hxxps://addons[.]mozilla[.]org/en-US/firefox/addon/wonder-switcher/

Analysis

max time kernel
92s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
22/08/2024, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://addons.mozilla.org/en-US/firefox/addon/wonder-switcher/

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	firefox.exe
Token: SeDebugPrivilege	4040	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe
4040	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 3776 wrote to memory of 4040	3776	firefox.exe	81
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 4776	4040	firefox.exe	82
PID 4040 wrote to memory of 2556	4040	firefox.exe	83
PID 4040 wrote to memory of 2556	4040	firefox.exe	83
PID 4040 wrote to memory of 2556	4040	firefox.exe	83
PID 4040 wrote to memory of 2556	4040	firefox.exe	83
PID 4040 wrote to memory of 2556	4040	firefox.exe	83
PID 4040 wrote to memory of 2556	4040	firefox.exe	83
PID 4040 wrote to memory of 2556	4040	firefox.exe	83
PID 4040 wrote to memory of 2556	4040	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://addons.mozilla.org/en-US/firefox/addon/wonder-switcher/"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://addons.mozilla.org/en-US/firefox/addon/wonder-switcher/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f85a1290-42b1-4fb7-81cd-9a3b1e467254} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" gpu
    3⤵
    PID:4776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bae6eab2-e72d-436b-a6d7-9929604f640c} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" socket
    3⤵
    PID:2556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3028 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 3168 -prefsLen 24739 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fcfb8f5-a7d5-40b4-b4f3-ef04cf64b8be} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:2000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3660 -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 2692 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a453faee-b70a-41c3-acb7-6011d8e2619d} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:1076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4840 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4824 -prefMapHandle 4848 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80c7b907-aa17-47aa-94bb-8cb063634c13} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" utility
    3⤵
    - Checks processor information in registry
    PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 3 -isForBrowser -prefsHandle 5484 -prefMapHandle 5232 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05566e84-2781-4bd2-bc5e-417634de79cd} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:2304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 4 -isForBrowser -prefsHandle 5684 -prefMapHandle 5632 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {998eafaf-cb61-4a1c-9aa1-d3ca9488e47c} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 5 -isForBrowser -prefsHandle 5848 -prefMapHandle 5852 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d089c58-dd86-473f-98d3-332122c6df30} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4124 -childID 6 -isForBrowser -prefsHandle 4136 -prefMapHandle 4116 -prefsLen 27235 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1804228b-cab2-4a65-a4ab-28b0f96d978e} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6560 -childID 7 -isForBrowser -prefsHandle 1516 -prefMapHandle 2708 -prefsLen 29675 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afa52397-a0a7-462f-a770-4c090b02e075} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6972 -childID 8 -isForBrowser -prefsHandle 6748 -prefMapHandle 4552 -prefsLen 27880 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2ed40bc-b01c-4028-9aab-d6fb462a74da} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5864 -childID 9 -isForBrowser -prefsHandle 5944 -prefMapHandle 5692 -prefsLen 28101 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52cdf013-5465-428a-b3bd-898879bfbff4} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4408 -childID 10 -isForBrowser -prefsHandle 1276 -prefMapHandle 4288 -prefsLen 28101 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf8e0ffe-1ff8-4d34-a5a7-2fccc32dc335} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7040 -childID 11 -isForBrowser -prefsHandle 5080 -prefMapHandle 1216 -prefsLen 28101 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2632e792-f045-4aca-946d-917a00138cd8} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:2016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1548 -childID 12 -isForBrowser -prefsHandle 6476 -prefMapHandle 2748 -prefsLen 28101 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17153aa6-339e-4b7a-a3ba-9da2578aa00c} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:2584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6284 -childID 13 -isForBrowser -prefsHandle 7300 -prefMapHandle 7348 -prefsLen 28101 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {700e14c6-f6ca-42da-b6fa-566b508ed4c6} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7288 -childID 14 -isForBrowser -prefsHandle 7348 -prefMapHandle 7608 -prefsLen 28101 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0134838-afee-4d5c-a0d6-0ea8e050f7a6} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7864 -childID 15 -isForBrowser -prefsHandle 7780 -prefMapHandle 7784 -prefsLen 28101 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc0a0696-9827-48f8-943e-19dfd74759e5} 4040 "\\.\pipe\gecko-crash-server-pipe.4040" tab
    3⤵
    PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\activity-stream.discovery_stream.json

