hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

22-12-2024 02:43

241222-c7x4qazpgz 6

22-12-2024 02:33

241222-c171cazmes 10

22-12-2024 02:19

241222-cryejszjax 8

22-12-2024 02:11

241222-cmgw1azjar 10

Analysis

max time kernel
185s
max time network
197s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
22-12-2024 02:43

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
95	raw.githubusercontent.com
96	raw.githubusercontent.com
97	raw.githubusercontent.com
98	raw.githubusercontent.com
280	raw.githubusercontent.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Trololo.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\ScreenScrew.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
6036	powershell.exe
6036	powershell.exe
6036	powershell.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4044	firefox.exe
Token: SeDebugPrivilege	4044	firefox.exe
Token: SeDebugPrivilege	4044	firefox.exe
Token: SeDebugPrivilege	4044	firefox.exe
Token: SeDebugPrivilege	4044	firefox.exe
Token: SeDebugPrivilege	4044	firefox.exe
Token: SeDebugPrivilege	4044	firefox.exe
Token: SeDebugPrivilege	5620	taskmgr.exe
Token: SeSystemProfilePrivilege	5620	taskmgr.exe
Token: SeCreateGlobalPrivilege	5620	taskmgr.exe
Token: SeDebugPrivilege	5312	firefox.exe
Token: SeDebugPrivilege	5312	firefox.exe
Token: SeDebugPrivilege	6036	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe
5620	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
4044	firefox.exe
5312	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 2468 wrote to memory of 4044	2468	firefox.exe	82
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 1876	4044	firefox.exe	83
PID 4044 wrote to memory of 3524	4044	firefox.exe	84
PID 4044 wrote to memory of 3524	4044	firefox.exe	84
PID 4044 wrote to memory of 3524	4044	firefox.exe	84
PID 4044 wrote to memory of 3524	4044	firefox.exe	84
PID 4044 wrote to memory of 3524	4044	firefox.exe	84
PID 4044 wrote to memory of 3524	4044	firefox.exe	84
PID 4044 wrote to memory of 3524	4044	firefox.exe	84
PID 4044 wrote to memory of 3524	4044	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Endermanch/MalwareDatabase"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Endermanch/MalwareDatabase
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8d754a6-7a60-4b39-b3f3-a7d2c3a57567} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" gpu
    3⤵
    PID:1876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24759 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70f3973d-283f-4dd6-bd3f-f3de4bbbda3f} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" socket
    3⤵
    - Checks processor information in registry
    PID:3524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3152 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 3000 -prefsLen 22700 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b141a70-9aee-4bb7-a4db-255ba50ddcd2} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3656 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 29249 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e403df52-2b41-4b02-9d52-96439731761d} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:1056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4796 -prefMapHandle 4708 -prefsLen 29249 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7ba8e54-2730-4abf-b054-1ab44e867609} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" utility
    3⤵
    - Checks processor information in registry
    PID:696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5164 -childID 3 -isForBrowser -prefsHandle 5180 -prefMapHandle 4472 -prefsLen 27046 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c98a538-f035-4782-899b-462c95f13fe6} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:3872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5324 -childID 4 -isForBrowser -prefsHandle 5332 -prefMapHandle 5212 -prefsLen 27046 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b87b0ca-4afb-40e4-bedf-dbe937174133} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:3688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 5 -isForBrowser -prefsHandle 5548 -prefMapHandle 5556 -prefsLen 27046 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1057783-16fc-4518-8b67-80608581a30e} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:2420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3568 -childID 6 -isForBrowser -prefsHandle 1524 -prefMapHandle 3552 -prefsLen 34757 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef993f8b-7645-4426-b470-b1ee3f8025ab} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:2880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6720 -childID 7 -isForBrowser -prefsHandle 6716 -prefMapHandle 6688 -prefsLen 28222 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afe18f97-37bf-4a20-ba76-a3486c3bfc67} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:2012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3632 -childID 8 -isForBrowser -prefsHandle 3568 -prefMapHandle 6836 -prefsLen 28222 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab2c5876-2f2c-4d36-a93b-30a17aa209a0} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7024 -childID 9 -isForBrowser -prefsHandle 6888 -prefMapHandle 2756 -prefsLen 28222 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc29c43d-7390-4442-9d42-e2a2295ee0c3} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 10 -isForBrowser -prefsHandle 6840 -prefMapHandle 4564 -prefsLen 28222 -prefMapSize 244658 -jsInitHandle 1324 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13be4834-8834-4074-83fc-dcda681b7464} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" tab
    3⤵
    PID:5184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3916

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5620

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4084

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3000

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:760
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1852 -prefsLen 28742 -prefMapSize 245077 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a542fef4-63d2-47a4-bd39-8f0f15c1df90} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" gpu
    3⤵
    PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20240401114208 -prefsHandle 2296 -prefMapHandle 2292 -prefsLen 28742 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73f9f7a4-0fc8-4a7f-87ff-28ee9f8fde9d} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" socket
    3⤵
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3324 -childID 1 -isForBrowser -prefsHandle 3256 -prefMapHandle 3268 -prefsLen 23520 -prefMapSize 245077 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {858407b6-b0a8-42fa-9311-9a71e67f01ae} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" tab
    3⤵
    PID:3644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4212 -childID 2 -isForBrowser -prefsHandle 4204 -prefMapHandle 4200 -prefsLen 34370 -prefMapSize 245077 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09fcabc5-acc4-4a51-8aac-f1e28a3b9ea5} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" tab
    3⤵
    PID:5352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4868 -prefMapHandle 4792 -prefsLen 34370 -prefMapSize 245077 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d2ce58e-e0b9-4e9f-82d3-c84512a2bcaa} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" utility
    3⤵
    - Checks processor information in registry
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5116 -childID 3 -isForBrowser -prefsHandle 5132 -prefMapHandle 5128 -prefsLen 27866 -prefMapSize 245077 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eca374fa-a49e-4636-b880-8dacc9322fb9} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" tab
    3⤵
    PID:1124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4912 -childID 4 -isForBrowser -prefsHandle 5172 -prefMapHandle 5168 -prefsLen 27866 -prefMapSize 245077 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd4bc0fe-fda7-4d12-ae36-bb2a94c85810} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" tab
    3⤵
    PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 5 -isForBrowser -prefsHandle 5412 -prefMapHandle 5408 -prefsLen 27866 -prefMapSize 245077 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {812b7db9-5def-4bbe-9fad-71f788a2d382} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" tab
    3⤵
    PID:4092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5648 -childID 6 -isForBrowser -prefsHandle 6056 -prefMapHandle 6072 -prefsLen 27866 -prefMapSize 245077 -jsInitHandle 1140 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87b721ce-fd60-411b-aa93-b9a2321bc2d6} 5312 "\\.\pipe\gecko-crash-server-pipe.5312" tab
    3⤵
    PID:4272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036
- C:\Windows\system32\wininit.exe
  "C:\Windows\system32\wininit.exe"
  2⤵
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\activity-stream.discovery_stream.json

Filesize
48KB

MD5
10948bb03f37ffd07f31d16b4b6fb04c

SHA1
747b6ad4ce9910a429fe82086ae8bb0cdfdde83a

SHA256
8b0af773d09e20efdf31598737be8887616edd2b7133b65b6a864eb05674dd71

SHA512
32fdcfa7e088f44e72caa8cd5f93206a373c961b1d77c38a88247c25653e03cfa39ce441dab0f0c7582ee456d7e74875d0c51422f69aea9b0762a66f33e58f27

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\doomed\134

Filesize
2KB

MD5
6e3b70cb98755d3ac400beba6f36c306

SHA1
b6c67493231653b8b1f742219cbe0d16fe6638be

SHA256
62d44b597164b38f0e55c770b3bce31f662c75edca9bbbdc62120851d34c3810

SHA512
c38a5214151ec32330492acd1c435542f4a2c7efaa211f0b07bb3923b9480f83747b46b4687ce34b964c09f772d29c8af4b3c2587adfdfef2b8b21505953ba4f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\doomed\30606

