hxxps://www[.]sendspace[.]com/pro/dl/x1wf1p

Resubmissions

09/05/2024, 05:59

240509-gpzxtade8s 3

09/05/2024, 05:39

240509-gcfneadb3w 1

Analysis

max time kernel
388s
max time network
385s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/05/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.sendspace.com/pro/dl/x1wf1p

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31105494"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008184d0691bc89b45943f8497c1abf5c700000000020000000000106600000001000020000000993e6e384efec74fde5fca227deb393f5ec2738fce918fd964c705cc4631ada8000000000e8000000002000020000000b32ef19c80724d21885c5e8dc9654b738f2ae1292de361224dc0b27d1526c24720000000cb0f63d658c45e1f7e70562f256a3064cf3673fdfa2b79ea835756d48f13ae7f40000000826c9a0d17caf730f1e0765ed5191edb6d81fdab8ba007c4488c42848b729edea5904abbe0814ca44088db588cd56ec2f850d47f6003f215873e54482a189a30	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07ef484d6a1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2228312024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2228312024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008184d0691bc89b45943f8497c1abf5c7000000000200000000001066000000010000200000003ee8aebacf4256230ccae2487cb968d8bbd7202d6585aa406e54c349738f34ea000000000e8000000002000020000000d64006cded80fe4f05c6bf03daa18a6622e57b416673edd30644ce99966aeee4200000005e776c030bc9e480cff8b97a007fad9e54ca6fa12145f8dccdb240c86e99ff5c40000000a4430c237641d6bc0c73714c39932af244943652eb39b80c589a653ac0d027300def81ee00cd3eb54086509d3b0166f404a287c6251411102854c709ed713e71	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31105494"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00df284d6a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0609F0D-0DC9-11EF-A993-7EEC37352443} = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\INVOICE-VBDSJ09HSJA.svg:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe
Token: SeDebugPrivilege	3484	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
692	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
3484	firefox.exe
692	iexplore.exe
692	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 5080 wrote to memory of 3484	5080	firefox.exe	73
PID 3484 wrote to memory of 5052	3484	firefox.exe	74
PID 3484 wrote to memory of 5052	3484	firefox.exe	74
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 4956	3484	firefox.exe	75
PID 3484 wrote to memory of 3664	3484	firefox.exe	76
PID 3484 wrote to memory of 3664	3484	firefox.exe	76
PID 3484 wrote to memory of 3664	3484	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.sendspace.com/pro/dl/x1wf1p"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.sendspace.com/pro/dl/x1wf1p
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.0.374694216\247380959" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1476 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f884438-8970-4a57-8aba-0b724350fa0e} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 1812 1d87edd2e58 gpu
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.1.923830013\1708703699" -parentBuildID 20221007134813 -prefsHandle 2176 -prefMapHandle 2172 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6f08dd9-0edc-473a-bb57-5ff62d6ae541} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 2188 1d8001c3e58 socket
    3⤵
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.2.2125273564\379861584" -childID 1 -isForBrowser -prefsHandle 3076 -prefMapHandle 2744 -prefsLen 21711 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7924fba7-289a-4f26-afa1-77205309bfd8} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 3088 1d80313c858 tab
    3⤵
    PID:3664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.3.168718531\659660826" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3560 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6877151-9c03-409c-a267-64aeff106966} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 3628 1d803f9fe58 tab
    3⤵
    PID:2896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.4.1871770454\508493874" -childID 3 -isForBrowser -prefsHandle 4684 -prefMapHandle 4668 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20cc1321-1d9d-44f9-8527-f60ea718bab1} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 4708 1d8036f1358 tab
    3⤵
    PID:2744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.5.1284362419\198389195" -childID 4 -isForBrowser -prefsHandle 4848 -prefMapHandle 4852 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd7c8835-5a4f-41cf-a1eb-9b26f6fb383c} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 4840 1d805954258 tab
    3⤵
    PID:4312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3484.6.1964926916\673166024" -childID 5 -isForBrowser -prefsHandle 5044 -prefMapHandle 5048 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1304 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3da6eb77-eb55-473f-bdff-19495daffcc8} 3484 "\\.\pipe\gecko-crash-server-pipe.3484" 4932 1d806a8b758 tab
    3⤵
    PID:4936

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\INVOICE-VBDSJ09HSJA.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

