pipe\gecko-crash-server-pipe.4752" 9604 1846c8fbd58 tab

Network

Country Destination Domain Proto
N/A 127.0.0.1:49817 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 acrobat.adobe.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 e29329.dsca.akamaiedge.net udp
NL 23.62.61.185:443 e29329.dsca.akamaiedge.net tcp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 e29329.dsca.akamaiedge.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 185.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 166.188.117.34.in-addr.arpa udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 52.88.195.36:443 shavar.prod.mozaws.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 36.195.88.52.in-addr.arpa udp
N/A 127.0.0.1:49825 tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 auth.services.adobe.com udp
US 8.8.8.8:53 send-asr.acrobat.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 172.64.155.179:443 auth.services.adobe.com tcp
US 8.8.8.8:53 auth.services.adobe.com.cdn.cloudflare.net udp
IE 52.215.98.41:443 send-asr.acrobat.com tcp
US 8.8.8.8:53 send-legacy-fc-asr.adobe.io udp
US 8.8.8.8:53 auth.services.adobe.com.cdn.cloudflare.net udp
US 8.8.8.8:53 send-legacy-fc-asr.adobe.io udp
US 8.8.8.8:53 179.155.64.172.in-addr.arpa udp
US 8.8.8.8:53 41.98.215.52.in-addr.arpa udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 p13n.adobe.io udp
US 23.22.254.206:443 p13n.adobe.io tcp
US 8.8.8.8:53 p13n.adobe.io udp
US 8.8.8.8:53 p13n.adobe.io udp
US 23.22.254.206:443 p13n.adobe.io tcp
US 8.8.8.8:53 adobeid-na1.services.adobe.com udp
US 104.18.32.195:443 adobeid-na1.services.adobe.com tcp
US 8.8.8.8:53 adobeid-na1.services.adobe.com.cdn.cloudflare.net udp
US 104.18.32.195:443 adobeid-na1.services.adobe.com.cdn.cloudflare.net tcp
US 8.8.8.8:53 adobeid-na1.services.adobe.com.cdn.cloudflare.net udp
US 8.8.8.8:53 206.254.22.23.in-addr.arpa udp
US 8.8.8.8:53 195.32.18.104.in-addr.arpa udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 18.235.168.50:443 dc-api.adobe.io tcp
US 18.235.168.50:443 dc-api.adobe.io tcp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 44.198.86.118:443 dc-api.adobe.io tcp
US 8.8.8.8:53 files.acrobat.com udp
US 8.8.8.8:53 use.typekit.net udp
US 8.8.8.8:53 prod.adobeccstatic.com udp
US 44.196.228.180:443 files.acrobat.com tcp
US 8.8.8.8:53 files-legacy-fc.adobe.io udp
NL 96.16.53.134:443 use.typekit.net tcp
US 8.8.8.8:53 a1988.dscg1.akamai.net udp
IE 52.215.98.41:443 send-asr.acrobat.com tcp
US 8.8.8.8:53 a1988.dscg1.akamai.net udp
US 8.8.8.8:53 files-legacy-fc.adobe.io udp
GB 18.172.153.59:443 prod.adobeccstatic.com tcp
US 8.8.8.8:53 prod.adobeccstatic.com udp
GB 18.172.153.59:443 prod.adobeccstatic.com tcp
US 8.8.8.8:53 50.168.235.18.in-addr.arpa udp
US 8.8.8.8:53 118.86.198.44.in-addr.arpa udp
US 8.8.8.8:53 prod.adobeccstatic.com udp
US 8.8.8.8:53 134.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 180.228.196.44.in-addr.arpa udp
US 8.8.8.8:53 59.153.172.18.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
NL 96.16.53.134:443 a1988.dscg1.akamai.net tcp
NL 96.16.53.134:443 a1988.dscg1.akamai.net tcp
NL 96.16.53.134:443 a1988.dscg1.akamai.net tcp
NL 96.16.53.134:443 a1988.dscg1.akamai.net tcp
NL 96.16.53.134:443 a1988.dscg1.akamai.net tcp
NL 96.16.53.134:443 a1988.dscg1.akamai.net tcp
US 8.8.8.8:53 virustotal.com udp
US 216.239.38.21:80 virustotal.com tcp
US 216.239.38.21:80 virustotal.com tcp
US 8.8.8.8:53 virustotal.com udp
US 8.8.8.8:53 virustotal.com udp
US 8.8.8.8:53 21.38.239.216.in-addr.arpa udp
US 216.239.38.21:443 virustotal.com tcp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 www.virustotal.com udp
US 74.125.34.46:443 www.virustotal.com tcp
