hxxp://parallel[.]life

Analysis

max time kernel
430s
max time network
430s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://parallel.life

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	firefox.exe
Token: SeDebugPrivilege	2156	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe
2156	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 4044 wrote to memory of 2156	4044	firefox.exe	85
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 1936	2156	firefox.exe	86
PID 2156 wrote to memory of 3960	2156	firefox.exe	88
PID 2156 wrote to memory of 3960	2156	firefox.exe	88
PID 2156 wrote to memory of 3960	2156	firefox.exe	88
PID 2156 wrote to memory of 3960	2156	firefox.exe	88
PID 2156 wrote to memory of 3960	2156	firefox.exe	88
PID 2156 wrote to memory of 3960	2156	firefox.exe	88
PID 2156 wrote to memory of 3960	2156	firefox.exe	88
PID 2156 wrote to memory of 3960	2156	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://parallel.life"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://parallel.life
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51ee0049-2aa2-475e-a323-da22a0f8c852} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" gpu
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2416 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f64af38-2dd1-4dee-80bb-5fd6fd7834b5} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" socket
    3⤵
    - Checks processor information in registry
    PID:3960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 1 -isForBrowser -prefsHandle 3188 -prefMapHandle 3184 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d12c7f7b-588b-4d2d-8dac-f5445fefeb9e} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:2384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3876 -childID 2 -isForBrowser -prefsHandle 3868 -prefMapHandle 2672 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7d6dfcf-6eea-4cd7-9f66-c76e5f8caafd} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3812 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4628 -prefMapHandle 4604 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0aaa8788-ecd6-45a1-aa61-9463d0df3036} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" utility
    3⤵
    - Checks processor information in registry
    PID:1144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5276 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5304 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de22b07f-b88d-4617-8b89-a066e63b2304} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:4812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3244 -parentBuildID 20240401114208 -prefsHandle 3220 -prefMapHandle 3232 -prefsLen 29278 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4f544a7-faf5-4d24-ae8d-fbf39352ec8b} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" rdd
    3⤵
    PID:3372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 3280 -prefMapHandle 3256 -prefsLen 29278 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e9462ba-87a8-4c1b-a078-00c7f857018a} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" utility
    3⤵
    - Checks processor information in registry
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4512 -childID 4 -isForBrowser -prefsHandle 3280 -prefMapHandle 4524 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b6c533d-55f5-4cf2-a843-6d71f4480d1d} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:3964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5924 -childID 5 -isForBrowser -prefsHandle 6000 -prefMapHandle 5996 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32ba034d-6fa9-43cc-a1f8-755ccd0391cc} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5916 -childID 6 -isForBrowser -prefsHandle 5908 -prefMapHandle 5904 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21f83860-b7f2-4f89-926b-af4fc0bf2b38} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6808 -childID 7 -isForBrowser -prefsHandle 6956 -prefMapHandle 6952 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d00a4ff6-2592-4959-afc7-2a53f4620565} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:4784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6308 -childID 8 -isForBrowser -prefsHandle 2780 -prefMapHandle 7152 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {474731ad-e653-41f8-b6e4-9781e0292529} 2156 "\\.\pipe\gecko-crash-server-pipe.2156" tab
    3⤵
    PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
ba9422c9ebe8eb8312240aec542ea9ee

SHA1
37dc13e18703c0f89520d6a0ffa0ef52efe3e194

SHA256
6f791dbf4e354532613d235a627bcbbc9a19e6ac4b342a67460bb581fc768daf

SHA512
55f67f95c18a7316a5c6ac16036f1092ecdf4be31c47362990eedce8510c076b11d20d27199c65eadd2798c4cf4c9015b10d1f1c747bd86b0d823660a3a435b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin

Filesize
8KB

MD5
2ab819bfea13bacef2fa3d6f12b69933

SHA1
5587beec4535110bec658b2df527fe7870bc0841

SHA256
bc73393ee1693c667465d47e818fab149b581ef90e023a5fa1b8f7ccfcb5852e

SHA512
80ecf9e17df7abbc3d430e5a42b7757e1231761ad7d6107ede6e8fe70c919b9185c4002340b422493c20858014cc189bacdbfca5754f74d84a7408584009d66a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin

