locky | 90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674

Resubmissions

25-06-2024 11:46

240625-nxaffsxfme 10

25-06-2024 11:35

240625-nqbpyaxcke 10

24-06-2024 09:07

240624-k3smfaxgkq 3

Analysis

max time kernel
276s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe
Size

236KB
MD5

2fde1e85e1ead98a8c0e1ca7eda2a243
SHA1

4e195c7dc0d7bd995b81fc481dd300e966481201
SHA256

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674
SHA512

b56a5d33fd6f99d092e5a2b7d332c0632eb4354a1c64cfb66b4a9997e5f6e0fd9d019b775705e89fe94c26b41762e11ede9dda150fc19a857ca9e2cfc05b65b2
SSDEEP

6144:FXtIh3WC7HpTBJNDrSfdH/qiNMxsJSoR:FXtsPpTrhgdHChxsJN

Score

10^/10

locky ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HELP_instructions.bmp"	90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallpaperStyle = "0"	90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\TileWallpaper = "0"	90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	112	firefox.exe
Token: SeDebugPrivilege	112	firefox.exe
Token: SeDebugPrivilege	112	firefox.exe
Token: SeDebugPrivilege	112	firefox.exe
Token: SeDebugPrivilege	112	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

112 firefox.exe
112 firefox.exe
112 firefox.exe
112 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

112 firefox.exe
112 firefox.exe
112 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

112 firefox.exe

pid	process
112	firefox.exe
112	firefox.exe
112	firefox.exe
112	firefox.exe

pid	process
112	firefox.exe
112	firefox.exe
112	firefox.exe

pid	process
112	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 2340 wrote to memory of 112	2340	firefox.exe	firefox.exe
PID 112 wrote to memory of 4080	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 4080	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 2388	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 1004	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 1004	112	firefox.exe	firefox.exe
PID 112 wrote to memory of 1004	112	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe
"C:\Users\Admin\AppData\Local\Temp\90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_HELP_instructions.html
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe"
  2⤵
  PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.0.903723389\262858435" -parentBuildID 20221007134813 -prefsHandle 1832 -prefMapHandle 1812 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa550673-5caa-4199-b746-40e82a1321fa} 112 "\\.\pipe\gecko-crash-server-pipe.112" 1912 2cc87ff7d58 gpu
    3⤵
    PID:4080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.1.687664067\1386123659" -parentBuildID 20221007134813 -prefsHandle 2284 -prefMapHandle 2280 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c09b03a-aaca-4976-a787-c13bf5571fa4} 112 "\\.\pipe\gecko-crash-server-pipe.112" 2296 2cc87ee3558 socket
    3⤵
    PID:2388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.2.1656753072\1889599236" -childID 1 -isForBrowser -prefsHandle 3092 -prefMapHandle 3088 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a68f8be-29a6-4b54-94ef-5d2f5741dd68} 112 "\\.\pipe\gecko-crash-server-pipe.112" 3104 2cc8c08d558 tab
    3⤵
    PID:1004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.3.191776269\1676675351" -childID 2 -isForBrowser -prefsHandle 1284 -prefMapHandle 1288 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da9bedd8-eebd-4f6c-b270-998d99b8203f} 112 "\\.\pipe\gecko-crash-server-pipe.112" 1292 2cc8c0f5b58 tab
    3⤵
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.4.2135679445\1355592876" -childID 3 -isForBrowser -prefsHandle 3540 -prefMapHandle 3536 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54e56555-eba8-4f1d-a69e-aa2636982b6d} 112 "\\.\pipe\gecko-crash-server-pipe.112" 3000 2cc8a8b4558 tab
    3⤵
    PID:908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.5.1049552566\302442138" -childID 4 -isForBrowser -prefsHandle 4844 -prefMapHandle 4840 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e70c0e9a-680a-4896-873f-946df0eab4a9} 112 "\\.\pipe\gecko-crash-server-pipe.112" 4856 2cc8e817258 tab
    3⤵
    PID:60
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.6.496800550\461526225" -childID 5 -isForBrowser -prefsHandle 4996 -prefMapHandle 5000 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55399b32-b911-4994-a31d-ce87f891ab2a} 112 "\\.\pipe\gecko-crash-server-pipe.112" 5076 2cc8e818758 tab
    3⤵
    PID:3704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.7.1107455358\790573452" -childID 6 -isForBrowser -prefsHandle 5212 -prefMapHandle 5216 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f63dfa0c-494c-4999-aab1-a6d36ca1dfc9} 112 "\\.\pipe\gecko-crash-server-pipe.112" 5200 2cc8e817b58 tab
    3⤵
    PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.8.50096818\805559265" -childID 7 -isForBrowser -prefsHandle 5612 -prefMapHandle 5648 -prefsLen 27589 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4de84601-74bb-4dc0-a6f6-bd15ccc3306c} 112 "\\.\pipe\gecko-crash-server-pipe.112" 6008 2cc908f2458 tab
    3⤵
    PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4812 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
1⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4804 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
1⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3620 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=3836 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
1⤵
PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5236 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Filesize
13KB

