20d67deb420501f22ab720556743178aa140ed506fb4ea71a61d1c0072f6d75c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/08/2024, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WindowsOptimizations-main.zip
Size

10KB
MD5

2cf74a81d37bc4ce8fa4c4bd63717485
SHA1

b262afde717bde5c130ea32d145483fd9a2beb73
SHA256

20d67deb420501f22ab720556743178aa140ed506fb4ea71a61d1c0072f6d75c
SHA512

2f1631a3881e564565f690dd76681feaf586843441fcbeb874d1720cdc625035ebad1e1e36e437cea79273e0698c3bc2c40eb9f5458d007f6265f9c2d8c964a0
SSDEEP

192:+Dz+PzKzKWXiz/sv1WzbshyzizOJT4UvDUjrz9RfWzaz7e0qxHzPGRz45rbVzeoH:+Dz+PzKzKWXiz/G1WzbqyzizOJT/EzKb

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	firefox.exe
Token: SeDebugPrivilege	3712	firefox.exe
Token: SeDebugPrivilege	2000	taskmgr.exe
Token: SeSystemProfilePrivilege	2000	taskmgr.exe
Token: SeCreateGlobalPrivilege	2000	taskmgr.exe
Token: 33	2000	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2000	taskmgr.exe
Token: 33	5448	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5448	AUDIODG.EXE
Token: SeDebugPrivilege	3712	firefox.exe
Token: SeDebugPrivilege	3712	firefox.exe
Token: SeDebugPrivilege	3712	firefox.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3712	firefox.exe
3712	firefox.exe
3712	firefox.exe
3712	firefox.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3712	firefox.exe
3712	firefox.exe
3712	firefox.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe
2000	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3712	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3188 wrote to memory of 3712	3188	firefox.exe	76
PID 3712 wrote to memory of 2116	3712	firefox.exe	77
PID 3712 wrote to memory of 2116	3712	firefox.exe	77
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 2188	3712	firefox.exe	78
PID 3712 wrote to memory of 4908	3712	firefox.exe	79
PID 3712 wrote to memory of 4908	3712	firefox.exe	79
PID 3712 wrote to memory of 4908	3712	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\WindowsOptimizations-main.zip
1⤵
PID:1976

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.0.47401033\638359422" -parentBuildID 20221007134813 -prefsHandle 1744 -prefMapHandle 1732 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {23d674de-292b-49f4-8ee2-e978f765beaa} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1824 23195017b58 gpu
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.1.216852362\561334892" -parentBuildID 20221007134813 -prefsHandle 2168 -prefMapHandle 2164 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebbd761e-f54e-4e4b-a7d6-d3c289ca21ea} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 2180 23188e6f558 socket
    3⤵
    PID:2188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.2.199330782\216061095" -childID 1 -isForBrowser -prefsHandle 2708 -prefMapHandle 2684 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b890c1b1-0817-4ee7-836d-b5b0adc27733} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 2948 23193e5e758 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.3.1579635007\1800443762" -childID 2 -isForBrowser -prefsHandle 3528 -prefMapHandle 3524 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac41aab3-f06b-4d30-a016-69bbad9b6da0} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 3536 2319669fe58 tab
    3⤵
    PID:4608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.4.456615413\1570640224" -childID 3 -isForBrowser -prefsHandle 4188 -prefMapHandle 4184 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79f96d72-94d8-4ecf-af7b-6f8368d70e43} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 4196 2319a0b9e58 tab
    3⤵
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.5.1413147447\311185551" -childID 4 -isForBrowser -prefsHandle 4964 -prefMapHandle 5032 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {902525ee-ff42-4502-93d5-a46a239a57d4} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 5076 2319a70d658 tab
    3⤵
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.6.1494330004\351506426" -childID 5 -isForBrowser -prefsHandle 4864 -prefMapHandle 4856 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b9883dc-6ba9-4c97-a36c-cbf1640960ec} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 4836 2319a70dc58 tab
    3⤵
    PID:2096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.7.205745376\1189743167" -childID 6 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0773cd78-ad68-429a-b68f-4b99f94c37d5} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 5248 2319a70eb58 tab
    3⤵
    PID:236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.8.497694797\1678186957" -childID 7 -isForBrowser -prefsHandle 3992 -prefMapHandle 2984 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45aed035-b5b6-4a36-9c5c-246b60f2ca6f} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 3984 2319a703558 tab
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.9.822276127\1414414087" -parentBuildID 20221007134813 -prefsHandle 5808 -prefMapHandle 5816 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3ee88e1-c017-478d-941b-00a3c9c01804} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 5824 2319bc73658 rdd
    3⤵
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.10.316365227\1131321160" -childID 8 -isForBrowser -prefsHandle 4312 -prefMapHandle 4224 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e3c1f59-0de7-4fd0-aae6-c08fac74ee38} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 4300 23199416058 tab
    3⤵
    PID:2200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.11.2054750600\317380365" -childID 9 -isForBrowser -prefsHandle 4396 -prefMapHandle 4228 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {014ce0e7-49db-4588-88cd-284b1500281f} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 5736 231982ccc58 tab
    3⤵
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.12.1093523549\1851300011" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5436 -prefMapHandle 5432 -prefsLen 26768 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09197b01-cae5-4f5e-809d-d552b45abe93} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 5428 2319d871858 utility
    3⤵
    PID:5632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3712.13.689145749\574795561" -childID 10 -isForBrowser -prefsHandle 6288 -prefMapHandle 6300 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af247132-f70a-4183-91ea-9c0af5edffba} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 6284 2319da84258 tab
    3⤵
    PID:5876