Filesize
13KB

MD5
e74d7f23f39430d89ee44772270487bc

SHA1
9ce7c780f494104bf86de6bdd9ceb87e5d2581a5

SHA256
a177311aefad9d1282f5d6a54d29879142fa9b31b45c570813d009aee31cecb3

SHA512
59321c277001415390879503234f4601730c0e8bf3b294ac499cd33802dbecb401f3541e6209ec808d6656f0f447329a5d6571843da0d884a3b95b9b0d1513e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
62ca7ad82b453b6dcb822cdba37b4526

SHA1
d9bb189e50c35d498cac5d359074c0363a26dbac

SHA256
b2875a6cd68939e520380c791d9ff5a680be3a0c95f79748b1aeff7686d61e3f

SHA512
c3c4736a4768ecd6d8c2759e40343a4efc60d05453cc86123d7404709f57900e3078b8c03d87daa67200075ae2e18a6c677b024b7d5c12e3a634720b8c27f0d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\broadcast-listeners.json

Filesize
216B

MD5
dbd65bb61d8045ad6b4dcbfcfcb4a4d6

SHA1
c0d1bab5e0181852a6b0fd48e18c29e8433dab52

SHA256
dba797492d99273bf17b85f9b9196e923e473b0d3f73cbfd2a6235326ef17a32

SHA512
cec85743c431a4d8020451378753f9be4777f3b2726155899e996f9fdb8c5a9e54914731746825e7550987de9042c641bfd67d80fbabc354270cc89e729321d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
f354d584bf8917f8673ca3623094fb39

SHA1
af7bff2bd2a926bfb2c479550832bc90dac9d5b1

SHA256
326a0122bc7a3b64469699f2d98bc247ec6b91964b316ed4017b9c41cbe26bd4

SHA512
1477e3532889bc5b1e420ffc9d625f1ef05933bb0a1a4b519d9e69cd37cab148dbf86c375ed04b796d14e21efee0a060b3f30be60d0e7fc1cf6c0d2673f027ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\dd84cc74-3062-4fbc-bc6b-5cf55ee05ed7

Filesize
9KB

MD5
8f067140207393e581e28dd37f838e6a

SHA1
bb73362d6e25fcb297059703eb8e9096e59ca469

SHA256
2dd0aa922b4a52a2faea7679b5ec4f57d2022f31a51fbafaaee19f5fe556322a

SHA512
1973f61b32fab43562226f7de171664d6ea8bf60223b92b189106c39f136641e5595b04a27660e189e625467a5d9d8565ffb278bba6ed4394c9f1e2cc4aa243a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\f5813d10-56c0-4325-91e7-93198a33f2a0

Filesize
746B

MD5
0440598bf7ff8544d7fe51814eb5f25d

SHA1
a017fb619f95109df1b58fb9ade07d6b2127a371

SHA256
58db92a704f65c53a8f0f2a037007364a268421527e66318b8780e584a6c6f09

SHA512
6deb3951d859cc19b049b5502c72a7bf2b6fe6b9d8b497bc7a8c0b9728ba9738dec1b12e39c6b231d7d9bd7a2f27595c972e72504adf9eb955c08561757e326f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
10KB

MD5
2981ce60a25e96d65255f7f7446e1497

SHA1
ce1ec6c314ca1df2e5ce4eba3c86ce404776a098

SHA256
9f693cc5013c22dd9cd9e97095e1f2a1070fa3e8e4275b81333702a4d0392c22

SHA512
a8304efdf63849e9e20a4c31121fc21d12beb8d6325bb2fc631a974c39a6b9700db98c71a961a1f7b2f3ee6caa15e93d2b6c9c23d63fe85c02a296d881f56537

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
10KB

MD5
15a59b8da3b1205f1db342a5e4563868

SHA1
2642fb7a9b545392fd14b6f8b649c798d0e44bbe

SHA256
15a60c2eabee2c8f8bf388797856ebb489b01dd3cc3043e86b8e8a70edd67195

SHA512
aa3cc586c1c21ba36e595b4fc41763151168a39f3f1b00071368a98cd50c54117b11a2412af5b998e3520f29be2704b247e4ddd7442f8a0f365f2860a49b32e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
9KB

MD5
9897d48ab6f7774475600a9054d28587

SHA1
55c1234e2fb0b1b66e126321d36222d1aa8b3be2

SHA256
b8d366fa073c78a96c018fe78aa92c6b81ddee3a7662d46017c61a16a3e793f5

SHA512
27a2dd82f5e039d4efa6f29be5e0dc9e3c0ca1bbfe35c7324324b44d61eb3583ab8b84ba0cefa6ea14de154b41f7964c5b32d25147229fd262d1e8d4bf641094

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
b976427c275dd2c9d91a85c2ce594459

