653bfeb94f41c3a3e35b39f8f980393fcbed4c4ee1f82c2e82d9f1089f2b08fa

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-10-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

free robux by jan.exe
Size

37KB
MD5

890ee6656ca4c3b83fd466f7cfb985d4
SHA1

b66619a4c85075912452f245ad488698819716ea
SHA256

653bfeb94f41c3a3e35b39f8f980393fcbed4c4ee1f82c2e82d9f1089f2b08fa
SHA512

08bdf9bdedd4921b2b302daa533c314676bb8ccfe2346e07daf19e7eb03142223238865ed80a94841de3b8269be7ee7436b297354473986986240dc4f08186ff
SSDEEP

384:4yVvEiTbTvpWNcZ0y8fvCv3v3HLkacparAF+rMRTyN/0L+EcoinblneHQM3epzX9:JV7TZ38fvCv3v1cQrM+rMRa8Nudrt

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1680	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\78bd20d76fe16a23d2ebbd3cf81edd1c.exe	free robux by jan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\78bd20d76fe16a23d2ebbd3cf81edd1c.exe	free robux by jan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Windows\CurrentVersion\Run\78bd20d76fe16a23d2ebbd3cf81edd1c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\free robux by jan.exe\" .."	free robux by jan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\78bd20d76fe16a23d2ebbd3cf81edd1c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\free robux by jan.exe\" .."	free robux by jan.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
1	7.tcp.eu.ngrok.io

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	free robux by jan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe
3776	free robux by jan.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3776	free robux by jan.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: SeDebugPrivilege	2768	firefox.exe
Token: SeDebugPrivilege	2768	firefox.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe
Token: 33	3776	free robux by jan.exe
Token: SeIncBasePriorityPrivilege	3776	free robux by jan.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe
2768	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2768	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 1680	3776	free robux by jan.exe	78
PID 3776 wrote to memory of 1680	3776	free robux by jan.exe	78
PID 3776 wrote to memory of 1680	3776	free robux by jan.exe	78
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2572 wrote to memory of 2768	2572	firefox.exe	86
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 3128	2768	firefox.exe	87
PID 2768 wrote to memory of 1936	2768	firefox.exe	88
PID 2768 wrote to memory of 1936	2768	firefox.exe	88
PID 2768 wrote to memory of 1936	2768	firefox.exe	88
PID 2768 wrote to memory of 1936	2768	firefox.exe	88
PID 2768 wrote to memory of 1936	2768	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\free robux by jan.exe
"C:\Users\Admin\AppData\Local\Temp\free robux by jan.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\free robux by jan.exe" "free robux by jan.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {928c96bc-3d36-4bee-80f3-c8c9ae1aab47} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" gpu
    3⤵
    PID:3128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c9b6fdc-974a-4f73-84f6-7aa01139808a} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" socket
    3⤵
    PID:1936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3060 -childID 1 -isForBrowser -prefsHandle 2752 -prefMapHandle 2736 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9e3f113-36ad-4be4-b6b5-be48b2ded162} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
    3⤵
    PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4004 -childID 2 -isForBrowser -prefsHandle 3996 -prefMapHandle 3992 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a5b5816-b4d7-4fb2-a6dc-abb71d3f4f5d} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
    3⤵
    PID:2160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4980 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 1584 -prefMapHandle 4968 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eda23868-f07f-4030-b305-f99147e85524} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" utility
    3⤵
    - Checks processor information in registry
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5384 -childID 3 -isForBrowser -prefsHandle 5320 -prefMapHandle 5368 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {866d8bc0-87a3-47bf-850d-2cf89cea6a30} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
    3⤵
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 4 -isForBrowser -prefsHandle 5616 -prefMapHandle 5612 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54f8baaf-41c2-4709-8836-726f044d10c4} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
    3⤵
    PID:2504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 5 -isForBrowser -prefsHandle 5812 -prefMapHandle 5808 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61022119-25f0-4bbb-af8f-5245448064bb} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
    3⤵
    PID:828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3588 -childID 6 -isForBrowser -prefsHandle 5808 -prefMapHandle 5616 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3c38b58-6d7f-499b-9c14-20d8ad414375} 2768 "\\.\pipe\gecko-crash-server-pipe.2768" tab
    3⤵
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\AlternateServices.bin

