6b8a5f0172a346d08d8e6325b5d5354a01055bdd8332f93aa174ad27b0ec1bee

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.profile
Size

807B
MD5

f4e81ade7d6f9fb342541152d08e7a97
SHA1

2b9ee6d446f8f9ffccaab42b6df5649f749a9a07
SHA256

28b4a453b68dde64f814e94bab14ee651f4f162e15dd9920490aa1d49f05d2a4
SHA512

26544e0b85ca6d7cca3b8ace7d01f712e24020f07b6a6ad54a6942909040221f09bf922a4d0da555ce64ceebb4934b28719a23a0e6401337a69d4a0170bd8e4c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 3 IoCs

Processes:

cmd.exeOpenWith.exefirefox.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

firefox.exe

description	pid	Process
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

firefox.exe

pid	Process
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

firefox.exe

pid	Process
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

OpenWith.exefirefox.exe

pid	Process
2276	OpenWith.exe
2276	OpenWith.exe
2276	OpenWith.exe
2276	OpenWith.exe
2276	OpenWith.exe
2276	OpenWith.exe
2276	OpenWith.exe
2276	OpenWith.exe
2276	OpenWith.exe
4828	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OpenWith.exefirefox.exefirefox.exe

description	pid	Process	procid_target
PID 2276 wrote to memory of 4696	2276	OpenWith.exe	99
PID 2276 wrote to memory of 4696	2276	OpenWith.exe	99
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4696 wrote to memory of 4828	4696	firefox.exe	101
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 2300	4828	firefox.exe	102
PID 4828 wrote to memory of 1892	4828	firefox.exe	103
PID 4828 wrote to memory of 1892	4828	firefox.exe	103
PID 4828 wrote to memory of 1892	4828	firefox.exe	103
PID 4828 wrote to memory of 1892	4828	firefox.exe	103
PID 4828 wrote to memory of 1892	4828	firefox.exe	103
PID 4828 wrote to memory of 1892	4828	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.profile
1⤵
- Modifies registry class
PID:4712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\.profile"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\.profile
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86e7114c-3576-4d7e-bb53-8067ca4c7c5e} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" gpu
      4⤵
      PID:2300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6bd5e21-9c44-4fa4-8b69-3f982521e34b} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" socket
      4⤵
      PID:1892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2920 -childID 1 -isForBrowser -prefsHandle 3316 -prefMapHandle 3220 -prefsLen 24741 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbdd210a-65a9-4952-9d5b-321f21a9447a} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" tab
      4⤵
      PID:4396
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3544 -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3304 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b06f0f08-4f85-48d6-8d5a-67bfca05c72c} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" tab
      4⤵
      PID:3636
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4872 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4864 -prefMapHandle 4860 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbba7db5-7d95-444e-890d-da9bc713bd74} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" utility
      4⤵
      Checks processor information in registry
      PID:5440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5200 -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 5244 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b606fc64-4185-4c8f-86ba-4ff117225f87} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" tab
      4⤵
      PID:5880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 4 -isForBrowser -prefsHandle 5424 -prefMapHandle 5380 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a5fe6f3-f83d-4622-adb4-1836b68df661} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" tab
      4⤵
      PID:5892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 5 -isForBrowser -prefsHandle 5432 -prefMapHandle 5372 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccb460d6-ffff-4959-8fbe-374d1412fd07} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" tab
      4⤵
      PID:5936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

Filesize
13KB

MD5
4dbd7fa8b804f896f1bdb0eb526d608e

SHA1
6d80cdc21504bc5959e1733ce2ee8120da4ffdc0

SHA256
d82eaa2678dd14c7d62ea829c595303feaae5960324db9104a17796fa148d00a

SHA512
c0a32d08b72a1ba05d04296d5ee84fae2a7c461c3fb083641de7fc63680d22d7f53832bc9225fbd80694033ce32d4b0252c3d72ae379730edf927480bea41e91