US 8.8.8.8:53 ghs-svc-https-c46.ghs-ssl.googlehosted.com udp
US 8.8.8.8:53 ghs-svc-https-c46.ghs-ssl.googlehosted.com udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 46.34.125.74.in-addr.arpa udp
US 8.8.8.8:53 232.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 www.adobe.com udp
US 2.18.190.73:443 www.adobe.com tcp
US 8.8.8.8:53 a1815.dscr.akamai.net udp
US 8.8.8.8:53 a1815.dscr.akamai.net udp
US 2.18.190.73:443 a1815.dscr.akamai.net udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 acrobat.adobe.com udp
US 8.8.8.8:53 acp-aep-cs-blobstore-prod-va6c2-data.adobe.io udp
US 8.8.8.8:53 p.typekit.net udp
GB 13.224.132.110:443 acp-aep-cs-blobstore-prod-va6c2-data.adobe.io tcp
US 8.8.8.8:53 acp-aep-cs-blobstore-prod-va6c2-data.adobe.io udp
US 8.8.8.8:53 acp-aep-cs-blobstore-prod-va6c2-data.adobe.io udp
US 8.8.8.8:53 e29329.dsca.akamaiedge.net udp
NL 96.16.53.150:443 p.typekit.net tcp
US 8.8.8.8:53 a1874.dscg1.akamai.net udp
US 8.8.8.8:53 a1874.dscg1.akamai.net udp
US 8.8.8.8:53 e29329.dsca.akamaiedge.net udp
US 8.8.8.8:53 110.132.224.13.in-addr.arpa udp
US 8.8.8.8:53 geo2.adobe.com udp
US 23.53.112.167:443 geo2.adobe.com tcp
US 8.8.8.8:53 e4578.dscg.akamaiedge.net udp
US 8.8.8.8:53 e4578.dscg.akamaiedge.net udp
US 8.8.8.8:53 150.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 104.19.178.52:443 cdn.cookielaw.org tcp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 8.8.8.8:53 167.112.53.23.in-addr.arpa udp
US 8.8.8.8:53 52.178.19.104.in-addr.arpa udp
US 8.8.8.8:53 assets.adobedtm.com udp
US 23.53.113.19:443 assets.adobedtm.com tcp
US 8.8.8.8:53 e7808.dscg.akamaiedge.net udp
US 8.8.8.8:53 e7808.dscg.akamaiedge.net udp
US 8.8.8.8:53 19.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 client.messaging.adobe.com udp
US 8.8.8.8:53 wwwimages2.adobe.com udp
US 104.17.27.92:443 widget.uservoice.com tcp
US 8.8.8.8:53 widget.uservoice.com udp
GB 18.239.236.83:443 client.messaging.adobe.com tcp
US 8.8.8.8:53 widget.uservoice.com udp
GB 18.239.236.83:443 client.messaging.adobe.com tcp
US 8.8.8.8:53 client.messaging.adobe.com udp
US 8.8.8.8:53 client.messaging.adobe.com udp
US 2.18.190.70:443 wwwimages2.adobe.com tcp
US 2.18.190.70:443 wwwimages2.adobe.com tcp
US 8.8.8.8:53 a361.dscg.akamai.net udp
US 8.8.8.8:53 a361.dscg.akamai.net udp
US 8.8.8.8:53 92.27.17.104.in-addr.arpa udp
US 8.8.8.8:53 83.236.239.18.in-addr.arpa udp
US 8.8.8.8:53 70.190.18.2.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 dpm.demdex.net udp
IE 52.17.32.208:443 dpm.demdex.net tcp
US 8.8.8.8:53 dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com udp
US 8.8.8.8:53 dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com udp
US 8.8.8.8:53 by2.uservoice.com udp
US 8.8.8.8:53 by2.uservoice.com udp
US 104.17.28.92:443 by2.uservoice.com tcp
US 8.8.8.8:53 by2.uservoice.com udp
US 8.8.8.8:53 208.32.17.52.in-addr.arpa udp
US 8.8.8.8:53 92.28.17.104.in-addr.arpa udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 server.messaging.adobe.com udp
US 44.198.86.118:443 dc-api.adobe.io tcp
US 44.198.86.118:443 dc-api.adobe.io tcp
US 44.198.86.118:443 dc-api.adobe.io tcp
US 8.8.8.8:53 adobe.tt.omtrdc.net udp
US 18.208.38.181:443 server.messaging.adobe.com tcp
US 8.8.8.8:53 server.messaging.adobe.com udp
US 44.198.86.118:443 dc-api.adobe.io tcp
US 44.198.86.118:443 dc-api.adobe.io tcp
US 44.198.86.118:443 dc-api.adobe.io tcp
US 8.8.8.8:53 adobetarget.data.adobedc.net udp
IE 66.235.152.156:443 adobetarget.data.adobedc.net tcp
IE 66.235.152.156:443 adobetarget.data.adobedc.net tcp
US 8.8.8.8:53 www.recaptcha.net udp
US 8.8.8.8:53 server.messaging.adobe.com udp
US 8.8.8.8:53 adobetarget.data.adobedc.net udp