Filesize
8KB

MD5
ffc809f942273774f60221d48e1b8020

SHA1
ada786875b3efaa7bf10abf541d4dff85d866ccb

SHA256
3c7fa27e83522bff73883128a7665d0e866f242a8efe6b3f8261e6238c9b9942

SHA512
b1f2aecd66b1d6a47f0119f962e5d95564239e5ebc9945d29113a35a27cc50dd428bf6edbfe64af868dfa71c614c406a8772147b47b56fa7848b737b9ed4088e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\AlternateServices.bin

Filesize
17KB

MD5
70125e7188facb3dedaa2c7e11708dd5

SHA1
bb8065b74d8dbfd56509bbf9d368ab0e9a9989a6

SHA256
93de5d0e30483ae5d62c96c07dc12b91a4d5600cd1f04aff58d198a0e73edc0d

SHA512
42cbda4e522edafffa46e3a68018e31234937f64f290f8271a60095514c72d5f3addc582fbb87a85f3154a4f56d7a66082a2da8d6665d78b274a4143b6eb2b73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
ce2cc6ca80768e88e78ecaae0672e4ab

SHA1
96394d3ffa7f329fb6d87f8f61f0566395f1864d

SHA256
c5f6903685ce9b0dc9460aec19666aa0496bb08ca23a0ba59ba61fe8ca23b242

SHA512
b28c8c55ddbe811d48709d1f7fd3bb39d640ded1bdb26e964cb0352077af9247119d06861b59ac6a39542286fbb8f824ad9fac224f63c299db84d87f9777fc8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
13KB

MD5
61b742d1b6f632c9fb87af3df88452c1

SHA1
b0f56335d5c706f77268f8b1a14212cf0b018b1f

SHA256
b0d5ac182f354a2e5ad7f8dcd635f44298925aa5596b398f35533a6f84b0618e

SHA512
c1922e17fb9df72e762c372952291267f46ea7fafe3ef9828738c203ca295ca89f745f1121b1a5bf8c9e7423c0607b86d126e0cf95d6332df9da1bfa7ae784a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
68625ee931388d8a4137d3c12b211b8f

SHA1
0e234ca21270723b8fa28cf244439c762c5236b8

SHA256
6f753f1cd9e1e8021bd2726979a6058a540253f9620176a7fddc8e30700bdce7

SHA512
7da9fc827b0363a91c7436564ea723c59bcf27cc993c4a4731b6e68386659cd1854c373aba91663ee66b5ce8c47d6be3cbb1162cf88aff5ecea2a76d83eacb7c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\pending_pings\0ca2a7e4-733a-459e-896f-cd44efab1a01

Filesize
671B

MD5
5384ceb44ca67ae300b44170f1719a0a

SHA1
df3f9a6845eb34afbc73171dac79abfe0154c5f9

SHA256
204b80f62b24da9eeffc6a5b47d1279e07d909f091f8cd9eb9453d2491551ea4

SHA512
f89f8c72582a6b100358d871828b3c027995a5b4a8b8cb590d35a658b4ec3270b9cc8aae29ddd9d419bca4b1f38dccedd3a04b59af88d1a5eb57338108347e2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\pending_pings\12b513c4-71a8-4f0f-8836-de0e042e0b8d

