hxxps://telegra[.]ph/Happy-New-Year-01-06-37

Resubmissions

06-01-2025 10:36

250106-mnqkmswqgp 5

06-01-2025 10:32

250106-mlb98strcs 7

06-01-2025 10:30

250106-mjxhdstqhs 7

Analysis

max time kernel
54s
max time network
57s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
06-01-2025 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://telegra.ph/Happy-New-Year-01-06-37

Score

7^/10

steam discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	firefox.exe
Token: SeDebugPrivilege	2892	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe
2892	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2188 wrote to memory of 2892	2188	firefox.exe	83
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 2092	2892	firefox.exe	84
PID 2892 wrote to memory of 3168	2892	firefox.exe	85
PID 2892 wrote to memory of 3168	2892	firefox.exe	85
PID 2892 wrote to memory of 3168	2892	firefox.exe	85
PID 2892 wrote to memory of 3168	2892	firefox.exe	85
PID 2892 wrote to memory of 3168	2892	firefox.exe	85
PID 2892 wrote to memory of 3168	2892	firefox.exe	85
PID 2892 wrote to memory of 3168	2892	firefox.exe	85
PID 2892 wrote to memory of 3168	2892	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://telegra.ph/Happy-New-Year-01-06-37"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://telegra.ph/Happy-New-Year-01-06-37
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a278ef6f-522e-4727-bda1-318a571bbc2f} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" gpu
    3⤵
    PID:2092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2404 -prefsLen 24759 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a59949f-83e0-490d-8835-81a862aefc76} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" socket
    3⤵
    PID:3168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3176 -prefsLen 22700 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d4aeb17-6bd0-4463-9256-43f4094f161e} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
    3⤵
    PID:2556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3640 -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 2720 -prefsLen 29249 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17b253e7-17f0-48c7-90a1-310cd2267cbc} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
    3⤵
    PID:1988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4588 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4356 -prefMapHandle 4576 -prefsLen 29249 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49f058fe-e01d-42de-b031-721847aa2e73} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" utility
    3⤵
    - Checks processor information in registry
    PID:2108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 3 -isForBrowser -prefsHandle 5344 -prefMapHandle 4736 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db56c05b-7925-4348-9432-f58d9ed7f9ce} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 4 -isForBrowser -prefsHandle 5552 -prefMapHandle 5548 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06b4a227-7159-4ae9-a125-2084a458b914} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
    3⤵
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5664 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04d225aa-0ed5-416d-a4f2-a439103b0567} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
    3⤵
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6176 -childID 6 -isForBrowser -prefsHandle 6088 -prefMapHandle 5708 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a675768-5077-458c-91b7-8d283d322dc3} 2892 "\\.\pipe\gecko-crash-server-pipe.2892" tab
    3⤵
    PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9enwga8g.default-release\activity-stream.discovery_stream.json

Filesize
25KB

MD5
c1ffe0d876a7f6c9f94ccfa57bfcd175

SHA1
da7da63387b4458234eaec1165932d9c3e2ab485

SHA256
6904f66f00de0c9c53272b3a97e8ab9e7344c9ba78f4aef3710fcadc4e2ccc28

SHA512
9ee40fde29c35e2cdc992dfc73a45061aa0c758bbcfe7535427533b505ff4309726cbef5c445dbfa41291c065414021ca27bcb94fe60ad01a9f9a3143892492f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9enwga8g.default-release\cache2\entries\51C15E82D91CCC38B95AFC771E4779BA241453B3

Filesize
33KB

MD5
c19429af5f3b9b83664e9752f0a72154

SHA1
2ea4a771b1d09c2bacd79b40483d911e94a509a0

SHA256
adbf4a46a3c0dc72723f3264f6d85f74c4dcebdc6ad35c5ef726780a009b411d

SHA512
fc0fd21c9e90f3bdb761d199309a7cadf034d187480a8f4f8c2662b1354c35d7c4ea6bff2d2c138eedbfc9ced13dfdd0527b60ebe307c97d22b5c60c27e15eb5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9enwga8g.default-release\cache2\entries\A2A535CEE2EE65519C5241D9E0186A778B89D718

