Malware Analysis Report

2024-10-19 11:22

Sample ID 240808-ve58qszejh
Target https://lnky.ru/sd0dr
Tags
steam credential_access discovery phishing stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://lnky.ru/sd0dr was found to be: Known bad.

Malicious Activity Summary

steam credential_access discovery phishing stealer

Credentials from Password Stores: Credentials from Web Browsers

Detected potential entity reuse from brand steam.

Browser Information Discovery

Checks processor information in registry

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-08 16:55

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-08 16:55

Reported

2024-08-08 17:25

Platform

win10v2004-20240802-en

Max time kernel

1661s

Max time network

1503s

Command Line

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://lnky.ru/sd0dr"

Signatures

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Detected potential entity reuse from brand steam.

phishing steam

Browser Information Discovery

discovery

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1320 wrote to memory of 3740 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 1880 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3740 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://lnky.ru/sd0dr"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://lnky.ru/sd0dr

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 1936 -prefMapHandle 1928 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59155a6b-53c9-4fe5-b865-1c5c80f79ab0} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fc10e39-54f8-40f9-bd57-683e4b4cb569} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3104 -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3092 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {060e079b-f987-4ac7-a086-66cf0cf9640f} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2584 -childID 2 -isForBrowser -prefsHandle 2736 -prefMapHandle 3592 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e42aaa6b-6c7a-4fde-8333-6954674cd63e} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4512 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 1548 -prefMapHandle 4344 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5957ac74-509c-4e86-84b3-e8501e99f822} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5344 -childID 3 -isForBrowser -prefsHandle 5336 -prefMapHandle 5296 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8c86e2d-491b-4a1a-8f76-70efa0e3ea5c} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5496 -childID 4 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52144a84-86ed-413e-af26-65444cde23c9} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5728 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee006b9f-2ed3-48ac-b166-ad17cb6c04bc} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5760 -childID 6 -isForBrowser -prefsHandle 3188 -prefMapHandle 3140 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab6ef0dc-cc25-4178-81a9-ac5fb7d76944} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3188 -parentBuildID 20240401114208 -prefsHandle 3156 -prefMapHandle 6036 -prefsLen 29278 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ead29a17-4b60-4b35-8029-9eeb0d02dba5} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6064 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6076 -prefMapHandle 6056 -prefsLen 29278 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1587ae39-6400-4145-94da-c0502bac519b} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4628 -childID 7 -isForBrowser -prefsHandle 3788 -prefMapHandle 5172 -prefsLen 28006 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83ce5661-4c7c-40fc-8d2c-a4445c5a6cd6} 3740 "\\.\pipe\gecko-crash-server-pipe.3740" tab