US 8.8.8.8:53 www.recaptcha.net udp
GB 216.58.201.99:443 www.recaptcha.net tcp
GB 216.58.201.99:443 www.recaptcha.net tcp
US 8.8.8.8:53 www.recaptcha.net udp
US 8.8.8.8:53 cc-api-data.adobe.io udp
US 18.208.38.181:443 server.messaging.adobe.com tcp
GB 216.58.201.99:443 www.recaptcha.net udp
IE 54.77.72.255:443 cc-api-data.adobe.io tcp
IE 54.77.72.255:443 cc-api-data.adobe.io tcp
IE 54.77.72.255:443 cc-api-data.adobe.io tcp
US 18.208.38.181:443 server.messaging.adobe.com tcp
US 8.8.8.8:53 156.152.235.66.in-addr.arpa udp
US 8.8.8.8:53 181.38.208.18.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 cc-api-data.adobe.io udp
US 8.8.8.8:53 cc-api-data.adobe.io udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 255.72.77.54.in-addr.arpa udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 sstats.adobe.com udp
IE 66.235.152.156:443 sstats.adobe.com tcp
US 8.8.8.8:53 adobe.com.ssl.d1.sc.omtrdc.net udp
US 8.8.8.8:53 adobe.com.ssl.d1.sc.omtrdc.net udp
US 8.8.8.8:53 geolocation.onetrust.com udp
US 8.8.8.8:53 geolocation.onetrust.com udp
US 104.18.32.137:443 geolocation.onetrust.com tcp
US 8.8.8.8:53 geolocation.onetrust.com udp
US 8.8.8.8:53 137.32.18.104.in-addr.arpa udp
US 8.8.8.8:53 adobemobiledev.demdex.net udp
US 8.8.8.8:53 cm.everesttech.net udp
IE 54.171.82.40:443 adobemobiledev.demdex.net tcp
US 8.8.8.8:53 dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com udp
IE 52.18.190.199:443 cm.everesttech.net tcp
US 8.8.8.8:53 cm.everesttech.net.akadns.net udp
US 8.8.8.8:53 cm.everesttech.net.akadns.net udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 40.82.171.54.in-addr.arpa udp
US 8.8.8.8:53 199.190.18.52.in-addr.arpa udp
US 8.8.8.8:53 adobe.com.ssl.d1.sc.omtrdc.net udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 privacyportal.onetrust.com udp
US 172.64.155.119:443 privacyportal.onetrust.com tcp
US 8.8.8.8:53 privacyportal.onetrust.com udp
US 8.8.8.8:53 privacyportal.onetrust.com udp
US 8.8.8.8:53 adobe.com.ssl.d1.sc.omtrdc.net udp
US 8.8.8.8:53 89.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 119.155.64.172.in-addr.arpa udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 acrobat.adobe.com udp
US 8.8.8.8:53 e29329.dsca.akamaiedge.net udp
US 8.8.8.8:53 e29329.dsca.akamaiedge.net udp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 216.239.32.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 recaptcha.net udp
GB 142.250.187.227:443 recaptcha.net tcp
US 8.8.8.8:53 recaptcha.net udp
US 8.8.8.8:53 recaptcha.net udp
GB 142.250.187.227:443 recaptcha.net udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com udp
US 8.8.8.8:53 ghs-svc-https-c46.ghs-ssl.googlehosted.com udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 dc-api.adobe.io udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
GB 142.250.187.206:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.187.206:443 play.google.com udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 ghs-svc-https-c46.ghs-ssl.googlehosted.com udp
US 216.239.32.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 ghs-svc-https-c46.ghs-ssl.googlehosted.com udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 ciscobinary.openh264.org udp
NL 2.18.121.197:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 197.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.187.206:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1---sn-aigl6ney.gvt1.com tcp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 166.183.194.173.in-addr.arpa udp
US 8.8.8.8:53 www.virustotal.com udp
US 8.8.8.8:53 ghs-svc-https-c46.ghs-ssl.googlehosted.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp