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\AlternateServices.bin

Filesize
8KB

MD5
dcdbaee28c0e780d7ec579ceebde2157

SHA1
e4e90a36b172f2193af776744819caa3e57d8658

SHA256
3afcba289a091efcf745f1dd64a7623eced436511976e47a68474ee05400bacc

SHA512
40723febdfdb18e3b0a4922e7680bf2ff93e105eb1e238fad359850ba0c97a84b9ef91cf38bdb86eed387ab5c28a1d5da8b7a390d35e9d46986afbac9300c470

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.bin

Filesize
5KB

MD5
7539375283325cea27502fe276906561

SHA1
5c4e89fdfce32aa72f2fe66cae0f49141163062f

SHA256
01a8b6081880ab1c9d7b510c0e011d8e8a605085a798fe7e059161e0ebf5e662

SHA512
aa476eff2426b01e82d1f34050e464a192380dd3d87d16d285559c0e833152db4040c1f45f1bce42319dfc64b461c1d24b083406ebf0738d7f35612bde5cef00

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
5bb68edc4d2eef2848fbaf67fc1340a2

SHA1
23eba21313de5aab7c2232a3cf601dc19e2a75c7

SHA256
c7786cd2c99997a7e0bc5580aaf90034ab9e6939f57647d5a6634b8317e5a7e4

SHA512
cd47b529ca57321028d4bd218cb2c7fbef5f312113b8f6c875dd1cc81274cab603f2f080198bf60c5ea52c77950d6ebf3146ed5f61904030c1619068867bf5b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
6f7f31cab6429c3858da254c6032e8ad

SHA1
01710484965354ba3037a68255ecb6a892004f8e

SHA256
a92e5640167e4a6c9902c1ccfe9e61e014229927282f6ae5fe8cf1d83560e44b

SHA512
2b8b6134c73c0e1be09dbc87dbec16cdee98ec57b66397543c1c7fbe85069884588e7c957db5bf9e75a777b2073d48045dffe5316197cb211a68320a948259d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
8b04fbb32b4363bbeac87bff2eff0db4

SHA1
9b9a0e948822d53919b36b39d68e1cd06fdb8b58

SHA256
ddb31695d4df23caddc705dfc6436247a6af0445d38c29dc9cdfce3f11dbbdeb

SHA512
b734175d497764e5a1ec05a0b4b88af01974cece7e8d49f206fc069c9bdfea4aff524873ca8a6d6ba2cf7edcdeb39a402896728f8835fbec613831ffe3ed92a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\db\data.safe.tmp

Filesize
2KB

MD5
af8f3d0ee5ebf256642914056ab09c37

SHA1
e3920fde0030d51d431b47a93b3835b05efd7305

SHA256
5dcba97c3e5aee3841d5ac58a3d7fb396e9a0e7590956c6c4d9e07e11c88235e

SHA512
0ebdd4497604b61cfba47afcf5b127a9da428d2d41aeb4f35f0501bef11b070183ee79b577ac698351da18f06ce6fa778c9aff51f57d9422416c31001ead9a68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\51660cde-4abb-463f-9044-d48036156cda

Filesize
24KB

MD5
c06bd348f0a9c11bbc09972bbf5a8e6b

SHA1
632576f4a5fb49216eace3084ad15bb9ab986e11

SHA256
65300e182a74d460eac24ffdeb0d1785d61164edede03ac3fa7ce1c0153e99a7

SHA512
41fde512e08d36ad6fad9f088048e490f9d346f407842f68df03ec928a91ef322b96f56423450cef12bfd740342371bc6fb15fa833b6fe5b032761b35fc41cf4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\8d329edd-9119-4666-815d-73839d1f2cbc

Filesize
982B

MD5
dfbd91807830bc84db4ffa25e99f69e5

SHA1
7eb34358b68b99bf15ebb09037930ab84032158a

SHA256
e22730df5faa0c5a3e5ba9163b3ac4884811d30a82eb2faf5309cc7b4eec42ce

SHA512
e2d028a7c278e6c703e5da99548ce83da7e67ead8ff0e99441d54bfb26f4728568466ce7e4773fff308916a1afa60eafc1bfcf7d914889c7f35389a21c57ad86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\datareporting\glean\pending_pings\f9519d26-853a-437b-8685-bbe65b6db3d3