MD5
1768b9e74fac64abdcb95fe54e9d3b26

SHA1
7bf27f6339a26b683c715ac4032312b81306a7c0

SHA256
7f643b48114c1e0f730d0c8e9eefaf096163bcb3818c9a1586405a02ab10b391

SHA512
1c757ede95df61fd3eaa5d0d0c9c26c1637e720648c7feb1a46125c48f452b8cd09326a8197aa656fb9e4184b7cd3569c7bf2cbcf6ad9cfef34d10de42284690

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\BC0DEF32A0157EF46FE3978BA10BDBC89D00D071

Filesize
213KB

MD5
ed8eed165f59dc4e70e59389b7ae0513

SHA1
dfb0374952fca498b2a1db0a378d5a79eab9f4dd

SHA256
ca077818f98acb1c6272cad0fc4d170fe5f23de19a713e7be32e49ddad31c592

SHA512
323fb93c0279a08f37d24b957cadfd6e3ddcc8a46ea409e0c4da248d5c19d6fa001d85f6460082aa274101d4aed967ebf5db6ec3087fff3f0d135f9d515a349e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
3KB

MD5
dfbf1539fac512b7a1834f133a8dd56f

SHA1
0ca842c1e4a6d359a5b577771fc16e9a9564ee50

SHA256
2c557405343b7b0592a469f5168de8c71234c7e728db917db55fde96eb6c4db6

SHA512
723b6a8f3ac6d83299da1b92f8614b741bb28c3d0ca8c994cc143903b1296f17f201e09700935f9e45e589067aa7b62fe6dedd1145257b85acfd653282b24709

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\97b71b1f-0225-4852-b13a-4d4a817a4453

Filesize
10KB

MD5
e34ee5c26893eaa21839bdbd54bc4f6e

SHA1
71329686bb26bcdebcbb6b945e1e2e6d7f21bde3

SHA256
855d25fa50d90849226ebbc256e8f819c23df50609e3c583a7d5ff2833a3ce20

SHA512
48e8cc6de169dd7c4434b9050b869cab101661c9558edcd30f5653d667cb35507d75249c73d68891aa7edf2d0393d88be988097e26fe8b627400cd19275e63b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\f1dd9127-32b4-4bad-9cf7-8360bb889be4

Filesize
746B

MD5
a87ed2f10a9cfb1422f0ad097ec8fcfd

SHA1
0e37b7ee31ee2996f11b19e4a9e7d7a4c647eac1

SHA256
9b99396829cd950265403806507a6f0b0ae90d58b1ac39e44f4788498faf45f8

SHA512
b068f353ce226be99e9217528016f56c683adb97efaece4883d9cbc51f125b4856a320a5c9902d92a89ae0ff6a3af1b29de1c031f1d7a2a8a9303edb9dafa0f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
8KB

MD5
c3d933f1d0a5a9ae26311d75b0cafb05

SHA1
469c9e7cbd5112f276141a6e899d86a90b1d8669

SHA256
d83f7f6938b6196b04f817cdb4ea3e14c947ba481e38d9354616cd53ce59767c

SHA512
f5a8724859ca1deaf6ed1694fef706f729718851683818427881f5416199ff1ee905c3ffd5100fc8e351b1fc93443b31b66f11d01228f81a1042f8b03cdaa410

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
aa009aed82784345a8ca3b5aa095f8d1

SHA1
16980d4b0f2b51b0e45fdd2fcff83106380c2756

SHA256
73925ac75f04e364bcff34e0cb97977f25d8418b4f53b96acede2f037a42d498

SHA512
c85f31f56389576378058c86b66649455242525421f0932f9a2052d0bd2cb779aec3f19c98109c10f042151a594ba236e6e281e6cb5ef8eddf93b0464edc09ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
5715c5f658a6f025c84e890f410810c9

SHA1
39e840b6de8d8a8065908299453efb5445e938aa

SHA256
21b906b94ba00077753942829b9e3aeead36158151f69a6f7ecd398d1afc6083

SHA512
f7e5d2545795500ad3e6ea38cfd5d6322619b91a5506cce6d42da92afcbe21cac2b2dd78d6eef4963242815b539d9c6d008eb8f42bba50fe2003a2e9e875b310

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
8d983c7d275a52d045d7b7e47d16cfa7

SHA1
9977c37f3dbf8aa7cfecf17a7d8aab44c09ecc2b

SHA256
91a3ae39e96e2222b6216c4b20b2812576052591d093c04ad4aa35281251e81b

SHA512
b348979b7704586ff26264a0313b56a6c2061ce0b7dfce72ee08563dfc6fdc7e1f16c03c7a00d1052c9529e9292c9812c03ff8f233324da89b0cc2e923abce6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
b87d6f8297d8844f7d0a5ae14ad42f97

