hxxps://bit[.]ly/4glCDwi

Analysis

max time kernel
50s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14/09/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/4glCDwi

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3492 set thread context of 4872	3492	Solara.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	4872	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Solara_External.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	firefox.exe
Token: SeDebugPrivilege	2436	firefox.exe
Token: SeDebugPrivilege	2436	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe
2436	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2868 wrote to memory of 2436	2868	firefox.exe	79
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 2240	2436	firefox.exe	80
PID 2436 wrote to memory of 1172	2436	firefox.exe	81
PID 2436 wrote to memory of 1172	2436	firefox.exe	81
PID 2436 wrote to memory of 1172	2436	firefox.exe	81
PID 2436 wrote to memory of 1172	2436	firefox.exe	81
PID 2436 wrote to memory of 1172	2436	firefox.exe	81
PID 2436 wrote to memory of 1172	2436	firefox.exe	81
PID 2436 wrote to memory of 1172	2436	firefox.exe	81
PID 2436 wrote to memory of 1172	2436	firefox.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://bit.ly/4glCDwi"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://bit.ly/4glCDwi
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0470f6ce-45f4-4dd8-b386-04a992d6f5f3} 2436 "\\.\pipe\gecko-crash-server-pipe.2436" gpu
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20240401114208 -prefsHandle 2344 -prefMapHandle 2340 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd42dc75-655a-4194-a723-5d580a8dc64f} 2436 "\\.\pipe\gecko-crash-server-pipe.2436" socket
    3⤵
    - Checks processor information in registry
    PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2816 -childID 1 -isForBrowser -prefsHandle 2848 -prefMapHandle 2784 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43061980-2568-4b92-ad5e-f4262ea4ef21} 2436 "\\.\pipe\gecko-crash-server-pipe.2436" tab
    3⤵
    PID:3936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3588 -childID 2 -isForBrowser -prefsHandle 2964 -prefMapHandle 3556 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af8ec15d-0ff0-4d70-9e31-bc059c30461b} 2436 "\\.\pipe\gecko-crash-server-pipe.2436" tab
    3⤵
    PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3600 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4736 -prefMapHandle 4568 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f2da29d-328c-46d4-9e52-ec72fe2192cc} 2436 "\\.\pipe\gecko-crash-server-pipe.2436" utility
    3⤵
    - Checks processor information in registry
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 3 -isForBrowser -prefsHandle 5484 -prefMapHandle 5468 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af5619da-1ab6-4174-bf57-256e85709d0d} 2436 "\\.\pipe\gecko-crash-server-pipe.2436" tab
    3⤵
    PID:4180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5648 -prefMapHandle 5652 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {101236d5-dc10-4c27-9d3e-2b24914800cd} 2436 "\\.\pipe\gecko-crash-server-pipe.2436" tab
    3⤵
    PID:5060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 5 -isForBrowser -prefsHandle 5912 -prefMapHandle 5908 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1356 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4787dc4a-eb79-48bf-ada4-8208371c9e19} 2436 "\\.\pipe\gecko-crash-server-pipe.2436" tab
    3⤵
    PID:4980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3200

C:\Users\Admin\Downloads\Solara_External\Solara.exe
"C:\Users\Admin\Downloads\Solara_External\Solara.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 428
    3⤵
    - Program crash
    PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4872 -ip 4872
1⤵
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\adahrqhl.default-release\activity-stream.discovery_stream.json

Filesize
35KB

MD5
bb34fe74072c1c83b4a9ebc807d6f303

SHA1
71225a3942e86e34023dddae0f01a397cf81176f

SHA256
8ae7eacb783fd8e08a6aa26fdb85fa94c9efa8b62944520651a0150e1a232b04

SHA512
1941394a335bc9293df1ba3b24acaf4681c18c8aa318ab2956830f84385048876cd4d94b0a1eb00b85df78b012ea3504d3761053f45d108c1fcb752dc96a038e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\AlternateServices.bin

Filesize
10KB

MD5
db2af8e24c1df125fe6e278b12e9006a

SHA1
3c274cbe4858bf3169c90d1766c247a425d5fc28

SHA256
e4e69e5434294dbf502cd9c75cc56149a92b2c3544b1cc3d1d5810a9bca3b010

SHA512
6a3fd9bac937fa76497ac3aba4eca5453ebdb0548cfda1d0e282efc597b82ece7645f07f88d3c9e707b0ccfc8ff047b98b5b4b1621d779ab61c374e31fb6f540

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
e38131ce76fc8b9d8ab9627626531616

SHA1
caa4cc2ab779ffc4a789393b8e75ebae6bf3e292

SHA256
6e4a202ba8d5ccbc29ad95a7ea23211033e78e4d8689cfdc6d3695d7133ad1d9

SHA512
a863deeb1006f7b4aa97f39f82978a05a4f69b055516f34f3983f4dd3dd362593acbd8f25c537bafa9b70b30f7e5800c7c0ec12ef8eed7efad73beaa108fefc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
e7f9422c5b10bb338ecd730f6c38f921

