222bb350d0ab241083b2d8c6f29ed82d63f07aaf3f35bc4f32bfa31281eb73c5

Resubmissions

21/11/2024, 10:39

241121-mqe7pawkcl 1

Analysis

max time kernel
146s
max time network
152s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21/11/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Batch File Code.txt
Size

200B
MD5

a79bf388eeb5e5f6b092991d7fb803cd
SHA1

39d7c1deeb977bc02ad053e7eea870d71ba1e8fe
SHA256

222bb350d0ab241083b2d8c6f29ed82d63f07aaf3f35bc4f32bfa31281eb73c5
SHA512

62c6e3ff34c07b2bdc179adb7013bac68f202baf31b7529071baff80210cf69a50e8029b8aa493a3f8954cd299437447a4468bf0e52717a14c2cece23e514262

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	firefox.exe
Token: SeDebugPrivilege	3664	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
2716	NOTEPAD.EXE
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe
3664	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 4244 wrote to memory of 3664	4244	firefox.exe	95
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 3668	3664	firefox.exe	96
PID 3664 wrote to memory of 2500	3664	firefox.exe	97
PID 3664 wrote to memory of 2500	3664	firefox.exe	97
PID 3664 wrote to memory of 2500	3664	firefox.exe	97
PID 3664 wrote to memory of 2500	3664	firefox.exe	97
PID 3664 wrote to memory of 2500	3664	firefox.exe	97
PID 3664 wrote to memory of 2500	3664	firefox.exe	97
PID 3664 wrote to memory of 2500	3664	firefox.exe	97
PID 3664 wrote to memory of 2500	3664	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Batch File Code.txt"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc72b08d-bcce-48f9-be73-dc7da8f031b9} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" gpu
    3⤵
    PID:3668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb9123fb-f02b-47ce-9b29-2a8f17b753e1} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" socket
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3268 -childID 1 -isForBrowser -prefsHandle 3176 -prefMapHandle 3308 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97f93c63-43b6-4184-8be4-09d4fc5b9c61} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3728 -childID 2 -isForBrowser -prefsHandle 3400 -prefMapHandle 2808 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ece880c6-9072-4fb9-8290-065946efbac9} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3716 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4816 -prefMapHandle 4836 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c9951d7-bf6c-48d3-b712-aa954db28061} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" utility
    3⤵
    - Checks processor information in registry
    PID:1300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 3 -isForBrowser -prefsHandle 5640 -prefMapHandle 5644 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49c95e00-85b9-40c9-a596-5586017434eb} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:2396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5624 -childID 4 -isForBrowser -prefsHandle 5800 -prefMapHandle 5804 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fde4df42-3470-4cd8-ac16-a39dd2a3df72} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5584 -childID 5 -isForBrowser -prefsHandle 5576 -prefMapHandle 5004 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {750c33f7-ae65-4667-a509-2a94d55f61e5} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3860 -childID 6 -isForBrowser -prefsHandle 3436 -prefMapHandle 4216 -prefsLen 27253 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0a3d33f-6b8a-4ac2-b0a8-dcced0082eb5} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:4264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6340 -childID 7 -isForBrowser -prefsHandle 6332 -prefMapHandle 6328 -prefsLen 27253 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f77d2c4c-1e51-4f54-9721-9b1c0889641b} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6312 -childID 8 -isForBrowser -prefsHandle 6484 -prefMapHandle 3868 -prefsLen 27253 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a0da406-1819-41af-9d90-87871b5d831e} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6716 -childID 9 -isForBrowser -prefsHandle 6712 -prefMapHandle 6708 -prefsLen 28040 -prefMapSize 244658 -jsInitHandle 920 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {519c07b7-041d-4912-a091-d5b31fc156cc} 3664 "\\.\pipe\gecko-crash-server-pipe.3664" tab
    3⤵
    PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dom8snqr.default-release\thumbnails\b81ffa61cb04647d43da798dba2cf05f.png