Filesize
118KB

MD5
af75af4b8840ee148e56b8357d181587

SHA1
98a21f0795c2c0336244a6ebb83ccdce33ee0189

SHA256
e6fd03168102ee5ee45671b92e42e08236c590e80745a91edc417716c76e8c8f

SHA512
ba983a3d3a17825bc2346278cdd11c748e48aac84edddcccef4e87f2da25c90800b764fc948f858fa6e6a911a277127166348e39604c9b4ad668c633710d74a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\AlternateServices.bin

Filesize
7KB

MD5
2ecbbbcd2ba6dcb9c682269a5443fbce

SHA1
5406e2c940cb5d012468fa564750e5b9d29009a5

SHA256
cdef7a367ca490691794e2222c45355fbb200990c1a414ada44595acf50ae4c3

SHA512
d3df3d7f59df748e73caf4920c5e225efcfeb7df44de41a4444c5f174f86642048f30fc162ec494facb69153c62619feac9c8d514c3e50b6c87c0628016772cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\AlternateServices.bin

Filesize
12KB

MD5
a255f3eb6b603ff19c2e81c53d1cf103

SHA1
055d3d6c025efbbe9c422490d80d3c703a7e59bc

SHA256
714e340daa37dcb4e84f7fecd3de840d9cac33dabf07085d4f37317d11f02837

SHA512
b46772f1ce2e69eb06499b331e456ceab5279a06f7b5b734a243f503ac57784c5dbde172662caea24d6805a1c0f53ddae0a8867914415aa33f87f91201634afb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
e86b2aa5265a7f2e5ad8d3f7a36c554b

SHA1
23dc154ddbc7fffaccc7b7bcf956c462158985ee

SHA256
6a370c0c2da3bf94a434c0578e0785ca481e8ee73aa7629a2890574c31893f10

SHA512
696c9b87183383bf92bc3dab83e30ee496d2bc770ea5842933758ffa80158f512793c5812d42369c044a255551c17705b48e5469a1031c03c0384af726df5651

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f3072848e0957cf81ac1c97f4caac8ec

SHA1
a10e58dede16d048338ce71c3dab3a50707c08d8

SHA256
72b2ec8ebdae04c5489b872b090619e16a19b74eb4cd6f5d70df1cff9c8d0f34

SHA512
883c2ee0368f80a8acf0101be097b8f7805c5d274816dcd67b9b230bdedd623db3cbab18dedfd30fdef3913ba0c626765f707057b0dff8cc88744cbf3d20be58

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
0e04255b78a9e9702485d48f93321972

SHA1
601882583117d63fdaf87b8355b66e25fd21a242

SHA256
3eb6a6601e6a2e1154e2b37ab62dec5440ddd139bc7e42148d7864acf9731dd6

SHA512
0910554105c880adf55a6da6a5f49f6337d04e1b5825f80df6ec076695fdba4c9eca8934bf0186a76629ec074c66205df82e02f05f13c56fff6412a9be9bc9b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\pending_pings\1a2a62c6-b14d-4a52-9444-2718f16651c5

Filesize
982B

MD5
95935122d75aad6f5352e044fbbab2ef

SHA1
f1ebba3c140a75dd80b95299f9af1c0705a8288e

SHA256
d6e8fe1757df1e36574ae612274ce0793a6962406ec5e41cee7ccf4644e22c16

SHA512
85e3a35e68fce497335cde4144f28586e981df0945e7a0393e98505baf50e37b65348814973ada1f53c4d4b31530808debd148649587701254e91b019b94fd2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\pending_pings\6ca74cab-799e-4d12-a108-eaa8ea03d4bc

Filesize
27KB

MD5
b6f89911e4bd94bf8f03fb75e78e28ee

SHA1
662648708e68f8f601c9f6278faafeee115b31bb

SHA256
7191865160b0bfe0a3fd7b771fc1aafa168629cd8b72f76f946f025ec3890320

SHA512
d5243666226915cc90f8064a30fc31a747871c3cf28157d965b8e6b39569d149a44aaee1ad5d8f168f8a94ee0616e7c563b26b7421dd7d04a2191d29a1453946

