3c01616cad90716f17b84d968167f167bbbe28dbc6b2292e42c6794273d3fc7f

Analysis

max time kernel
435s
max time network
617s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-01-2025 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

class.obj
Size

27.1MB
MD5

c0ac40b57fa3ad25dd796a79d1a4dc91
SHA1

5b19923fa8b61fa04a2864dfa473443d05724419
SHA256

3c01616cad90716f17b84d968167f167bbbe28dbc6b2292e42c6794273d3fc7f
SHA512

2aac4849d6e7a79bf403ab1a8ce95765ee7079a35d55611dbde5cd2845f533ba1a7c3cb6b572f1b4a8aff75665755ee6ef690fa103bc2a93f69c9c8751099f07
SSDEEP

3072:dmoHwq/ziXTdfyUMkupVZ2Y+0BmlYHvxxscRB3585Qm2E9h0ED7/HkrTI1VXhSp4:K

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
864	OpenWith.exe
4672	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4100 wrote to memory of 4672	4100	firefox.exe	82
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3944	4672	firefox.exe	83
PID 4672 wrote to memory of 3388	4672	firefox.exe	84
PID 4672 wrote to memory of 3388	4672	firefox.exe	84
PID 4672 wrote to memory of 3388	4672	firefox.exe	84
PID 4672 wrote to memory of 3388	4672	firefox.exe	84
PID 4672 wrote to memory of 3388	4672	firefox.exe	84
PID 4672 wrote to memory of 3388	4672	firefox.exe	84
PID 4672 wrote to memory of 3388	4672	firefox.exe	84
PID 4672 wrote to memory of 3388	4672	firefox.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\class.obj
1⤵
- Modifies registry class
PID:1416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1896 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6314cc4a-9265-469a-8a56-60895282f878} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" gpu
    3⤵
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {378b7845-ee9a-4368-b1d8-d5b245296d31} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" socket
    3⤵
    PID:3388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1496 -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 1436 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26edd66d-13b8-4517-bdb8-ac59182a0368} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" tab
    3⤵
    PID:4668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3564 -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 2732 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {859c6db2-7274-4ce6-88bb-cb55f62aa9e8} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" tab
    3⤵
    PID:2704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4580 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4656 -prefMapHandle 4652 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f240b9a-0c05-41d5-9328-1e2268bd39cf} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" utility
    3⤵
    - Checks processor information in registry
    PID:1664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 3 -isForBrowser -prefsHandle 5576 -prefMapHandle 5580 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b82d40c-76e6-4181-abd0-cd3314dff995} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" tab
    3⤵
    PID:1268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 4 -isForBrowser -prefsHandle 5728 -prefMapHandle 5732 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0861d99f-1012-47e8-be4b-0ce3bf40d383} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" tab
    3⤵
    PID:3628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 5 -isForBrowser -prefsHandle 5880 -prefMapHandle 5884 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34cbfba6-193c-4934-ba7f-e7434a9a55ad} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" tab
    3⤵
    PID:648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6200 -childID 6 -isForBrowser -prefsHandle 5972 -prefMapHandle 6152 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {289a3548-2f90-494f-8210-9d55a4d4dff9} 4672 "\\.\pipe\gecko-crash-server-pipe.4672" tab
    3⤵
    PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
6ada1578f29ffbd8db2216e83f00e127

SHA1
48289e3ff16366e0690c58acc92565db3a7b6fb6

SHA256
7d308693138aea6614b21ddd126ff97651dc080d252f6aec2bca0eaaceb780f4

SHA512
f0829baf2195d3947d99d6542abdaae89173ea40ed4ec725660a32cf14f38e4b69b1fc2487903d08dae8e48c21156d64c4d6c435a8850f7ec9b281b24368de78

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K7JLA2KABH9V32NP5QHW.temp

Filesize
9KB

MD5
318da8f6f35d1a6b4d4bf883e407165b

SHA1
d19054052c4522c67f1313991768330ec106ce54

SHA256
2cebc15164c1fddf5f37878641ea4e1608e660ceca38c88dcc43e4e9b4107aea

SHA512
794bffd1639057c672dc02ff39093a5c76440dd14ae65ad9d3df9cd4d7d31d391f511249f270194a618ff57448ba6c57c8598f8abc66f8309367f264ca90863d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\AlternateServices.bin