Files

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\9a55fb47-fd9a-40bb-b4ef-9ac5cab803fc

MD5 c640fb9352ab5bfd738e0c5622284681
SHA1 c7fd0146e80dc65551ff8bdbd4f10a6e03105f3d
SHA256 f8d285cfc5948d1aaf34b34f6ae5712244a6b897869d6ba39c320ab108b83371
SHA512 d092e902a21784305e232749a28c356eafb8a2d1604a6c67432c4a26ba6b68667be828babb326b1eb1d4b0c6e076a702cf970b942437a85245fcae350ba38212

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

MD5 fab9c3c6ca9b5036784693392a5b4e46
SHA1 dc92c8a36a20880fcdddc5ceaeea9d0dace0108f
SHA256 d7fbca7bb2bf3ee20011156d98165eef4d08b2eb2fba41fc6528716296316f17
SHA512 479ca4625c6e5d5bd316db27c0e897b8f6aad7e97341bd94f84cfa5a2de06e5d78028b99bff020ff046638279514c5713821b0969620eea6803d562316ec70d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\2b6aeb89-41a0-45cb-b625-d995c08bd702

MD5 33802188eac62aba3a5467d4df4c7672
SHA1 7eb72513f1c6f62b0d7f259b5f01c48beefefb0b
SHA256 bfc16f79116e1ce6be63c744015cba805570cd41c965d12eb991ba7e7ec39122
SHA512 0da3d8ceaa60254102c91cdedb1626fba674237a942088a8162dea31bb7025d5eb4cc32d557b0e7e9ec2a57972a7c943cf9a18300a99c790bb6659932c0f70d4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 89fb414d778d11d3a12991de60301815
SHA1 1d7a63ca92d9ad28930ce2feaac8c71c3f699ef7
SHA256 935ba660008416f0b46a028a709944f11f9c2858243a2f7bc0b57aa1d96314be
SHA512 49f06dc78f2e08621ba4ed19925d8c7ed040502f13edaeedc7df3d675e77417d8b7b3c0b3feaf7f4fcef989091b363f5af1fa9258de57cee5bd904e1d7a31f9b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

MD5 7b2fd821d301201cfcfc5bc7b7c2412e
SHA1 66f2bad0ecadfd244f9beb99b93772d8a175b7e0
SHA256 2aa112a992d8dbd7a8e82d2d8d4e85dc7844930b16c7392c9c753e3f8d0325b8
SHA512 bc8bb6505522d85fbb9dea01e8700ff53f02c2926af8bd84297943d9bf39430735602dc22b6f1acb39b9e4461e89f70aa6ad0ece7096ae135dc01713c3c623d9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a92399c7346154eaad3ceb7ab9430d11
SHA1 a29cf2d98e17db3974efde19f153f1acc0194774
SHA256 a980cecaeb702fafd8a0f7ac50c59fd932fb9f95c069ccafb193456c0af57b8a
SHA512 e9eaf2a3bcc3f5b62e12feb9cf152bf0b29506b41fd11aedbe060de836a2b6fae4e00e657968c49c73cdf5fbf421131fb8ef7768749c0ac9d01b0af8f2dbb7dd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\78C37E4CD07D5A173D59923A55B5A595E3358AE1