Filesize
57KB

MD5
2d0666dabc6d7e4fc1f7ba5cdb1c83c2

SHA1
c6ff259fc07ebee588c5897acd49cd6550add788

SHA256
d5a7e2f8b98e9323f4991b1d23cab16ae80d8104c571cb389b1abfc610b106ca

SHA512
12d184ff71db4db5d4725ecba51763f6d1cad8dbdd29ecd44e74174402a2375fb5e38bb22415d71d48bc46ec8d88a09c442b2b4b14ce9a75288e9539fc81ce35

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\075B8FCF1E4761117058C2EFF149858F93A6A354

Filesize
9KB

MD5
0b2013de8935554427ba10b93f6b543a

SHA1
be6e7243448dd5ad76b8687c30acdb44e427dae6

SHA256
88535cad28d775a6d5d4ff8232c9620d971b6e93712c0686d5e20bb8a838515b

SHA512
0d0bcb3f1f73128e9298c8b20693bde4ba2760ec067339d919bafd7df60462e3226989351ebace3ab32f2680fdc6cbdb32a290dcaa0a4826784d9820154e8dd5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\0BABF52A64DC7B1FCCDD563D131A086B80FE77E0

Filesize
9KB

MD5
0dc18937f39bd3fd07babdac0bb7e8ca

SHA1
1bb6b139d1cba7a28c014496f8312f19e1ba368c

SHA256
ee3033c3465250a32675c9a4a0f983b2d699811def13348c6cd6fb66c43f0975

SHA512
a540a45fbf467f62a2a663a256abe8d8b2eebc2d80c49647e6aecd8fd448365a442a39afe02eaa455394f3c1492f45d7ccfa3936097db3d634494e3d5f3a0c3b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
fd713e7761c2e56e16db888001c8a182

SHA1
89b4a3a0bd6b6c9b0d93a2e2456a0eb77c08621a

SHA256
861062be2bf445324df540051fc4f3dee5a977b177dab0bfa8f1de93e8aeb395

SHA512
f4096f1eba2521847dc175d35dbe4286a92b9bef65b80f71c1ccc8bbe23fbe039a09df5089d361ac7e855c522493b89cea58847542e3210af662633f9aa33fab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\2681DF1C05D8B1BC372A0505C935A59887AC240D

Filesize
16KB

MD5
398b846eabda081d1e5c295d31c153fb

SHA1
af5524c15f9be863471f6ed63c90ee1e3543c346

SHA256
5ae601130a0ac6323612349c4ea68712f07ecd65a1afe69e91a1c178e3acfb51

SHA512
9c262c0009dfcc72fcdc3685f341bb2376850447c859e936be53fe31010a6307914a670d3b40521a2ae003d88b11bc986cf17ffc145de5e48d237a81e1ae8317

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\35E25671471609E16A4B568035D2BAA3C9640044

Filesize
656KB

MD5
1826e61e24462decd62d8c70d7b533ba

SHA1
ac2fbd1ebb3046dd9be6fe3c0d699599101e6dfa

SHA256
17f558d1c53039a67724236fd0bf0e8621e43a7f83192ab9f41cf9bf8b0aaaa2

SHA512
5edd5e087ac15ba6c002f6c63f6845e7ee9cb4319d3d317d0f69ea0dae8f9079b98994e493fc008e1d7bcfaf3feefadcd4417ac62d5ef037e30ae73223329c4a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\40A8F58CFC1A23A6BAE836E45F467F9B93975806

Filesize
93KB

MD5
bcd6a46eda83c926a66255f207327d72

SHA1
fb45ed55ae8acb4e7e70b22d6a43429c6b13fd75

SHA256
a408b137305e3d51eef46d8ecf4d6729ff61c60f8736de03ec6f297819a6bce3

SHA512
77425ffe58e9d454cd437026c6a81b7925014e84cb9eae84768d4b23a12784db1bd4278b5060a3e0cd349109722be3f387a8053b440d9e79df8fb9e08414f836

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\48A773B8B92BFF039D7CB5A9DA03A6DC953D7D7B

Filesize
43KB

MD5
ad40e9fb8e4710c1f34a754e8b243858

SHA1
bacbadfcd07b38f83d207deca225507eb3a43e5e

SHA256
92d7435f299ff2b846d04c4af35c3c87af517f1f93f399a62d04b83539c14031

SHA512
efa9502423452d00807f758b145f496db4457f36a79d080dcbd0ddb6ec7fc9edd8e6d8541abe4a9a638f678edf3376cb2055f4720d05af146cc15c1136dbdad7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\51D4B4B68F213AA5210335E68D3441A3F8D0FC6A

Filesize
57KB

MD5
2e678fd55241fc1bbb776ad5a6936608

SHA1
e3b9e85ba9f260e03e879a644b98b1f52b19e42e

SHA256
d3eb697055fdb224edbcc4201165315d079615df1cc8a5a2231f2f9503bbb79f

SHA512
dda2412f8ebca3da418685d6e4bfa35a76bec683c606e2d6b6a4769e9f8a9275130707ab57d6c260723e1cb36c8e59a7503ae6e7d4f74546642de8ab26cfa8bb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\549C94847E35BE89DCE95DF86EA39378F22E5078

Filesize
1.0MB

MD5
5afe6baa0e82911f49e3fe9da473b672

SHA1
3763f1ac9659cdf695afac87427e23acfe43a434

SHA256
56cf267085a6f875d4f37e479360afbbda4e4b1295a03b2924f8b5f2455e3fbf

SHA512
93a67649e3222a0f042dab5515f465cd1ac3bda931cc876438938485a8a0c7ace6a6f0172e8d595087275a3fd4523b60bad6ea3eed987a2eaaf08774cd17a259

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD

Filesize
32KB

MD5
6f6c2bd8eb8c54d8d3789accbca11eae

SHA1
286136898cb8eb0e179fa768e8e8541af674bf2b

SHA256
c1d07c1962d2df7033330e015f22839d96bfea168e8390a153913b905b2a062a

SHA512
fa46c30ae9c598b98aa65933501b25832778109661d124e7a8d6fa6795197e938f8b76ea88de013d2d8f5f82c38924a6c783e810c1861623eda2a2ed6c7d4a4b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\5B5F81C77EA4A0D4425E62E3D6F82E571526EBF3

Filesize
74KB

MD5
eaeba35411608a211bb6fb99a590a427

SHA1
96b555aee5f338770679d4f6e2c26183e6b556ec

SHA256
03864fd7d9db0c8f51f81f3cea981c3d7181f8b18678bd9521588188d604232d

SHA512
892642831e701711c6d75288e77da0234bd72c0906765292865751a8c50c4d41fdc28de3a3aceb522d044a6ffe476b6488d758ee056ea0964b6de557ec7cfcde

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\643973A72CB665816E627CECAEEAC7166A356FB8

Filesize
114KB

MD5
8cdf68fb637effeccc261bad509346c1

SHA1
4a9b881766b78a5cedd30cb7d8bc982d0fb5c81d

SHA256
4a97473b55705d75b26d4476256ddcfdfac8dfce73da799d3ec1eddc6d96ba46

SHA512
75f295b0fa868c5b58edf635a5dc89b0c617a62fdca25f255fc8162592da7c566056db6f046372ed0d370de70f4fa069277be0d39e66dbac151cfcd61fb57723

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\6CB8DA195B83F1EE369C11A33C63581DBAD64D6E

Filesize
96KB

MD5
d675bc73353eea9dcc9bbef78c0285e6

SHA1
807a63f07216c63a2001e97b0397e3e426295efd

SHA256
5ba37e36e5557d4642d923f3a4a70dfa195bcbaf8881b43c11f2faf3aa67ed2b

SHA512
5e616b2e2742f4921a58a31e05bf48d4e6a30168113468d258232f40f03daed5a4518090bdebcf2fce7fef5e3f07f1c374d51f98a6d7f166a7ace0eb5d3b6fa7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
14KB