Filesize
12KB

MD5
079451b56b386b0e712334ebd57d9fcc

SHA1
a595e7dcf156855a05fc0c26182c100c06f5851d

SHA256
9d66a4d5f23724ded2e56820fd9788f31d8b7d2e3b552a8475c67222ad994506

SHA512
4587ceb81a7872583f5c6e18dfeb2138dc7c07b275ad7fa48f451237cfde12839029928180048444726105c7bba4db11dcde26ed03ebfb55958a952b38168a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\AlternateServices.bin

Filesize
7KB

MD5
4b61dbbe5644a693f247ebd6d7900eb8

SHA1
55b5d2c100a60cd8e84419307d38e3d1dcefeaa2

SHA256
54ae9daf34be6a6db913b642cd868bc07eec09df6c7ea8e3662a0ad520760369

SHA512
0d1aeab6096b37b4e601eec9c9b8d6d687878614d2ddb619468cc12391b50b75f2c34afcd01154efc957c292078bba98b45b785cf1ec1c1a1d3b6b449f7ea0fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\AlternateServices.bin

Filesize
15KB

MD5
fc7a5d26f82529c599ac9f3f5dbf30b5

SHA1
882dc16c319c5d8df1ceb44f21366567b83bf667

SHA256
b3e1df0259a5b00bca7de8c43aeec94c6ecd83fcd7c24d98598501c4780dba85

SHA512
1596106c8b97013133ee718217380301a009445867c4072316541e318fb907357be2817ff1500729184b090649a52101729dd1ed2ae999ba52cf88cf51f3811d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
2da259f3f7cacbf07c32d981f0533aaf

SHA1
3f1168b7b7115c87455c7e61e014aff258a0aebd

SHA256
b6ca24e2160789b0288c8a1fd16ff0353672ef2dfb00d154051b117c7701e64d

SHA512
68488f78bfbc960a30744a57af7e7d54dd6f18e6511763d4a1bf0eda2b163283ff9ae1bc95546a6bed8f0bee6dc251628021c5697f4d4e9bf5e8c7e2503ce802

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
68e65e94daa59db84c6862f125ab4189

SHA1
42db5d36e3cea45a338cc1bcdb11a333b2226f91

SHA256
c638ddf7ac66c7baf776be6f0ea832b99884fbc0596cdbd5f4e73256f51b4b26

SHA512
709a46945670aae91b8c4b22083e2b0619419cd5297ab9c56f3f9ec7058dfaf2dc724565ea13179efaafd09e87e17b05e87c50e42e539011d6a68568a2eb7475

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
86c302e945194eab6145ca34d5d19ee7

SHA1
e0b4f122138d277675c30e630a83d692b5f66c31

SHA256
65640dbd0b7f2808992cee4b263cd1dea3d13f9e0b17f7e2133e76e31627763a

SHA512
703859505a2f588e007dc8c69ad844f3de3c5446bb018262af3a2a5af513433a3f26fb8b520d6660d7135611d6a3c025ddff6dac586c489825b59459f0151904

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\2689a17c-3c04-4b88-9b66-0219d78951bc

Filesize
982B

MD5
1f38ef312407b1f57785735d12475c3c

SHA1
c1c48165a9ec7b9eed4e42e2f4675046b657c797

SHA256
09fae793f254322788941373af6a00265a82fafa15fb458c74d04404de1f13e5

SHA512
55957afa890d59939a71a73bc37d6a9bb4caefa9fdc0bc68ca6a0026f142f0920ab52920dc5c7d9a6d93a2d059613d560a9c9c226ff0033c8ffef93443f2ceb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\9bb74ba4-17f8-483d-8edb-1d489500c611

Filesize
28KB

MD5
58c536fbedbcec030d0be3f4777f932f

SHA1
ba0f160e0d42a2cfc19bc6dcb98d7ebacb6956df

SHA256
4512a6155713150a9b377ead66291eb24cf5633afd9b3fd188ce1333f31677aa

SHA512
65f57d4f24a55aae435c03bfa1008048f681b69cf8c692afd7e933738e7753aff4f7e55263f9f2fcd86bad4357fb2633318a66f9f89441046645ecf76b5428d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\ad2a994f-aaca-448f-8a88-2ee831ebdd46