MD5 562e25fc31ad9250c92adbebcffc449b
SHA1 92e91527b5c7f4ead224f46bf7c880761b0891cb
SHA256 5653321acf9ddd3b6576eb7e8758a2e74f57b562b3b9dc76de70a2a4f7a8bdee
SHA512 1f4696aa234cafa9e78736834d7a85e60ce2f07b221bb9d717c013646c0042520f1ab02acba79c031afae2f15bd872e79b42f1f746fb016d47b3ad2d233b3332

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 58f5a3c6f46dabcff6c407b5f94a29e9
SHA1 d69f14aa05c318618fe2a8ec382dd5bea44d752b
SHA256 5c7d08f482209754f420a2c81b046a4b0cdda2ac3d0083781096736a80027648
SHA512 d1d04c98bef3d7560b9a3504c15161449a022b7f0818071339d9faa3cfc3aaea6405d1afd0d5a226926ada861cabd147ed263215cefe07dc4ccb28b1228f39df

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

MD5 be7ff5e0d419010d8d96c9483e6fda92
SHA1 5b0b212263273e2ca7d4cfa65ee7199dc689b2fd
SHA256 e38431d7e97695fa74ed157e619b2cc3bd7ad3ae9985d8cfe51a5c2b2d856e98
SHA512 175d5feb12b9b5c31fd021c45b11f886d23f26b9fa891847a9c6fee6a6cc2710d82b8a6a84b1d9ac4b939f587d7b495cc7a94bb0b71d4ca90434f9f4f8fa97f7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 521783e92f1a2ff6c9d90b8c3bea28ac
SHA1 e25c210e41c71ba9c74458b7f5e96be0d591317f
SHA256 afb612877b7a0816285190db3cf668f07893557db8f240cc05a4fe599c0c4402
SHA512 4e5caf370236a9eae3d7e3d232efdfa46552d2cb4f837216bc273d481bf7de7c7047ab2405bd53690c5dc5f119f3b23d7301795e82d45893ebd2351bfda8fed4

C:\Users\Admin\Downloads\Tax Docs.DIOhSIEH.zip.part

MD5 05e5853f25f1bac896da194b1bf1f98f
SHA1 a136767f1bdf8df0f44c4775e9a773aa5fcbe27e
SHA256 666a0c2ca933ce1935015de26a95cd018c4ce3debc8afc20fd0b4f7526c5996f
SHA512 08dce4179482eb0b1f8cdd7bdf40afa319da2a29c0f4bf85275a9235eaf3ecc0993c70295f69708c6c99949dca363eda04f4f160c528a0db03bb1396b56f12f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 b329956c24db70439fdf51fc197bb6c5
SHA1 3c4c8ae3b8d945fe1aa9b322d2b2ee96302650a7
SHA256 57975d4a08212a35b12b0ba1e1a117f9d836a8a6027efd25441a16b33e0cf0e0
SHA512 1ab3b4659721d3324f92048d76c76c7a01ec0d09ebc412493ef28528cb805570ad2efea8bada6f33ace76fb637efc650f73727090aa6f1ed8c98bce5321cccf9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

MD5 7d0c04de2c3a64bbe2ff53ffa422546b
SHA1 b94ab4e10b62ded09245fa03d07b7d518a4c1f82
SHA256 817cbdb0d36165588f7440c399056c14f2fa3df9a14a77017f2642729773882d
SHA512 ecc8558157baf9ee3f98479ccccdd3291c7e671cd420dd06704d0c52b373eb97fed261e0b7a36de31459a57cdb2cda5af6f21992750e9721965b2c2b8261c405

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

MD5 43bcabf54c5e29427ef8602d96673c66
SHA1 144a473200ca80a17a8eeaa474b391ae2e58529d
SHA256 734b06321944a616e0c7a0b728d6b84affbb4bc4e5ed1a5cc4119ca0c76b322d
SHA512 00fd2d29a57296e4a785b796e3ab0ed136ca453ac5c808f5cde2419900dd82deed0309e49a0855ca5df98363c167a86d01851a92d7daed015ef23ffb2209a144

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\default\https+++www.virustotal.com\cache\morgue\219\{14ac354d-35c4-48b9-ad97-37ef6896d4db}.final