MD5
a2bee57669c330d6cdf24c5fa92f877e

SHA1
2224544a7d8e5cc73b5b33165cfec26693d06fbc

SHA256
a2820d456047862d7b22a4c3b27255d13788e151f3d4de93332827eec3d4c48f

SHA512
1222ba91d0bde14fcd0ebc7991aefa92c939d6d60c97742b13bb8d28f0f4cef7d137e01fc9b613c60154f8058a806d2718fa42dcd38f8a70e68e1db60eef3f97

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\88D98E29E70FF6FCC796CE6166E1AFAEA3FCD363

Filesize
183KB

MD5
bdee9281357c4dfb012eb2d87af540cf

SHA1
dc16286afec49242d3a3a72c77ffc180598fd609

SHA256
059ea68d374ffb96ac40e59394befa4f1c060022bcdf4c45c8c14399113e9f9e

SHA512
9e8b0d873ba40ccc7e86097885b8cd7a1c950119e92e24dcd8d18cfb85ed5df411bba63a74e658835684518e548dafcc41fb8673e59f3c54849d2c54503fe8d0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\898DD9B2524810E5DEBE7B3D92F2C9EA590AB028

Filesize
81KB

MD5
a819682e486ff0af9cfb3cbb04112a74

SHA1
50f702e40788908a69a794b74b8740753406f907

SHA256
f48f340b761525cd7bc0367e1ec49c4492d6f4af06a9de8a310624879f712f5f

SHA512
c871d7c329f8253b87536c8b41a104bc1a587e5a9d87e684f16f29796c57beb438aa2d41e11712fcc8cb473c33cea31c2bc2230f37107465b2399517e4378dbd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Filesize
13KB

MD5
69abf4db9691e92dc74b613a681c0390

SHA1
613fd0d627bd95089d9fd92953d74d7a1ebff2cd

SHA256
a9f0fd265fadf981eeda4d639a9ef357ccdaaf4442ac30f9ad90e1d73d99df2f

SHA512
4d9567a65917eddd6b007bb1d905302e05c1ce116c689e3bf18e0760c491c2f8a370b5387d3304b2bc9d085d75bfe7defc2479c9cff0400fdd6207951cd2b8c8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\94A149694DFC456EFBF58B41D01186DD49CE2962

Filesize
26KB

MD5
1f8b33cfe4e4c5947f3fc55d67c383c7

SHA1
01e5496887e94049585bf1ff15712ec7032b449a

SHA256
3b821c5428d86d450af0d46370b0f5ad5d6a63cee38c06b834cc9aa68c8edaf3

SHA512
57e3ce7b54a4d9ecdc55035300de7ef845a9bfc816b3e024c629c896f80d3da2c326fe4e3363558a42a2c62d93ec0813e08dcec6ea91b0f0e3541606a9363f4f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\9B5DC42D011707A272F4010AE622B8F276F1ED8E

Filesize
99KB

MD5
adfd8e714e755f73e6c42bab5167f9a5

SHA1
0a8a0dcbcc73778200fa9fc4180963fb8f5f8807

SHA256
cde66e44d0e7ee1c00773d23e4c04c7c7e064261921a2f91db6b7f155c09e29c

SHA512
1c0f4ce2fc71a3d9b8fbc9b92912047848620696c313529fa5c15bf26488a46ea1bf112051ba96935de56a176e228d92cd76910088eeb2db2373701c40770242

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\9D10D1A547A62AC089371C527ADF71D3D60A521B

Filesize
10KB

MD5
0c26573b65ab6454b0ab94d0c190641d

SHA1
cf536b7556b34ae4e69bff8dbdf1fbb38c5ccc91

SHA256
54cc1f6cb460aad9f6bf4943df67b51a0608611b95c1586d0ee1cdab5e8977a9

SHA512
6a6d81b815f0da066bb7fd6b7bce7b228e2d18d6e47b2be34e823d6c8d68db9808f577741bf82f457ab090debccfac7a2c35dcf08f91511d76a0194eb22f83e5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\A9B08356EBD30B2479D50C01DB7627B8CACDA442

Filesize
15KB

MD5
7d187a6ec6e686fe9848aafc98143d6d

SHA1
2f1b571c7dfeb7adf4d0ce016ff4962287a551f0

SHA256
2ba46ee4efc21855610ec94fb042ea6c0e0787707d40df44da6e0fb1b0473e72

SHA512
f4ba5071183629611efda7bb3f26e7017cd3dfc2dce9b8175390f37bfe912234129a0a029f1ce2ad1d6b67f99bcec4b00fd78c103686aa312c1f981a326f4909

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\C57FE16AFA081A9EF9A48C329E13877DA2792A79

Filesize
10KB

MD5
f39dfd7ecd2def608bd653a8654a77eb

SHA1
9c0f0125988e19ecdf98dfe9f6e102d258184f0e

SHA256
b09e5e66d2d3fb1076deda30e45239745a79eeca5d7463b29c80daa0f996ea90

SHA512
32e1ed31ffed1f89a851efccb7778a138c92b378f6311ec95bf1858e7db10bb2a3a8baf342c8c0e5ab3290ad5e20a0f7575d769a448f24cbc859f35c5bbfe6d7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\C6AAE3BEF68545BAEAA11049CA4974A1E564BADA

Filesize
114KB

MD5
023bad0fb3e39cc4cd8ea57804c81317

SHA1
07f4bb92b98d47fbf0881b52cbbbd6af307a3c97

SHA256
c47d46021377e34023500e36dbc032b170a906a69a861c21eb3a572a38431360

SHA512
e503a2e49dde2faca2998ed944e54aa5aa024a38fe751ac8c30ca4a02ee16f3ba3ae1c2f1587f63eb934fccb015ba264e3ac9d7ce2074aeb23dbdae0276ec1be

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

Filesize
159KB

MD5
ad388cbf551f3faaa06c410ac140c591

SHA1
ec1a289d1c0f8f135e9b503ebc5af549a81fe787

SHA256
3a899d3f07659755f62553b8137c858f832bfeaa3cb3628a54be82f79a550a9c

SHA512
ef53e459e7e95724543dfaee6fe1747beaef8636b25a9aaa31a79a4fb38321152eff43f28ddc1551cfa0d0907148636a46730ce425714379efb2895955423dbd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\DF456E58304C9DAD83ED69C2CA536AC36867EEA1

Filesize
2.1MB

MD5
6bfaf3f2fb9ba16eb44c54e75c1f0330

SHA1
e1a3d9c353048280db54cb032d36122a09beb9ee

SHA256
7f479a080b10a44b526fd7d6adce85e2d735bae6ec88f56de4088b2087950ffb

SHA512
8b1d5a58a824efa17bf9068bffc188f1562b40cd9028a60578d73d5eff8108cfd328798d0f2b8d182b914145091bf894359d2a8eef9e22bd6a1a5d48690f794a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\E1F68F2B93384A426FEBDCD7ADD3E24E219C93AC

Filesize
471KB

MD5
748909f48a04fb017b3888fd2c2a525b

SHA1
0e2244066d6b185c6f007576f0d84c0260226260

SHA256
a194b446c7a90d0d182bd4a1c7e211b203b325467225d1a57dd64cbd5582c5bb

SHA512
a743db54748895d1098eb17aea814bd5ff3fb921f3f4bbe5e681d8a07b99509f365e633bb49f390763cf893cd7ab6bd7d8c0088951ce21237d690032b58c0d9d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\E68EF5A4A0F2B98D74AA53199C542121A70249D6