SHA1
1af13093cd86dd70bf6357711a821fedbcc8dfb1

SHA256
b6cd92cf48c137d8b90d92d1bcfb051b209a65626c8d1e623db5fe4260a17953

SHA512
27dbdceca1a19b707467c7d9f6c79194cac91b7f7ac80fed07b3f1c6796e7d59640d646ebc3429ef2963565ee040fd332aa49d0c69e2c7597b2c9450d1304559

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
2807273649654a14008b0031828ab5b0

SHA1
611589a66a00750ff0b9cc27f6289746e2cf5cf4

SHA256
5d7975c86e3e2fcd131c25238b3a65bc69a351c704ebbf6a6c9731bcf7a14d30

SHA512
5d52fd2af8fff5198fa8a668e2a531ac35bb3e7f95bbf80079ba8d779a7cbc8e10e157ce256478f4704b0e03c8dc0b585b2c075591d36c03d5d7e90562e6695c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
96a4384ca882d24fd59f4f5849f7777a

SHA1
895f2736674882a3f5fbf14c2e286937b1b82815

SHA256
389f6932d779fd6898565c046e571ba1db6c93a39c678f9c7ea176e43427fb2d

SHA512
9b471e3b357fede932fa30a06f4c2c71286ae149b57c3fd2f168100070569f26fcccb5508a2963acccc0ea3f0ec15e1226bdf40b1b34571bbebe808b10c08b0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
1949a30c606824a5e0795afe9efe234f

SHA1
41391104a4bd01d25879e70455162c22c71e4c6d

SHA256
63c056e27368353e06aadb9472131fc253b96c00d1299370c7c50cda3e0781a9

SHA512
637179aeca7f06d1ce8ffef0d9f985bfa053b963742d51538cc80dff12a38b4c01229e176b4853eed908a058b575fe651f40da1b66b3f7919b024da70d3971a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
59ee9c13a650e7876828c0e79b54e0b2

SHA1
175bcfde375899d9cf4f28a794e237211825962b

SHA256
056dc9cd059c6658345b7d5ad0ce3cba8410d430406559bcd381e5c36cb80bd9

SHA512
ffb9cbb547f8eae1c7687427e093182bfe1d6e9196f0bcadcd316e038bca7abe76ae861b5b34d3a755f8c63a1a4fc716585818b8c98b03c987915198dd068bc4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
071638fbf4d6eb5e935dcfc14a561f8d

SHA1
c9a3a578ef24a1c7cbf73593d8c4ef12634ced67

SHA256
d87b0b85c9fbc958a4d4c84384e649102f46b8f0eab913ec329856d93d69a405

SHA512
3fadd6645e8b1a56166e5770ed4ef9c3234b26c7aaaaa83e6141b380588cc1c83019b8c9bc8e1767ecac1a9fd8b770d69919ebed2b1e23c77f52726d85211ea7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
592KB

MD5
7c7d5621a24ad43bf4c60a8545745dfc

SHA1
51f6662db31bac704d4ab22645991581ed8046c1

SHA256
da3ee6dd88774bc98f22bc4ace92dba6ef4191eccea24642316debf126548161

SHA512
12d3f181e2bd436a9979c17ee308ecb72cf9c631476245ec5fe4aa3124cdfc05150b6121f741a7c07a6f10d63a91bb210b387a0190976ddd63dd1f7c0d7cfcfa

Download Submit
C:\Users\Admin\Downloads\_4_HELP_instructions.html

Filesize
8KB

MD5
336d7dbf252794e2d9faf599c10552a1

SHA1
d5deedb9978ca1ae98104f34755642173aaabf5a

SHA256
6b8d0e78586a982cc6c14e076464e9b9e008e966fa9acaf2e8bce494b76f0aae

SHA512
985d31006849eb21c7cfa7c1e2acb7004204041852b161d336066fa7386974118a743bbaf2f5c8aad8e8ec0bb66be8302ab3d48e440bc089ad4f10fa2764859f

Download Submit
memory/4784-1-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/4784-2279-0x00000000022C0000-0x00000000022E6000-memory.dmp

Filesize
152KB

Download
memory/4784-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4784-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4784-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4784-0-0x000000000043B000-0x000000000043D000-memory.dmp

Filesize
8KB

Download
memory/4784-2278-0x00000000022C0000-0x00000000022E6000-memory.dmp

Filesize
152KB

Download
memory/4784-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4784-2280-0x00000000022C0000-0x00000000022E6000-memory.dmp

Filesize
152KB

Download
memory/4784-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4784-2558-0x00000000022C0000-0x00000000022E6000-memory.dmp

Filesize
152KB

Download
memory/4784-3-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4784-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4784-9-0x000000000043B000-0x000000000043D000-memory.dmp

Filesize
8KB

Download