MD5 f9aa7369700c2897b8f2a7382d4ccdf0
SHA1 d9e58adb4b968769cdfdb9c84ce0889429036572
SHA256 fc80f107f67d436b749c1180c43b338a0d3c1d22412ca1c906c4c464a6776232
SHA512 51378990c40c84ba55ae2243b07265abc52a8276593fb47a4b5ba0b6521387c825c4bc1130922e8826461de8b94eea482cabe5655773e83a0ff795898238acad

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 08294b135923a5dc63a242ac269837f5
SHA1 15498c09e756c3112e11a9eec202ae91c8a2e82b
SHA256 3dd3bddb6f7a0aacae4c8795919b87ba9ffcaf7528c0291056899bdc8d6cc2af
SHA512 282e6bef9499bdc9d12a45ed36f64ad96c65713afaa1d9bfd310c3220c674667ebcb3caeab354147f2c81931bb56886928f74d1d5d0eb3d80fe59d686860f711

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a100d133ceef216df540891eb7eca273
SHA1 7179d2296468bedc305bca002a815463d7da06b8
SHA256 08b5e0debc954bfc1d702b965debf9edae8925b1ca1d42eac963f694d2fd406a
SHA512 229e5fa8ec4e6cab803a6ea8768e708d1b4a0f2447758a992f4cff4e9e1da07da4fa53fec57cfc2a18957eccaca312ffcc61353b8e583e96abeca945f18a671d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 1a274f82d997788629107013007807e1
SHA1 c124730d40e39636120a29cfbc19585113c880be
SHA256 c6e69325283477abe14e733b1f4be2ef23f7c779973b1c1f517142a1b6a94058
SHA512 fe4b122b8fd00331eb5887f8d2890639b44dc86d4730dbb1acc9aa87c9c3cf7d4897b37721aec1b2fb0f69c6ba6da4927d6efffb7b55bed72f3cb83286f99dd6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\4931

MD5 1b8ecd355b7265894e866e9c5d8e9a05
SHA1 a15f278f55858dabccc2026945e44804dd689c46
SHA256 3611a6c867483d5927b1770ae758d1a7fbce42e99cd5d8d91ad946e7ecb8dbbe
SHA512 c77907e5e5599939b0f71c821faa078839f00048be56126c59908d41f6639b4ae66a236a850849ae4712212e200a6eae01417aabeba486caf9efa506ad9170d6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\12720

MD5 71a3d14df300a8286218acba518959ca
SHA1 9167dd946dd1ebebbaa3aae1f87580233ab3b7b9
SHA256 8caf79e2240bb9a18f786e56cd8b0ec57a348673798a6ae7e0e8942b2af7279c
SHA512 60a904b6179894eea34413fb1c08f3cb7458c253efe0929def1902e7ff6de93983024dad7a47be3e5a806f0c3a098dd698fd911fcd67132d2279da6b6739e5e7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 10b74d076c53fd1437cd26e5abee0277
SHA1 d85ae718e6bc71d67fbf8d9f423f39e1aada6264
SHA256 46cee15ed00d194d7bca20544c01c419de707b621f5a929a02d29ce19c5ba330
SHA512 5ee0e6fe40d0d790ed8dedf59f0605877e41483cd748acbc65645547fb921f4921ab389cb0bd1f337543dc8ad038458055dd8eeae5e6cbd6fa60f2933371ff77

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 94c7fc6f303eeb79bb621a06b914c51f
SHA1 b57da916983991a633ce4f687b0ca4167d4fc204
SHA256 8b16d0791ef6e1e66a710d1524446afd2b69340525f18ba67c06e0dc12e1263f
SHA512 784d0922d15f569d6b2a906c5e690416961ffcc3b31b1622c7cbe79d8ec9dfef625999e64c7411a943d909bb173dea728e86c44872581d9d829050303dc8d313

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 7d4add16dbd89d8a83bd0e025f7ee507
SHA1 ffb80dfc4261ee3ef756fceb6ddbf39b72fb29cc
SHA256 d6a6a91051e35b3c07f3ff5fec33b3e73673bd271f6bedf655c1d3bf5ac85f44
SHA512 29e224254ef82cf7c8135e645f9a43b17d652da3b9648c5c2f6aafeb97d596ac3c062d3911dfb3ff12e1cadef638d81a049ae66bf78b98a946e6a25a96cf5994