SHA1
75131241e91b1b7be95195b43717c19883dddfcb

SHA256
d1d5adfc96948ced4cd5e21f1f507a7e25c215306cc04917de3b6051742a6567

SHA512
9eaf4418a583f35f9eaf1596564e235fc2c60b8bbcb23c9c28824a2444f5adba747e83739d4187fb29fc0b16a04864e8c5715bfb770f7a67a04c9e6a0d865747

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js

Filesize
6KB

MD5
94ddc6e4e1d69e624a89281c2ed528d7

SHA1
f2c188b5567c4c232a5f05943380f080f66c211d

SHA256
6b9dfc3fe1f585488c3a70fd98bc545f141a034b8d9652052c51d7a8e7303102

SHA512
47c013ad26fed5f41316173efa033660f22856a35335b93aaab58aaa76413fff177e0d49a6a6c03a8d41c85fb4e1f6b5648b78cf5abd98558d7de01bd8f6ede3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js

Filesize
6KB

MD5
050858f70a1ce3019afee79b6ad29305

SHA1
ced7cd5412e202fe23487a3aa5e0b94964996743

SHA256
834ca6c6551074bae3042b41b70f8524c204456e454e17c846893166d2dcda3f

SHA512
5b0c819f1e1dc86b6560138afc82c65f53d5e14370fdefc5e0ade5b5a31fbfea03bab8024eef475869453485fe6495ed136dac8ebe695c42b9dc84b5f65125f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a21c3da883a41fe3b374a9e6fa08af6d

SHA1
22df423ac03a671c883bb2bd1ba0424e06119d2e

SHA256
e5c4a7f9c220dd46f2cd4e74fab7f408114bd894a2a6d4c5faad75666f3f81ff

SHA512
5fa1bcab1b51134fe56927df38cfdce8a97146f9464e570165edb6fb65c30d25dfd0b157701cffb8a7e3decc74a1d2c0c0b3968b3ad1f7a71a0a367915b9768b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
afa09b2d4bfe7c8f0fb85d73df03e5d5

SHA1
d94b226bc1a10097738de08124a1d4ce4aa1ce34

SHA256
edf06f78b4b3e6f1dc63804f5e0365f2dfc9681ed86f58cfe0c3cd7ec3448947

SHA512
244ac7f6aee933d0ddb58a44922e9fe7c99c06432a29a725e27b61494a92aef65cb78aa9b3849a6b898f546dc38ce36fb4b6be20bc632be73dea4a82a9552cd1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
7.7MB

MD5
f108c94a85665bdf37a37ed7b1ae4f28

SHA1
536b88ddfd21cc8aed94e361ab2a6bbf6a3ac383

SHA256
688ed0e81cd83535f4c9b5489b0ab20eaa08100b3644fc31551b5d9862496f83

SHA512
72abef903a1510d96d5aba8634e099b7bd862cc19322da7bb943b5e5e77533e25767a6532d99a24264fb2dbbdb56e601d7337daa327de1b5fe6af89082547759

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\targeting.snapshot.json

Filesize
3KB

MD5
d2d89f4c6b6036c9bca736ad23dba6c1

SHA1
8e9349709d193992fe181d561b17648f1e807741

SHA256
65b6bf264d87cefaeb6e9fa0b7889d08273f278c79de73fdfc3fb57cd463d71f

SHA512
7427d2a9160eba80c242d6b1ccf6dd283e4a852153bd7b387e2f4404b43872b73455dc0fe923e7bfdc78843098f4df55996d13e2db721913f5c60c618b708e7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\xulstore.json

Filesize
141B

MD5
1995825c748914809df775643764920f

SHA1
55c55d77bb712d2d831996344f0a1b3e0b7ff98a

SHA256
87835b1bd7d0934f997ef51c977349809551d47e32c3c9224899359ae0fce776

SHA512
c311970610d836550a07feb47bd0774fd728130d0660cbada2d2d68f2fcfbe84e85404d7f5b8ab0f71a6c947561dcffa95df2782a712f4dcb7230ea8ba01c34c

Download Submit
C:\Users\Admin\Downloads\VJUueeM5.svg.part

Filesize
1KB

MD5
c17bd6c58592d3b13f76acb6970c80e1

SHA1
051d65f29593c51312cc817218b48bead50652db

SHA256
98582e229fcb702fe2593db6acdb0e9481efcf8fab541ccf96ecb034b58a540d

SHA512
2953063f58b0930b282ab8beedbca1332a68481d6701a56b79cc914aaac4d035f675649aa7c5eb527568e7415328f2f8e076f2b3cf1ce651e026d5635178388a

Download Submit