Filesize
36KB

MD5
08e8a6a6338f6a32f969881a10d2194b

SHA1
2f0eec231a3bf45edc921f2467db658dfff8beb7

SHA256
4debb95002ada6a8853a809adf13829f8a58f3128e541c836da1ecd64309f186

SHA512
80d1d6f94ff4597ad24da98307c5ad13c8b40885d12e96df686a40614649f854894c442fe29044e7ca9aa5a73586b08c0c055f6352407bc8a1fc245d3238c9bc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\cache2\entries\FE338ED8C8567F347263DD5181953AD49CBB6971

Filesize
221KB

MD5
d61fefa987ff2debdfee2c403ece6a8e

SHA1
4d10ec450d69e13c0de010e3db736369045e0e84

SHA256
36e5babe87a21c99232e1394616735c706c6f8bf9d3175f303f74ecb05d509f7

SHA512
eab21afa2a96ea6dfd604fd8a565b719194e5d9feefc4cea8109638ad8f906a324b784d966c5737ee99e2762a7e2329a84c617e4a86dc10b2ae36f8e781772cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp-tmx.xpi

Filesize
306KB

MD5
eacedf2a10e75dfcf4c22072413dfe4b

SHA1
d4dbea6e7a650d476f757084ab95d8d79c7516d1

SHA256
c8cf74f1bf02261b3d59cfbb1fb935656ba3b2b9f11b2b60bc64d74ac374281b

SHA512
e09934ee2082730c45ae6d0f7f6e3cbd45a79c41ae267bd9277f330310f06a4197a97da40ea41e183d710ae355bde72e24fa52ba4539598c7424b4e7cc92bdce

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

Filesize
8KB

MD5
c4b32911c32a46b497eeb93ec2d6ef36

SHA1
055854b94f429887bc43702d95018304441ae746

SHA256
49453febf53a7ae7a6f9408826e3c709ba5db8f2777968aa38fda9c172861fc4

SHA512
1b556b1b3c26c4f2aa9b2bb07f63c94650a0f60420c41d8702990cd0ee7353054af067d2e263a9dac65348e9107358f7f31539dca850123c4c0fb82964f9a9ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\AlternateServices.bin

Filesize
13KB

MD5
900ec6bec22750f8bf270dce04f31799

SHA1
3dac52c4d0def4e6cae89fe8904925fc4014b61a

SHA256
495bcd925a1aece542630d5bd99329282f52c93041fcc0dabf96681d3de1bf4c

SHA512
200b2c2aa8304837af1442bd0830533c484f4e36d31214024b3dc86917c9697a7c55a32354915a26f8f7b3725f3ad8bd685613995d2ddcafe966eb9aae3eb238

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
be12b61c5b894cb70e74ef8286245322

SHA1
c174f898cb5844242b9c873048cb240a2d7d178b

SHA256
e0cdc18d2bc5dc64bd8bf24eab98087c11a4b2c7bc1ff794ccdef55c507116a8

SHA512
954f0b217c8af9431b6ff8f7270baa233a12352cec7343f5aded7df38390b59d7f61b095beb3282fd0e02aac69d4d1aa6f0ca21889d5e5b07037640638135be0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
ae049e05d30f9d4324fef4fd6c0154d0

SHA1
8969cf6887ae95e847164e47b90a991a5eb7cb65

SHA256
cde5425a610f2ed075ca40ce282df35cac313d274adcc25676749c2dd7476a9c

SHA512
7876468c3dabc69d75515823deeaff670a2d9439c471c8b5c1891bd807167d7b19cb9b6c5c1d84791d388589dd6ab1b4c7e917eee2c84ecb81e87383892bde59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
9fe5dd18a555d070f360d31df0dc7324