Filesize
10KB

MD5
1673e2c461428e796e8720a9b07c88b3

SHA1
178729eecbe020cd64eaaec626bdb6425e67929c

SHA256
3b14b90d5e44bc4671e28b390571779425f9f58bf3b2c8efbc870eda8cb6be5d

SHA512
c109ca3feba8819ce6f77f10ece9e60467d6f86e446fd57c83070256fa87a2e07e7898d5798f85e571956f0a7358ff344bab732d3242cf20153abc50713a6124

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\E933B02DD530DC9EC50746D1CEC737201F1400F8

Filesize
16KB

MD5
5c84f08dca73d368b43d868be7c9eb69

SHA1
2a0ef08a191996fd9056595c074a299faa667291

SHA256
2dbe5e6810f9e330cae66c3c6b7e65597d9974be3553b486154b179bbbad6802

SHA512
04598f2038aa36eeb155d2f1966170b51d95789c7d13a2513ce4d717fec2d6d97248b00305f12a6930ad1a37232ddaece961b428236bebcc01381fb65e5b6f1b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\EA87465A6B977981215042B94E7AB9FECDDEE708

Filesize
13KB

MD5
1c98d6f32826cb51dfac7e667fdb7c68

SHA1
7a75ef8a741c1e1d49582888d445c09aa382e30c

SHA256
f3a1cf40edc6215acc1e6ed579bd2e7ae9ed76c320765d264e559b09794657b6

SHA512
4c5ef6270226745f48deeed26b29c3e0f656d652918faace288c1b87e1455452e05eed1eafd7d536730ccb520e71cacef0ec52a857eae073ea87247d13c23d97

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\EAF17210F28F22D6EBC808C2C1515A0B71A3E8BA

Filesize
163KB

MD5
44c4687ce16074780ec4f53ff0c7ee35

SHA1
3cbb0033494386b468af04343cd2e53cc8c98d14

SHA256
1dd1d13249207d92ec7cfd4af293a05e8bae3935061cd9e131e94c207eb4a249

SHA512
7dfe07f6de72ee2ec44ad1d44f75392990115e540d1ddd2c48be9f2cc149522e178408c3788906b5548966273ad56faae60e5f5f6ed0596ed0c5438845016082

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\EDFE528CA6E8AC26DD319332A5DF88AE369FBF0D

Filesize
20KB

MD5
78513a0d2cb289d4896418bbcee3bac5

SHA1
b184ca3da99615e4dc639d445d9208015815a03c

SHA256
a08a476be25861fd8ef253f2b8335375aea640669f48c1fe91b8c325f17cf7d0

SHA512
4316804e0dc0414c4dcc5b774ebf06a641889d07d0a053a7d50eb7b6a3553302ac54f0854e7c0ef181e63092371afdd5ac43f98fbb7d7842fcbdb1af69fc6c4b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C

Filesize
417B

MD5
5ffd8622ad8539741eccefb11cfa368b

SHA1
66e19c989c209570a2818b8b70d13143d16b0b0b

SHA256
39c21fd774015d2b3643eaccd20868d6c8b8cb6893a3aa140a3cb94f6c2eed40

SHA512
46615126eaf5c9ca18a1f1088ae323146d124628c60b14333284ad526e2a8fbec659ff55e5ccb8327a400e5555f901fe3e6462305e809b9b8de00d29c3cd7903

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\F2A2083FE81DFDB7AE59CFE7692CFB2304CD4926

Filesize
81KB

MD5
392abf56fd1b3b64fdcc73ca7fed7386

SHA1
a9ea7fc705be00d0b6fb76df329c0c8b8fada41b

SHA256
6ef4da537ef4dcb6fd2194d1c2ed291f33f1130bc35999a95bd914062e0cc4cf

SHA512
4c07627bef26e9db7fdca46f12c94c78aeed1c9613fd2b38f29d86cf1d2e936408895fe02ced7e11edaa301e5294b56428fe254faea7a1642fc2574c8b745336

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\F7238E2D6FD33D777BA92C46B87D7C03780BB3E7

Filesize
792KB

MD5
735b17c7cebb540bb59e1954fc8a3469

SHA1
19bfb02b900ffadc0b8ff386a7085c03fdf4cff2

SHA256
c7ba2219c31dea5b07667094ca4245959e7be1207332069eeb368c99149de34b

SHA512
2af6181e04159ee7622bd98830d15d2e77a0603426c22e7dd03541ddf6a2561ccbc85fe6043b2b43e49cfdd2333a7df916b536b89985eba39836b40777edc6e5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\F7AE44D61AE3B0F0DAE34F930D7950289949245B

Filesize
11KB

MD5
2409259042bb8327b436ff4b3f620138

SHA1
a768b084043e1442a7192c8b1c1f8cf005088ca3

SHA256
56c57080877e3bc9b5d9168b920a9c616dab02c26a5038c73dc67a37f35d7776

SHA512
01f68fb897ed9f9943b2e92c81cd91b2da6528da2b0074ae6ac618531e6b8299b80f54a4a182553025d4bd660cfec0e9e14441f2964410faee127687957d28cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\index

Filesize
10KB

MD5
8193aa4920dcc3a4906b23757728cb34

SHA1
85bf1aaba167cd97c7b1ef1be1b1b0c79cb51e7b

SHA256
54797592b5727942ef72d0acf3ab1856b2cf2d263d2b20c047c3402d6511f5dc

SHA512
43f04fee66d7c494c84da65dfcedca1e24dada0718b239efea6f12341e86855e96a7806a52ca2fc2ec2253bfbb278f2bf1c524d8d7c4b34800a6199973679a8c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\index.log

Filesize
10KB

MD5
9e43388b3f2c50630e4dd8ca6f355cd9

SHA1
3698181e16ce9abd0f1078ddaaf7b3c42535dda1

SHA256
9cda2a228a004ede3c70518acd6e213a2d950895de6da294bf8d19ffedfd65a5

SHA512
cf0e077fbb39f08e4c3bba6eca36acf9959dcbbade5fa5ce0d329a9e3401ab8c0ef67e21a17b2db80ee51aefcc98c09f0c582f5a9ef46bbf394f2def56273e24

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\jumpListCache\5wNInBO68rJ8NQZPFvC6YsuSmGe2SgJjK5AYvgkh3TA=.ico

Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\startupCache\scriptCache-child.bin

Filesize
469KB

MD5
15405b40b11396456243a08ab4c1f30d

SHA1
eda1aaf4281a3f6ac05af57ae91e37f6faf3048f

SHA256
2aa3c813af62320d33d79d971fe48ef775ff66a716658e428b043e2425e721b1

SHA512
e7aadce7de8ac6ca2243cfba8ab242ee6b7e7590445c4d8bee16d39cbfc2b74f0095230ba2bf70db70eede4a3cf1be98372bf79c3bb0db2826608a5da4520618

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\startupCache\scriptCache.bin

Filesize
8.9MB

MD5
1faa792a3adad058abcd51012847f019

SHA1
69179a45a24e4197d068af5096beecf11a308718

SHA256
dbd063eee8f0842f8e1fb3947f18df86e4903f8df48a2a348530979f3083cdb1

SHA512
2747f8eec68ec4ec00e71dc334d7bbd24ffd7f267805fbe1173b17c56d6fc5c43a9bfbb23b3eac37edb69f52be50a2d0e8565ee7424dfb5d33aa3e2ca984bb77

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
28b4d92540d67cb14210b20977e74b78

SHA1
05b4eb71ffb6ae7bfb60e20983711ba4741295d3

SHA256
6cd1a7a58b562d01662c891ac853cb60d68ecf360a5514b73743f3fb55d47366

SHA512
5231e7bb09f7dbe290f01ee7232f320252295fe442e23ec0d281ef31e4f97fa18c4e7ae3ea2573a43fa7d76842aeb16131c278bea6e6564e8bbd81439bb0ccd2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
9a529b9d38938f17026f94b94a39f848