Filesize
671B

MD5
ec36b875262c4722802a2db0e00a8db5

SHA1
52ea9ca41a89390f1316433c7104846dc9efd7fb

SHA256
877eae79ea70a24ca5b361f8ed8ebf70264073d9b372384885928d9b2da88db6

SHA512
cad95b512a27c811da96dc293624aaea7ae41b70d2e555d252ac6a01c2e98497d37a1f939fdc494c4e5466641c626d09dd5f8062ce0b362c7fc90c09895d1bc3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\prefs-1.js

Filesize
10KB

MD5
44dac8763bdfc5f5ee510e7d32f783b6

SHA1
396422ed5e4c14071f1c1cfa96220ff506f184ed

SHA256
4c93250b21e88d9fc324bcf36d85ee6c47bb6a31f825872b7ea7b2bcbb212e86

SHA512
246d9b6ced9b0575da4ab244c920b45878bb66836877893b66ed8562daadcc95665020a8a361d2880be89b48af4ecf7785f1ee8ddef5fe01667344d852d2db39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\prefs-1.js

Filesize
11KB

MD5
5a70421ebb065c25e5d66c587b643728

SHA1
6e5eefc826327ff033a5a3b8bdf20508004feb22

SHA256
3ffca8c5c6465233e6e31f9f08340c9313167168845cf3013e1f54b3fa051d3a

SHA512
0761e9529ab5dff2452cc2dfbc6804b410f83abaa7a474540a4fdaabda713d0cc754ac9f6420404aa4b986a2cfa7a29dac2bd91ea5320dfb2b0c807ee598b691

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
fcfa4d0f0286dc0489fdfe454d5d5feb

SHA1
a91876dae19332e8b1b567f2f73d3f9ef8c9b605

SHA256
a0f0e43054367b2275924b8dfe7e759fc1a900a05bc27b1b975742aeeb52e3ea

SHA512
0bb16848e9341842cd12346eaa8aa3983d4c0da41e0eba19873a21a13881461499cc48d7dea980ad02162aeeb1a11310075b37dabad8b082c1099fd682a63ccc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
fe4525148336eb3111cc8c0165625a08

SHA1
cb020268c93349190c1e0e7ea31c7a0a02d3d97f

SHA256
3d259a886fa41e7116e9afe0ebe4b7862904342d2a350026aa4ba8733abf096d

SHA512
01da6b9fe67b1ef50256918edd9171648728f1744f91252f125c6e50e4740a922c00489560fcbf0a970b72287962b0a137ff60392f47d08402f55c1af4e4eb6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
910e82a4e82e680636dbddc74a0bd97a

SHA1
cbaa0084e884ad375b856f23efeeed642c75935a

SHA256
768d266e45cfc93758381015645d360c6ab67dfc290bf9b30bb71af28d6b5c7d

SHA512
12b3db56660124b3b36698fe0bb192db6b2966840ea070775a5582bc3b05b6ff1c91dfc9e94a5b9f61b1bbd256f237218342061a42c515d42fcb7577d1c49803

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
afca50c5dc71ccf9f48f61dbdebc5bd1

SHA1
513e905138bab5b134f1a6d8bbd1fae7579cc8af

SHA256
314eb0282d35e69f1d5ddf02c140b5d5819e3ecc5d2825ccd87e6f11819ea37f

SHA512
918d0cb4065f43bb1652b67f8034704d05c2065d431101c37e19e13ea645f0b331da60eb644271092405cafd862c9845a79aac1c436bc25d922fb846b9eed221

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
592KB

MD5
913e3d60082114fd50a2c4182fafcc78

SHA1
269477eedc91fc23a6928ef8e26c806d17747892

SHA256
42395737f24a9383f8c16075847ea44c0671e6cf43b4f3ad296b05e63d7834d4

SHA512
f00a63e266a1230ee01fa58a8b58f2ccb12066260fc424592a39f0bce5011a06b46b789616dde46ea9fc7225f4e22052083f46f2f3b2aeed2719060fda20c6ac

Download Submit