hxxps://go[.]eu[.]sparkpostmail1[.]com/f/a/TeZdKDVSihVahrYyiCrP-Q~~/AAGCxAA~/RgRpNb0OP0QjaHR0cHM6Ly9sb3RhZG1pbi5pbi9kdWUvY2lnYW0vaW5kZXhXBXNwY2V1QgpnRA44U2evTxxnUhJ6YXJnYXJAZmFyaWRlYS5jb21YBAAAAAE~#ZWd1ZXJpbkBkYXNoZmluYW5jaWFsLmNvbQ==

Analysis

max time kernel
123s
max time network
152s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
06-12-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go.eu.sparkpostmail1.com/f/a/TeZdKDVSihVahrYyiCrP-Q~~/AAGCxAA~/RgRpNb0OP0QjaHR0cHM6Ly9sb3RhZG1pbi5pbi9kdWUvY2lnYW0vaW5kZXhXBXNwY2V1QgpnRA44U2evTxxnUhJ6YXJnYXJAZmFyaWRlYS5jb21YBAAAAAE~#ZWd1ZXJpbkBkYXNoZmluYW5jaWFsLmNvbQ==

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	firefox.exe
Token: SeDebugPrivilege	1852	firefox.exe
Token: SeDebugPrivilege	1852	firefox.exe
Token: SeDebugPrivilege	1852	firefox.exe
Token: SeDebugPrivilege	1852	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe
1852	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1852	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 3572 wrote to memory of 1852	3572	firefox.exe	82
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 4964	1852	firefox.exe	83
PID 1852 wrote to memory of 5100	1852	firefox.exe	84
PID 1852 wrote to memory of 5100	1852	firefox.exe	84
PID 1852 wrote to memory of 5100	1852	firefox.exe	84
PID 1852 wrote to memory of 5100	1852	firefox.exe	84
PID 1852 wrote to memory of 5100	1852	firefox.exe	84
PID 1852 wrote to memory of 5100	1852	firefox.exe	84
PID 1852 wrote to memory of 5100	1852	firefox.exe	84
PID 1852 wrote to memory of 5100	1852	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://go.eu.sparkpostmail1.com/f/a/TeZdKDVSihVahrYyiCrP-Q~~/AAGCxAA~/RgRpNb0OP0QjaHR0cHM6Ly9sb3RhZG1pbi5pbi9kdWUvY2lnYW0vaW5kZXhXBXNwY2V1QgpnRA44U2evTxxnUhJ6YXJnYXJAZmFyaWRlYS5jb21YBAAAAAE~#ZWd1ZXJpbkBkYXNoZmluYW5jaWFsLmNvbQ=="
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://go.eu.sparkpostmail1.com/f/a/TeZdKDVSihVahrYyiCrP-Q~~/AAGCxAA~/RgRpNb0OP0QjaHR0cHM6Ly9sb3RhZG1pbi5pbi9kdWUvY2lnYW0vaW5kZXhXBXNwY2V1QgpnRA44U2evTxxnUhJ6YXJnYXJAZmFyaWRlYS5jb21YBAAAAAE~#ZWd1ZXJpbkBkYXNoZmluYW5jaWFsLmNvbQ==
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa70a6a2-50ab-4b0a-8b4e-74bc52bffa2c} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" gpu
    3⤵
    PID:4964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24601 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fd4f885-1a3e-48f2-9908-6defa73f0e14} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" socket
    3⤵
    PID:5100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2928 -childID 1 -isForBrowser -prefsHandle 3300 -prefMapHandle 3040 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e57c6ec-6917-439e-9956-f19f5534897f} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" tab
    3⤵
    PID:2188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3052 -childID 2 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad853025-72fd-470b-8530-cfa85a7ca1a4} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" tab
    3⤵
    PID:2148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4208 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4120 -prefMapHandle 4204 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cade7a3d-d5c0-438f-853c-5f321931f6a9} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" utility
    3⤵
    - Checks processor information in registry
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 3 -isForBrowser -prefsHandle 5268 -prefMapHandle 5264 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b38a00f-3457-4374-abde-d9380ba10edd} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" tab
    3⤵
    PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 4 -isForBrowser -prefsHandle 5428 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4214bcf-20fc-4a91-b39f-0af084ceb05a} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" tab
    3⤵
    PID:1108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4332 -childID 5 -isForBrowser -prefsHandle 5604 -prefMapHandle 5608 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0285d389-b102-4e27-a68f-dd15f4256d0c} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" tab
    3⤵
    PID:4500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3316 -childID 6 -isForBrowser -prefsHandle 6032 -prefMapHandle 6028 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fac19c8-dc22-418f-a6c0-e701663e555b} 1852 "\\.\pipe\gecko-crash-server-pipe.1852" tab
    3⤵
    PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\enjqfdim.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
57dbab3eccee23d566c60c7837f52a52

SHA1
5f7bb516270f8ba72b06f0a55cdfd4b13494ece7

SHA256
6fecb4a76831cd10f6a06e4e3a192afdd7c64279f64d392991b3f276ae8a0b39

SHA512
b65cc785872e33aae9e47df9868d41ae173b2b51a2d03af1a94418d7e930c8b970bdb39aca310f428b4d56d9fc0f782f1e52f5ecfab21bb7315d54f88ffe98f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\enjqfdim.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\AlternateServices.bin

Filesize
6KB

MD5
31cb52f9b88f71f563c12cbf4e70c4d9

SHA1
4de026ef5df034a9a461759b80cece0669a6512a

SHA256
e981fcfb8e6658d6a146e8b52dc034b0914b3a41970bcd23684de3a156146771

SHA512
d708741c571237962086db56d7cfa0fa6d95cc9ba5457a0acb2b1f9c9687a577a6d5c80b816af0099736e5608dd137279e249eb6b845eb601187e7d8290feb61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\AlternateServices.bin