SHA1
3aba404c13edda44098459565ba6836dd44c5721

SHA256
e384fa5419af785a35bbd26c5b75e70576e7d028c139b2ccccfa1da69b7bd2a3

SHA512
148624d6c45a0e5b0c8397d41a48925bdf2f4b6bdae02f688b5a8e0cebde20dd7a5ce0044d0e21f0ee6cfc1c1f6c6c0549d2f8358c69b1f1f8dcd13f7a37fe67

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ghmn42wf.cxv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
2.1MB

MD5
0d6fc3ace016c93aee727de88e129563

SHA1
b7ff775554b565c2412209bb13a6bb101f91b269

SHA256
0475c528402646e56df92200386b7aaedec2208eb03f8ddcfff64efa16b750fa

SHA512
537e971007965187fa25c9051f61f92061cf9fb9dd50208958e75e687e493ac5df2c30073d2cf632b5c7c59e0c7dc4a77984e740e3eb0007f8e515656d6168e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\AlternateServices.bin

Filesize
27KB

MD5
b4abb4f81adb856ab7140bfd355c60e2

SHA1
9a3653fda0f06b3a1404510f35898b6778a5d9a7

SHA256
5c864b8b2b3ce87d80e25b653d120b570ce0167fef67b407cb63871208487a67

SHA512
d8495859fb8bac6155d63a1342b33d8a78dcb533f34febc2e9e6e4891df8bcbe2debfe577647622361d7b04376e7de54d393a027dd4f47e0f953b67246a3c461

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\AlternateServices.bin

Filesize
27KB

MD5
3db71b4d25d6d8fe24fd2b9910c14f02

SHA1
a24324d2f5d243a7525093fdb91a1117e8cd6c2b

SHA256
af77f8ba3cec513c6125abf039016c88d9e3f15f9b2f9978adbdffcc8ebc7719

SHA512
b76d93c3a6b972b939a25187f8399b1fec62518e7c684c46dcabb2452cd7622c796a9c4a3187391261879ab8ba341961b69e513c01c9d3f9f82e7759752018a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\AlternateServices.bin

Filesize
11KB

MD5
61197d7a0954e54970b86f81ed05b7f7

SHA1
5c9efeb91405951c5f0b9cd183039687d0e39df8

SHA256
4341e6837579de1dff856158b0c9d9ced1e8663bd726d150387eb04b7f775a45

SHA512
9a8a7b45699c93192b92f03d8ceac199f8cdab6fe1242feec06ab6ce29031e65289ace878acbee62b7ac4b74dffa29442e4cd4737c58842c7338c08beb0c67bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\SiteSecurityServiceState.bin

Filesize
2KB

MD5
65598dc8c7f2ecd561f9c1030ef16445

SHA1
1a4acc111500b280a43e9bc3bfc1aaac9fe46653

SHA256
57fff1279fcc48fbb996ad52047f6acdc7b9f2dc9b00940d40ad9104c07950e8

SHA512
9ffac81a58414a51ae3ea826631e4a9776580e01d44091ae52773f181064aea883a634fcf121b933c9e131476177ebc1a9ce2b6738a6b198729b47aaf9fda934

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cert9.db

Filesize
224KB

MD5
671ca3ae551cd3fd8788d19663466cdf

SHA1
62193c531e8cea5a85c936c37da8dd661e0f48c3

SHA256
4e6637bb5b1fe6f82d3b5b5212ce8a6d985c850e9f62acd959892bb057fdc03d

SHA512
8f4bedfa960c6c671fe4e8598e3193ae2895e92884df0d0e20ab548c4941447e1d80fb51c47c5eaf245e5dc9725ae463409b8dc589e181c437b83d464e570b14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\content-prefs.sqlite

Filesize
256KB

MD5
b5acd9cf58ba89e643e7b2e839e0707e

SHA1
82c2b9cbea4acb50b446b786818287be7b0b8b61

SHA256
4d4fd87f1cdccc9f826ab7de2b3980db6fe4ed328f079ceb24f680557da9667e

SHA512
1fdaf5173a2fa956e3793b3643b44d928a4c81a1599bdf4b057396bfca5948ce1097194dbb5f528959c8cf4e34d058922828236c6060b41510e9ea2cb9ed424b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cookies.sqlite

Filesize
512KB

MD5
edba751a83a01820a1dde96168330d8b

SHA1
957a1133014fd58baa606786ec20d1f99f1c212c

SHA256
a53faa0549b5c9f502234dd0a56d6c3f9f46583c10b5bdf40ae90396320c31d0

SHA512
6965e01d094e372b2b5839d65b082511e6416d5f527d4e14a587592c86af2b46a526650fc51030d0302fd6b404f59a5fab21c3b5e4dd76d10d6fec39959376bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.bin

Filesize
40KB

MD5
4dc0c16e47623edcbbf22a5ab208874e

SHA1
4c6e074a57f095bd87ca339d8dd4a5c49fc4459f

SHA256
45895862c6f357440bec62c78494d8884a39fe6307c03582c222e752b183dd2a

SHA512
84937df023ebad00542743770474ab50a624599814d5a7da230665fc7fbf3dfed5dd362e111fc52d962e45a4f9f4b20a7bd8d8cf033c3e294df369daf687112b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.tmp

Filesize
39KB

MD5
c7205848e8b4210bbeb9af33273d22ff

SHA1
4e2cc08c4c3d2f7ee5e92897932acf0c0d96aeb8

SHA256
edcde6cbe2391abc5fc1cd7ad4d06e849aa736ae48ef91aa81a19fb5e805afea

SHA512
4df8506163972a1b95cf72a5eacd27729e518ef802b5d37225d59bcb8ce4e627c4da794686040359048f8782dcaa1e246d85b02f11e54cf89f5f05bca7c3ce05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
b0d290f011740f877ae3c39ea25880ae

SHA1
a9c7a7d4cd253d1ba6f3bcfe826fc9d1c1ad1a77

SHA256
b625a15f603a1ea7499b27f742d409096e3a65a1fd32e8c2d45c4d40dcda8963

SHA512
1e5f1aa41413afe5eda7f088a0fc80c0eca90df3ef63584c57d8a4e3c0cd18413e5aeb81b3aef4cee6685dfa8cc4bedc3ab54a14541c10e4b14fa65fa04ea2d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
20fb67e703ec8d92ded03a8c86a05558

SHA1
291b4823ed8a981b2e4a37cd689afe1ddd50d554

SHA256
d31d9e63ea6a7e2fd9faaf7cedab6e4c816d8133a292135dec6b2d0a17909c61

SHA512
1b868365d1b4fb4218da50d97d66d53444f9974dd34df9f07129c9d1e1df6a1db4c9ce351ef4eaf93f8483cf567cae3e670b5af13f30d79fba9f5dcee4064acc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
ae772a71b52c9ba933ff9a2d314cd0f7

SHA1
c4c793f72956e3aa196a48abbc86a4eb2b41332a

SHA256
58660ea8dd0f13d5d41986efcd292c4eec8e601963aa5f483159c0c80d598794

SHA512
b817974b5eef9f77ec423216f0e10f4f5dfc64e118c1aab15633790e380e6b2b004615cff32ed472cdfb6885997d81d6c63f2bfe1b3efc2db087e751901ccf7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
1e055146cde93a5a99fd739d15fbfc81

SHA1
d630a5c061a4968b5a5032b52ca3254c8e7bd69a

SHA256
197d41f73ac6d4372626837221d1e7bfc24c6aa07e067286133888d838c16719

SHA512
7d29cb4c431daa221a8a19aa869837fae6e9b85ab70d1b3cb38c42cc7e2322daeb17767beb01fc6fd51b4586c840c127cc73f015eaf6910cebbb300d5ee46ec5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
c8a0eb8e4fd563361de469193019ce69

