hxxps://telegra[.]ph/Happy-New-Year-01-06-37

Resubmissions

06-01-2025 10:36

250106-mnqkmswqgp 5

06-01-2025 10:32

250106-mlb98strcs 7

06-01-2025 10:30

250106-mjxhdstqhs 7

Analysis

max time kernel
93s
max time network
96s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
06-01-2025 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://telegra.ph/Happy-New-Year-01-06-37

Score

7^/10

steam discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	firefox.exe
Token: SeDebugPrivilege	3528	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe
3528	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3180 wrote to memory of 3528	3180	firefox.exe	83
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 2692	3528	firefox.exe	84
PID 3528 wrote to memory of 3460	3528	firefox.exe	85
PID 3528 wrote to memory of 3460	3528	firefox.exe	85
PID 3528 wrote to memory of 3460	3528	firefox.exe	85
PID 3528 wrote to memory of 3460	3528	firefox.exe	85
PID 3528 wrote to memory of 3460	3528	firefox.exe	85
PID 3528 wrote to memory of 3460	3528	firefox.exe	85
PID 3528 wrote to memory of 3460	3528	firefox.exe	85
PID 3528 wrote to memory of 3460	3528	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://telegra.ph/Happy-New-Year-01-06-37"
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://telegra.ph/Happy-New-Year-01-06-37
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1908 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad220da0-5a47-43b4-85f4-91c62c2d7326} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" gpu
    3⤵
    PID:2692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24601 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4fa0cae-39b9-4efb-9537-05e0a5d70432} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" socket
    3⤵
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2916 -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3172 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4c8ea44-e37c-4d9d-95cd-739b32b68f6c} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" tab
    3⤵
    PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4172 -childID 2 -isForBrowser -prefsHandle 4168 -prefMapHandle 4164 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ee573b5-012b-4fc0-be28-0cfe59465f6f} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" tab
    3⤵
    PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1428 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4748 -prefMapHandle 4576 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aec5d634-c1b0-4368-bf08-14b5808355f3} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" utility
    3⤵
    - Checks processor information in registry
    PID:1588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 3 -isForBrowser -prefsHandle 5460 -prefMapHandle 5500 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8d36ca7-1166-44ff-9971-e9725323cf7b} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" tab
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5704 -childID 4 -isForBrowser -prefsHandle 5616 -prefMapHandle 5620 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35315bbb-e261-4cf6-ae7c-066c44068ce0} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" tab
    3⤵
    PID:2844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 5 -isForBrowser -prefsHandle 5836 -prefMapHandle 5780 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84d69323-5770-4232-8ba8-3ce98a22ad75} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" tab
    3⤵
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4424 -childID 6 -isForBrowser -prefsHandle 4508 -prefMapHandle 4512 -prefsLen 30948 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d7f0bf8-775e-42bf-aa9f-962eb69f25e5} 3528 "\\.\pipe\gecko-crash-server-pipe.3528" tab
    3⤵
    PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
7f7c84232ba3b95dfc0096eb938c1378

SHA1
bc7ddacf6521a5c880a6f3b5e62a35a24d8aea55

SHA256
08b052f46e4ac4eb03678620f7982a4df6f56633c2e19fb62b71f08754cd9894

SHA512
8c30b6e666de4a22a89260f19cf94ba4574864dbed93683679dd23953931412d302a044b85d0f0e6e9ff3e582fb1f48a10be58c81059db171c69c264ed775aa0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\cache2\entries\51C15E82D91CCC38B95AFC771E4779BA241453B3

Filesize
34KB

MD5
f9ac6bd56ade4ddad6c709ebf647fe03

SHA1
187ab503dbdef9674d08aef5b5498fc4802a2278

SHA256
2482085819fdc4f0ac5c61a7d79b4356a72e19db51d8b85fcf0e09e955c70535

SHA512
83eeac8a451e41fe2bef461e09cbaad6017c34d46549cb8e5409de1c85aa37dbce1bc7757d12f8e582a0dd4157a3c687bdd08a782b180a9304f089aae13ae5cf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31

Filesize
13KB

MD5
82b6090bf18a5285deeed53ad4fa5467

SHA1
0ed3b06366d5b7caf8d2ab5989989b079205f651

SHA256
f0d1c9a8f93fb52c838f7a4c794247a9f6534ba1f20e17a951a4596bf39504f9

SHA512
6fa13f4650b658f1a63fa5acf92ee7190329742ba5b1c7316540baa41c618c7acd19fccf4916f35e0ba04ac0e0905caaf794e4c9e9002baf8e94fc95ff5a8d09

