Malware Analysis Report

2025-01-17 21:24

Sample ID 240603-q2z8sahh45
Target https://go.deogy-communications.com/e/1029141/l-1029141-2023-06-09-9rm/22td7/690386208/h/cYqZQUYgWoDtiUT_PRbQ-KjtuATb9NhLcIVCD_OtaOw
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

Threat Level: No (potentially) malicious behavior was detected

The file https://go.deogy-communications.com/e/1029141/l-1029141-2023-06-09-9rm/22td7/690386208/h/cYqZQUYgWoDtiUT_PRbQ-KjtuATb9NhLcIVCD_OtaOw was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Checks processor information in registry

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:46

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:46

Reported

2024-06-03 13:46

Platform

win10v2004-20240426-en

Max time kernel

34s

Max time network

36s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://go.deogy-communications.com/e/1029141/l-1029141-2023-06-09-9rm/22td7/690386208/h/cYqZQUYgWoDtiUT_PRbQ-KjtuATb9NhLcIVCD_OtaOw"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1128 wrote to memory of 1868 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 4888 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1868 wrote to memory of 2328 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://go.deogy-communications.com/e/1029141/l-1029141-2023-06-09-9rm/22td7/690386208/h/cYqZQUYgWoDtiUT_PRbQ-KjtuATb9NhLcIVCD_OtaOw"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://go.deogy-communications.com/e/1029141/l-1029141-2023-06-09-9rm/22td7/690386208/h/cYqZQUYgWoDtiUT_PRbQ-KjtuATb9NhLcIVCD_OtaOw

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.0.224850241\1694479399" -parentBuildID 20230214051806 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {908273b0-8145-4451-9ba2-7162ffa82d97} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 1828 22914812758 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.1.1460773729\1703060612" -parentBuildID 20230214051806 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3394fcd9-eef2-4082-a3a9-7e1532c1aea2} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 2424 22900590c58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.2.1063243119\836147197" -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3028 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1cd4747-192a-476d-8003-b996317f80e2} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 3044 2291773d558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.3.332275215\205098730" -childID 2 -isForBrowser -prefsHandle 3852 -prefMapHandle 3848 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8057704-b87e-475f-9048-e9c2dcf2abf7} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 3860 229193c5058 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.4.1584293147\297882162" -childID 3 -isForBrowser -prefsHandle 5236 -prefMapHandle 5244 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a133d838-22c0-4c1f-a188-5139c8f187ea} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5204 2291ab40258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.5.2040759106\2128204774" -childID 4 -isForBrowser -prefsHandle 3100 -prefMapHandle 3116 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {181f4fec-96dc-4c20-bf38-e1a1fbb3719b} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5480 2291b858658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.6.1552863945\330556157" -childID 5 -isForBrowser -prefsHandle 3076 -prefMapHandle 3080 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7707d0b9-5fb7-4268-a91c-9068e0c4c356} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 3088 2291bc0ba58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.7.1563243439\459983926" -childID 6 -isForBrowser -prefsHandle 5672 -prefMapHandle 5676 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91986b1b-8834-44a7-8af4-ad9aa1df117d} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5756 2291b9ce258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.8.2029482491\1539458234" -parentBuildID 20230214051806 -prefsHandle 5708 -prefMapHandle 5712 -prefsLen 27697 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad79ec09-9804-46b6-a09d-38f3ccd0ed41} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 5736 2291c0b1058 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1868.9.1525458846\672805999" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6096 -prefMapHandle 6092 -prefsLen 27697 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d1bdd9d-2b52-4d24-8730-5cbc46720073} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" 6104 2291c4c6d58 utility

