6a2a635b29935e9b7a1630d20c36816ba93903c6527022959a86ff3c2345f685

Analysis

max time kernel
1795s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

watch.html
Size

746KB
MD5

c4b7564f403d813e32d3e50bbcd0a249
SHA1

32ea053becd4fed3eee89014bc1c544a14ebe311
SHA256

6a2a635b29935e9b7a1630d20c36816ba93903c6527022959a86ff3c2345f685
SHA512

42f2b8cfa4e7b6bddf721a71d2437c7929442ed6ca2bd96f0ac1da92edca8a8f69dfb45358996969b4437ea4d962d52818125506163e8f9c5a55af927a0f8c22
SSDEEP

6144:451YkTYkjYkAYkzYkeYk2Yk6YkXYk1YkoPDP8F4E+jx2v6DsPCUNfLKAYf0t3MD/:4DY4YuYFY0YTYXY9YEYcY9PJG5+

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	firefox.exe
Token: SeDebugPrivilege	4808	firefox.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe
4808	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 2804 wrote to memory of 4808	2804	firefox.exe	92
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 4044	4808	firefox.exe	93
PID 4808 wrote to memory of 2560	4808	firefox.exe	94
PID 4808 wrote to memory of 2560	4808	firefox.exe	94
PID 4808 wrote to memory of 2560	4808	firefox.exe	94
PID 4808 wrote to memory of 2560	4808	firefox.exe	94
PID 4808 wrote to memory of 2560	4808	firefox.exe	94
PID 4808 wrote to memory of 2560	4808	firefox.exe	94
PID 4808 wrote to memory of 2560	4808	firefox.exe	94
PID 4808 wrote to memory of 2560	4808	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\watch.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\watch.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0422906-824a-434f-83d6-14763a38baea} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" gpu
    3⤵
    PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2456 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6a7141c-239b-4478-b2c2-37fe457cbe4b} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" socket
    3⤵
    - Checks processor information in registry
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3184 -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 2820 -prefsLen 24741 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0649192b-1a86-4287-a62c-bd0212dbe0b7} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3624 -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3536 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7de3d28c-0239-4266-a42d-3e7d92e86131} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4924 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4948 -prefMapHandle 4944 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abf1b60b-87f0-407a-a412-0f72013a854f} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" utility
    3⤵
    - Checks processor information in registry
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 3 -isForBrowser -prefsHandle 5464 -prefMapHandle 5460 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26dfd184-3616-4734-9f3a-79dcc168026e} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:5564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 4 -isForBrowser -prefsHandle 5628 -prefMapHandle 5632 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8535916-e681-4980-ae5b-ed70752ea13a} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5916 -childID 5 -isForBrowser -prefsHandle 5836 -prefMapHandle 5840 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73ca507e-6289-4d35-9091-3c83b76ccd15} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:5272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6120 -childID 6 -isForBrowser -prefsHandle 6112 -prefMapHandle 6108 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {220ba2a0-b14f-4cf7-8907-eee388637f5e} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6084 -childID 7 -isForBrowser -prefsHandle 6088 -prefMapHandle 6092 -prefsLen 27174 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ae8750f-5567-44bc-b5dc-13d798607d94} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:5640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3132 -childID 8 -isForBrowser -prefsHandle 1696 -prefMapHandle 5820 -prefsLen 30495 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d7fc094-21ed-497a-a380-e408a85024d3} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:6872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6720 -childID 9 -isForBrowser -prefsHandle 6744 -prefMapHandle 6296 -prefsLen 28040 -prefMapSize 244658 -jsInitHandle 1032 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73991f3c-67a1-48fc-ac8e-5f3693cd0ead} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" tab
    3⤵
    PID:6620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3608 -parentBuildID 20240401114208 -prefsHandle 1548 -prefMapHandle 1860 -prefsLen 30574 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f89edd38-c5b5-4909-a0b7-da4bc0e7d348} 4808 "\\.\pipe\gecko-crash-server-pipe.4808" rdd
    3⤵
    PID:6496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1292,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
1⤵
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault755cccc5h1699h4033h9445he16916566509
1⤵
PID:6784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:6920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4272,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
8KB

MD5
9a275d1b98a7cded0860da1bbebe1080

SHA1
8a6343d5ba77cef999754be4b25d812314a867e0

SHA256
bb0f3a294454be8a8e8e382bc7235b6063b2e87be9f04ef67f3f96d10364165c

SHA512
65473a92efe1ddf5acc684d6daeb3f61f9b6ef9beac1f4cfeafd027e63d0100f46446447d022735749f9abe3d744c51fcd76bec83e777db4b91065a603085186