SHA1
f34ea6570cf9de785911be70022a1cdce39ff34b

SHA256
e3d603c1378e1d86c467f55ad761e2df65c359bfd93ab7175559c761a943b47a

SHA512
1da4b53bb32204341fc19d2b12769027c0cdc21a3b05dbb509894f38ab4ca75c01e82c1079c7d5c5466b5aab13ed2ba4c376aacb9ad669c6cd098e353434822a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\events\pageload

Filesize
1KB

MD5
2267e036699c7d4a1d2c401eed7be499

SHA1
9e15f83bdf388890319d6e631a350e15b49632ae

SHA256
5ed52ccf361ead5ec583fe26de2aa218c9c2621e02491e723ceb3e1fc8df0175

SHA512
1a7e7529797d374a555154c4079bdfbc1238f021b20ed3177f24c0c46bf5fad50c9baf11cc7a853e1c90449b92e24b993555289a14fd848a487a841eb91ec818

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\054f1353-cbb3-4159-900c-e73e9ba8d849

Filesize
734B

MD5
edbd732f71d3c3919321b97e8372ceb4

SHA1
8bc3e80ecc8a7aba8d3605b0ee6fb845b1b1b292

SHA256
5c6db0909eb9afb52fab04bb3716c26cba8c9aa55e76b85058d57c6e0a7e0703

SHA512
ed984e92f12c78f62d0c9f50db6a8b1364dbf2c790a236ffe7df1712ef05c6f99f7862875bce8716f31e7f2039e7b79faa295b15720768ef59c32697b5cbf4df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\22280f43-a68e-4aef-988b-76cb6e01bbd6

Filesize
659B

MD5
79ccad1901c4ec0661b51710f3b959de

SHA1
9026a57a9fab06b3ab37fe354fd69ce0ab1b7816

SHA256
755a0e2d89593f7a15e749e2e17b7660bb3e326c1fdb955062bf2a0dbe2880bc

SHA512
3dbe6eaa0b0c15a3b5e2c66ed7068b2fb36d67380ba001efef4417a54f8f6c59e97132720af13298761a90b445aeee9aa77bbc7dd65a4fd21c39407f9f350c2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\738b068d-fb24-46b2-9a5a-1ff8b75b3aa4

Filesize
847B

MD5
39a00f4713a5fb206ef0cb80a91c9d1a

SHA1
9eb30791a6fea1508bb5101f184e8f992016a378

SHA256
8bb9dca2d831a12b825c0c1c670d2c3ab8a63e3951ffce37ebf8c29c48aefcc0

SHA512
dcc23b6930059b02b3b0cf4df146f2fa563ecc563d8306a5daac4b14900398f8772df333402bf7ae5b49d5ef09cc1b7efda4b8fd0ba58b5d9e0c299312fb3687

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\77046491-94e0-44e2-ad57-1682f4105e32

Filesize
1KB

MD5
2bc8e8c12c4ca3a5f61e7d6327e6dcf7

SHA1
941cf3a5ebe1da69aa81bf47e732c1f4849a180b

SHA256
ac452194147e3a719370d30e3272a2e7a1c04226a6378c23936fbfc64867dd7f

SHA512
36660b9f8573a94093a53c4ba0c6c8dc895fd4f23e1f10dff78d6a33e4639af7d413cc525dcfef5edcdd5056b6ded6ee4dbba823f84aed9386e0925e0987c147

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\7a2b143b-242b-40c5-b10e-7c976574db58

Filesize
3KB

MD5
d4b38e830322232ed129704c3786fde0

SHA1
e9199a137aec760dc73aafa6a290d8016dd77dff

SHA256
67ed59c5a683d16f65b2c2bd59227c3f1344a094db1e3cc85a59fddf1f2056f1

SHA512
5baea98c3e56d09f628c974c83b23924162f1341b33917091e27a7899819e3e40e1ce53dbbb3f70f7695cb7daf6e1476662e559ec96a095698c483ae37043867

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\b92bf817-685b-460d-88ce-466df1dc1778

Filesize
2KB

MD5
534e22bdfa6fcea87c531ca73267bf46

SHA1
f47744ac9cff8c0dd6a0b08e0b4cf1d91518acbd

SHA256
27971cf75f20025bad55d69aaa72405938e12d6cbd29c220a20cb8278a3b9ed8

SHA512
a6348e6e853b24c5fc5b7b3f37002c78c04181cfd31760de8d458bccc0c8428f67a3f2ed3bf41704fcbba3724fd3f3d04a2b85386f265ffab8c24323f04ff8d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\dd523331-5f4e-454d-ba0f-baf893eb7fa4

Filesize
28KB

MD5
0fd17e768fd971fa6165f94a269c2a19

SHA1
a6e76ee2b42b3427eeddb35fafc83e40543cd7c7

SHA256
cd5a6f94c9f184032c4adc033a9366d59459fd4e2eff34d62296cf1b13a67f35

SHA512
6b83097fdb8452330c91b2ab48bf4ab0081038d031c7cd82f3a99b16dac47fbce1ad0456a889d75625289a38b8ff331eec9c934b5419f085dbf4c21cf1016048

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\e4f809af-8010-4134-ae6a-6bda63442d86

Filesize
982B

MD5
57a989b908d81e7fc7bbd0eb8acf63b7

SHA1
94d459b389e067fbb257753c78869dd892351074

SHA256
8ddb9b76c316f4b474f59c2dab89d5672ee2e705bf81b2d62caec219527b66cb

SHA512
70047ebb493ec1a05f636cd3488992e19197eccc8a24d529eed25e739400bff609138baa4152035b523c0d50294de4e5797a4586d14ccc2abf7837455903e85a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\extensions.json

Filesize
37KB

MD5
45e0c5c1585e801295e2ad37c62d5c84

SHA1
98964a7f77bdec22ed0e05998c85afa96e191127

SHA256
48e93314a7caffa8bb9ee7aa845c720dc8cf9bb2fb12be653b960be6e3245194

SHA512
806d0201162b0f2673a14987cac897f90f17b4bffa4cb3acf44a5d542ab8407c57d7650ab749b6276b2b7b9ed4407eb1c7e8f1cee61c2cc60ac19f34c39aebd6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\favicons.sqlite

Filesize
5.0MB

MD5
6a80f5c2b2318e7adbda252361f565ac

SHA1
c257f4f79bf579b19548514490f3b0dec7d5f6d2

SHA256
7f9ab23138f40dceefc5e7e787a67947665b66c6c1a3fe35eead39096417f461

SHA512
ad98452bf667110e50a77deafedb9415f642a06733002c5d221dae985b04d951d03133da36108523933103d4ba60ae69e81b42234d7d2113c9ed103f120f65b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\formhistory.sqlite

Filesize
256KB

MD5
d75af4a091c5dd2821cfe754874ba5cb

SHA1
8c864a07a365edfc5877c76778fc2d6c0bf46de6

SHA256
bc2019e44fdf3423d04b94707ce32dcd1c1573e7522a75e21e3dd4a03208441a

SHA512
bb10181ad83dd5b414e02e383ff5e51d586afc168f53181c101692bb34726b2772467a2db1ffb5f114c58903995109b59c8d7d79c588aa5bd51e0384408de40e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\permissions.sqlite

Filesize
96KB

MD5
f23a14a62d2c77a18ee5507f4a774678

SHA1
30c1230d7d2d62e6cf896f3281b19d490478d53c

SHA256
8b6a9e26855c7d6007e4fb84c197d24da367165775d4dc9a296010f86e2b3858

SHA512
6b1cc716943513921dc63ecd34e35af22570453e2c3417c0cc8a8c9e527466fdf7d8f1129c02fb5c75a5843af622fdd89ea20941bf258cbdfced777886664af1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\places.sqlite