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 go.deogy-communications.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.117.188.166:443 spocs.getpocket.com tcp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 34.237.219.119:443 go.deogy-communications.com tcp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 34.117.188.166:443 spocs.getpocket.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 pi-ue1-public-lb-f0209c6950285322.elb.us-east-1.amazonaws.com udp
US 44.230.111.112:443 shavar.services.mozilla.com tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 pi-ue1-public-lb-f0209c6950285322.elb.us-east-1.amazonaws.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 221.5.120.34.in-addr.arpa udp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
N/A 127.0.0.1:59688 tcp
N/A 127.0.0.1:59697 tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 autopush.prod.mozaws.net udp
US 8.8.8.8:53 cnn.com udp
US 151.101.3.5:443 cnn.com tcp
US 8.8.8.8:53 cnn.com udp
US 8.8.8.8:53 cnn.com udp
US 8.8.8.8:53 112.111.230.44.in-addr.arpa udp
US 8.8.8.8:53 119.219.237.34.in-addr.arpa udp
US 8.8.8.8:53 5.3.101.151.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 151.101.3.5:443 cnn.com udp
US 8.8.8.8:53 www.cnn.com udp
US 151.101.3.5:443 www.cnn.com tcp
US 8.8.8.8:53 cnn-tls.map.fastly.net udp
US 151.101.3.5:443 cnn-tls.map.fastly.net udp
US 8.8.8.8:53 edition.cnn.com udp
US 8.8.8.8:53 cnn-tls.map.fastly.net udp
US 151.101.195.5:443 edition.cnn.com tcp
US 8.8.8.8:53 edition.cnn.com udp
US 8.8.8.8:53 edition.cnn.com udp
US 151.101.195.5:443 edition.cnn.com udp
US 8.8.8.8:53 cdn.optimizely.com udp
US 8.8.8.8:53 static.chartbeat.com udp
US 8.8.8.8:53 lightning.cnn.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 8.8.8.8:53 z.cdp-dev.cnn.com udp
US 8.8.8.8:53 get.s-onetag.com udp
US 8.8.8.8:53 registry.api.cnn.io udp
US 8.8.8.8:53 media.cnn.com udp
BE 92.123.50.203:443 cdn.optimizely.com tcp
US 8.8.8.8:53 e5048.dsca.akamaiedge.net udp
BE 92.123.52.10:443 lightning.cnn.com tcp
US 151.101.3.5:443 media.cnn.com tcp
GB 18.172.89.99:443 get.s-onetag.com tcp
US 151.101.3.5:443 media.cnn.com tcp
US 151.101.3.5:443 media.cnn.com tcp
US 151.101.3.5:443 media.cnn.com tcp
US 151.101.3.5:443 media.cnn.com tcp
US 151.101.3.5:443 media.cnn.com tcp
US 151.101.3.5:443 media.cnn.com tcp
US 151.101.1.67:443 z.cdp-dev.cnn.com tcp
US 8.8.8.8:53 e12596.dscj.akamaiedge.net udp
US 8.8.8.8:53 e5048.dsca.akamaiedge.net udp
US 8.8.8.8:53 get.s-onetag.com udp
US 151.101.3.5:443 media.cnn.com udp
US 151.101.3.5:443 media.cnn.com udp
US 8.8.8.8:53 turner-tls.map.fastly.net udp
US 8.8.8.8:53 get.s-onetag.com udp
US 8.8.8.8:53 turner-tls.map.fastly.net udp
US 8.8.8.8:53 e12596.dscj.akamaiedge.net udp
US 8.8.8.8:53 d3f7zc5bbfci5.cloudfront.net udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 5.195.101.151.in-addr.arpa udp
US 8.8.8.8:53 203.50.123.92.in-addr.arpa udp
US 8.8.8.8:53 10.52.123.92.in-addr.arpa udp
US 8.8.8.8:53 99.89.172.18.in-addr.arpa udp
US 8.8.8.8:53 67.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 d3f7zc5bbfci5.cloudfront.net udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 onetag-geo.s-onetag.com udp
US 8.8.8.8:53 signal-beacon.s-onetag.com udp
US 8.8.8.8:53 signal-floors.s-onetag.com udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