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
12KB

MD5
833c503d0aaa87fc0ad5d723e5f18751

SHA1
a1fef47acdd5fbaa2c0ea1f6fa0b31145f6cf885

SHA256
cbeff2d88bf1335c0e8023b2e1d33bba288ac2a791782798a9500692fb3c0f83

SHA512
ff6311ddd4dde515e98391237511dafbcb1ec4e44319f596928b39bb2fd3e8b17d04b02715529dd3ccbad529a9fc551d5cefcf630220e2b7a4770fe5f927422b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
21KB

MD5
f6c0e0a92e16801d3dde45135236be44

SHA1
20eb41dc9e0b3cc0cb9d6452a360f42303d1d931

SHA256
2311a2dbf72ea67618e0b94c822e58c83e1910a96105d7e98c88ff1c955214b4

SHA512
457b41629e9381b66e239da907aa5cc2abd95465ba75277070ef60a70f0bbc3b4d78cdf54d4859b6d049a4fdaa454fd123148406e30a8bffb7172d36a5752ee3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
f13586775500ad900e2889947d38556d

SHA1
0eecddc0f60f70c72cbe55a09a57c50a9d09a7bb

SHA256
3a67a981ee4777d3102cea503de979407ef7ebb84ddac8b97d3879aa57e49ca1

SHA512
ed0a8a2e21b8d7f90806ca1dd7184c7948ae6c356d6326741606acc07cdce6dee40027a561716e222e82d879608e23f1a407eda94b098b7dbcc4f2b635770711

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
456b3843d5139ec0011a98dcb9195450

SHA1
be7fa9f086f5bb93d842568e73f5ee1ab6212e06

SHA256
f57df2d6952b39a592e9e1c8896fdb055c4136536abf8b97c960b9f50fe03c28

SHA512
3624f67dd03932531b5e6021f6ae4077f2f527e64bf4fe82226a00349e1e0910827fa996d4e65a66e8d926b6d7e9bd806cbfc61bbd2bb172eff83a29f84c6300

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
4dd6f83a26daa546b829e307073c2a03

SHA1
512fe3c31191b61791a70b8384f55c6d4766bc3c

SHA256
ddbf58cb09a5c2014f30c7dd2306a14d8ce1d5402f243c1e786d279a0341c3b7

SHA512
37735e2fbc9b961549e2addc5bdb781cb3e10b13c201ce823f41fbb216b946ab0ba2c70377c77be45dbccaf2c7c4ec2de287367dec1f442ccdd0df5e0d37b9a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
b08acc1685bbf31f9cec48dcd987b99b

SHA1
af2fd0a95ef4408f271229074be1f864218cd31f

SHA256
07c6198c18805136079cca9c23d16f7ecb068bdad65b8600f8960c0aeada47c9

SHA512
bdf1dbdbd34a5f4b35b5ed49fdb595ae38c4b09e760c0b2fb0fcd63717f5d1c8e32b2d6082ff8c91df2db930347c859ea1f2a5a22c6bfefd5b8d9fe3114ccd91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\73591ab5-f862-40e8-adc0-4dc81a637acf

Filesize
982B

MD5
4f6702d38a145ebc530cd55af1eb2c61

SHA1
29161e56f3e333ebacfc82a0145ddf52554a980e

SHA256
b7212f8a83b3931330de771cb27002b5864c998135eb533b768b61669f6f5263

SHA512
771d96f31cfe91f0323425aef74f40a35d2b25184de0dcd0aca65c4e829165b5c337efa871901f4f1b3335b9c25853c7cdec636abefb8b4b749f828b5aa23aeb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\e52e5401-5a6a-41d3-8538-41b974bae53a

Filesize
26KB

MD5
668f103500665830d72b296be9b1ae60

SHA1
ee697b1a3562ba70047b62a30489ac9348cc7a42

SHA256
c24a1f0c86e98d6ed29a62832528d5ebeb823bedcfcc0ff117ef098e44968eaf

SHA512
b0597d704d992d4d73e29782d4f4d0d9683fcc5cb38d89c5c389c3548feb28b934c8677cbb208f31499d2ac77a2a346ceee2c718e0e8db634472187425351eff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\e97166e9-4510-4017-8b83-2bbd1fc627f3

