bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
Size

897KB
MD5

5394d548b6afb562a42ff0e39507550c
SHA1

a66ea4a0d81531b5daf16b87d9298326c70b90c9
SHA256

bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813
SHA512

a08760331c5f3064c046f3231076a57f5cdc3e84f102231baf2554587567104a9b3ca657b08f20a17df81fea3f008f194ab62093ecd048b720c20f0d373f54a6
SSDEEP

12288:TqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga3TY:TqDEvCTbMWu7rQYlBQcBiT6rprG8ajY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	firefox.exe
Token: SeDebugPrivilege	1596	firefox.exe
Token: SeDebugPrivilege	1596	firefox.exe
Token: SeDebugPrivilege	1596	firefox.exe
Token: SeDebugPrivilege	1596	firefox.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
1596	firefox.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 3632	204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe	84
PID 204 wrote to memory of 3632	204	bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe	84
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 3632 wrote to memory of 1596	3632	firefox.exe	85
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 3860	1596	firefox.exe	87
PID 1596 wrote to memory of 4004	1596	firefox.exe	89
PID 1596 wrote to memory of 4004	1596	firefox.exe	89
PID 1596 wrote to memory of 4004	1596	firefox.exe	89
PID 1596 wrote to memory of 4004	1596	firefox.exe	89
PID 1596 wrote to memory of 4004	1596	firefox.exe	89
PID 1596 wrote to memory of 4004	1596	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe
"C:\Users\Admin\AppData\Local\Temp\bdf20ad72ff33157d5fc7dfd4f2ee50db9f1b01adf8aa97817785a503cc3f813.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:204
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1864 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f33e80de-7559-4804-8d30-23841fbeb56a} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" gpu
      4⤵
      PID:3860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48fbfa30-3356-429d-9634-a6e676f1ff2f} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" socket
      4⤵
      PID:4004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3464 -childID 1 -isForBrowser -prefsHandle 3420 -prefMapHandle 3492 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f11ec6b-0164-4e40-8566-df5224e58196} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" tab
      4⤵
      PID:4288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3876 -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56206e11-04c4-4de5-b588-58e7acc4d7d7} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" tab
      4⤵
      PID:3940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4536 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4528 -prefMapHandle 2784 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ef3ae5d-0f64-4189-a2ef-bf9ffe5ea96a} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" utility
      4⤵
      Checks processor information in registry
      PID:1344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 3 -isForBrowser -prefsHandle 5044 -prefMapHandle 4652 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f2434cf-2852-409c-afd7-b03f37a85c24} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" tab
      4⤵
      PID:4968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5460 -prefMapHandle 5464 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76d76b79-f4fe-45c5-9585-0698b7b87c37} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" tab
      4⤵
      PID:4188
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 5 -isForBrowser -prefsHandle 5776 -prefMapHandle 5772 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1232 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4d6049a-dbf2-44fb-a74b-f9483f8bf6e4} 1596 "\\.\pipe\gecko-crash-server-pipe.1596" tab
      4⤵
      PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
4420acf9633c6d9836101fa7785cc365

SHA1
9d6790ed5150ee396e698bd93e525aafa7a8b5e4

SHA256
8559bb1488529b30e047be17aa006dc9d58520140a12570cc008ca2fcb7e539e

SHA512
bb0fc7bb1e1c90f3983648e92ac1c4345c4bb87c63e81a853653f4642f2e118e3a27232cdd5a8aa13b7a733fde31d22868a4dea1f747760bcc9273c7d69303b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Filesize
13KB

MD5
3f18cf24ae4656b306c64fd4fca03cb6

SHA1
dc345a49e62571d8717f0e1e5e38ef05be3e64fc

SHA256
f2612c27dd47b4a28b835ae64e718abecc0996d93a460ad9c4b2e964a8acfcff

SHA512
220a01a2c51daa442e5b4609a3dab155513def7063611fba195926f6bc199219eb8a7896a44724f343bd9d12cfa6e3a28629bc2e5407c9ae1aa125368c292f47

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin

Filesize
11KB

MD5
50ab01d2a113337288ff715a390ce4cf

SHA1
ed23e80a4feb4c49397774feb1d435b2bf56dd43

SHA256
964e1ee542c00b11118783465b559eb00c6b2439a18edb4e9ae8d9fb8a996b18

SHA512
ae2d9756e33878592933b119a6c621ac4c9bb470eaf10341f693181cd4a1c0e47d52eb925c367e5841fa9a8d0667dbfc7ed20cf73f8381451a99141c1dfce434

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
25KB

MD5
febdcaef0d4ee899b950bd8c945f31ff

SHA1
465b78ab2f38539f80c672c1b4fba081da1c7255

SHA256
1967351ab9579db8340ec2e014ae69d1ba2020aba92a570d9dd8a794c250be3d

SHA512
fc68f9a2ef4bd86bf47a431d55421e9b4d5e8ebc7560a341d7b6c9588cdfe7da3dd83f1f218d0016b1b3c143c7223faa83771fb7a13073e66b480231cfd0c600

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
4b6b10db33c722351fd91d602393788a