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\cache2\entries\A2A535CEE2EE65519C5241D9E0186A778B89D718

Filesize
118KB

MD5
3139609646fe27e8b8640145bfd3a48c

SHA1
de5c5abc09712e6d13f8ca8b5214e5724d351221

SHA256
7629fc3c175f06562a4aa9cd89dacbc91fc53baef70573aa4cfa8fe4c49c02b9

SHA512
36b641de03b346004587275d092939fe3a37792c0cd55350dfb0a1550df7561234a34ae9e628b1f3bee99e7f8e9444611b6e48adae8ba5de2ae39f7c91ad25b5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\AlternateServices.bin

Filesize
11KB

MD5
eb7387c9cc951e43b480d0878e38f3f3

SHA1
915aa4797b8b5e92e42cfa9aab351a01bd090150

SHA256
889dfa1fa1c8713c88392d692fd8db5ed2e46293ac001ab857dae1190b6ed792

SHA512
c247778b8d148d0be6ca841c1947734017fd2baaa1eb81a17d67d299898cb7f60bd264bfafb844b8f009b0a43e13bcd55d52f317b29dfd5adabd55e7fd1b930d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\AlternateServices.bin

Filesize
7KB

MD5
ceb46376ac26acfc1df9fad8f19fa4a7

SHA1
ac6340a2859e200de6311f7c263cf422be3196ad

SHA256
c7e34572478b446c8a6fecdf906cc3684b2913a0277cbbbfdc1bbb22d7273919

SHA512
895fbc4a35c1b0ce830da798600a50a252d98ad0ab867e8c7a24810ead8035e05f6ef634e0bd235f16016a8114654ea1b206ebed8b0d506eef64cbc247afd237

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b89cd3d531ffc89dec0686c91c983fec

SHA1
d751a30d65f02e2263cb80b96e9051c3fadfeb3a

SHA256
0dcf432f2751841a239de42f8995921bbe6fff858130d425744eb6f677b59897

SHA512
429c12560dd99b1476e26bf5d6cdea1f3e1a283369c18044601a44127a0f02e94938e50f3b9246d73fff5413f96ed8b0328154639c61e6f0f8e9ea7f83b83cb0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
4c71a1a46a3b3dd97d490bb00b41a29c

SHA1
60c4ce4e87b02ba5ef26131fc9cddd1367f0dc63

SHA256
3b4b0c1742295d651207e57f4d42c445d54273199a4ac914f52e50cacf5b8249

SHA512
afe5d45b4d960d802d9d62b070c055e5094f9347602d5ad36311445c7d0a14827f6f6ea5034c021acc17445fd2f14669bfc2d98547beb832f644b2a299793fb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
b55ff4b369244f5291a01fc08e1fea15

SHA1
4da7939c1aa0996287276dabae970ec938e2406a

SHA256
6b2e7ee4900d1833569014bf9ab267b9bfc4f0ea3b01c7e3c7418f4697625ff3

SHA512
0ad662f3cf4761b9ccea7675d432f4e90af247ef991fa950ee55fd597ebc399694aad8ff4f9ab323b3e63d5e2b4fff7e7aeef36d8d226245bf8fdc7a0294b217

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
29KB

MD5
c7fafadabf09afb69595e109d193d8ba

SHA1
d296c91f167b1830a0904820c4ef1f40761e1e67

SHA256
722cd4491dc1b799395810ec48e58a15f99eba7cc5a7c6a006cfa2f6c23fbc13

SHA512
fbca9b5abad01d932fe855aaed0e925015e89cd27c040e2eaf8614817bbcd7ed5434c20d9926c867c5c71108f3cab3d3ca5ffb23c03c845177b3ca2e13fbb149

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\8a929d60-9f44-439c-a55e-faa69cf9eaca

Filesize
982B

MD5
addf09eb7a7160b6db11effaf3118659

SHA1
56420aa3ad51d65df3997464155756174c787fff

SHA256
a2e6025bef3b0b5525e94e48d1954e0d62cf74a053b80ae632695fdfd794984e

SHA512
33648b079fdfecbc8efec29bc6323814c7365d19bfe1007191b184f1ce6bb2d9cc77e03ddc0c8ce2311d4e32926d3f250a8f58ab80085196555c18f5ddc76b6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\98ac8f31-7b40-4c7b-aa3b-739d5219907c

