Malware Analysis Report

2024-07-28 07:09

Sample ID 240625-l2bszashlc
Target https://sc.link/MUiwq
Tags
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://sc.link/MUiwq was found to be: Known bad.

Malicious Activity Summary


Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Checks processor information in registry

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-25 10:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 10:01

Reported

2024-06-25 10:03

Platform

win11-20240611-en

Max time kernel

108s

Max time network

111s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://sc.link/MUiwq"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1540 wrote to memory of 1824 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 2492 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1824 wrote to memory of 1812 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://sc.link/MUiwq"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://sc.link/MUiwq

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.0.2033091014\95462632" -parentBuildID 20230214051806 -prefsHandle 1796 -prefMapHandle 1788 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f3abe5a-c209-4634-bfb1-811091a5e8a0} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 1876 23e40d0f158 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.1.2026891190\251955191" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de4cbf6d-18bf-435e-874a-91e0b0ac86e3} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 2420 23e34185358 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.2.1352394228\99169480" -childID 1 -isForBrowser -prefsHandle 3116 -prefMapHandle 2884 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcbe734b-18ce-4e48-a9a3-70df002cba08} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 3164 23e43e3e458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.3.1667338988\82529832" -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {925527ae-08d6-40ed-8c3a-3c306fe85948} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 3584 23e459d2858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.4.602623279\668375240" -childID 3 -isForBrowser -prefsHandle 5184 -prefMapHandle 5136 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a97f12b-8293-4791-864e-d26a50ebb717} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 5196 23e47673758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.5.1855956777\157595" -childID 4 -isForBrowser -prefsHandle 5332 -prefMapHandle 5336 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8b8da47-96ab-4c56-9529-700b5f2e1a08} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 5324 23e47672b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.6.251095192\2040931221" -childID 5 -isForBrowser -prefsHandle 5544 -prefMapHandle 5548 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08e20e04-38bb-419b-8eb2-f37b406578b7} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 5536 23e47675858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.7.1666564013\793286617" -childID 6 -isForBrowser -prefsHandle 3028 -prefMapHandle 2808 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {512e8e24-ce08-4b5d-acc9-953a731bb209} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 5364 23e47e44258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.8.758679206\988710579" -parentBuildID 20230214051806 -prefsHandle 9712 -prefMapHandle 9716 -prefsLen 27695 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d4d3e71-cabc-452d-b133-ee2e29cc6929} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 9704 23e48aa9058 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.9.1503496855\1827365235" -childID 7 -isForBrowser -prefsHandle 9576 -prefMapHandle 9580 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b84d0c92-c895-4c9c-b817-0474509b031f} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 9584 23e48aaa858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.10.1891589158\1993861518" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 9376 -prefMapHandle 9412 -prefsLen 27960 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38a6a266-ca79-4f99-95a5-02b126998d2a} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 5724 23e49559d58 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.11.1650319955\1728101972" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 9380 -prefMapHandle 9384 -prefsLen 27960 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c55f8add-35fe-43df-b5f5-b5e2bd46de96} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 9324 23e49637b58 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.12.666409660\1639459839" -childID 8 -isForBrowser -prefsHandle 9580 -prefMapHandle 9540 -prefsLen 27960 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11861f23-e36c-4a9f-9079-793bc0e8d337} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 9324 23e4970e958 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.13.465305130\844466502" -childID 9 -isForBrowser -prefsHandle 8928 -prefMapHandle 8920 -prefsLen 27960 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c04173b-1c97-45fa-8510-eb428b469102} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 8948 23e48cb7658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.14.1128309710\87635681" -childID 10 -isForBrowser -prefsHandle 9744 -prefMapHandle 3256 -prefsLen 27960 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f4b6657-19cb-45b0-a0cd-8771cab8abc1} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 3104 23e497b3258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.15.974871078\1880667687" -childID 11 -isForBrowser -prefsHandle 5368 -prefMapHandle 1620 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1316 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2b11eb7-e07a-46e5-b5dc-f1130f2ecfa2} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 5764 23e46951858 tab