Filesize
8KB

MD5
028354053c70553e9486de51d99261ec

SHA1
ac6f50b922d4c23a83507e43d7ae4e418eb46a32

SHA256
5f3900d5797ac543a53815de518ab5b4bcbc4ab88abbf7bb7d18dc417d8f4f92

SHA512
109f0f36932abb7c720086d32708544afc169c7d6010f293a9babd4bc8fc4121528ceaa99984b35903b2bf65e743925c640511cb78366c5f50e01270f8b6d966

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
4beecc6c917910f6ba85ce596ae94197

SHA1
31915d63d22dd0e4b3e2a654f78ea38e3707a8c9

SHA256
acd458efb8e6d2f769bd901aa9b4d78bfd6bcf5e91ccefeed66405ab3f3f2ad9

SHA512
4122e359377e1a47b2ae81b8f53c1145d19bc524e400d900a188eb703f340a9e65b2ec468fdd45fd6913742c47e4e920f8ccefa1984d5723eb39d32510ac5655

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
bfb8ba5580af6d4747e3c65d3ee375d8

SHA1
2f81dea716e33aa8a8f1fa8c539cd191f59829dd

SHA256
fa93c2f8a32ecb45ffd8cb6e98ddb3b6a9ab0286b8b0a56d35530f03411b3a56

SHA512
e7dcab8be000f2bbb5ae2c99d8bd6069234aa9822443d003926a9668ed9657a86b818dfb50c2bded4659890de654ac458fda77b9073344b2f5af249ac2abd13d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\pending_pings\003951aa-4d14-4468-a9ae-afd0772b2f30

Filesize
982B

MD5
e9918d66f78af1eff2befdd7f3c81e9f

SHA1
4936dde5c481ed143399c32f896e1841ac617cd0

SHA256
608ebd66b39de7e54a603498017c58932741bbd0e234534b7c905a7110902618

SHA512
f8809c354bacdeca72b168d7344fc09656ddb0908e171e8f29a255c92fc58357147c2154520d512471b00d73238bcd5ececf58578c99523383a42342e807eb93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\pending_pings\443b319e-e0a2-4be6-befd-772a69c9e477

Filesize
26KB

MD5
a281e274cc923b8ba0e747189770e031

SHA1
00dc61c4f0b927850458a204b11816f3004af787

SHA256
f9c93b81cc88df133a07b14178c94b8f6e7296ef1c8b57357e4ec6254d4b1100

SHA512
bb31717d9411881699cf80489a8b291f88d8548bc8be959d1e7de308712e65a8cc116b79758d6d0f6a2f8c0dd99beaeb6f787112ced550e8d14e0ae4756730fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\datareporting\glean\pending_pings\7721b130-168a-4c55-b8c3-b356a074538a

Filesize
671B

MD5
f6082e94dc4058a4decb6d564fa24b62

SHA1
d71c25393c913d5db6f159f1da53e3c0681080c9

SHA256
cb1d9a63bd683414e994d9776a9aa6363adf02baf29810075128a8057e3d4e25

SHA512
534abe59763266539ebe0dd4daa0a9863219333f9495f0e7c37ff37cb2400b66a1d95e397006be4394afae21bce26fc62224ba1365a0c864481d2d576e4301e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

Filesize
1KB

MD5
36e5ee071a6f2f03c5d3889de80b0f0d

SHA1
cf6e8ddb87660ef1ef84ae36f97548a2351ac604

SHA256
6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

SHA512
99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\prefs-1.js

Filesize
11KB

MD5
17d7f02ad90c99cd6cb9105f6fa55a04

SHA1
9d8d1f91e5964a3539567299eced83d9b1a32340

SHA256
0c6bd550e6cf27c04827fd375eb69db2c31e416333592e3130fa9ae50a44f7d2

SHA512
66e3cb9fff8f7f5b9292d2d23cb1ccbda25a123ffeb4a4a5b17283c61fe0020dce3ab2d1e32d7b39b24907c131a61e50c377ec6689869389063e2f9c35edb59a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\prefs.js

Filesize
10KB

MD5
b1b5357e1a3f7c637c5b2b98c24793ef

SHA1
98182614698dc6aebf0cd3b678c48cf2ff7f3a03

SHA256
7d4680eb3cbf9487e157fe7c45add5dc085798437251be547c9e5efdc05d956a

SHA512
6e6f5b5aa589b7923054d2d59a7128afb095d4ab2e768dd2abba6099923e9a9ff219811084e8e19d1f0ef6e9ec79f55462f56a00794dfea320b5a4e3e937859c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
b9ce6ddc22c1febbb9d1066c4767f093

SHA1
38a395f80c5f1915d31320b9f713547edec85ec2

SHA256
65ecd2eb5c80416f7a7a7f3602009c910c7408c7ea1e5fb795a7472ff254a7a3

SHA512
b453e65b4b601283f30ba1dcc9aef8929ed7ba0f22ded41992074b6cdca8f0620be05e474d8c4ad0ccd1aa59b8263a6e8e6c8a1a9e79a20f100de00fbe782481

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\enjqfdim.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
92d55c366e9b04cb8f5d1e901769f476

SHA1
3d69d2bc4789be9d17b9d71c79ae2297a1ad001f

SHA256
46fbc77fe57bfe1d3906e9c12efa98683586470fafb0e51f1c9a9e810fa170cd

SHA512
f9aa35ba22a99cc99d70ea54e2dee1b9b2535778ccc61e51bef984c4885638bf452b7dd1ed07728df41c8271625c783b1ddea19d4a603cc2a54765529bb758bd

Download Submit