Filesize
25KB

MD5
e69ae4f8a1a3184d4bebb7bd698d3947

SHA1
0d5b957d53ca2f9970d3da4c3d9dcb15eefdd061

SHA256
6ff1248efa5d4589edd9f921fd8b8ef5ec2d34ca1c8f53b45943a5b67ecc094c

SHA512
39d21171372058c7cc0c03069631938467b2837245451a660019a86e5145ebe2f339c51ed637236d1d8abf5ab5e22e3fb46dbb1635c79a96344a9b7d0a46ae08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\f9e74d5e-8d59-4439-8690-5b955188ff81

Filesize
671B

MD5
a94ab92de26e1b693b230a9afca16cc3

SHA1
de3914313e1fce17c147422e09ceb3937d0aad87

SHA256
3100531306d0b283e3e84c42fc84405985fea00a253ed14f89fa3665568fbf9a

SHA512
d7953bfccb9507dad3a78be74d7455aa20dbe2eca435c1a6ac950b3525ca39f20633410253501718cf55fd241b32200c2946ee69a8b758446cfe51538b31ccd3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs-1.js

Filesize
11KB

MD5
73bd27afed905d0886b26ca0c0ff5e96

SHA1
777cb6645800726d779d169c396b5d32b9b7496d

SHA256
29c8f22d95ab75eb04a7d08b918525ff871add153959ebfb90c15e0e4ddc5cbf

SHA512
537f0ea5fd11fdb138500581f1d787b503d9300815f64a5ac1abf4dbceaf19eeef4615627a6c9491a1e5fda3211e395e96e525bf078e50c088d1c64a61fea406

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs-1.js

Filesize
15KB

MD5
b37fd7094e3e64920f61abeb68fb7c5b

SHA1
65e4c17f28e45e5198c6f9d8edcb71ef1d4965ae

SHA256
5fdb3a888a5c12739466ceaad871ba70c659f7526583dbe6f747492e218f1c97

SHA512
8c4ae46638cc5eb3134a007575cff0202e05efad8ec1d0ed0754e1b18690f39dc65d39c7b8c42888b05813fa261f3d86cfbc10b6281f2a02c1942cb969773773

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs.js

Filesize
10KB

MD5
21c32e344cbb7796a6ddb454f2bc7aaa

SHA1
d89844ca284295b952b798889c8f724de92b0630

SHA256
7c4447cd632c91886a9e0b2057c3fb52efdf5f1f59cbe094898b70cf6f23433a

SHA512
526f85ca56c96e4ce07466057ee1b632c84265ed6605deff0f85fc754ab96077b9cae988f02af7808b5b03d7ff30013f01092869410c871ab03199ec814ec322

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
bad116f185f2ebd70f240533fec4a859

SHA1
1b1a6fdf9e9648121e82a7698501a029bf9e4dfd

SHA256
1bad2cf195af032ce0e71053b4205edfa16dcb7566d73dced3a440510b135138

SHA512
fa376cfc7ef9dd66832e85bf019ddd9ee9409afea89a527050f2bfe8942281220445142f99e9820a81b10e2f811f91676086b0332320094964f83c1401ba0ab8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
41KB

MD5
4957a2ab497f20d48fc6c27bd7c62bc7

SHA1
d4af584d138fe827aa08b3018aa711034eb465c3

SHA256
98e158ce307e64739fab48beea0a85fd65423fba351d0f8121cf8d7254dd637b

SHA512
0e1dbe1c8fcc6241d963f199e3f0d3a8e0139ca518ff8101279de75b65e63a4b04453262732119095e48677ebe901da8e72bd2a35600119d5c1735d4442bb9c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
e70e5c5cbd2141b58649a1d8ad78d406

SHA1
07950a35485deb5f3d37779b1874563e1b303083

SHA256
3fef61d13f7dc26b65bb6451700010469cbb03339f2391bfe196e7a6ca085311

SHA512
d5d3dab436586befd454cabe8255f412237c0426648b21a4d096890fa69dfbe4b4aa5d8b79c5cc3d7de634d02574834fc23eb06db3b27ca81ea576bf9264d2df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\storage\default\http+++steeamcommunitii.com\ls\usage

Filesize
12B

MD5
c14b5c57472b92f120f0c4772de266f0

SHA1
27df6989d0aca394f4392a5948f224b02c264027

SHA256
937b09e309d2ca54bf86dae0877dd2d032e028970dd78ab72f5d3eb42516ec41

SHA512
d7f541cbc5ead372ea401d81daff177519e3f01bdef0d01783662180a932ef45444ae29af408563b33b0655ac40b8b8e1f5be2129986469053281f608518a763

Download Submit