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

Network

Country Destination Domain Proto
US 8.8.8.8:53 sc.link udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
RU 178.248.232.231:443 sc.link tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 34.120.5.221:443 prod.pocket.prod.cloudops.mozgcp.net tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 52.25.243.81:443 shavar.services.mozilla.com tcp
US 34.107.243.93:443 push.services.mozilla.com tcp
US 34.117.188.166:443 prod.ads.prod.webservices.mozgcp.net tcp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 34.107.243.93:443 push.services.mozilla.com tcp
N/A 127.0.0.1:49742 tcp
US 104.21.56.200:443 stearncomnunlilty.com tcp
US 104.21.56.200:443 stearncomnunlilty.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 151.101.2.137:443 code.jquery.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 steamcommunity.com udp
BE 104.68.92.92:443 steamcommunity.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com udp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
US 172.64.145.151:443 cdn.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 cdn.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 cdn.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 cdn.cloudflare.steamstatic.com tcp
N/A 127.0.0.1:49749 tcp
US 184.25.193.136:443 store.steampowered.com tcp
FR 217.182.48.150:443 catherineasquithgallery.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net udp
US 172.64.145.151:443 cdn.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 cdn.cloudflare.steamstatic.com tcp
BE 88.221.83.145:443 community.akamai.steamstatic.com tcp
BE 88.221.83.145:443 community.akamai.steamstatic.com tcp
BE 88.221.83.145:443 community.akamai.steamstatic.com tcp
BE 88.221.83.145:443 community.akamai.steamstatic.com tcp
BE 88.221.83.145:443 community.akamai.steamstatic.com tcp
BE 88.221.83.145:443 community.akamai.steamstatic.com tcp
US 184.25.193.136:443 store.steampowered.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 88.221.83.155:443 cdn.akamai.steamstatic.com tcp
BE 104.68.92.92:443 steamcommunity.com tcp
US 184.25.193.136:443 store.steampowered.com tcp
US 184.25.193.136:443 store.steampowered.com tcp
US 184.25.193.136:443 store.steampowered.com tcp
BE 88.221.83.66:443 clan.akamai.steamstatic.com tcp
BE 104.68.92.92:443 steamcommunity.com tcp
BE 104.68.92.92:443 steamcommunity.com tcp
BE 104.68.92.92:443 steamcommunity.com tcp
BE 104.68.92.92:443 steamcommunity.com tcp
BE 104.68.92.92:443 steamcommunity.com tcp
BE 104.68.92.92:443 steamcommunity.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com udp
US 52.111.227.11:443 tcp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 142.250.187.196:443 www.google.com udp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\activity-stream.discovery_stream.json.tmp

MD5 1f589f2789b49a7b7594c8cf38174bae
SHA1 1515cc9eb06026672e93237c9b3523968ee23635
SHA256 be2eff20923eca1266d991aeb7643e98f4ca45fa0955ed547dc5bb6dfd4a726b
SHA512 584b8ad21c1f0b96b0126422c03f6a088e72cb6fc239400328578e8942f63050c69eba6e6aed5ede59fbd9377527aaf9f91ffec0ca2ac4d45277910ffb27da9a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\prefs.js

MD5 7dfb6f24ada59474e47577b6655d7357
SHA1 29ca49c21f2a8371655dfb803018043d2aa0d71a
SHA256 3c2829018357306053acce2dc0efbb723bb6e81cabd36b06b2a007487f968f4f
SHA512 4fe4a2b8a1fdff365265b1621a89ff0645c0ae5290a9a6b3b09b041a6a34f5b9c72f432be1489cc7b32067541d854c5cd6436c243a2538c3feebc1762cc8ce5a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\8E4FF116D0ED1BF8F1256614F449B164121BD324

MD5 eadd927484522dca725891b6c062002e
SHA1 8d0562998255a7b0bd070223846d8b32138bc967
SHA256 fbeaea1f13d76c00c50661ca24b627e638dc8d7bef3e17a1525cd9b9de3782cf
SHA512 5a15808c4cf5351bbef5af78659a9e5f444155d4786aa6264544844b44d9d649c2befc33aef4c6eae02e2b4a3463b6d44adb59ceac6887e67d27d4f22ca6091f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\7959FDF469BBEA58A62F824EC657E1F6BF2609EA