SHA1
eb19fe37d0f644f6555b9585f25e0220976e9b2b

SHA256
df74796c24cca2d0059e0db13ed2b2d607b6615c0fd70a22f342518c84cbac04

SHA512
5330c8ff18680b3c2d732b7e9485809b9ea29afa418d13cc7afd4c157d6a50b69af82660ccb5ecc4070e0b12f29b6921de1c81ac33b1c0f8449d23e8ed685892

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
c15043649086e15bb8ca67f6409f3369

SHA1
91a9d99bd173ab92b5f2d60e269e102677e5852c

SHA256
831502c8a8684d7f64f2583e3702c4206732e77c397bdaa3ac803d949f60f75d

SHA512
ddf34f18abcafd9c9dd820f294ee8c7488e9d7fa2818677775795f0db72c530d54b37517c9a5fedccd5576b8c2cb4985e147534640e0859c8318b549ff3a1b68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
8f44dc307c5b0e355dc99560548b2dd9

SHA1
794fbfb89cc9d76061d3bad95852ca65dde4205c

SHA256
e143748d2d00ea47c5285f51287c3e2884102cc7b06433cadef0a11111466a9d

SHA512
d561eb4d40bda5d4190754a275ffc25df0816b998e4cc2fbe499a194bbced9eb3834ac8d60d58de6b4ab82f2b37f74942512ff752491a6c2e63d463458942a54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
657f11bbfc3fe305f8d36baf5ffad751

SHA1
52700224a7e0498ed4d3c05c05f2fae6dbd7c8c0

SHA256
0ad25190047f5266816ff46c25e1c81e4f980be5b9ef3fff8b77860b45d02c7d

SHA512
b7cc0fbc73118b60ab322ac7ad9c57fef772f4dfa0157fc71ac302c9025d2f24afba80ad5279b38f84afc9730bf0afd7c2cf0361a7cf5d78fa6d9c66cf234a32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\2ec37d08-fdbb-4212-a5e6-e87f4e92b090

Filesize
982B

MD5
bf862b46614f71b0222eae51f6fba15c

SHA1
51b1b76988aea6bc881c977142a935adcbb19d82

SHA256
f82723af0650992e5bc6a0112db30b304793219bdd217353e6d92e0f427af57e

SHA512
300a943bd973f28a388b3fec9a91ffb14758e64f6f7e4994570ece87d409baf8eef9d4d59967e57672612bc5382843f0759fe2bd3992a0b8155766b0825b7de2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\f66b4691-2ba1-482e-b060-e81097a13884

Filesize
659B

MD5
1558ae66383bb3a1e29198cafe5c73b1

SHA1
474aae7e721119414d990c4baf9b7d94a62cccc6

SHA256
ad83a8fecfc903a394cec0664cec88db2b2a5b7ace02bf1a349d57e0fb9c7c45

SHA512
09d1a727656599c015806450732de0bdf82769a269b7e90fbd0363f0b53fa278b48bd44a0f124add5102d23bb73646db98f2d957fbbed18dcd2e1543a4f43858

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\prefs-1.js

Filesize
11KB

MD5
3bacaa483a73a124b849204a659b1a00

SHA1
6131ab72dea409e84ee9c95e7e78b8e169975e7e

SHA256
63cc241f01e9c76e0a3c80e5b7b50447f127469916ea6b3ba3195878f445ce75

SHA512
3d1ad2dbdd41dfb0f51a3312608c60cf1171651a76f02346557c06f0b8ee29fa003fe3ba9a1bb16a007644da59580e797581aa4ae11ca65cf1924dc4eddc0c38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\sessionCheckpoints.json

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
982e06f1bf9ceb9fe0484d828e120c6f

SHA1
8db1b76383cb2934242cad162dd404404c725373

SHA256
0cb5a23da9aa42ba5499e05cc7deb115d915f06a4eef024905e60c5a14d197b5

SHA512
f8bef98c30ed7654e38f9afebb835e6cebe3624c7a31a23a072c5b572c86c83b0737b147c2776a93bb9387faec2ff582fdb4068171548d9753082e5a4896223f

Download Submit
C:\Users\Admin\Downloads\Solara_External.-uDUD6VS.zip.part

Filesize
21.5MB

MD5
d7e88ed838ae033a72edf8a8fb93ca21

SHA1
2c610b09a337ccda17067cb45c8bf243428d4a1c

SHA256
4168839667c6837fe934e6b334953e211be0582ccf7bb10bbebff7244635ac96

SHA512
866f513eaf8d672ae43b50fdbafa0d40329bd6f0b192f231c8ee181a155d05bed4df57cddb427c034069989c729b3f44bbc299275ceea5cde954353cdd7429b9

Download Submit
memory/3492-338-0x0000000074A10000-0x00000000751C1000-memory.dmp

Filesize
7.7MB

Download
memory/3492-328-0x00000000004D0000-0x0000000000526000-memory.dmp

Filesize
344KB

Download
memory/3492-443-0x0000000074A10000-0x00000000751C1000-memory.dmp

Filesize
7.7MB

Download
memory/3492-327-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

Filesize
4KB

Download
memory/4872-331-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4872-335-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4872-337-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download