Filesize
6KB

MD5
198545fe37739d3c42310dd2fce49169

SHA1
319cf8b594af4ea1b1c6742639bb6ec84454d5df

SHA256
f5586e6cd18a1b39c80e85206d3a38b5f545697d718aad03f0e7afcc4188e4ae

SHA512
fceb850626745118e155eb9e2fc107823b30cf9b6b5b2efa4b6341a8e5f4899d69a9964795d72e868bd83dc36f0b391d011c44d2f8ca08d02ce26b78d955f1fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\AlternateServices.bin

Filesize
8KB

MD5
3e756e6ceddddbff8f45f59fb824ec3e

SHA1
d30ca7dbef05e08c1de12b5ee3e10539b79ed416

SHA256
0d34a5ad54c6fe0ea9284b14244f13bc0dc1e4189edf532dddb9ae15d18cc51c

SHA512
6eae40691d8edee03cb9e803421f5b6027077975d4b2572c8e219aa2e0882af4b95c7b223c1e287b8f7d28c8c009eaf60ef26ed9485cc67e9725a5231824171e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\bookmarkbackups\bookmarks-2025-01-09_11_kRLbBYb71xkGHLnyYpNM1Q==.jsonlz4

Filesize
1006B

MD5
0afd9156c13b48431ad314c5ddc743fb

SHA1
0e1d1923d263a73a7b08ef7178e5cbd64e56fffe

SHA256
b853826be5db6fc1e5736d2e9b53be6c5b4d6ed96a60e419eb06fa6a5de0b8b2

SHA512
ab3263850caebdc9923657bea7a03073e848fd7ea478fa351ff723b8070f3a847f9bfe4a805fbe6ab08906ce6d8f716fcb61395897736c83c5517ffaab7445ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
40ed823844278b10ef93ca1438d7c39a

SHA1
c4be75e81910eed9c892e7d04d325a51468048ba

SHA256
8af84983e12ae78370b8bc3ebd43f98250e298a90a947efe4f0c4dadc3f75ad2

SHA512
37d4df2c1bd951d90bf1a131c8fef0c73f137ba49a8be871493659efd11c78e94e842ea981aadc7cb4c8eb9e6354da3150e2117a8f37474d23613e1818ef67ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
25KB

MD5
86c8bde931a350423d96f3345908ee0b

SHA1
a2c05bcea6f07b3f38c75ebab40ec10b637d3a37

SHA256
300e8cf8df97c55e4942b2fe4ccbeb4fe5bbbfee1e312f104be5999bc8973a1b

SHA512
9db020ec0d212ad50097f6090d851398d9cdc4edc6f71a80017867a4d0d7210ce24c386987b3e3874b2538a6b0784b3fa902115ae13c3c994fa82f586d4deab3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
25KB

MD5
001eac3cfa962fa93cd4745a304f6f51

SHA1
0b26c91b57a3aef317cfe9f6239e81b1f37d9516

SHA256
585195dfc723238609949661f5c4abb6372996ccd7ef47018deb715a0f455c10

SHA512
dc222ef7d0b40de849ff94b60bb6a250e591163460eab622bce724b812a3707428b615f25e7c2d24aed6d6724612175a7236642918d20aa9dc9841f27c245e4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\pending_pings\45a78cbe-3328-4493-808e-88e98aef7932

Filesize
659B

MD5
cb54f34ebeea2c242bbe4c054950bd13

SHA1
00939e68f809986af67cb89540351b0fa419387a

SHA256
e233ef6a0e47d9f475bd7e98d2fd9ef09be2526ca786c35c9d2be3e9cd5da122

SHA512
5ccc682a615575a5af8c2f8c23d98acd84a3539fcea9b4d06a621c9045377e2095126742deea30fb7bfc6c2f171e16d410beda5d15ccdc9ca718c0ce201e5acd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\pending_pings\fadc7add-c70b-4ec1-babf-bbaf2a2c4d49