Filesize
21KB

MD5
7b335988876ec486ba2411d0639aba79

SHA1
e9bb146d823ea971ec5627c9390e3a7bed630522

SHA256
a275b04f3753499150313f4223b0eebbf92e51e0fa715a4591e24504f0d06877

SHA512
02039751b76eef8516060f7530ee53dbd094f3990a2ec2dc2753559df6dc1bfcf429df383e53746a7f434e1051f77561065669dec813f761c795d8e8edfd2ca8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
04a75825f484848c0d84c7aeb6148b22

SHA1
f77c929a2a44702c112a1250163987da8d9a930b

SHA256
7c30deb6214f40afa96c671e98dc10ee9d18cda4effa2d49fede1936dcca70c8

SHA512
f1d9285fba56e5a703ca85e4372cb3e5837819ef812106043a971d915d9139695638de8c88d3916e5a1407b3ef3d38e720d092d7657fd483b0c30665b7e2234b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
cb311cba7f6431e05c7376ac5d6db52c

SHA1
7d08fc9258fa9c39ab197a3b9df0f7d4584b970e

SHA256
31f0f22fbccb697cfbd119c6748e28fb7d3ae509abf8b613b175e918d0caa412

SHA512
e29067487eb8b2998822a0f754770a40cdee2b4f9887c95e1ca143b992e61f4ec402f324bd7b5ec6eb6f931c8f60c3574c2f9cc25555797ad55712c2987dfe2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
5e0f56b01cfb2a36287f53bc2e787c9b

SHA1
71d6acd77d1f7271e9799241cef6c2ed1abf56ac

SHA256
b4b851d218d76dad604fb25f55829a9e0285396b3cdfc9e70d74fe790ea47406

SHA512
c939933e3d8201564d992fac2b30f11b479487a0a81114af5d767f035c25ebeff7770e2f96edf93d7a1dff1beb2d70bc5b37c0477df26552631aca396fbafcc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
519d5b6b8b6752a1cd0969d57be1d2dd

SHA1
4e8609db464c275f25634932f1cd9d837337f86b

SHA256
efae52675c83f2f48e4fe4af9dde7a68e04973adac7a34cd6330ba4099a65e0d

SHA512
71b1272d05595a93d545df9b525fdfea6c53f3ef7a922c9e0146c09166d447baccc0e11b411557f96adbea1be20fc44dd3cd60250f098d2c3f5e022b84ceee92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
c6c05fddeeb78a6b804d64c5e935f4f9

SHA1
a6b48d2ce604c889c0838a2132fadf1b77c2799d

SHA256
6b2a1d31f0374dfbb7f17f99fea3c898bdce845efd3f5712fb9a93141bd1c3db

SHA512
d77a0f6feb0d08622394c42429a0d8e348c5cec9f7c4c129ccfcfffe1026fc286089193a4153751e27b5b4bc315cdf23827d9996bc53e32607ced783a04fb4f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\1ad58b9b-afd7-4f88-83af-b5c9485a7118

Filesize
655B

MD5
777706251f741c9e0c9841ba0e943f98

SHA1
9cb56a147ff82e41dc6e04c3d4c5930916adaffe

SHA256
39e611dc60c6c62c13ca72ceaf9e8bbf4a98b4dfc8a99f1875bfd665813147f6

SHA512
289a051181a4a472b2f8395a5dfd48c3d97e1acfd512d854e9fc7fc5c2e197ade7cda4d868077fc61b36b0a10640691d88ab6bfcf2b04140ee42485a7106df24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\2fb7c5a6-93a2-46c6-8e72-3a490dd22c1c

Filesize
24KB

MD5
a3021801ed287edc147220cdd4ce600f

SHA1
9dd6505b7e4538c83e5dc1680cd8b946133baa1d

SHA256
e26c85a42f519cb23835fc7935e08ecbb3dc6559b2e90aa10de1ad29fb2f25d9

SHA512
c85b3c39464eecb76bc95853be5e8a654c57538bad0d97ef73cdbc4a849a86fc6fce0db3eb37a613c22f7009957bac3acab2ae49729b1bacc4d8f151ea6da8f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\76d5720f-f2ec-4a3e-ab06-a58b22f28a56

Filesize
982B

MD5
e31701540c6a3d5468edeb9fcf846fb2

SHA1
bf10999d55742015f8a1641c4a57e333aaf7d72d

SHA256
8f7ba0cf3f33d12a977151565b223b1b398c4f5641837dbb9acb8ec4a19cffe0

SHA512
296ab09c1ae3cdab0238cf925e72ed47c9482adc32f741496a987bfafd4b376698a4c4145f53d0409e4f54d10c02a292835c4cf15b99f89b4c0b2d5f871a601b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\9af6a2ed-6066-40fc-b089-ea7ae9c9a4cf