SHA1
a1f3cb0ddee9bcd70462cfa965a1e74a0def09ed

SHA256
974580085139d3ee631174aa173db3e5115a4e85b0e8cdc5219d819fdae96472

SHA512
a31b1ac7680fe07fae40641abc02a158bfe5962299e3ca3b30af2ae87cb2a59555a2445baf714b3ba62a78da8daa82b3661e7e48be0ecdf2924537b6bee7e1f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
7e226ea3a235faf9b761271bf45c2575

SHA1
0d1e4cb8fca53731a32152e94058e44310e92c21

SHA256
252c4a219c53dddd961c5784733a8c618cefe4461ac7cad5289f68f0b6e50791

SHA512
d2da2b2d5eda462cd5b803b5e2e44857fdf5ce43f50866de06311c907314e5aee1f33f8f226f61606a596caae92bbfcd8104f37000e4cbac9505a6858a0874d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
62018c3920b734a1e3bb3e75b4242f72

SHA1
0470ed7e3e7e3b642e96f47c5f21c2eff62ef795

SHA256
7f518588e04ba302000b053e5a176f89ff3a9b60d4e69aeacb2f9c8aae1f544b

SHA512
d3123bff1cf89a2d5a17949f817049dd059b319e0d2534cda34135c0278efa168e4e6ef2ea221237b22a17ad5011fdf959ecdd0a1cff0757d5037cb83f78a1cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\a16eb172-4de5-4598-b9eb-4b924f09f309

Filesize
982B

MD5
d605e72e545c43886d5e6a8c8eadc6b3

SHA1
0ecae96497af0b6be56e23f89afcbd2a9e090b9e

SHA256
199fa20cad8edde8fe22d7c4302fa28e4bbf519c7b87b74ee70b3ddaf6973344

SHA512
1331148e18d527d96e7d84bea52d35cb1a0fadbb38b5ddecac1fd239a1a3709f90a7d4dad6c07e1dcbe900f85af9753ff2d691a7aff98a9158438000f3f8dbbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\f0afaa9f-ef8e-44f4-84a0-9f40d16d39ad

Filesize
659B

MD5
de8da8e71129d85e0231d1c17daf7f1e

SHA1
3da3dc02b78a8f5fdf992ded79e919dc80ef108e

SHA256
d91a77da0bc2068141dcaaa50495095129cd283f9e30c3db962a209f33811a35

SHA512
72ef706cebd5dcdda03226308de0e5e71f31da53715eb493d3dcd062f8d10addce63062d4bf3affc56116687db1e61c3b917faae0ae5f98bdaba8c825066a9a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js

Filesize
13KB

MD5
16a2f001447c094656d7474f728ce5b3

SHA1
27110d691f01af92aa41682d848c61a324e99513

SHA256
a39f3998bdd69174a7e6d80c1358546aca177bd797970b0688bd4e26880501f2

SHA512
31e1a40197ce212fc80023f3f612fe008670faafc7e6863e7049870ac216ee8cf5a2b3bb3a55d860ae9c208a89d5bcff608b4b6f1bf23b9a05072f36fc0a4bb3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js

Filesize
16KB

MD5
abad128aa1900ab47a63e7fd43d3d402

SHA1
ba19211ea486711f10e936c4c2a6c9b4ce054944

SHA256
93b29b9a6e7555b136c0605f5b7ea8fb14d3618707d82fcaaa83a7ec030e11ea

SHA512
22c9be75e6b3f2af94d29186016b93f226990241f9b8b1dfd72fba91fbe15acd682a0f68cddae91e51ac08df911d050b466c931080cf59e8e9d1ad6624764e66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js

Filesize
11KB

MD5
cb15bda23f8b5709cba4afa30b01bcca

SHA1
aec29eae952027a45987ceb54dcf3f56f5157570

SHA256
cfa7365f934842014f0d5df1607f57d97ab433ec58cba747e46ac420d2584d3a

SHA512
1f35e753cb098417a23066e825cdd9c93874ffc0e29e8edbcbe81f297be12f288616d4c782931a2bc035e1233a8a3a02e6bf6264a31af82830238a25c8f5dd35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js

Filesize
11KB

MD5
191732d8aed1c7379257e33225e0dd44

SHA1
1464ec727b6bdeb5a6536a9a823f1b3470dd9d03

SHA256
3f7a8e3353ff9893d30d8f4022d31d48df47a90009a2ffe1534d21a2788fd5cf

SHA512
9687a071552874e7625fc53e3946c3c97ebf3d08635cee013ee1076f242349dcac86e93210cbd48e888c0c7927e8ba2d1c49f81563c59e4f9a086d51b116fbee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.1MB

MD5
a7f90f8c67bbd52ce7e2da514e6b4ce1

SHA1
d1b3e94cff5f28de963d0d65d874091e809d27f5

SHA256
5d662b0333da65547fb0755c1bb0cc0f41310ff19dd7d0d1f2dc69c6f1e4a9ae

SHA512
4614ccaf133e3899683468eb968891456124b1e07076ff9e122b6263024bd79a1b5baf3f27cbc960dd63aeea7bb89209df6fb34e934a0d69930a4adb1301f85f

Download Submit