Filesize
5.0MB

MD5
20b8ea55d4c2a77eabdaaf7c52d48e14

SHA1
906914f71ff14a6a6bb2f1bc513842f11cc2fd23

SHA256
48000ee802e89092f30dc80f57a2af3db6645d0e0e65191946f6afb98e2e01f2

SHA512
bb1a61fd647ddefd604beeec1b852e0c82e2a66de4cfb035daee88196763dce22739ebb1ad4bdabf8bc1f4c9da02e9dc42be067a038cdddb8c8ba30b208195be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs-1.js

Filesize
11KB

MD5
3e33ba90bb2bf58605451ab4fdc71def

SHA1
27e7f75f0d6555e464a587d074e55c5965486bc1

SHA256
d0fe35a178afc39f3894df4c414bab4ae48105c3912d9d0c557846c10296b90d

SHA512
89d169677399836b6fd688aa9849abeabed7cb43dd85dbcc058004e1f8210aa79f1d50e75c941cccd2185dc7b701afcb6ddd8279aed3a2d853cd7c04d1755f22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs-1.js

Filesize
11KB

MD5
1263d7bb2ffe2d4e06d70b8e768606fc

SHA1
60cb297971b2381d21c8497d5ba20dac1da65533

SHA256
ddacec5a78861bb898fb2b25799a02d64ce9e5087348745496dae058a5d1730f

SHA512
c5504d5714c34b28a5946a7d1ebea75c42ef93c170733b9ef010a30172ee0cfa19476adbe5c29f15aa4498a101ca466d24d76fb25f973039eb955faea8f52e5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs.js

Filesize
10KB

MD5
483561b34f46cc4e174317f312846c02

SHA1
17fda3ee46cf50244d923163c540c875017de77b

SHA256
c298efa772819d4a0e7949a9b133c2c694a400b97b8489d86ccee841914723c5

SHA512
33f813e12534a97766d1ee92cde6f9c670a15570a6d6d41296012f1e0fcd017e9430d479f93ebdb126dd42cc412561cfeb7e6df6dea17d6cf27fc892013bed27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs.js

Filesize
11KB

MD5
f5f22e1c243f92b6de4722cc1e2d7607

SHA1
924331e3bff6f03d39ab9739228cf9170d3cbc65

SHA256
fb85e93f7f09e4deccf22da0549924b22c6b5b9c462a14f251f151c7ff20787f

SHA512
d10b0cfb1ffa2a2c75d39e462e3e0a33440ee7c80a408b234a74c9d43289017f19bcaa644ef28d2a7f47eb032e70ffe67af1d3f226548880969b97d597b104dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs.js

Filesize
11KB

MD5
9889b84a10b5ec8a8f300f192dd097a1

SHA1
ab94e93242a3fa8ad17857bfc37c43964719aa0b

SHA256
3e98c38a0ca7e7022567a91771f4e09fb5954f2e22816866775bdd0fb829f13a

SHA512
6939ed4142840be716b4fa710b742f20fc730bbae1876680c30b92638b0963a9cd522bac2078cccd0cfcbcce111a6df330a26938948beb15755984a0f1f27b01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs.js

Filesize
10KB

MD5
f5a5b4d0ff96b64609a40c5bfcb80fa6

SHA1
4c0ddabc26c734ed55bd4d6237e0408ac5dbbe96

SHA256
e21d7588ce767e8393d4df66c5e16f825c99742084c9446914dfe1fac2ba5ed3

SHA512
010619b3ade0807eb489b20a6d8c02c419be971e7517792d872e03901204552e96d2f585547c2bc46f13c6b54ac968701714e48d8b3fee720163bae0f0640663

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\protections.sqlite

Filesize
64KB

MD5
76786a4c0dd19d88d6d3ed95a293bf2f

SHA1
b0d6d676127a7694fc6e71ee57fcc2ffaa621ff7

SHA256
1a2564c1ba20b8038d35c2319258d94dc15d97914dcf753b31c48b79940dfd31

SHA512
8cd3298e2ebba763d3c80ac4b17e44af7eb63b46304967d0c6316d314baf8611c05f7b9979c2c5c329ac167aea0246e8c9f057ffbb272481c13fd5e4b4bcb2d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
7d029f2780fd039a4be9ca8427bc36ab

SHA1
47bb62f56b2492ffa0a502192ec22119c1d24c16

SHA256
a748b07623db50e4cfe856523d08cac4e3262402ea4c8e9eb08647ea9f15cacd

SHA512
c139f99c798975f731b833917cc568f124401715fad471bb38aaed749310ebda632edd948b7d534694f1f254233237be865aed0f865ff2d5e9a7a62aee0e8146

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
26f3dbd9ac24c5f6332bd09aed2c078e

SHA1
8bbbe84404fdd7830d8ceca80d192057e0ee3415

SHA256
0716f73197ce3d7f9c5d1846f34966800808cc71573aabd2919d8113e317a0b0

SHA512
93648eb294d93cb3ec6dd2a4e6a72077fa58e8aaeab5e28b6554d3f2255f7bbd263840cc1cfe3bab235892571c75d8c60a526bbb4bdd32c04cd0219a7e2c8d20

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
8e7560c68ff204672520420b53942948

SHA1
fb6d9ac27058480512d802b52a3e5596c658f378

SHA256
905a70b30225a5d20a7ac334225b1b1d8216416403757dfbf6ce4336e74f16da

SHA512
699cc480fe75cdb8a5e6413700ec888858fb76176ba093bd6e30cf172a7a396451fd9d3851fb077fa797712c566479e9dfdf3f4eb50ec33fca6449d61a755ad5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
3abd2de1b19c75fe694ae64368f8c60a

SHA1
07617a77afaa73be89252d7a8e98da969582cda9

SHA256
99618870f71708eaa8a3268efc2945a6860d4aacdd52d6b6ab9c42f9f39f0390

SHA512
46f257012c20188edb762be348b883d92552ca3b44b164bdf9620126fa61b6126e9056caff09c0c60b5a7f16496dd7826d2e51e58481fdcf2c7eaba6af7034f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
25KB

MD5
03bc32bab43982a0a1faed0e9f2c8e52

SHA1
4a95ad8e459f0a01b97375f920b0905eb1cede76

SHA256
541f0dd9e26380a1b96c2f740715dddf7ba4cc9a357d1c7a6208a3cdd5b14f07

SHA512
8652636d551ed1c85863071b67964aecba35f7ea4c6eff481797542512bbfa39e84629ecc2d3c127a7cb88be58d4897119e7173d98bffba71594c680ee5e25a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
cf721698a2dbec882cbe9247e9d927c5

SHA1
941b644b54db22d416e5be717c167fda30d57a2d

SHA256
9e702a146b5f9986154ed4986d47335b6d4ac0755a4da0d591f26faea1816510

SHA512
668a7a703b109c36d1c6cd57406ffecdeb5a4b3e13ea039c111ebaac930a3824e18f1768fd6772279196cfa12c1575ac5255ee51c9121e361ab831d8c78e4ae8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
719236aeff123f8036a536e3bcf19c40

SHA1
67c3cc585b98de12bf09ee536c5c2679a178b893

SHA256
8e38ecf67b0ced26fc62d4a570174cd15921e90d180a8ba169ee447650a229dd

SHA512
31fe2627ffd9fedd008b1f6ede220cd4f6cee9c14c8bf34603e20c74161988a23a35ea4eb362d289d38504fb67d9a102d604c7ced4917fdd81e9e6d57c358989

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
44f2dd4ed32abdbd50ce4f647a4f2fda

SHA1
7ce45b2d9ffa6d870ee770db964992cb959ba59b

SHA256
2f206237b79e154675f5b068970d534dfa6a1d627de335688413b65dd0daacef

SHA512
f1bcb1689e64afedcd332171f9b6048edef83295caa351ca7d31abc2d62fbb5e17a1a47350b8f1552af859a43097f8e12bf92b6e324595d799974f4d642bcd9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
866a4d10aaafeb0d108238ca4e8981dc