Filesize
982B

MD5
6895c96a5cd5b64de18594fc2250f303

SHA1
4d853db3fd4b4a004c906ae00b4b399e58381487

SHA256
8c2739c1ac06bdf71b776882e72f1907de0ea5931bb4ca473b754074c7cadd1b

SHA512
82e04d45d2d0332b3aa4281b4a109a4ed0e272e4c3f212ececd0e1fbed381e939e1397f7b0fef579731da1e6e2c9082cac9800087cbe78b77a92986440de22dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

Filesize
1KB

MD5
36e5ee071a6f2f03c5d3889de80b0f0d

SHA1
cf6e8ddb87660ef1ef84ae36f97548a2351ac604

SHA256
6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

SHA512
99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs.js

Filesize
10KB

MD5
1ffdb7aef337232b48774e5eb3a3ccf0

SHA1
1c545cffc32b33cf08e9de50ce9751667a2fd181

SHA256
ee326ef3acada3738eafb6d47bdfcfb3d2ab6e94edca969f57b0d9b71eb40cd0

SHA512
eac746614b255018aab823c0c1ba135d3ab4887dc6898e3aa917c3a23b39475535309e2be0dc3fcb81b668430c6fd7708ee6cad02ecef347de65b23190f081a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs.js

Filesize
11KB

MD5
98e49b25afdb3b919561a77b916af7ff

SHA1
78e9a9522608307c1808fcccdb84dade47d899f7

SHA256
1a239b9564c402ef6907a077da45295c9269c566b39326fc28ad53d3fa9a2db0

SHA512
e3cee934200309fe8e26898960052b0de18b83ded9acd13c58b82545fe3ed814699ba0cf3e68c8cfd4861bd099df34edb2234dc2ac7ed8aebcc0a964e10a4bb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs.js

Filesize
12KB

MD5
94337cf93f99110571118a9cb3b8b362

SHA1
49b5f9773982110be05f5467f4bd668ee2d6ffc5

SHA256
dba8ccb1f45e574defbbc9a4308e2f260bc50ee612fbb0c30a6eb4438deb5e4f

SHA512
d4c3743b9001aac74e2c57580ecb265eadacc4f56d0f466bb7a933432ceb71c3058f0a50f520801eb17518d83fa8262b0fe8bec272b57f23c690242c67bc5702

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs.js

Filesize
10KB

MD5
0869c46d97b8fee7ab5834ab4743947d

SHA1
baca1838b879900e00cd7a56553c8de1abcbc02b

SHA256
b5a3bf5b2e6f2403f2c17256321901be16076c225e2678942a6d1d5474384f21

SHA512
172f2c8e0f78249f634a3624d7b95da3278c4f8b6167776763505ac82b5a49c702590157e6bb2990986cd7a39e2ae07adebad107030448419db7b52d85a7ff94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
61511516a55d702f15c041f4e5d76cbc

SHA1
6bbe4eab7a13e5b1aa3d47a01e8baa9084c709a8

SHA256
8e3b879be82554c75306fb067a9967e3cda25c94417a6c9532cecea4a106234a

SHA512
3d63fe90ff563ea0b281588f91a417cbae189735af91a7c80d3d6c73cb0bd9f3ca159fa4c2c2f15b7a9a33f67f0ed0bdc7a29eb42a21f38003584b4a35412f40

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
2a81d003454c8f05b1b5891b6bde112b

SHA1
5f5a2aed334b77309e4238589c4cf37e8ed6903e

SHA256
25abe78c572b631923c8511a96d5ef2d720c4815e9e54dcf22e791da5fe1a1d0

SHA512
1d8a021125b6c0063ae5864ffb859716640b4d62ec753104ec0c2447c2da29f278ae1448c1c657fd1248558090dd636b92b2410ea0dadaf8958d71e50299cded

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
552KB

MD5
678f014473cc5e85e604ddaf9f4098a3

SHA1
df5c6833044d9daef105b9911bde56731f9c097d

SHA256
981e2a19c7c4eeb10cad82a892e406f51467f630f4df07c57708602c35d482b5

SHA512
86e271d972edf23f2f08c42df5829dd66d4ad298a21f818b6864e3f00ec1f3df81ace6ac98b3d2ee0d6622067d7303e4474fe3760167cdaf6488604fce544fb9

Download Submit