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2000

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\doomed\11320

Filesize
8KB

MD5
d80d68a34a4efc8addf6a168d5717c40

SHA1
14331e58e691cb187cc469f51df4fb461d363933

SHA256
815d875b5ff6c06aca8aae8d62add38b3544e99082f35553afcb640bd6c22a7b

SHA512
ace30eec11387bf2d1efeac03acfe4a86f6f3a9c60cfb3dc9b2b7f6ec608420d124ed3cd77073090b6e77ec67fdaee43642ab3fa9436a6d7623b4fdd8b9cc46a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\doomed\1812

Filesize
7KB

MD5
bd00e35ad95739d08985d50224da2a87

SHA1
36b05de593d0a6c7c252bcb92da5f06db0c2228f

SHA256
3faeddec59c4cd002d1ae882b544fc75566b1fc0b2a6831b3a40d967a2556bf7

SHA512
63512d177f61f409f30a4fc6e6e5366a607cbbc14b027ad68075bb5d2228ef46a86ded87c464bcf5be1f1d6a0dfd7e90d81dbe4dfa991f5c8aea3ae0cacffde4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cache2\doomed\32065

Filesize
8KB

MD5
f8a72b9d8267302d95f30b221cf9f95a

SHA1
85ec3e799c3cfe43ebfb1e7317329e06d44bec6d

SHA256
d51024311bbe51f82716ab104674706950ac453dd9273a10c8e73d61acdbdea7

SHA512
ca8f8e310e41284b164da031cbc485c04e628181d959c65b3a4176d9148ac9e69fe32a5e940ac4299d001c48aed846a5697ba469bdee281af8021307cb16622f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
1c2922302ed4b754a2dc7809103a6cdc

SHA1
f863a96991c4009ff75663cb3233f2d06b1c0a18

SHA256
a1879e3de8a2a856565e7443b526ea1b3d8147f01501db2251676a29daa2d100

SHA512
b51fd38075d403f4382ac7c4be2d8ae2710507184b7e97d723fbbc6e7c56b848ea95391194159412cbc92bcc8422f5292d9d5ac62e4d627a6343fb4198c4fa78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\2fc7e05e-f50c-4f51-945e-8410d24e58f4

Filesize
10KB

MD5
f67ab52a44580a1f7f0d09e25e2dd1bf

SHA1
24a69d2cd2c85052691de1de67d50434717c54d3

SHA256
967a5e100a8043d9047f364159a37bf2a86b5d664abc28c18aa3544449eca866

SHA512
70c276f0f475f4ae30273755c2b99e4d65fd427b35d06d9cf2d593b6d28af93824d60b5b4e70b567cc75778c2e9fe5ad3f5b7e324044e73d1f186815a0d3edbf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\a2e40dc7-0c81-4c3a-b6e1-8b8780abb206

Filesize
746B

MD5
7e95d23b35c51845ba25577f4cec726a

SHA1
ff958d6eba40eeecdf7a030ee2e125ea10e39586

SHA256
66433696f85061c32874d866537ee439692e990ff3c9a30750216e7453184b71

SHA512
26f662f33e6495eb06f39e7b3b152e7d80e43c632a998d9054079eda07b0abb665d7f7074d5bfac1a6789edad5f1b1b1da006f1027e5986b105b3437ea9c5ac4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
8d546eb742dd76ff4b1dd29c25c3f8ad

SHA1
a7e4d3b6d9991b21f1286255cae6682f2aa56030

SHA256
659eac0b7b461ce41ef58f2f374f10dedd343458f36db783edd17fb5830d051a

SHA512
f09611f2cea4e8c04bbf648573dffac9e8c28aba0031597934c660921658f172da3ae11e859ada1f536e391c5fd78a30f7c49828d6c6ed87c602990c702f0144

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
1e55601c83fbbfe4fa02d612f601a5f9

SHA1
06c3c91826c6b9f2b3f3d9fc88d533b8cd1c74bc

SHA256
a382b84bb9ac5a4ee24829def3eb460bd32511e84a7fe5dc25165c53a98fdc12

SHA512
a0de043d4384a75abea7ccd5d205ec4a0029e022185099cd2d8edede09d2f4d88ed0120af61f9b725bfcd9887494c6830cbf51816564e2e1b8385fa7fd086c92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js