MD5 f83e89d49b9444189387ee85df44e005
SHA1 250a74045ad1007df157416e42a93f15dcd1ba6e
SHA256 7823faa475b42c222fce8ab6ae6f2fbbf160e37502dc06a32d11dcb208a837e5
SHA512 88129957365f6f064cf419735acb630e2505ee288cd6ec60e93f96744b57edea2937ac1e65f810fbe2a9622985682914446919459fa4d75f2ce4987435e74e2c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5174f4d42d9003bc68f7eb61d35853ad
SHA1 3e1769aa0791d8e6c5af4a1a301b1ada71a606ea
SHA256 6b09149718be487e3f997f6a99358fcef700b6c14f40bf3e00c0becd1f889987
SHA512 3bce72f6b78a8606707534cb674e18fd60714c10ea498c9d0588b1048c0bd5e8e8baddb56ce2caa3bcf00b9b70cc4779f5b7db5382aee3684802b257c24ff62e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\26580

MD5 af5210746d5956a5ee80eb99e435fc2b
SHA1 8e92b1e5cbecc34615f9a1fec71a98a9838c8176
SHA256 44e8603ca8ce81e0bc3c2b8ff01c2ecd4e790b626d17a4051d538ba81e12cb6c
SHA512 797d04ca75ca517a84fcc63afc0d477238aa9cd9e8f2feaea9c7be8dcb63e1365c13395aeb70ba446b30131197704d6cb3f6c8424b2df8f15e6a8cdd77a88682

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\10140

MD5 0bc74b0d69ee5bea27f5465893e74c7e
SHA1 2bc0e0a1202bffd2fd74dcac9d642d41623e7521
SHA256 18e1f703832a925af8a3ed1b692685a1f126efeb0fdcfcd4c3499e425d8bc563
SHA512 f7e0df0e403d7499340e47d9a964e4c72b85a2aa9b68e3f1c07b6a2304337d9e034f194a22d838690cbc67e538c3f5fc185832cb505779575e5fe70caa10923f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\11611

MD5 b0b53c11fd8eb244556ada6f5b278cfb
SHA1 edaece160f04446563f77f923b4c036df3db5239
SHA256 dbd0e355445e2df2feceaf7036350fa29badb4a49f275384d5fecbffc2367283
SHA512 bf13090c77d3d052177dd906389d23c2dfd0290568dd4b59b214c02e64b77624c7118c3ca8af056d3169bc09353c6c93e29889fa29030bbc8439aa1247d8337d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\32674

MD5 ca8c6aff9644154fe22b5f02e589a41a
SHA1 f7d1a8723119c05d85281fabeea96d534074030a
SHA256 6c41a2821c2e3965144f56b6e0f53d6d6116191bae4b74dc4339ba498b1d1deb
SHA512 5f0da0e39e30003effc35708ca1ca781aa3f3103f146772f005dde2b85b7bd8cf586fc4183c5d47ed71330140f409ca9176770d6fd6899ab504d13c02d7e7e99

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\15785

MD5 f08adf9362bba0f61441b35c8e3fbe16
SHA1 9c24ece4b0c36dedb9efc56dc8c7df53b7744ae1
SHA256 d7c3552fcb300aac43ed9a0592a6793605ebcf202c9494d0df7f670d2b98e30e
SHA512 29cfdc742ccc8f6823b95311462a67444f54c1f627dbcc78aef0d1a0100d435219ae09784a6a1ca1622310e288511b4d0f899d7404e0b471b78627f0623f991f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\9827

MD5 144665c3ba69f7a4b5c1fe38b87207d7
SHA1 c3aedb227aba05e5bf4445cbe0cf0dd58213788d
SHA256 6bc674c555309f5fe429a577531c545554a6a09579e3b6c1efd4db24b3c8d83c
SHA512 de1f3578422900111f3ee7700c6d890bd9856469fcd463afe04219f916790e8101a4bfc49d820c84a804c0b80dd302827042ddf2af6b47c7258f2e002ad70d78

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\6112

MD5 f382ba30f5c0b76bc07b09245f445f8a
SHA1 f0ea4c3a58342eb0fa5a465afd62472e275163a8
SHA256 78105f7146a9ac3f5d58b2ade8e89e8967aba65fd526ee5919adca8d2a329bec
SHA512 42f6923d244fd07a69497d0e83ea5fdd2386884dc9c123b0423ad3cfc4003870a8eeed105abd04ce8afa245cfc779ff418f3c680a8a0ac852ef0be55cb0b5898