GB 3.162.20.66:443 onetag-geo.s-onetag.com tcp
US 8.8.8.8:53 onetag-geo.s-onetag.com udp
GB 18.165.160.101:443 signal-floors.s-onetag.com tcp
US 8.8.8.8:53 signal-floors.s-onetag.com udp
GB 18.165.160.30:443 signal-beacon.s-onetag.com tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 onetag-geo.s-onetag.com udp
US 8.8.8.8:53 d1ekdn256kz7p5.cloudfront.net udp
US 8.8.8.8:53 signal-floors.s-onetag.com udp
US 151.101.1.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 d1ekdn256kz7p5.cloudfront.net udp
US 104.19.177.52:443 cdn.cookielaw.org tcp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 8.8.8.8:53 229.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 66.20.162.3.in-addr.arpa udp
US 8.8.8.8:53 101.160.165.18.in-addr.arpa udp
US 8.8.8.8:53 30.160.165.18.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 52.177.19.104.in-addr.arpa udp
US 8.8.8.8:53 zion.api.cnn.io udp
US 54.156.52.93:443 zion.api.cnn.io tcp
US 54.156.52.93:443 zion.api.cnn.io tcp
US 8.8.8.8:53 zion.api.cnn.io udp
US 8.8.8.8:53 zion.api.cnn.io udp
US 8.8.8.8:53 cadmus.script.ac udp
US 104.19.177.52:443 cdn.cookielaw.org tcp
US 104.18.22.145:443 cadmus.script.ac tcp
US 8.8.8.8:53 cadmus.script.ac udp
US 8.8.8.8:53 cadmus.script.ac udp
US 8.8.8.8:53 i.clean.gg udp
US 34.95.69.49:443 i.clean.gg tcp
US 34.95.69.49:443 i.clean.gg tcp
US 8.8.8.8:53 i.clean.gg udp
US 8.8.8.8:53 i.clean.gg udp
GB 18.172.92.68:443 d3f7zc5bbfci5.cloudfront.net tcp
US 34.95.69.49:443 i.clean.gg udp
US 8.8.8.8:53 93.52.156.54.in-addr.arpa udp
US 8.8.8.8:53 145.22.18.104.in-addr.arpa udp
US 8.8.8.8:53 49.69.95.34.in-addr.arpa udp
US 8.8.8.8:53 68.92.172.18.in-addr.arpa udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 tag.wknd.ai udp
US 8.8.8.8:53 secure.quantserve.com udp
US 8.8.8.8:53 mab.chartbeat.com udp
US 8.8.8.8:53 collector.cdp.cnn.com udp
US 151.101.2.202:443 mab.chartbeat.com tcp
US 8.8.8.8:53 dualstack.f6.shared.global.fastly.net udp
US 13.248.140.122:443 collector.cdp.cnn.com tcp
US 13.248.140.122:443 collector.cdp.cnn.com tcp
US 8.8.8.8:53 a80a9201ee101bbc3.awsglobalaccelerator.com udp
US 8.8.8.8:53 dualstack.f6.shared.global.fastly.net udp
US 8.8.8.8:53 a80a9201ee101bbc3.awsglobalaccelerator.com udp
US 8.8.8.8:53 udp
GB 96.17.179.158:443 a1944.dscw16.akamai.net tcp
GB 96.17.179.158:443 a1944.dscw16.akamai.net tcp
US 8.8.8.8:53 202.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 122.140.248.13.in-addr.arpa udp
US 8.8.8.8:53 158.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 medium.ngtv.io udp
US 8.8.8.8:53 aus5.mozilla.org udp
US 34.120.253.250:443 tag.wknd.ai tcp
US 8.8.8.8:53 tag.bouncex.net udp
DE 91.228.74.159:443 secure.quantserve.com tcp
US 8.8.8.8:53 global.px.quantserve.com udp
GB 18.165.160.126:443 sb.scorecardresearch.com tcp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 sb.scorecardresearch.com udp
US 8.8.8.8:53 global.px.quantserve.com udp
US 8.8.8.8:53 tag.bouncex.net udp
BE 92.123.52.10:443 medium.ngtv.io tcp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 34.120.253.250:443 tag.bouncex.net udp
US 8.8.8.8:53 assets.bounceexchange.com udp
US 34.98.72.95:443 assets.bounceexchange.com tcp
US 8.8.8.8:53 static.bounceexchange.com udp
US 8.8.8.8:53 rules.quantcount.com udp
US 8.8.8.8:53 static.bounceexchange.com udp