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\pending_pings\a678bf47-e3cd-4241-b31b-5068092e898a

Filesize
671B

MD5
0aecd5d40531358b972ac99b495dec6b

SHA1
c1e48dc24333f1916ffa1b1385539fe744b674d7

SHA256
e013bdab92a20541605d1d1500da077e76f1fe74f26fa5d906ff6dc0103ef536

SHA512
e00f90226afa6db3d15e2193d27c1edf2ec302ebbc7e1ffc0a555e8d305b57b7db093c1348e56e31450847b2f15ec61d8d084be6c08aa0cb14d31e177d3c174c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\prefs-1.js

Filesize
11KB

MD5
fb81032f18ca95bf4a1b54eda78cd1b5

SHA1
79fa0378301a3c69b8b091c4750df1613d731587

SHA256
c6ddd3de4f3008fe763150c6c9e144dabe53b1782a6614db3d85fcd711994ebf

SHA512
45b176c9b9bc9e5aee6a6dc2a3df9a9ee3d34f3b43e5b744f9f00fd255c06f13501108be5ad4dd8c8fd925f4fe86c5e076156dc56771e05f341bc4eabd9372ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\prefs.js

Filesize
10KB

MD5
d58dc3c912bd2bd5bb212599a5a958e3

SHA1
78f20fb2b8dc93fd09aefa6b901720ae1c28236a

SHA256
cc5bc3349da8d4e047388bc9ca8124492a87a31f687fe4a2c3c9a7ed5a481876

SHA512
8d5458cd83b33b9b0a1a114e905ac91114af09553226509787d9a4e7d70ef7c6136e386b12936b935094dd2f2152947da37761ecdd7111da055a37f6e7d257b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\prefs.js

Filesize
10KB

MD5
80cea4504532ce4eb97f3868e18deb1a

SHA1
1e837f48563acf092ff263a52c9f151bff37272a

SHA256
fc1ebc21f5ccae1804d42ee4038e80216ba3a34404594f0aa4a2bd6a55c4b0c5

SHA512
1e2ca3ebfdc34f1829748fca9a963738fa4216466449b630c92f1661b21b393d613028d82ce3d55a84baf78b0e392d8a8b1dfdf9b1cf7fdcc8e9f375a2d877b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
b9509de257d448afa5cf1a9ea6b62ee7

SHA1
d6f89466d6efe51f62a4fb5eb7e19983f7c7f788

SHA256
2e88f408bdb8d9a9466556c71a695adb4be0e49627981706f934d9cfb20cfd3a

SHA512
d8d7949d34e25111c58a320a7eaddb0e58c29b2d60faedf24a26a8d5d2156a549fa2bfa8cb4ed1a8e66007778614784a02900e5df3662f28b22e0c5236a7fb6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\sessionstore-backups\recovery.baklz4

Filesize
41KB

MD5
5417b33fdea6a0f8d680debae8afc515

SHA1
4b39c0b4cd7c599b8d7428dfee844ce48d82fc87

SHA256
198e28fe029676563fef4b9d19a7c6c6cde5a555b1e24c416d9a32b1f849a70a

SHA512
828bccccbcab6fd28af46f9bda52c2b79884b75f2247042e508972591c8429d8fe56aac48369d8539b7a5635f1aaf26f5df2a52ed310f8acfef23bb2b9e63b51

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\storage\default\http+++steeamcommunitii.com\ls\usage

Filesize
12B

MD5
c14b5c57472b92f120f0c4772de266f0

SHA1
27df6989d0aca394f4392a5948f224b02c264027

SHA256
937b09e309d2ca54bf86dae0877dd2d032e028970dd78ab72f5d3eb42516ec41

SHA512
d7f541cbc5ead372ea401d81daff177519e3f01bdef0d01783662180a932ef45444ae29af408563b33b0655ac40b8b8e1f5be2129986469053281f608518a763

Download Submit