SHA1
8a60e983e1eb82204351e6c0a017a28e3048029c

SHA256
47d7fa18ab9e50ebca3f79f3865d8adb8404f243d264d92c32bc15049e4637a9

SHA512
844f60a3433387d01bbdeef19c590f6d0dbf2b78820caaabb770c4973dd33e675a7434748a43a757b5ac95fdc3af0e2528bdce1fbdcdbac2bb09e1c08c9e7592

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
abf1ae192bea3eb2f63e94e3ff80baa3

SHA1
c601750eef69ebef37c92f3f5ddeabe23c080fd5

SHA256
caf08ac0d3993dace15fba470d6a17f461ea8014c5446a64438221fee6bfd6b8

SHA512
cc48961c12b52f82a5978ed42f62c03c2686def9d0af45805c111c78512eb42d1b625031dab8bb22bf46a89bdcc928b960fe3bbe2716514236f6bcaabeb23c0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
473f4a2b4a05abcfc5b88b6d46fb8bb7

SHA1
f767320ebea31fe01281709605def1f5d47eeded

SHA256
260994f6079b4939d8d85ebdafeda565b6208a9102a3a8b8b3becd7447a31bc2

SHA512
12b9213f3daa21b3460c74f32d656f9181a59bf83525faa6ec1b696b26215a9936fc0f1f2f5485230e302fffe228267cfa6f3b4381fc22b28dfc72390841cc1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\15fbc631-fd46-464a-9875-74ba125bc0b5

Filesize
982B

MD5
17ed6c5126885a015cc013c0193ce5f7

SHA1
803c705147928f616ab88750c40df9edac640113

SHA256
fa3bb5343a01784f21cbd609f57034d58bced6591da2b8cb71f62615e882df6a

SHA512
f1e62c34c30f8a178c54a9965a6774c1204bbc0d7e8a761dcca3346c6d27c20d2eb9ba39b0ec68ab7264736d8e2911a11b7899fa55cb75ca8cca387f330da591

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\4d177704-6a9d-46ec-95fa-bac523051fd1

Filesize
24KB

MD5
051db0122a941208399fd2b94a04968f

SHA1
a9613fd14e0544bab585377daacdaf9beaea725f

SHA256
2d7749d490c728258c20a47933c6f4a5773f18f079fe48f4967c67a00ef9ec86

SHA512
112063daeb597e96473c628bc803d4329f53bd9fa4505d7197764b68db7883e1f8b7e2a026baa5623f773473c3eee03e2600e06713c7086dd7198c728e3f28af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\datareporting\glean\pending_pings\998da92f-364d-4da3-837b-6617c656ce79

Filesize
671B

MD5
5d1d8d4742112e4265ce783d36191bbc

SHA1
05a81dc32312ab8cd8afe7c84fb684010fc33ed7

SHA256
c7984add0786a0522903204104fe3c6c5a6d3d9bc5e101f72a1ffec3fed99b01

SHA512
ea8ce2a7aac64e1006d5837da430f262f4b5d5d39bec42bc37971911d735159bcdc444252feda265a6c1aa8469fd6681ab050dfca4f463cebc51140ca58cb498

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\extensions.json

Filesize
39KB

MD5
96b7b8827764062499aa9175cdc6ef49

SHA1
f9a3c038f1075595de1ca7fdbdfa6f7e2bad8ad9

SHA256
8eabcca89925086d827dc5349f7f2cb950c88bbe3651ff3576e8e22e360b75d8

SHA512
26bd8bc65aa60db9a3fb4fdcc918a6dae267cdba2cfd6dfd8669e8dd4d87e69db9fbe005c21d9bac1b88d0aa4e7ba0ca7818b6a9e7731ea5671558b976774159