US 8.8.8.8:53 d2fashanjl7d9f.cloudfront.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
GB 18.172.89.80:443 d2fashanjl7d9f.cloudfront.net tcp
US 8.8.8.8:53 d2fashanjl7d9f.cloudfront.net udp
NL 2.18.121.79:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 34.98.72.95:443 static.bounceexchange.com udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 250.253.120.34.in-addr.arpa udp
US 8.8.8.8:53 126.160.165.18.in-addr.arpa udp
US 8.8.8.8:53 159.74.228.91.in-addr.arpa udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 95.72.98.34.in-addr.arpa udp
US 8.8.8.8:53 80.89.172.18.in-addr.arpa udp
US 8.8.8.8:53 79.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.200.14:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 142.250.200.14:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1---sn-aigl6ney.gvt1.com tcp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 r1.sn-aigl6ney.gvt1.com udp
GB 173.194.183.166:443 r1.sn-aigl6ney.gvt1.com udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 166.183.194.173.in-addr.arpa udp
US 8.8.8.8:53 live-media-fly.warnermediacdn.com udp
US 8.8.8.8:53 licensing.bitmovin.com udp
US 151.101.1.107:443 live-media-fly.warnermediacdn.com tcp
US 8.8.8.8:53 dualstack.wbd-us-prd.map.fastly.net udp
US 35.227.229.24:443 licensing.bitmovin.com tcp
US 8.8.8.8:53 licensing.bitmovin.com udp
US 8.8.8.8:53 dualstack.wbd-us-prd.map.fastly.net udp
US 8.8.8.8:53 licensing.bitmovin.com udp
US 151.101.1.107:443 dualstack.wbd-us-prd.map.fastly.net udp
US 151.101.1.107:443 dualstack.wbd-us-prd.map.fastly.net tcp
US 35.227.229.24:443 licensing.bitmovin.com udp
US 35.227.229.24:443 licensing.bitmovin.com udp
US 8.8.8.8:53 107.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 24.229.227.35.in-addr.arpa udp
US 8.8.8.8:53 s.cdn.turner.com udp
US 8.8.8.8:53 logs.browser-intake-datadoghq.com udp
US 3.233.152.248:443 logs.browser-intake-datadoghq.com tcp
US 8.8.8.8:53 alb-logs-http-browser-pub-s0-1899014706.us-east-1.elb.amazonaws.com udp
GB 96.17.179.146:443 s.cdn.turner.com tcp
US 8.8.8.8:53 alb-logs-http-browser-pub-s0-1899014706.us-east-1.elb.amazonaws.com udp
US 8.8.8.8:53 146.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 248.152.233.3.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 events.bouncex.net udp
US 34.111.8.32:443 events.bouncex.net tcp
US 8.8.8.8:53 nginx-ingress.wunderkind.co udp
US 8.8.8.8:53 nginx-ingress.wunderkind.co udp
US 34.111.8.32:443 nginx-ingress.wunderkind.co udp
US 8.8.8.8:53 connect-metrics-collector.s-onetag.com udp
US 99.83.181.31:443 connect-metrics-collector.s-onetag.com tcp
US 8.8.8.8:53 connect-metrics-collector.s-onetag.com udp
US 8.8.8.8:53 connect-metrics-collector.s-onetag.com udp
US 8.8.8.8:53 signal-metrics-collector-beta.s-onetag.com udp
US 8.8.8.8:53 signal-metrics-collector-beta.s-onetag.com udp
US 99.83.181.31:443 signal-metrics-collector-beta.s-onetag.com tcp
US 8.8.8.8:53 signal-metrics-collector-beta.s-onetag.com udp
US 8.8.8.8:53 32.8.111.34.in-addr.arpa udp
US 8.8.8.8:53 31.181.83.99.in-addr.arpa udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 53.121.117.34.in-addr.arpa udp
US 8.8.8.8:53 dualstack.wbd-us-prd.map.fastly.net udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\activity-stream.discovery_stream.json.tmp

