48334de0444dd96926c17691c1e0ff236c09d347efacd5722855688f70983d4d

Analysis

max time kernel
138s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cstealer.pyc
Size

75KB
MD5

44d80709f492610a377eafff857aa413
SHA1

91e53c38437797bd7e0ae5bb45a3e03144c4ec21
SHA256

2312b7c1b6704e66d44d44971fed7492d2fa9655009e3cc00c6a7a79e59d8c53
SHA512

b3b42555de7648aa4a1d6dfc94ae0503964913af7baa9528b623e5f9991a560734d43b9c88608a3cca5f13c507debfd4711951230d2932933d981b7c0b31f0d0
SSDEEP

1536:DvIiOtbI3vkwsJlYaa2Is8qRai+jjV6P4grrRheEX:DvQ29t2Is8HdgP4grrRnX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\pyc_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\敲dse납튏㫿耀叠㡡ƥ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\叠㡡ƥ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\pyc_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\.pyc	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\pyc_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\pyc_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\㡡ƥ\ = "pyc_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\敲dse납튏㫿耀叠㡡ƥ\ = "pyc_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\叠㡡ƥ\ = "pyc_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\㡡ƥ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\pyc_auto_file\shell\open	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
60	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2340	firefox.exe
Token: SeDebugPrivilege	2340	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
60	OpenWith.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe
2340	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 1384	60	OpenWith.exe	88
PID 60 wrote to memory of 1384	60	OpenWith.exe	88
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 1384 wrote to memory of 2340	1384	firefox.exe	90
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 4124	2340	firefox.exe	91
PID 2340 wrote to memory of 632	2340	firefox.exe	93
PID 2340 wrote to memory of 632	2340	firefox.exe	93
PID 2340 wrote to memory of 632	2340	firefox.exe	93
PID 2340 wrote to memory of 632	2340	firefox.exe	93
PID 2340 wrote to memory of 632	2340	firefox.exe	93
PID 2340 wrote to memory of 632	2340	firefox.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
1⤵
- Modifies registry class
PID:4500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\cstealer.pyc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\cstealer.pyc
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 25755 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {263665be-0bb8-441e-a4cf-0279c08017e2} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" gpu
      4⤵
      PID:4124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2328 -prefsLen 26675 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6eb6bd7-df4b-432e-ac4c-1023e6227350} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" socket
      4⤵
      PID:632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3324 -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3296 -prefsLen 26816 -prefMapSize 244658 -jsInitHandle 960 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8231007-a1a0-44a8-b8b0-0deef646215b} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" tab
      4⤵
      PID:3612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3176 -childID 2 -isForBrowser -prefsHandle 3700 -prefMapHandle 2660 -prefsLen 31165 -prefMapSize 244658 -jsInitHandle 960 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04d61890-77a0-4a5e-9a5e-bc01ccf0f639} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" tab
      4⤵
      PID:1176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5100 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5000 -prefMapHandle 5012 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d97a194-ea89-4aed-bc65-a45e1955886f} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" utility
      4⤵
      Checks processor information in registry
      PID:5132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5332 -prefMapHandle 5336 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 960 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfd95e43-8462-4a16-bcae-cba0124d1708} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" tab
      4⤵
      PID:5452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 4 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 960 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79b66f2a-96a7-42b9-ad34-4cad24a73371} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" tab
      4⤵
      PID:5464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 5 -isForBrowser -prefsHandle 5668 -prefMapHandle 5672 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 960 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82cf8afb-1ab9-4e70-a082-251fe5560dd9} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" tab
      4⤵
      PID:5476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\cstealer.pyc"
1⤵
PID:5860
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\cstealer.pyc
  2⤵
  - Checks processor information in registry
  PID:5876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zirruo9e.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
a8a8580b712420a1ae2ac968e65f085b

SHA1
2776b20f877f376a59191d92433d23dae1437dba

SHA256
ee2542957d75f66a8c47f3102a3afe414d49067f0dbbc9fa11928e5c7aa8628a

SHA512
0b380e7cf44f85650d2f657b1bb4a4b6eb592139819315650f9a46c6b3adedc3e90ff5020581106c6a7039306b578b38d8f1b87988512d84e70e9571ee4b2b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\AlternateServices.bin

Filesize
8KB

MD5
9ced19ff6abc765eb7d7367943029854

SHA1
8369f4311ec18763dc6ae96f3ec166755ea2489d

SHA256
cdbf3a88566ede978dc984f093a8260cf992501b306d936ff17ebf16d73d790b

SHA512
a37b965905645daf54c27e49fd55f039dea146984f632f352d41b5ca31d8cecaeec848ee6b4660a651f6bae8687a5a991744ba35358fb5b1457b2b615fc85e4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
d906a25f1803e0344d2c6c724086b958

SHA1
b7344afec2ae67956388f7c45448870c34552a18

SHA256
bde873b0c4abf6f2d91ef4808fdd933f0fbd7fa2da94e04566e8fee0ea1c101d

SHA512
01853b46771a66855ae032926666f4caab2bf96a07e50e52c1ad3e3ff0f9b8dea01a4f3baa2710ed818d608f0d7e153b46d60c0933545bb556d575bc1c635251