Network

Country Destination Domain Proto
N/A 127.0.0.1:60715 tcp
US 8.8.8.8:53 lnky.ru udp
US 172.67.182.224:443 lnky.ru tcp
US 8.8.8.8:53 lnky.ru udp
US 172.67.182.224:443 lnky.ru tcp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 lnky.ru udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 224.182.67.172.in-addr.arpa udp
US 172.67.182.224:443 lnky.ru udp
US 8.8.8.8:53 steamcommuntly.com udp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
US 34.149.97.1:443 firefox-api-proxy.cdn.mozilla.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 steamcommuntly.com udp
DE 147.45.47.40:443 steamcommuntly.com tcp
US 8.8.8.8:53 steamcommuntly.com udp
DE 147.45.47.40:443 steamcommuntly.com udp
US 8.8.8.8:53 steamcommunity.com udp
GB 2.22.99.85:443 steamcommunity.com tcp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
GB 2.18.190.77:443 store.akamai.steamstatic.com tcp
GB 2.18.190.77:443 store.akamai.steamstatic.com tcp
GB 2.18.190.77:443 store.akamai.steamstatic.com tcp
GB 2.18.190.77:443 store.akamai.steamstatic.com tcp
GB 2.18.190.77:443 store.akamai.steamstatic.com tcp
GB 2.18.190.77:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
US 8.8.8.8:53 cdn.akamai.steamstatic.com udp
US 8.8.8.8:53 shared.akamai.steamstatic.com udp
GB 2.18.190.74:443 cdn.akamai.steamstatic.com tcp
GB 2.18.190.77:443 shared.akamai.steamstatic.com tcp
US 8.8.8.8:53 cdn.akamai.steamstatic.com udp
US 8.8.8.8:53 a1949.dscb.akamai.net udp
GB 2.18.190.77:443 a1949.dscb.akamai.net tcp
US 8.8.8.8:53 cdn.akamai.steamstatic.com udp
US 8.8.8.8:53 a1949.dscb.akamai.net udp
US 8.8.8.8:53 161.99.165.35.in-addr.arpa udp
US 8.8.8.8:53 1.97.149.34.in-addr.arpa udp
US 8.8.8.8:53 40.47.45.147.in-addr.arpa udp
US 8.8.8.8:53 85.99.22.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 74.190.18.2.in-addr.arpa udp
GB 2.18.190.77:443 a1949.dscb.akamai.net tcp
GB 2.18.190.77:443 a1949.dscb.akamai.net tcp
GB 2.18.190.77:443 a1949.dscb.akamai.net tcp
GB 2.18.190.77:443 a1949.dscb.akamai.net tcp
US 8.8.8.8:53 store.steampowered.com udp
GB 95.100.245.51:443 store.steampowered.com tcp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 clan.akamai.steamstatic.com udp
US 8.8.8.8:53 51.245.100.95.in-addr.arpa udp
GB 2.18.190.72:443 clan.akamai.steamstatic.com tcp
US 8.8.8.8:53 clan.akamai.steamstatic.com udp
US 8.8.8.8:53 clan.akamai.steamstatic.com udp
US 8.8.8.8:53 72.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
N/A 127.0.0.1:60722 tcp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
US 8.8.8.8:53 shared.akamai.steamstatic.com udp
GB 2.20.12.73:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
GB 2.22.99.85:443 steamcommunity.com tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 2.20.12.78:443 shared.akamai.steamstatic.com tcp
US 8.8.8.8:53 a1949.dscb.akamai.net udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
US 8.8.8.8:53 a1949.dscb.akamai.net udp
GB 95.100.245.51:443 store.steampowered.com tcp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.129.229:443 cdn.jsdelivr.net tcp
US 151.101.129.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 store.steampowered.com udp
US 151.101.129.229:443 jsdelivr.map.fastly.net udp
US 8.8.8.8:53 fonts.cdnfonts.com udp
US 104.21.72.124:443 fonts.cdnfonts.com tcp
US 8.8.8.8:53 fonts.cdnfonts.com udp
US 8.8.8.8:53 fonts.cdnfonts.com udp
US 104.21.72.124:443 fonts.cdnfonts.com udp
US 104.21.72.124:443 fonts.cdnfonts.com udp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
US 104.18.8.10:443 community.cloudflare.steamstatic.com tcp
US 104.18.8.10:443 community.cloudflare.steamstatic.com tcp
US 104.18.8.10:443 community.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
US 8.8.8.8:53 73.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 78.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 229.129.101.151.in-addr.arpa udp
US 8.8.8.8:53 124.72.21.104.in-addr.arpa udp
US 8.8.8.8:53 10.8.18.104.in-addr.arpa udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 location.services.mozilla.com udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 35.190.72.216:443 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 216.72.190.35.in-addr.arpa udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 88.221.134.209:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
NL 142.250.179.174:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
NL 142.250.179.174:443 redirector.gvt1.com udp
US 8.8.8.8:53 r4---sn-4g5e6nsd.gvt1.com udp
DE 173.194.187.41:443 r4---sn-4g5e6nsd.gvt1.com tcp
US 8.8.8.8:53 r4.sn-4g5e6nsd.gvt1.com udp
US 8.8.8.8:53 r4.sn-4g5e6nsd.gvt1.com udp
DE 173.194.187.41:443 r4.sn-4g5e6nsd.gvt1.com udp
US 8.8.8.8:53 209.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 41.187.194.173.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
GB 2.16.233.104:443 store.steampowered.com tcp
US 8.8.8.8:53 store.steampowered.com udp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 cdn.akamai.steamstatic.com udp
GB 2.20.12.78:443 a1949.dscb.akamai.net tcp
GB 2.20.12.78:443 a1949.dscb.akamai.net tcp
GB 2.20.12.78:443 a1949.dscb.akamai.net tcp
GB 2.20.12.78:443 a1949.dscb.akamai.net tcp
GB 2.20.12.78:443 a1949.dscb.akamai.net tcp
GB 2.20.12.78:443 a1949.dscb.akamai.net tcp
US 8.8.8.8:53 cdn.akamai.steamstatic.com udp
US 8.8.8.8:53 cdn.akamai.steamstatic.com udp
GB 2.20.12.96:443 cdn.akamai.steamstatic.com tcp
GB 2.20.12.96:443 cdn.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 104.233.16.2.in-addr.arpa udp
US 8.8.8.8:53 96.12.20.2.in-addr.arpa udp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.20.12.73:443 community.akamai.steamstatic.com tcp
GB 2.16.233.104:443 store.steampowered.com tcp
GB 2.16.233.104:443 store.steampowered.com tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp

Files

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\activity-stream.discovery_stream.json.tmp

MD5 53bf275a8af58771b94b91622f941367
SHA1 2422ef2ca62bcb2fea486878727bec01a17c2bc2
SHA256 cdafc82210c82f51a345af69687f458b4a1dd3b31f72060116208d060db6baf6
SHA512 c086d55d4b2daec5b538b770d81013e51f2ee280a2699d55906a9840ac75ae505cbff4e3823ddd94e6748ec4075104235221b4dd5e1425787ef35c25dae8032a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\fa11c908-4ef8-43a3-be63-8a455e88582e

MD5 5a2417373515c95a29bbf253a6544466
SHA1 32f3aa4cac48d2a3d8387ad636f768d7bcc86dda
SHA256 d23e8b9a778d362dfa86dadfe9bf34df263c1fd07d0e85c84447a585b4d633a6
SHA512 5868bec2ecf68074bf365998e0ba183de5ef691267c4b6f77d99cdb38f9dedcadaeb961c82c0de8c80d0f4baa8965fde41d1aa6161f8c7c8b9170a5584c98de7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\0b00ac54-4eb8-4860-b468-17819a0fac19

MD5 7c0e9d297c4b3fb3b9fa3f9b491957ba
SHA1 e3ffcee823d826981259cad01ac0e75fcc3946a2
SHA256 82f10f51126a4003f22435ab3709039119e9ac133d79d1c9369b02f490b6c6c2
SHA512 6293d6b108385c40ce5ddc1f76bd0f8ec07b33d7eaf697b8fa3e69c3f4b31533a91e4ae2b6222ca40d9ba0aae195de74db651d92759f98621431113ee272d307

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\96795047-9b11-4cb7-9308-517d8a8b8456

MD5 bfe131bea3c77264ea6f92e200895f91
SHA1 0e363223e777363fab0c39c720ce3c79078dc9bb
SHA256 4a52071b42a792e34b0a6daf8cce36fdf0dd446d102ae2b87edb9de981409e53
SHA512 a3df33dca569e0de233d3e095587f3ec78307bce064af43c61a389cf4ea137a91e9a271aec77755b3f5d06cf4ba307060159e06706e1ecefb2cb2add94d29a2e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

MD5 8853a387120c1c078f99149c1d4b79ab
SHA1 9e20b7ca10e9d3ec0a62dda2d745d6874ea6f910
SHA256 c432eedf123a1db7b7775e46248d59c6ba6f84c73a6c92fc8ca7fa7c1e556ac9
SHA512 b8b5f0c03d14301cee7cfb1f87a06289da83ae0ece6af1aeb06687c310e4ab67d1150da4897702a59df2bb1ad7203292f865b3394125dec26753acd818db41db

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

MD5 58936191fad6a8711bf4fcaad986c2a4
SHA1 29abe74424b0a90a583874d9cca1db7ea4c9a337
SHA256 503b136d505119bd05435731ba8b16707d4ba7294fd7c262b74c11ce1e915a0d
SHA512 1091bf903e7887280a66b3aa873950e4c98349695438cae05df8817c9f1d75f9fdc701c378cecea58b2a35d9efa094cf4f00b4465304272c624579446ca40f78