Filesize
671B

MD5
7e6e04c586afb50981131fc10ff987d8

SHA1
a8d27a2456e97c01f570f2e3be74451e549d2d33

SHA256
9173f648fed01be43640a5bb5db72f40bc6f998fd6961dfbe3f884969e0e0f63

SHA512
aaa49a939ed344e07a1ff2899f4ba9223cec7188c0906ca1466a39ad8127181a1be279a681ca55a730bf1148d6e2adef5a9aaa71d8052306cff7890d756bf015

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll.tmp

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs-1.js

Filesize
11KB

MD5
7b7e7d444d066d0af8d3192dec6d8998

SHA1
29250668a9e52c9c86738b710465901981275326

SHA256
0d65f62462f35812853614cf1811b116efb47cfd0f3134b294b4e6ab43a89158

SHA512
847964c9a8797284bd850248f0eb273b2868275a6d97ff2cb60d2a497144c6a66fb272a8aca205760826a011bf2555ec5a36a3cdff91c1af88c1bbf96144f093

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs.js

Filesize
12KB

MD5
0c5229ec552ed1e53ff5ecb6d6a318e3

SHA1
8fdfedb058052a0d4ebf0587682934b780577b76

SHA256
69363236678446e63fea6f358d2428a9b61d95c9a24982a6acc9e418345aa12f

SHA512
00e00367b474a0b91f985bc97458e5a192f28f7e0180c1af71701eb8479317be68bfec9ed3b6ce776b153cba770830290f6127e80f3b77732179e11d25abc540

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\prefs.js

Filesize
12KB

MD5
231bc2adc9e4c8ca9072c36070cd6e9f

SHA1
51ad081ac41c019af42253b94a78ebf90c6c9ace

SHA256
974b0b39034146f9d2408512653c84c92d4b3a0040a485226a84a2d2a9cc5c00

SHA512
fac69b4ee003b69fa518b3882da266e9cdd0b2759c6c6cfcef0c647dd77a6ad034f7d145f3932832aae65e808c2305c0fe91584aafad8995c1443c51c96d20e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
568KB

MD5
37dc62453b2d01eb64cbd9af40a5530d

SHA1
f88ab3a168d024441eaa58f2228c4d52b1ea8663

SHA256
94bdceb9e23210252a29e72b50ec44001aa187dda9a84a1090e18bc9d94e3b82

SHA512
6662b0ad31fe141d680694ea23abed671aaabfd2858c44b487136dc04878e2335a26ad35f2373ac348c7f8303e705989581eb9b6c6189308430362f52e99c9f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.1MB

MD5
09b97bded975efe6d9c23932bac1451c

SHA1
dca96fe68760d0292f14ceb0eb42f323083c12d5

SHA256
4faaacca915eebc502851c71994ab3817067f266b43004bedd985293b076e946

SHA512
cf276f7322c4622bfa27c05296f0986417c2401b8b0331a32f1125ea7cbf8f43478cd118b1f37d0dc0f98f597ea096a450af8c0e05f75aa212b08436d52513af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
2.6MB

MD5
1b65d7031f50e6d85a28ed03ba7637ce

SHA1
04b7fb2e4a2aabf8cdd7d85191bd770626191469

SHA256
73657d4cd6684c9b760e7c7d5396b0205952ce4356c5d8a0cc905318262ee811

SHA512
e54e180f3ce1664fa5adde2ad79d27b9cfdb244305e97e1a2052188e3f458a1544e8f832da450eabdad84378557bc3bc30069b0543a9666f9a372f0b8319e845

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vpqsq2xy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
2.8MB

MD5
df5881e53b7f6048aa0ac61d23806b3c

SHA1
5de4d4e67e64119299899a97585761b587ac4167

SHA256
7f4bbd8e32cdaa421618a2e62cf2b5a5099ebf56c4cfe5ce5d7c7b6e2352b70e

SHA512
2a09d7f83173e83f6ebbae0e855b5d9e6d900fe1c6f4a7883165b9619ed8743c641712f25bc73449df761788a66a0d6756c23432b4935604609b52cb65e3ea5d

Download Submit