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs-1.js

Filesize
12KB

MD5
4d80acaffe40b92e0b06d786bd3d8a8b

SHA1
34056e442cc343b9e47c039c9327d1fb28775224

SHA256
0df1acb75485f747edd8f0e4b22b63965c8023f2fe0f134b5cd7224b587f6521

SHA512
975823b8f3e347f6e15e56d869707dc91b0675551cc3173086b64c21ef21ce45451f6da1759a7f160d0ba568d8a7f9e8fe37e4a3d6ac12a836a4dcc8d79618a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

Filesize
11KB

MD5
77c52c8b9b969a1ea57e5cb8a5326791

SHA1
04e89456f4c60252d35c20f7cc53031adef608b2

SHA256
5f92ba8f12d86bb20f6a0e809fa520e45a3340e27fe3e64a6d0bdd6dd13c8612

SHA512
587b426e2137c21ba344076b86eccd1b59587106914f608c120f1a406017ba6af6a3a7c2090bafe06215851c2853251d3d68522ff193d86e32a6a8a0e77fd890

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\prefs.js

Filesize
11KB

MD5
f615073c2aeedd22a7aa237ffda10d4c

SHA1
d369d47ea91373aff2b3b8089ca5b623dc5c5eee

SHA256
e8a91efbdb2ac0ee5cbc9c5d73f702b48ca7ab2875dd32fd2299548ded36b6ce

SHA512
3600fe1d2edc7ef1ba5f9fd9c3281ee049b54742b8ba5d6a2812570d4068c130932a7e336e435888f4628fda1d7cb78052be203807d30dfb98ae9bb865cf9a83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
bd878ac4903ec12ecadebd30f68bcd22

SHA1
eb463796c6059c7cf7b0de48e252f4b57a7f47cf

SHA256
35a8ee5fb2a20caaac0500d820c658e30bd6cbc7327444833ebc453d50bde280

SHA512
ee6e6ac773f9a050ea879db23871d9bcf13336b78ddb925a0f87e46cbf8e25e0f06ffc39b10ef1660aabce9f12c10cc3cc9656038699b52c6d32544698098090

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
130e041d58b3a0ab1533fc5b49d56a8a

SHA1
94e07725d0024f7e4ae49e440d7965079063172e

SHA256
723fa8a4c1fd46f433fa96bbae58c829a0e7bab1345747a412e1d47e02cb5177

SHA512
2558b76d9ac9fb271ba604012b28b51cb4bfcbefeffd6717230c9a4f303a1c98afddc9e95170c0dfa83c67074bd307117b232a6c4cc272fa6c3dde26da8f46d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
a3088755c65948a6479a9b6913b4cc3a

SHA1
c72a47e815cf0d9b8a70b7764d4abe39a6f4ed50

SHA256
bcf786142c4c6644f6550157ef6573160f23fac09ba33e97665fd3cfcc86792c

SHA512
7741e60c14bc8b876206ce08f84ec248b7aeae98bbbc9218f32e49ac16edd1cefed686f2f573cb185437f689bf9f06ea38f5cb92e6169cb13529dfd77dda9c54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
dd5bcba8c4d415c471eedcdc95d91f43

SHA1
47a08b162e542856d227ccb353ba2a481d89699f

SHA256
3cc4d8668f443f45e3f6536b655d96dbac14a76efe27c04c4d303ed5520d918a

SHA512
f2106472987900e23c72960e8922d250f96a2f042fa3230ab7f143db965bab2b42f95f835b7812febb6d257ce03e558eb9c597ee7585b2a171a51d32a6ab4733

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ybdgtqfi.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
53b2f14ed7cfa7b12c96eefa139bcdf0

SHA1
171a6f8f78a9426997a03b53812c964ffdf1cca0

SHA256
9ecded8724d756579255bcd269f826fecc8d8792dbbab229de07f561f7008628

SHA512
3d84b4bbcdd3e5348956cd8fba13a01f9c6778af486f7f504339117d3ec4c619e19cc9be6489cb5f64ef510c79010da5ff7102fe3f02044dc15968b58e4d5318

Download Submit