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

MD5 9096f4e214ae9a8aac61d6512f95cccb
SHA1 9690c4f92c8b440605bfb855790318fa681894f4
SHA256 2b3ec38402cacf203fe1bb2f621334b029902a6f446654354cf57a886c43841e
SHA512 9519d814b23f3210f358a500cf6fca233fa35a098824230eb5067f48f791d787c7e8a61f40eb51ba8391bcb7ddbe2daa667259d7e003d3aa732e71d2814210ba

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

MD5 299f7fba64839867aac78a89f27e0d25
SHA1 a05d936e74a1f1ef822c05f2b2f90ec50478e58a
SHA256 653eae65c1463022d91d18dc61c1d7072200c4e30ff7ade94ad45589637f9b6b
SHA512 ece171cee8f8cbf52075401b7466238a687f726e05a19a1a81c234b7d6cbdee8f2c49b4039d10d8fb822e60a932f7cd9b696f9b21200d7d770cae94e815ed696

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

MD5 22b000eb012b38cbdd87e9da242a5ee0
SHA1 dbb3720b844327e97c329595a41651213312da8e
SHA256 de659bdadb74398e63ad7c565251156e5ffce6ca8c9786e52c909350963ddc5a
SHA512 ab96dbcb6a1ccf4c4bad850279f6514feed843f142980481b331243d8d3a8c616b185eec4d2d48abbbea167f64bcc5f371597b98dcc5e4bc6d8f657a4017a17d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

MD5 66f7886bb85aac926bcd39eb8f5064e4
SHA1 bdd9d02c9209b8b36469dd4e41c0e54c843b3624
SHA256 e7dec6adffb4dfcbd1f0fffac99e2fac1de3ec442b68ebe39e8d1f39247cda7d
SHA512 ccfa4279082de3b130fd56ea53168bfefb9c3f3d3200b613629ffba90540d79a8d418291abf2c0fc51d3922d017961082fadf220769d96a13cc8046437555a22

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

MD5 e88b3d15c1f09ab0fda37dd37b0557f9
SHA1 489941be5d1f61c5e8465e319871008a4f0b4035
SHA256 4b37c1e0fc8a4a125ff3ef2beec9c9997159ff6459784e2e4684550ea6a2b616
SHA512 34ef51100baaf912dbe081ae801ccd4df74f1ed14ab8a987ab9ad7f0e87cd290d42bf271131f4b3a76749e8517b18dd61a5535d959c7a72c5680d2cfe6e92381

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

MD5 3132f0457d6277dedf6ae018544191bc
SHA1 505f9eb9b11a259e08887e353f94147b025c8003
SHA256 75ca9910bef55d6d08854b90f947d8fee8630d38aee90ad3f165a99bd819ea8f
SHA512 6fec6f9493b7f584e4dd49293df99a19afb1287cf813735d40c0dafa387de2332ee764e0c13813727f0b07694ce2a28d0a458a97cc3237bef3a3a71259ab1b18

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

MD5 3881f92d85da6f67416abc977a2ba3a3
SHA1 2359a65164b01bc5b9c8a49522676b5a1ac60d5f
SHA256 28553f31b37eb6d4f6cac2590a97956cd5a376f30f1ba7d5de29465669c3f23b
SHA512 17d7bef92ac5b9d2d62f0341f952a1d7e3ea44a4d186a596d8cc74286cfc22e54ce268d6601db075594e86382a4c753487952dab502a1a56f583d93ed14184c9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

MD5 5758e1bd65012f4598aad3376bf48786
SHA1 06d5fc0370c3a74b02e16474807487cbdfeebeaf
SHA256 e2e93591e81270e469e4527f94420b60def86e17a25540705341cca7c6242d1c
SHA512 6b1d99b8aba013cd79b980f70f75b42eeff47b619fa65a8ceec9fe5a410165b379342889253bb9c1b9fe5cc988583bf3ae43ce83dcd32cb58eb627067a92afa9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