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\5888

MD5 021d5419214bf35df6b149c3ccc1c39e
SHA1 5c605d8077fef2ca88b51ddfd06a99922c86108d
SHA256 05829eefbddfc7982d7ad47e16b07d5680b33243e4db24a8dfe7c1b11ed6fe25
SHA512 b310e96d6339bfc1ee2c96b3c8a93906f5de4c77b78f0b5b3fb69ec9bea7afa74e4c98bad1c1943b6e9bbfc1eff72009ab9d634231fe1b5ced2a74f2f054cc00

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\D72F7EDC3AB426973A11219E2E7FAD92A2EBCF26

MD5 53af2c959b251ad2a34ff1e98effe5da
SHA1 7361efc622a0f95b1dee1da3b2e4e6942cae1187
SHA256 0ce3961f10afdbf8b105ba4d5cbcdf8d346dcaa5463f5c253214cb3416b9b5b1
SHA512 67a7a357d28cd6c8760e4fe0247f1d438d511612da523cd63d3e8badbc4456e6582e34a61da7ed7f6bb7bc87c68db4a11c1dfbee6068a8e6e1638c7043f1a037

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\AE836E384BF10B539BF7E3F25897373A8B098F67

MD5 ca498ad8a8b6999d9b5b57edf8345bac
SHA1 5864f8e84453ffcf4896b80dd7d91dbd883c23bd
SHA256 256ca2ef0eb9590da4dbaf2d2e044d5660089cf5eca52d2fccd14cc2075e1985
SHA512 143cdf3617acb28943ce1489ea04423055462ddf3f2d910d6db04486746b7a4371ce77f979ca8275dfc346a1e9e1c265d1818dd7f0318ae70bf006358cf2615b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\prefs.js

MD5 9b56af2589a03d773d01231cec5bfca9
SHA1 731133ce963ae95394b31704e88da7a41041a265
SHA256 864d02096da3d04d8805106d8633bcb7648c3edb74b7929d2fa3940fe20dcfc5
SHA512 ca586ad17c172a6f7dcc450b73bb9404725d50464819d8b40558b90ff1ed95ad8e2eb395e91826d87febd3feeebf9269cb56e6ff0fa5c773624e473d825bb491

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\prefs-1.js

MD5 485050810a93b877b4eb7c22f4ac4377
SHA1 98c6acb3aeff1a1ce58f622686599b4b80278bc3
SHA256 f5645ab0699324b6663d4cebfb9b87f787facc9083567f202fe510222d832865
SHA512 14d6a208ccfce82e6e34be59d1d499ec73d4fdf88d65ab2349e893cc7235885735caef52ab96d47ea668ef7689639b45672fdb8bbcb300c735fc133ae9553f5d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\sessionstore-backups\recovery.jsonlz4

MD5 4ba6e46397cd51233d700ccab4f7cad8
SHA1 cfbc085f26946d00e2c703f26ea4187ec9b755d6
SHA256 b31965fe9579f34531e4571437975d5f58f6a7d1039cab0c2cec3e242212bc5c
SHA512 396b7fe37bba384fe22f5b9d05e3827a5b37b7d4562d23884a9ecbd7fb3fc95a4013f392966ff203bb67e1fe2a5f64b82adebfaf14d0f18fe9bc861069905b98

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\6B58E01390EE8468516D031D404CD9A80CD3F2FA

MD5 d1f43fe4048f449de8e31c5fc39435f8
SHA1 24c5bcf1840fb34743904fa499f440fdbe2051d9
SHA256 ad7c9c7fee26932fd2aa6cc8bbc107e17f8855168998ac295381813b6e92ceea
SHA512 1fedd8bcd383a12d285c788f212d7e5d155c2881881e94ced3a74a40e1cd5151c009ccf8e6d5165bb2607fc96e61d31bbebd144216e62e959da12931a4c6e67c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\4C3B170CA39C93E08018D406DAE102ACE5B7A15B

MD5 f9a93d6351cb71eb4f6f1cc95e9e134e
SHA1 e9906533ee2f124941d86adc9a6af5955331a159
SHA256 e1370c7db712fafc98d6dffbd7a2f7ad3665081f422f2c09b86a7b7bd68df3e4
SHA512 019d0c6d54162c3d2b3d642f93c54c4618339930468b558a89b051ba43e262e797ae4687a8a7189286f7b3a3b18cfaec5df53ae41281b48969912f49d6129b85

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\8C1A3D8EE7199656F9187FA0098B39CF65350744

MD5 4dbbe7c383182f49a6102863bd3b92d9
SHA1 42bf3186b1102b01d562c4f43d8775cacbadd20f
SHA256 ee5609cec18a254e17fae434df1fb0c3adeb823c45a7e4c2de2614f5b127ceaf
SHA512 2b1aec20037f99eb47124eac1f0f6cfea598aba12ea58a1070956a52649e868f060f70d358a5e199c71451b3dbe73daf1b5f4802fe50160dd47e3e5cb3ee2f48

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\9450BF12776CF1DCE06925D117290E9779735D6D

MD5 1cd0e0a2dccd0d4e210d0d22e14c0e19
SHA1 2491f670dfa45c9cbf6cc3e68d3b2cf3c4117cd1
SHA256 239e31ed4041d4ae730fcf5fa234dbf5dbe493de4ddf183a30c6098e6468e244
SHA512 1101eb6bf5d776e9f59dfd2b9064ee15a05e5d43fb7bfb61b68011d0718e62754108d64762018076ae0c4a196c106d3dda5f6244fc1c0b755634850b1723bc96

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\95B952C4093616D09C6BEC32E5DF65C3D4897CEC

MD5 9ae44b58b68801348d2a768311216ec9
SHA1 829f7a36bf92fa935df01451ec4566f38b1e98fa
SHA256 202df7d4056f9d046bd5389567eb7e27dafadc64c8e9ca65dba56a09d577252c
SHA512 79e089d8775b2c9fa1f35523f5624a67cf23e7c9bac0fe298abf6a6b20a664ed2f06585fd6b3b22ef1cfcf0d226c3aad653f96b88d83c75a65bb249e389bc7bb

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\19346

MD5 7ccbdc62669ba9008e0edf2fa8111541
SHA1 20109ebe674f95b919d1800101792343e4c8f301
SHA256 6005bb5b08486669a92baf7601261ca3bd1cc7fd8b663c8bf6edfb0af7f92a16
SHA512 716c8b3d51167877403e7af325a51da9d2b3f5bdd16a28b0b3a4976a63e64f070af35a2694c5bba67d3fd21041ce169b08ea9672cf946ae760f2df6d0371e05b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\1560

MD5 0a58074af171fd0991036a11a6864f78
SHA1 0b397f113b62f91231241c48b9eb5b2200c0ca96
SHA256 b4de84d0f6d83b742988cb3303b921e47201312b3013cbb04f6268cf4d7def5e
SHA512 136b725fdea5dae2089f4821db5e4d37bfb9ac156b597a52d6c12a87ad2a54d4535a7588725afc979f3469b43528d4f0bffa951676554a1301f1aa9bd28ee1f0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\doomed\24643

MD5 0b950b6d11cdddc86fbdad57bfb8a2d2
SHA1 2788f693d172ecf8915797df9493c5b028e3b8ad
SHA256 a69e4c3ef4c678bacd32a9f68cd0dc19be1ba62a888aee8b07f8c2f6b01b303a
SHA512 5778bc80bb212f6db5e867337aa9745ca6d793453841ce2283772a0ac2dc6774df3c648bbb0590ad529306a632a29537fad609e9833a0bf21c28e0b95ea1c7fd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\4E364B755363CF6C68EB9C3D3D57279B5B420B68

MD5 2798e444c1fd4e996dd52c8b8a044651
SHA1 203dddf8e778eac3c168e548484c540cf72c540f
SHA256 e9b6917a56dc8bd893f81cd0d7be35ad7d2e4220fe0ea57ff9e196cf4868600d
SHA512 a6d62b2c0ea63b1753d81a1a7d7520ceba88664976c5f4596e44eeffa1e8705b48e040c38c9f8357abf68cd43b548a8ec89d429a9f8b5e732042bf09ee969417