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\8570

MD5 9978cdac8c6cae1bde2f3c07f1f5fefc
SHA1 e4dabebd614e9a2a5be7439e70cfe0d1f3b0fbb7
SHA256 5460ea327296d5818789e85b2da15d8f685c65b6f94b8dbd1ad8f258f69d4c7f
SHA512 7d7bae663c3067e07fe2257f0c1accfe2ee170f9a3662ba1a7051ed713df85ee448f9665bdd60063f67d4afe77d70187b5b4269d47ce8c6b16a7da702d91c226

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\29208

MD5 3bd20ee3b189bfc48e097b2257d41d5b
SHA1 8a64c0ad67cecee54f25ef6bea1676944de1a87a
SHA256 34aa34b3195b5490a2f88f3482ae5bb3a5388a8e57a7ed5b2b8bde713d51882e
SHA512 f50f4863d97d9b453d1a457ce6b7f8a5f2c02f9e4ff4f7e8913af668cf659b312f41b8ce2580f6b92a35a176319701618db7494ca730e16edf3a075f737cbe79

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 3f5da6ed0294f564a6bd1001a6d73406
SHA1 12bf7bdf9f5a4ec3cdabb1c504cf0ac0ad492c05
SHA256 c1669f8b249e6af6a57025f2b8763feb8580b0643d026e1d92700e96a8b45712
SHA512 78c4907e49caa19db02e50538f55b8c2fc6f32b65a63e0b403ce063aaa23ba9c20250bbba768651818b444dd69be59f8e587d7d2f4897f5f3ffdcbcf2cb9f999

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

MD5 02f8dde394fccd1e3224608533e82b03
SHA1 c2e865233bf85cb62edbbc22d8bc0e561a4c2a81
SHA256 b64a80ed9e81a67425558aa1a423e90fe1adb8cc879d419ce271fbe6cf554079
SHA512 64c2c7e6a5bda5a6c839a4293f620fdc34e25b071a35b14fb706e74d57ea0afa9857ea6509d563c4a2467fa23c6dc40a36c89b0253c77001953d318891c2970e

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 bf0751d6b80d450bfd58e680266de542
SHA1 a25c42b05208ffe119adcaf47a2ddb44472355df
SHA256 6158f6b106cf0d5247a7c7381d2697ae0b4864e88eb30999602c529ebc624efc
SHA512 b1689fce34e549a786ef42f52596476494100d1887dee3a420674bdc463ed9dd9a59b8db658a72abb584c035574307733b53f92360e466bc5984ef464a05881c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8c4a3482690961b7e400fe755becf563
SHA1 789fb90c9db19b6c07698a5f8f2f07b9be25843d
SHA256 0f6de938277542b420551436e87c873d9eac971100aff6d51bcf9592949a3da8
SHA512 6e99765bdc29f60df4a86f042d70e807885c48841383b36172f0787217799dc8bb80d02f7954a9e1402ae8a55912bda3b259d3782eb8631bb9eaa4de283eb4b6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8346bd5d4f3bc45d085d2731d3256910
SHA1 d0e9f774c056a72d55a4018d571ef33eb8ace57d
SHA256 1c9bee0e379fb5aae8550e59cacb09698406d4c3aecb22016b4dcf68d5a0a249
SHA512 c0d032974076c7187030051b173c1a45f727d162cd8c74c574b15916b63b5afdb48343f673113398fa7b58e277b1111865b68152db4d144ad42964bcffe9dfbf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 f8b54a324e002aa30ec4f461cbd0ee6c
SHA1 11628fa16c4285a60642afec2ccf99d644f38acd
SHA256 0029eda368a719f6cccab60c21efef03e7b2cd66434a599d33d0aa3c6cc1f354
SHA512 08342d15e2e8e5e3180e5d8e4af1123bc5414289d6fa2c3af8e49e319cc5ddfd6333c228f23fa14041c729c8ad2aef10641dcf3dc006d06a00e08d6fee15fe5c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 95b87a7926d5352d782a08e162936297
SHA1 2410540f54eaefb526d0e0f53dcf68bad78a72b3
SHA256 6c263d9c2b8890b324968583f04f41420d8cb5273a754260f8912698cc91c8a6
SHA512 4f73e5cc72b8f8bd28e28e15104726c2fd9b9efd7d4d06f3a7ac78d2025589671d96dbb78c2f14540088750cac0ecfa76979713269fc28cbd275095c4dd855e7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\jumpListCache\dJTQiZyAwnsn4bIC1kKIyw==.ico