Filesize
671B

MD5
846cea1c113484b5bbd3d8febb7519d2

SHA1
589e57b9d3de114cb31d3f70067065aa138eef07

SHA256
aef21c4094f018ee11bf32886a1765d1283b382dbee45250083832b3cb76deed

SHA512
5e5f9585dc97e365d65c13a62adc6a046b8f272a98f18fd006c90d20fe05191aa8cf85987d36872dbdcbb10509547823e1a5bcdd32de1c82d24bc04470b26b9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
11KB

MD5
a6a265ef02229a69f36134d4df451218

SHA1
1a7ea0745ccb9fea297947e176652dbdcd7fe151

SHA256
d5557e4cb98875fdf4b96825c698a786235f01a772b9b31161df1d8364aa1a59

SHA512
cf3e39c11328aa951027b7af23b542f56c68194d3211aad371ea79b38dd7513b2966b2ccb5e1c0a16cdb08bd6a91f4d47fa5b3be807a36a1c19dddf114e9e154

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
11KB

MD5
35892ffc79d80cd15ffdf25b15a99f19

SHA1
154d2f6d97f0855e7530c06c26aaed1dd84e6069

SHA256
a58bb4768a9de3e10b47c1504aa171eba5058381bde200d39bf345137b31e5d7

SHA512
80360f1212fa83d1fa7b347bd78ecc161bc69b4dc25ca07c664acd0705ce24035f2e692adff80fa7f469e0f933168d7608877033732fe5654a054b314976df1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
11KB

MD5
057593c0a5c73def7e8416ddcc8b0700

SHA1
3b5e38ea85ea189b80892aade308175a8e1919df

SHA256
95e9f283fe3c677bdb18fd2b4ba02f5dd0b8b1aad6668bd77e99cd75c47d5557

SHA512
143a248acfc0b19ed63078de7316f7d204d897cb7b0a4c790d94893947ea63ec5734ab5bcaa8897fb5099df4d4994f43dea125830f264883e898f4fa0d12b36b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
5368e624670f41a560f7b7eb334a6df0

SHA1
b3c25c63cc727f8df22a65c6a54f1f460bb24374

SHA256
6fbdda4a69eaf93542c48eaf06d1408d3f1b87adfca97033029dc7ac8fba3305

SHA512
4b1f532f3c0b3667f61a99d37ac45510af57d708ab663ca04bc407b1e0eb20b1a6f1ed139b4e3e425c69e4794b6f86c07ca56289ba1d0cd72e119eea05626a42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
afe25f4515c26f15e88a121ae1b2d06d

SHA1
c50567e50f8644995a768ba34355b7c81c94cac6

SHA256
07aa57ba82311645a594137ae4b223b0959f81e9cefa0a8e4ea5ae209ef05f40

SHA512
9d6fb6e7f92b5618742c8dcb1973c5fcaec3a489792a23e209db89208d32df1a0b36bd606cc3745fdd4b3e88cf9326522a0016f585157bd1ce4daaa757d0a5e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
9d4681d0bf87f76342a409c850deb31c

SHA1
1ab8c3dab5fb5bfc2af8c0a7d58081db590ddb0d

SHA256
1e4eee00231fe9469e5fd13d996b40f20062f8329720b7a79b5aafd34aa7723b

SHA512
b335d43a381ce7ed250751ed47047c16de901886cfd8b93b57295b2c4e25ccfc1e6e4f7100c935d94af288acbe880612c0f13bd84e5c036cbbe65378fe4070d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\storage\default\file++++C++Users+Admin+AppData+Local+Temp+watch.html\idb\299211469yCt7-%iCt7-%rfe5sdp0o.sqlite

Filesize
48KB

MD5
991028e287a705c3da71ec1e0ad5fb4b

SHA1
bba621290a0a047e0c58283ebb470fe7248565bf

SHA256
97fbf59e197440f917ff63c74a4bfb2ce50fd6d1d85fa41aca85bfd431dd5545

SHA512
214d77f44aee8ccac05e6bb1bbd4f1d2e96cf74451fc94361624c3c17c037e4197a29afc83aba5db463ae529a7a991f26d3010f6a26028296da8946a00449c23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
576KB

MD5
919ddc1c4ef41bbed6f46cc5c9d64467

SHA1
90b39f49acb28329ecc6e4459f3b5ccf557b5f97

SHA256
e9a607906a49bb5c43365d5bfcf1e9813ecce2bba71aa1fd4035e947144ae2ab

SHA512
20ab1112abc4d59f390e8a5dfb4d7a7416ac23aad9ed84b036e3797aed372ad2c9e59dba67d842040c8c6b6946a5bb002778a4e4344a601757d4063b6da492d0

Download Submit