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g2lldp8o.default-release\cache2\entries\772E596BCF03C6B7544F977140E8179CE4C05913

MD5 e02c5e02a0d0778a6d02cf0d946d074b
SHA1 f6d956d9b47b33347797a61d77ce9cfb601c2079
SHA256 6aaaeeeb5e42afec02f7e4e9d8cbbe24f81d8343c9043647bfb792c3f572e646
SHA512 1aa93cbc880363af561563d5f9e9471b6db9425f5769c1b3f9bc7eb3306abdf9a086a99c810bf37502409eb2b223f5646ad39696934e945be02bc764138db6c9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\sessionstore-backups\recovery.jsonlz4

MD5 e7b023b319f4661ab80defa570d42f49
SHA1 4ca57db2cb4ed85a45a572db2b9784660d2daaf7
SHA256 b97452fef6a9f55001de0648ab1c168351e7435a58da3a0d8a47b5440cde7d82
SHA512 84315e4619b72a1b136568b0cf1ca52ec24b80c63e4ee6a0216b63275062fdba4b6f92243d20d56135e9db70c845eafacac55e91910cd67174566fd7c6f99375

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a1f543f4f13a5db672029d2ece540ccc
SHA1 27b333e0307aa6fcb7aacd3bb93f6d18d9a6cdf2
SHA256 a4383e5e8ed46bdc04984aefbe74f0d6e00a9ab9f54cba66850c6138fd409e64
SHA512 9ea38e086bc8dcbb5cbfe618fe0d5b85233b47985d87cc8446e7e7d102b47a8cf5b4f94c3217f749893ce4122cf9089cf208eee96e6788eaa35cdf32b15250c4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5e67523acc23c63230869d1422c5a844
SHA1 31def5e60f5ce394acfb13a6a2be3a644ed5f81e
SHA256 4fbb6f91c8731299ab5f4dc8b71e3a0fa4a08832def2a7e461d9d2ed30f2626d
SHA512 6153e21e91621f31027b19a7f453bb41085b3258254f238b05b396d64eb35fd212ebf2a4df5908764e76db44f4c7522d225336f70ce913550cce1c9b2a8ce5ae

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\sessionstore-backups\recovery.jsonlz4

MD5 90c12ee64749d5f557af6be9ada2663e
SHA1 5afa389e4e21344cfe4b4e05a524b757cfd23689
SHA256 be3459f81ddcc2cab3b39e81a56ccbbc4daf49f54831df6fdcdce80d8a856a3f
SHA512 0f4dcd3edf03679ea4c796ddfbe372ba7c947a332de7bdb47ae1f8e6525ea413035c5e505a586b8bd75b80168c29f030a5b5338290c1f23da3cb1a03600f6b19

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\sessionstore.jsonlz4

MD5 0da7201d4594b58d12de55a06e4c4d13
SHA1 796fa5de00af87894298cd9258b6f3c46ad7ff51
SHA256 6c12d7b0d97f3ce02178ddcffb1105e6fbb62371ad4ebdf2e1e07aa3d778b9c9
SHA512 3d4a8e53925ba66fabf374403e4f309395f3d0cc8d0617f6c997955896fc9036bf27f3ac690fa5066f8266b6a98a3a7662b3948fb8411beac86dc598f13d3dd4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g2lldp8o.default-release\prefs.js

MD5 095367068c1a388bb49d6545e43f0a09
SHA1 74ce1c3fd4968f6c9eb7315bab32763621e1288a
SHA256 e4418663ca234969252a34375b1353eaf8f6665c365c09f58e78dcff0500ca24
SHA512 d575bdbd390524a40c2ae5518ecb61207b6d1967959ddd87e05232ab19c26a67193496757a1a229a6041ee306214cbdb595c1fed8aaba73772bb1563f226e18c

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 e0236413295e49948baeeb46d884acef
SHA1 c24f80184264ef596722c1a84b8dedde9bdad557
SHA256 11af5d1895a6e5952ebf08f72ad5121d828a5e2f8dc0656875d527e886ca54e8
SHA512 d99fd945c37dee141ea4e4f2e2460f482230bb679d8a63131348685a7dbebce074c9543161672fc525cd0c84d41d29e2ee78f6e3a7b8f7d18ca40eefcb95e5c6