Filesize
6KB

MD5
191e05502c5adbe1fbc7b94fb2a11f80

SHA1
e49b7cc3c4f06eb27be4accee913c90802ecb727

SHA256
b13041c44228e20c0eebd326e9895748f86ea350e48c719f4deb6e41769e8e01

SHA512
14e44000b8da6936a65e6237da3876372571a28f6878d8dfeeccc9b2ebe7b3550aa65c3b44b4ba4dd179d6ebc3134633189689f14e74f3faaaf51a549eb8d3f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2203c3d7341d2b90c561cb8805d48ea6

SHA1
f08e5330347dc307664d988d4136b3b19bcdbed7

SHA256
77b92bcc018470eef3ec55506875c0b8a898d95bffe9191fe85d01d12c028d10

SHA512
881396e9c5d9e22c8312c6b848ea87888a5b8366bae82e9b64a24ce44318758df95ad034e76d5eb492aef07d3e0ee753abe3e6a378812a76d502e9962de11144

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
3d2170503be72dedca9ca018d1acd4b6

SHA1
aa3d71a6cfc178f68cd1705c697f43cc3251b4a0

SHA256
76f4522c9209cc50769cb46ea8f2d40346a08fd619aca6bf458001ec40314fe6

SHA512
1d62a5de5b1931512722443d283047724e8be43c4f80419035bdae020d44abf1e3cd3c0f67f1c7a80661be8ae8d89ddfd552d3c2d54cccd84f8797e1eac0522d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ba6a23df99d6ed412d4a6407408b8956

SHA1
bb2a785f0a7982c503991f5ca4e0c6407eeb8f4d

SHA256
fb61ace9395bb49459d2a982054675050937a437eaac3076d86b0e6d3747e5ba

SHA512
917f8b7fc55b26582dd34ffae648eda42aff12ef6538b2f0263d201af4dafb79d0d27985d688e081a942fa774f80e0092420916e5578e647e55e18e5ce92fb85

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
e633b542ecd59e3cf8dfe28d79691a7f

SHA1
72db5c446f9cda302eae3a9dec36e1d0ac970fae

SHA256
28dcd4d616c15400aec851456b3aaacaea2652e15fd9a4b15805aaef776658cd

SHA512
ccccf5642c5608a2650d45886ea38ba77bb6acfeb7f3537374463fde5a6b21f978fb1b56523e3468ccba8ee05ab5a29571b3566dcee4e693a4f555d65e379b48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
516b4613347a47e1867ac41e2b1120b7

SHA1
35e8029e286e47f3877f08effdc9e5cacbea1870

SHA256
f638da605dfca3ceed4d5510b80847fd71d3911406c80eda6de24cca60ed8a31

SHA512
f8c0ee4aadfd948d348ac15bcb2141c2f3aa76240606f36ee1cdcaa8e0f839a380a748debd4a46513caaf153be0230052dd987c412749a757ff8831216d26582

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\default\https+++www.pornhub.com\cache\morgue\101\{4ea72b0e-6e58-4810-bcfd-7cc0bbd87d65}.final

Filesize
456B

MD5
4849126d62348e96de9f534891ee372c

SHA1
04208116ad7cb0edcb2c7c754042554104172d10

SHA256
92930e52c17a5e42a09f648d090ba0e48384fe2b6f4f6b3e3fc70bd8a0e6ac5d

SHA512
bd7769637a8707a21027e442faf6911019a2c731bff17fc11b9da0b74490162ea4eba2fca41942a7c114cc75ab1941f208c1fcc789bdc0a594b5ed269f6e6f25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\default\https+++www.pornhub.com\cache\morgue\248\{e19c3652-c5f0-4df6-8cd0-14b7013aa7f8}.final

Filesize
1KB

MD5
932479fe19d996a5e8f139bf51085149

SHA1
da374dfebb658802ee62fc8ec320c3442fc93192

SHA256
c57de29d8406c0e2534d96c4c23199b127d8ee9bb86dce5230bf8157894b4f84

SHA512
ddbc216c01474d8ccc4f73fc78d228e68600b2bc148cdf3b7d12108b9fbdce3f2c91fdddce4841e669b1a2a609a8fae927e2a551efd11877e6513f7849edc05a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
3018d1aad8385b734068dbad441e344e

SHA1
2a3925bc92ec843db64b6db2cd6fe18ccf084a86

SHA256
f33415b0b1fc8c7e52356318d44aef1ae6bd9c64a89afa012d43a01a79954f88

SHA512
7ab1a1115a4f7ac61ba41bfe5875792cfa84d81f14f71239e43848de5940bfa07e2e34ea4be85a61c091d0b4b7742f3f55961fd26734b528cdb2c0b4d169c5e0

Download Submit