MD5 f31b49e495bbf3b2ebb5f7a888bd0677
SHA1 f2f37c492db0e1909e0048f26d28613640ef244c
SHA256 51ec505b9daf4aba94752d0cb141b920a45de0d9f3856a3f7364e4bcbba8d9af
SHA512 1555ffa7bf8863e2e551487ea73ac60ccaa3202dc22406a543b823af84713dfcd90ef5f158c099cdec01f0dda48a66fb83978724c3a17f6f6a629a5f90d0e70c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\prefs-1.js

MD5 943523fef3c36c96d1280eb5444b54ad
SHA1 539ad8950c07e4662f86fcdabb7b75744771b213
SHA256 e7f17195e6bfa831d3c1f4d1789dc054545d261be5b12cf5d6e4a031bd14c80a
SHA512 faa401002d822373c3703f52d0f7d599cf4f12a9beef80a753c00910ed359cf9a804daf7cc81c0c534ae2b27191381ccbdc1dd693356d6d80f106a5a107b4a9d

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\cache2\doomed\29770

MD5 b6e92c5b279149fc35f5c4e072d08e69
SHA1 7ca1faa5037a1949745dfed06017083183289fa7
SHA256 015156b12b17e20e27801980916f1fffccdcff068f6286a93b33703e53bd98a5
SHA512 9e44ddfddc10861303d61da2ac5068d6e98fc6b1fc41173674beb5a2d83e2da3c99c259ae78f6eb9845f1065853dff49993cc9d00e4b72807e64e0b22b33f0f9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\cache2\doomed\25382

MD5 0fb4005783268fbf43b37c20a341e1ae
SHA1 c20bbfa2ac262fa025fe756e5993ade81795082b
SHA256 08a31411a742ec41e55759c7796917ce7643d4067cd1a0d466dacd9f042b2828
SHA512 84f369649d8260da1a44955f14c0fcefbfa31258846aa32ef0f4c087f1dbf2ebf8cf95ce8a4b1825ba42099cd59b6a23ca3316e92ac4c4416a131f9b35cb464a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\sessionstore-backups\recovery.jsonlz4

MD5 06c65cafd3f67338d8e88584c9e3dfe6
SHA1 5a46deff0e27865d28c2599d46fd8a1e83bff71d
SHA256 29789a6ec89e47d34c83d84217281ce4e0ac9798cc3f78b146813a4686b6f884
SHA512 01ea84745a375332e44d162fa420ffc2451087f8d8f9636be4eddf390cfab825f11dd621a2367502a4e22851b1c72af10a2e5610c2a79e22004af7dc607f368f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

MD5 06927e78c63247d2ac776cb1aba4d005
SHA1 46e2da94569d287c8179cbaed22f946562538f07
SHA256 f250527ddcdecd347615ea193e0a9690fc92d3b4c5e40c9996ee4869df01a5f9
SHA512 ada2e4343d18ea02383ca4b8f83e9ba22f8ca3f55c152d82534940fa00b4259368269cb5a173a5e3f7255bd70e44487a4becb55616f5670c4552316450960a32

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\cache2\entries\71C05F6819249867089DB9CB0792C18509109D60

MD5 b3f7cce4b42c1e42f28d703fa93e3f05
SHA1 fe135e16892cfa32294b0b0ffe45b26180a348d9
SHA256 3361fde10090490e1085cc0d2c1a23fcde92a3c3a475aa48192b6be09452b717
SHA512 39ef9fcd989cfdd261bdb3459758719762307350cb18efc3f5bdde9272040c746266d059401d450727a8a7692ce015a3b7c2324f41c4e814cd83d41fcc2c976a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\prefs-1.js