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
2728c6696f8ca1c2e93871fd995cda01

SHA1
7c7cba260bfea62238f334477c6002d6df934cb5

SHA256
6d29b692b5023ba7999f9cea93c35394ef19fe339f2965eb15c339643f2add89

SHA512
2cdbb568ddb225d7e4367b3442e45c31401ebc4dbc5fda53e467c035a86f707a269e6c6306aaccf096ebaeaf27efb87f4eb9143022b9e9d692cfcc909a1f6548

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
02caf1463e5a1a1e9f6158b4d249680c

SHA1
22dcf57ef3f5530ecc3c819de9bcb5e0485e9c1f

SHA256
1a41ccf52bbbbd19bc15f1be393c56cfd916c7eada59e2314124105138a9e133

SHA512
64c324fee5dfce765bf5cd6814b5d9af750af839690f7b6cdf7e1222f506327cf27cd988d5cfeccf68070d428eb687807112c8ba8ec1500c912213c0d93fcc2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
ec7ac05dc87d6726ef00ff327e674e49

SHA1
08ef5f2329776431586139ba82f9aec9bd2475e2

SHA256
a5d1db7b017d0d22761bfa996bbb4e26b4ea5b5cefc9fcf048659ae085a58bf6

SHA512
d751f00672b2f3a4156f8375f068ff1b419be2e3f9c7a7763d8ba97ca700699c2a861f2d96614598b0c632d84661233db00f032f42c3f8d975026ff625e86a02

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\39869fc9-62d1-4fe7-99e3-5a44cff6935c

Filesize
26KB

MD5
e13c2ea876ef2ffc9e5029f6a4c65a73

SHA1
6cb7de898e8019c7ae0553f24c0fa8133a336e1f

SHA256
56251f6f5e11710c113c9bc4a96e0fd454a6b04deb8bcdcde175f0cd20f1d507

SHA512
15cac6c15cba27b2375af3fbd56a018356e14950112a22a28478b6a2668b71a2f3e7f364c3eb9e2b4986f97c8c7dd67d4855ae336fb7a04e33d51bd10fb0914a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\be16b1b5-60a1-45ab-9d2a-d5d48ee311b4

Filesize
982B

MD5
224247d27535a716c40e0bd5975e388d

SHA1
45f40a81ed80156288793151a15b548b69583357

SHA256
2d1035d493b3dfdaa57199556262c6efcb6048c7a2bd587dc913fb248520fe4d

SHA512
1cfbfec03ee2e45438572da15cc0a781bb9213cb88da4c0846ddf86f8f107605957ad456f97592d5b2360294215d40d0afa587f28a2ef9392839dbccfe605245

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\datareporting\glean\pending_pings\e036496b-42e3-4de1-9f0d-13396258b408

Filesize
671B

MD5
58ef48a38a445fc72b389a3bf5d13a0f

SHA1
3969945ef5df270434e273ed83c6b366750ba69b

SHA256
29b9c7427920b28bd5c987f6b1edf102d7ca009f892428059c048b2ef564fcfd

SHA512
58259dd3a9d7bd212dac3a1e5c2613e0da09425a2d007aa96cffb2fed2da008c2c6f3c1580a1c74686b41b6b014721260f84e14054b63e794896cb294c4ff93d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\prefs-1.js

Filesize
12KB

MD5
492a34c22b4c027a08bf307995145481

SHA1
b85c6095d6961c8ae7c0ab3f0a1c7238fe919cbd

SHA256
2459d8b83dccc2e10941b79a2a5a083fb57c361fc205d196d0b7ff6548805f0a

SHA512
fbddd9e2b58a81f6bbdca759c62a2ea35e29e568ae8132d768347d1fd53fb96b8cba45b0150d30a10886f603278f7dd6098fd60290aedb70dc176a0cb9629acd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zirruo9e.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
17ba153e2e67c6bb586050fb9c520091

SHA1
c7ff4bedfefc629e59845b1a9ea9cf8bbe0676e4

SHA256
a03411c79076ce4133005dc5b879cf491589e983933b356be839a01fd499734c

SHA512
48e6e59a533cfb714587e0b34123adc76af0e10854bd457e5817895158600f6257dc1d1045d50e60aabe45d6f90aee19a6e2cfaa96a6abb1753b00f841c5d479

Download Submit
C:\Users\Admin\Downloads\KWuA2Mp6.pyc.part

Filesize
75KB

MD5
44d80709f492610a377eafff857aa413

SHA1
91e53c38437797bd7e0ae5bb45a3e03144c4ec21

SHA256
2312b7c1b6704e66d44d44971fed7492d2fa9655009e3cc00c6a7a79e59d8c53

SHA512
b3b42555de7648aa4a1d6dfc94ae0503964913af7baa9528b623e5f9991a560734d43b9c88608a3cca5f13c507debfd4711951230d2932933d981b7c0b31f0d0

Download Submit