Filesize
27KB

MD5
f28acc7aa397dd4d0eeade9b92426376

SHA1
dedcc6d24bfdc528d8d35ae3a26926342e328024

SHA256
e498febaf9a35dc2665d00564b1e882e0f4d977329bc050999a8369dcf15496c

SHA512
626a1cf40c9528410a80df5b18bf675881b6f17dd715e8ed94be4286223a5f8b3948d78d7488cffb86e060a281b24466eee5fb47f933c3167cbc98ec732c56de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\datareporting\glean\pending_pings\68151546-5ca4-472b-8c60-92734751ee41

Filesize
982B

MD5
17e36ea9364e4b6a7f4e2b8a75ff8c01

SHA1
d712cf21e49dd502f35d202f96e47f15916f2782

SHA256
f32a73fa9b65fcef0b8f30f8ccad3093151bb9d183d4357fc31481c88b92bc43

SHA512
653859ac5b96580546ffaa32cd6325ad682b2c9497686184c27a19e7a8a552f9d4525249231dcd998198ad780e16aaf9e1f8f54035f129a1e2336ad87169e34f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs-1.js

Filesize
11KB

MD5
c854c65192283009992b0a8398dc0ac7

SHA1
eb726394de8bbeb5597e51c393e34df37b46bdea

SHA256
55bdf1fdc8be79cef3aceef469918ac403448f0a8a4a93c7a7f624021404a52a

SHA512
efd03033616160413fb4d6a6cba5775d4d34f67bfc9746bdb44cbe327452536911e50375e4cf14697079912a143e8a9af31ee10f6f9ed7f71b5101d9103c3241

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs-1.js

Filesize
11KB

MD5
57a55806b96ad3df5803d96aeb3b58f3

SHA1
0e0d7cb7927de543e80a28909d38e59a05774832

SHA256
5c34cb85176494e3e47f58a6ce2329f3a3ecc41d7242c4f5297556535837a57b

SHA512
1f7a6f7128e6b2454b3708417a1ef7f5d5031d82f7eb456ae0a4eadf0310d9e80cccedb966cbc696db5de981bc3fa5946047d8dd8aa7061e4c3969aae2704d32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\prefs.js

Filesize
11KB

MD5
ac394266abec19fe6f6415f596c51c3a

SHA1
52769ea520ecee2096002218ed809a6dce18fd34

SHA256
2c77d9bd41e882315851511a88ca2b8796bc0966beee5ec1eafdeb6d7d2b7a60

SHA512
690d5a786ad129924b6c3dc5e4d773e98629424bd180115a4d6381cf65db0a1fec22d146e3ee34b4c2970719d5668222aad9df5a3c0efaf81d1f5ad5793cec04

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
da06cfdf4a0d99ba6e00e0ab9dd423d3

SHA1
d6a0ae09b6391c20d34c5f0c779b963e91bbe06f

SHA256
d4b127d9b98ec14b8e429a0b88dcf4199dc4cb7f99547dd748a9a0eded7f5f79

SHA512
0ebabbe05018361ff38fa33c41a639758ef8811214d93d288f51a5889e28de551a195cc59663bcfdc87f5adc944e2bfbe61605b861aa9a9e2356462ec296e784

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rl5fa9qd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
368KB

MD5
89f57808e16dbb6ac520d1b7e5f8d7c3

SHA1
b1a85eeefda42b9347e841b0a0642bbfc9b669aa

SHA256
035fb45365a1154067c3f90c98f4dbca8af79b03264e3e0c61c2a91f6166dc39

SHA512
1df693e70d06e63618c406e1c1a94b6f2c45007c395627e9e5fda295a185ad1d5ce44076e5689cd3b39f4a9e12843bce750007688fc79cf5f6e7fd7a1c562029

Download Submit
memory/3776-381-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/3776-315-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/3776-0-0x0000000074F61000-0x0000000074F62000-memory.dmp

Filesize
4KB

Download
memory/3776-5-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/3776-4-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/3776-3-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download
memory/3776-1-0x0000000074F60000-0x0000000075511000-memory.dmp

Filesize
5.7MB

Download