Filesize
671B

MD5
0defef874fe4328d5bd64541ba4cdf37

SHA1
c0b35a6c839a8b0c6639645e8ca6882cab239046

SHA256
d0ecdcb459b91abb5ca6aff11fb22c92094d122ddbe200708f3cb483a4c87fda

SHA512
565f5486695e72cdaa40e05cc73d5f518d3d6b92e02db176f8e7d350ed8e765d6692abc52fe03fd47ed96e77bcc40ffac928ff1413ed5a66be8f450517dd3505

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js

Filesize
11KB

MD5
5b79821e06b3afa4c79fa9aeaa758a32

SHA1
42555489c7c1a16c0ce3fa33da1c0262ca5f9afa

SHA256
c13bc72520d97ecd03b40f47ae3347bef62507b69d731b3edbacf19ab62d1d3f

SHA512
346bff2868a4d51d67e20762e45fc7b871d520231a448e0c365a72712dcaeaeaced36d96c6b0b8e57eb64ec974c21890f2513812f8ef56e231fb7548e2050dab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js

Filesize
11KB

MD5
5a59c881865abef220e8234342228b29

SHA1
2f8abfab773ebc6b4f3e82f756580d1cca17557f

SHA256
e024d27b11a696ce82872da38dd6ade07be7ef4184f95e2aaedda9769ea75636

SHA512
c5c8ea5d55152cf1ee15045d71232bdac638d8527d403e407fd7e59fb9fe4446c760e590c0cce76f77ffcaa538d15fd89b3954d148511d6a101689debbd772b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
f14dbf3f87875cab2903979f7e9ee725

SHA1
ca4adb046f2bcf68e8b1023442970585de71fe01

SHA256
84c67b47c971a1dd43cb34546aff880930c45a9735e8f38825ac6caf11c239a6

SHA512
75c603066f6d96b2e6a9ed1aa44baecf30cfd81a7827ddf7eda8fe9b66b59b5569f760db3bf10b6b1a74a477e86cf72ca01c875218853a513cac9459dee51f80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
63f88ef3686e7129b5e1c4f8e4e99afd

SHA1
4f51dba0a10d593a4dab8c10779fcb7c54c5aecd

SHA256
37e784e08d1b01a6f217f4bc15657b1e0d0807f3d68d18162b269294036d99d4

SHA512
8b5ab5c974728866cc329fd9005709e605bc4143e39fa63c232008857985f2e59286f5a630ff9e4a94ebf7bb42323d6eb5e7e9aec38283d50186320e0ef55b20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
1e93b79e76232a0031941ce15cabe0a7

SHA1
d629392e492c1f992f492a6d8a197c021b55108e

SHA256
4d81edbb2f4a9263079f20f7a4a0dc5f28b2bda89f91b7a92c4c7a317bf2a171

SHA512
d01659aeee34b38898b00573e24d796ae133def0c4f9b89d7677aee780caf9a86301488409b4d60bf491dfdfaf400bd06c85cd29d1c9afc1830da9181e12479b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
a6e935e2af170e9c4554effb910083c0

SHA1
c91ea8fa4823f70dc114c8ffecc262e1a35077e7

SHA256
cbb8ec750b803294e38b08cfe0e8ff5cbaf8ef94e3d25008e626d29dfbc1b639

SHA512
ee8ea574b122643dc0c377ce746b8a1b11eed4e99f7c0a05680d61454f00d70ffb87a346ac78f4400943ab8173b485878286519f33dd00f3cd786d5db2140541

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\storage\default\https+++parallel.life\idb\1266110774XhenMtFEtFTrcx3k.sqlite

Filesize
48KB

MD5
d4541171fddbde4d48da3a0c460784a2

SHA1
a8d9df08deb0c229092745ca816db48b2d61a026

SHA256
5fb1e3d24cf84dbec6a76e7f9ea5adea78481ea6d42a087eefbd67fbfc5af606

SHA512
21bbaa32681ff7842e4708396038b9fbb98cf1f28d811e91a4a51926b7da45eb0a9b2ae5ca1b962193e2eb94be7bf37548260ec5764109b2027a9ed5b247f12d

Download Submit