MD5 a3c1306e53848dce3a3c2fec6e1cdff2
SHA1 87f8463535c624202f9b6efe26e993b0b1f3157c
SHA256 d2d32f8573ccc7ad555d258c8362cfb0b699eb4b004f93dbeb171f3510df055f
SHA512 871e877c73990e372a7a41d9851e9dcf301efdc543696aa4dbc35b8a121e24b7fcdf76d426b5f90fa3a14253440697de01ffa0d82d417e5490560ce7d9740aa1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 0b4bca4dd978f513e7f9ebd2ba8a0113
SHA1 8da9b661be7d04bfa6acc9e8182ef37dd945f7f7
SHA256 a564fdc7f5be225ac6165f1323a792ffd98287a12f162c16076f72bdcb3f7dc8
SHA512 42b3cb26255ca55ab3effbbfeda1cca83f8ac130a065187993dd36e087e204fa37a85b4a5adfa99596da2146fd5c0f2883f4d19cbdc9569dbf9d84bf3a7e3743

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 97ae86a93f8adead6c119ebc7a0842ba
SHA1 1763a3ac053479ab86ec7aa749c6af6307f78fff
SHA256 eeaed845375e2e30cc2e59539aa53748953d77c6cb093e44a643676e6ce72f95
SHA512 459640aa7684c9a87d4f7528c0523dae12058e826ef13cc9bff7a6a4204c2496c3ef67bba1af3e1e218d7765fc11de0c5452374e01a90b8c10db6f5e995a3890

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\18123

MD5 e4cb9dcc44cb3c083a2b37d38ccfa361
SHA1 f1f2395142f27cdb7470563034b7dba0932cb90b
SHA256 4ebb9fc3621e5d80240c09d685b07a7324f09a00bb14e5551445a2c4a8af1e49
SHA512 0825af3a1fa0f6818cb4f8814cef9b2c131e8e59c6a31b6257151bf150500dc9ce4d8228f0af29f8f97878315d47ab1adc55b56f8206411d382386e3c4f36ee4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\12187

MD5 eebcd2432f562b21bad0e310f99e5570
SHA1 75d0ca2cdc4f369ec3e77eaaee956ded0475db74
SHA256 3ccde13c4493402a8c152bf1ee0e4e7b507c3eca9d74baad61fdabb31d9eff22
SHA512 036c4e256fba55e7814ef50dc9e77626d6a80c7da280a19fa9c8a0e68d198aba914edbb45b288661e303bc8fcea2d07a2e8979430c38d73125f6058602a432f9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\5993

MD5 1202568465a0e23578300c6a6df2a368
SHA1 c978c9109c0e1af909e6acfeea308ec48a715e48
SHA256 e98ac121e5c6e987221478d7d60d29cd85628743e5f575e18970b201141bf864
SHA512 b48abe87591f74497735327558c498cf3f602c6b117cb35f1d1f9ea59f52493165a8c93d6e738fff6b8ea1b5d749a466f86a4a4ba47609478fbef59bb8551bd4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\12559

MD5 ea35857a49d157bd25ae6dc59e696d52
SHA1 2cd50ed077aab933a02efcf1739af25fc20954b0
SHA256 b5d5904e792a4e5690a2a1c8698bd3f0afe8d878def3005015d9e57fb458dfa9
SHA512 48d20202c7abf3eae08cc7f4b65d0b3e5f153d1137064b61da7f44e9d9e5bcba7228dadb896d648c21abd9c4e4c1bebcc4f3f56d7dd2ee410ce48ecc8d1b3e1b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

MD5 cddf5daedb32e8df7f2d5d26f6228fba
SHA1 ba634a10b870e1da7e90ea0080901054fc2eb38a
SHA256 7f174b149537323f5b617f941ab0d62632480b25b3cf536fbd215c0bf8d87e71
SHA512 4d2019d582212933e1c372dc2afd2b6cec68a610f9ee0c3297b0acaceeb4e479ffbab33eb40430906c05273d8e0f1cc344b661288613a3a5c9168a720ee0b9f7