MD5 b45b85bf868a593e6f35e4e2eb68dc00
SHA1 e70616ccb835651dd1a39230d0aee257f8ff7f7d
SHA256 7a890bf334274ee9257cacf1965eb031c9384bca89cf71c635dc26e613ac01e9
SHA512 f4ae4f09c2dacec59ca5ab3db57491c986f3821667094e9adff7d679c7ea16bad1ecc7b44cf7dd5c21ee70ef93bc73780528a8bf6ba7fa27855951b93eae7b44

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 02a5685fff1621448081c45b3596b16f
SHA1 a77ab455fc8fa901123d4932b6f925ad8c2d1e16
SHA256 8e26b2936fc793bef75f112f1f7c21d1575324ee5dca4944da370bdca9e4ec1c
SHA512 d16f421e2571a191ac227439e95261974248a5867580283c0601394c5d59a1fa3575a4082e6f78384d32d83416232dff8eabc9b32e17f8d330a24fc4341fd843

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\cache2\doomed\23257

MD5 8d526e5752989448839c852bbc6572fb
SHA1 085839b104aae69770c74a7ad48320929e15f52e
SHA256 2d24199f4d0f35a02f219e1800c090a0d874f51f23f579a4970214a685948937
SHA512 b4d9c480712f945dd7dd184247ead81455420836e03e5fb135b6ea092a3520225a4273662ea2cc0226fc68450bf20efea08f126a3962237b75df25d6ae0b89a3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\cache2\doomed\6256

MD5 90eb7363a46b8e24d9b7f2e2ac707349
SHA1 db0372d980de5e001ffe1c4d58fbcb8d5f4faf94
SHA256 e76edc1e9171e36e24955fc51b7f555debcd1b0138a5092611d70a1f2eb5152e
SHA512 26c2b58c4bf43a4d0393a2a4c423fde2f91d403449e02a930b1692acbb0d4ae6096973e29c179ebfc6a1285c20c836a50b8c75a2140620a870a5a898d1d303ad

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\cache2\doomed\30479

MD5 dfe12ebbe34fada4f3d037fc878426a9
SHA1 8c7ea8ebd4e1dae55deced6a0b7fcc7841028e8d
SHA256 2470e3ee3acff1e516f47004c178c12040c2ec40a474de98e48eb53e19a9fbc1
SHA512 f29f653060194b995d075874c6e4d96b2a3badcf9548621bd4e2a25a38338f2e97351340c3225e36659dbccd314905cfcaba44e7494d7280099a7318205d9908

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\47kntzet.default-release\cache2\doomed\25082

MD5 bfd577f53066fab54d9f5c5e046b3fa5
SHA1 867890c2dba102b2e4382e16e504b9ba646efca8
SHA256 7af113ca75dca24ab328706fe3cc6ac02c9d54dd122b19128c12cc9b03c96fb2
SHA512 f32e68cfe80942afa94352c0263faa82e9191202a569beea8bf57d946c75064eeeb65e84ca4b8f8e9ab09bcd5284825bf42ef0e4559588b7bd5517b8707abe24

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\prefs-1.js

MD5 227fd214bc7b29165873c8294e7d0c4a
SHA1 fc5fe6c19844e9fee6071aa3319c5cd1b05f5e06
SHA256 728f30ad014dba5f96270ab830c8fe7baf29955fb642cf86255a6aec5439529b
SHA512 bef829ee4eb286eea0705b469f840f546f90c92d56134341643cf27a25f5d3764ced591310121b0ffd7ecf806a197882f52e4f80dc43f73d052af3d115529478

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5d55bfa922e05be6463c211a1f75b28b
SHA1 87c2d6fb1962fb2dbad13ee1aae6db267031ce32
SHA256 ae9e17f381a9a907fdca880d94a285b0bdbe4eabfc2869991ec6876fd35887b7
SHA512 4a03e512f6642db341a95f86e7dbf910f0191a8c047e3b5c509ce4e11ebb3c16fd70a62331eef5432d2e4e1df6cdc273b2a41ee397f2903b39ac3f28231f5e66