MD5 f72c101d2fabcc556b9e399177dbc0d4
SHA1 df408f9e629b96223686b658844a1255e59061d6
SHA256 c77a46707e0ccd9817b535299739af063a68825bba7b3a6e7b47ace0d581d462
SHA512 bdf86fe9ecfaee1dc225623364bd66b27f6a4c21e578fa6d3f95598ed676e374946b1c5696163fc66595727216112196edbf6e425b8ef1e6230685f93d5f8f5d

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7GBDECYECTP2GSDBJ1Z5.temp

MD5 1a78e6eea8a66b72bd272345adbf7061
SHA1 614c19f2fb00d898d664c2c4bd85dbba5886d2ec
SHA256 b8bff226223a11ff2088c0c9863d5b800ab5207550be6fa8ee40a1ab2f720fc3
SHA512 1f3a308accbe465448a97b9ba96f863a3e89f2b42b43220e3ed28af2d7e53414d5f6dc719fcb1a176aa436a76d931b2ab2a62625de5613c6de7e9651f254eacf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

MD5 10ba3edd02be29d1352f7380086add10
SHA1 889f282bc385ed1c946b8b3593468611a2bf811a
SHA256 02130a8c05e5eebafef6c4562c691922369e4433ebc0b2617f7d738dbc596441
SHA512 bace8727839151a761cb1b1f275df018fee15a848f38722bc29737c05ec69fa2f5087313820c11d8c809cef72bc172410cce1807608d532932b26fe6b92e1271

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\activity-stream.discovery_stream.json

MD5 9a5ce3be51d4d5f5b12168ea414e4e5d
SHA1 14f755901b3135604c5c849052693769db8f192b
SHA256 98dec55807096505c95ce0acc89862c9c2e23ece3e623988accdc7bec476493a
SHA512 5413f9ead51f8b392b8e93ecc307a900dcda704494a44de4e47500065aa14165db21d16fa7e1a7c67364e2dfd30e918ab2828f86fce0a8a4c82f1653837d1bce

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 d438dc28c9d463318b234a54fd3630fa
SHA1 1160b9903dadab55dbfeb9bda0299d17c982dd8a
SHA256 96f27267e7a89c0ffc5ef8b838fd5939e69ae4b892782618712ddb2ab6f498ed
SHA512 83ef8ac55baa63702ef3b9e98ed12c93983f1dc5d2a34a32fee58eea698db68347b92f182ab9b4486e7a3b613d55bb52efb3f11db6164e898b99e60ac9697075

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

MD5 6523715bd7379774847eca407d88542f
SHA1 6b2a638f08f12ee8391dd48b663a9b1c976fb9ab
SHA256 155b717af7610f5c50944495dd11f12fd44eeaa4046d51db7ee3cfd8c2300ad2
SHA512 58e5f14fd22a708c6c14f82dd36a7c93b650464a64d75e9c4f17bcec90afa64d9070ceff2a095e6ff5fc822b09bffd371bbb4cc5cdf5185af4e42ac157fa5643

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

MD5 2a4866e7fd5312e65a907ec0955aa79f
SHA1 e25a5f4b3fb95196627ff1a08bd0171c30ebaab8
SHA256 bf50c3a96ef0154d1a0dabe641119bae5da36de3fcba3515f2f9d11763b83b7e
SHA512 03ecc6978146aacc09f22b68b25b5919319e398091550ff22728995989354f1181c6c6d2f956da6ae14216673922014b151d98a8e2cca4ad3949225dea325deb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\bookmarkbackups\bookmarks-2024-08-08_11_UT4wYQLgjY-3vFiWOpYIog==.jsonlz4

MD5 07776d530444df861ad61e28b81ce943
SHA1 e5b401ac606af8d3bec6e0a12e2e2e958b52d60d
SHA256 f98d76826cdd3a0a6fdb4a0efbd6362092f5d53f4330dbd8f03e05d4b3adde42
SHA512 c2feeca7e99e211b80902988c21e39dc95fd306da0160213b26e1bacb480548b44468ed3dc75e390ce670800248d97655a9939e7976becf1f1db3141d79d9f77