SHA1
b09e4940eb4011a5d73896a5d08c3f344ff9c579

SHA256
ea1468f6d4964792eaeaf98eaa7351d2243853e2ca5585625c75171f124849d5

SHA512
1708a560c92ddc2e4b1d8965957afc878bc2939531d7adce046cb6741894e19816b12791ce1348d7c7fe6b54621683ccc17f2e4c639a4b7e760ea4676709fb52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore.jsonlz4

Filesize
13KB

MD5
6e2b859214987395581368bf6194c29e

SHA1
cf1703721e5cbd71f6fa23b906e3b485513381dd

SHA256
3c92761d9f5be59139067beec85b386e04402a1dbe9f2f845a1d2a43d5ecc664

SHA512
a2731b49a0d3645694e91b2bbaa7558d47c0f35167fba066c8c56d656544132f8a94bb920513d9d9c0e02864726bc20a72f9fdbc041908091c641fca21ea625e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage.sqlite

Filesize
4KB

MD5
59878f4fc4d4c45c3868d374480d946e

SHA1
b31eb8cd9b27bc82b988e471efdfd1f683413698

SHA256
d355bb28c0ea34ced99cc846d38e926a16480f11067ffcbbc1fd6e8dbe8afd05

SHA512
b6d407f76e329a651f615cfefc1dbf7110892e98fde626191983a54817324cfbf24a8b6a0a0ccb05996cc3e5fa039e5877c2c9363e113c3624e71252759b8133

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\default\https+++github.com\.metadata-v2

Filesize
48B

MD5
cb849f6c62463ea15c4a2d7bed8a6594

SHA1
b9570ee39aa0687bf22b350f7ecc42a6f90ee835

SHA256
ba3ab557173129fd07746810dbbb47a7a8662229fc0e781872c73ea454c21b40

SHA512
f06790c0d278c2306e84cba0da7ac4913fce30e454b2ed0fd4257a44336987ab48bc9ca84b4a2ee15fbf3dbefbfcabe74710b2bc8bbfb2d3c2187abcc819f27a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\default\https+++github.com\ls\usage

Filesize
12B

MD5
757d99b94b30c4cf178ad22987dbbd1d

SHA1
8ad92d74d96e694bfde8c0d1f043818293d4b477

SHA256
3a1749533ef1295c3d2618fee3e01608549db00c48293e009b045ffacf52d86a

SHA512
fcb291523824de5f145fdf85077df2b71451f682cb0047f25116fb796c34f1fceb22f27a804f9e99f92468600429a4aa3fa3f38bc67cbb987ae81792f8918f48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\default\https+++www.fbi.gov\.metadata-v2

Filesize
49B

MD5
f755b18924b6681a75df5efae36377ed

SHA1
a762121bb3bf79e758ae9f387898bda085aabf15

SHA256
510a0cbf54ef3e69a24438fae46eb56bf6cf8349a4aeff4b8b11b425ed57239d

SHA512
d00ad82c126f6b3ca99e0ba86908e30702a10cfaa1c73ae248aa7aae423d2beb54d483fd3e597f374284c59e51c5aafe112459a8723beb60f60d2ec85a962b46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\default\https+++www.fbi.gov\ls\usage

Filesize
12B

MD5
45eb0310df41f8a19868d6c99c264a73

SHA1
b659fc8a8e5e4922c483e2dcd787a026c46b6b10

SHA256
766e94edd6035366e1ca98657ace0030f89bbfc9704b6ede6e5e74a434280eb3

SHA512
cc09e44f775cdaf62a6acea6844400af61095679e8ff059986e9c866f9e4b7c009f68a073acaa4dc919b7b138ee13431eb01faa107a74c67acfdc0a4ae8616b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\default\https+++www.google.com\.metadata-v2

Filesize
52B

MD5
2ed1e37058127119555457956492ae59

SHA1
da76926c9ffe8b53127848958ba9fac162306a37

SHA256
4580e21458b539a1ed79bd27a8d57568e5b0ec81a1aa68452bfb37a87e27d182

SHA512
c84ca05a5d8c8ff7fb46c12349cd3e2a289605b95b2a2ac43f4f709a1b1bf57c211e3464c087f1fe07cf4cb6c6ec26088821200fba90eb98d95877f979fdb6ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\default\https+++www.google.com\ls\data.sqlite

Filesize
6KB

MD5
dc330a6c4c88a45f7c9091dcc1f133da

SHA1
5d18068c86c7d7b5a397377678f7564df10aa934

SHA256
5c09e3729468e6739168c93bbe28418d2e825ac64f27d98b3dfc2194dc43bf51

SHA512
baf05cb4bd76413c2d1b640d0315e77f35ef753e8af7d262e508f6b0871aa56c7a2448836cb977edb401c093d74dbfe6b8eee11cf5212568003ac81050534bda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\default\https+++www.google.com\ls\usage

Filesize
12B

MD5
001f9b2bd56613973fd485089ece6356

SHA1
f0e3c917d3f0b53acfa503dff56585b111844693

SHA256
ff1dcd69782282aca474b631560cbc34160b3fa6fa19643ff6005899a88de7cb

SHA512
10d0c4fd491d18013b9ab8280425f25914db9e5e69900b6562214ae390a25bd310aea5ab271a3686ba0559ad7fdec5f980276b683d3de0399bd465078ee3cf16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
c02f3b36da3545b6158e742fe03966be

SHA1
cfaa7bb9b389426665f4bf0f0049aaceec46d665

SHA256
94bca240a52664de27c7892058e7369b669fffbadd6eb42331bb470689891c01

SHA512
616ee2434bffb01e5ef9bab88e832b9f348b6738e7d5ebedc06a3e4f183976ae51c7b6d4c2fe932f409d5623948b2835f3acc6517443cd82602caa1537a10349

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
608KB

MD5
bfb6668889cf0097a13089d0589de697

SHA1
aa2a2494c08465bd11978e0df2500663c40a6494

SHA256
968296cd5f803b7d82cc037e98a9e29c480a3052d16a7dbc84de5b084b45deca

SHA512
6e8b232164d6d3e3703685018c14f89e3ce73e0d3e0623b876d4736f3ca8cb53c53581ce8532deae2f97c069f1eeeaaae580b11ae313f81da83dd20799a56d34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\xulstore.json

Filesize
217B

MD5
3c7edbdeecdb47fba617e3d03c36b0d3

SHA1
53628ce8c5170810fabafab8e001bfd971d47825

SHA256
c3db6f2519b071b7441022f9ed508b0da5ba40295be0ee449a27bd6146595d04

SHA512
bbf56ea374114173f7de198cd71ac6e75276b0f30926c6690db512f45ac2e54d099d990c285578f702696494d2884d8550e5dddadeee01077933034ac3817842

Download Submit
C:\Users\Admin\Downloads\EGFmcgvC.zip.part

Filesize
104KB

MD5
b79554fbb0dc8dfc2382b39b5dd3a6ea

SHA1
c92e557a8c1f756108d80d7af2d2bf8c8ca0c3e5

SHA256
ab7d15cf7d327924602b5cd6e6ad43306573ca14198a00d8b5cf3a5ed532f8c4

SHA512
cd88011fc6e0c6377362a0563caf8e0494d622ff74202dc4fdae88f4ccc62727d01523e8e0a430db49b895a793f7cdc718ae96640a7fc839ee94b789f6ccfbb6

Download Submit
memory/5620-1288-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1300-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1294-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1289-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1295-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1296-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1297-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1298-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1290-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/5620-1299-0x00000265A7D20000-0x00000265A7D21000-memory.dmp

Filesize
4KB

Download
memory/6036-2002-0x000002587DB40000-0x000002587DB62000-memory.dmp

Filesize
136KB

Download
memory/6036-2007-0x000002587E040000-0x000002587E084000-memory.dmp

Filesize
272KB

Download
memory/6036-2008-0x000002587E110000-0x000002587E186000-memory.dmp

Filesize
472KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads