hxxps://steamtickets100[.]com/s/KQRA

Analysis

max time kernel
75s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steamtickets100.com/s/KQRA

Score

5^/10

steam phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
76	3464	firefox.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	firefox.exe
Token: SeDebugPrivilege	3464	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 2220 wrote to memory of 3464	2220	firefox.exe	85
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 4984	3464	firefox.exe	86
PID 3464 wrote to memory of 3792	3464	firefox.exe	87
PID 3464 wrote to memory of 3792	3464	firefox.exe	87
PID 3464 wrote to memory of 3792	3464	firefox.exe	87
PID 3464 wrote to memory of 3792	3464	firefox.exe	87
PID 3464 wrote to memory of 3792	3464	firefox.exe	87
PID 3464 wrote to memory of 3792	3464	firefox.exe	87
PID 3464 wrote to memory of 3792	3464	firefox.exe	87
PID 3464 wrote to memory of 3792	3464	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://steamtickets100.com/s/KQRA"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://steamtickets100.com/s/KQRA
  2⤵
  - Detected potential entity reuse from brand STEAM.
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99a969b5-f30e-4d8f-a90d-6ed1a49b37e9} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" gpu
    3⤵
    PID:4984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e0c859f-8102-4fd7-9cdc-965b948c5bc3} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" socket
    3⤵
    PID:3792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2976 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2956 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bd12435-1864-4637-b328-3bc4ea907e2e} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
    3⤵
    PID:3960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4048 -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 4008 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ba24d1a-eb67-4c45-86c8-5d4e1c07aa29} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
    3⤵
    PID:4744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4728 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4664 -prefMapHandle 4736 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3fee766-85ae-4c73-9082-3e36ba86587f} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" utility
    3⤵
    - Checks processor information in registry
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5288 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2ad5fd9-e05f-44a4-b8eb-7c5b9dc5af65} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
    3⤵
    PID:2684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4668 -childID 4 -isForBrowser -prefsHandle 5548 -prefMapHandle 5500 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {387f6485-79fd-407d-b4b6-7aa8286493bf} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
    3⤵
    PID:4792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 5 -isForBrowser -prefsHandle 5636 -prefMapHandle 5736 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0f19e19-df33-4a5c-beaa-011e986d8d7c} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
    3⤵
    PID:4292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6012 -childID 6 -isForBrowser -prefsHandle 5932 -prefMapHandle 5940 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e81d1810-f4b5-468c-aac4-481406295dc6} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab
    3⤵
    PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
5ecf1edf5c6d1f8d0403b9a08a5e16ed

SHA1
3180d33b152405dbf9a34dff0d6b96ac35751077

SHA256
b76c21c3ad9405344a053090976e032ecaf71b82b637a88da89190e3e73df1bb

SHA512
dc3304d12c016aed8745e68779121de8f55be9d75a5eeb7d67d1987d7b3ef2b053afda9cec54b539d6f64064fddc14d5e1b56ea14d41ee123a73d1277452c965

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\86254BE5C4605A6368B6E91A664F0C6BB10599B0

Filesize
118KB

MD5
d715210fbf89b33ff01758297b95d3e5

SHA1
4fe011adbba412b5771ea80ccd1ee6bd873743b5

SHA256
e50e65a5eef9dfc06e31f9c814f98ee563671936c2f65c81601d85570235589e

SHA512
f47609c68f0282b0dc50e732c3f63287b39b0c336910ee732042676f591403ebf118924c76e983589ba0ec790880bd8ace4671d0c7327b8bce537499170fe3ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\BDBFAF694C30FC9FD0B5D03F0456B4CA5FF7B159

Filesize
34KB

MD5
01ee11616d231adcaa47482515ce4a9c

SHA1
cca5dbe9897d061954ef0abc2db0ffadcf0cbf6b

SHA256
a16c1d79dda071aee6bbd757584108ecf93d1ff4110239fc66c8a9e1309812e8

SHA512
cdab8b5dfaaf7e17ba96bad3b6d67e56cac000bdb451281db5655dee0d6b478da583324c4b32fbf42544c5f2de599fb4a9d719d2680a06a647fa5eb7b8158077

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A

Filesize
13KB

MD5
68d058d97aea80c6d09426bf8dcc7f00

SHA1
d86826c27c842f5045aa7b113b457598631357f7

SHA256
6884c6e19cf9f20a99b0200b1944b2fb5d3f2cbae62ddd0c1e2e5a7f458c25f1

SHA512
abe252dbf0beaa7ec92b599812b2cb7aeed745e7c8aaa95d18f9b69292078a249c9b65d9e37b0bf0660dc046c29dd9acfe7a04cd52d5bc7b3c4e7aa41ff3d9d4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
6KB

MD5
17389126997c36641fbd183050f1cf44

SHA1
e613e747bb4486242a28aceb28a3b0514f131295

SHA256
0551955b7a78860389459975754c0507700c1edacc2209e93a8ea4c226831335

SHA512
c494e4e94132b9cec3e005ac52ec6f16d61738807fd82f7e5ec1c356ec9481db9f3f90a16787a9f682580774980b6cb1af7712206063cad5775ce71b48cf6d53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
8KB

MD5
b4d15a604f111c41801c77ea6434c47b

SHA1
6a7eeded41d35d855e8133715344a30e66f06a23

SHA256
9f9cfe28dcea173e29000bbb4686bb86b5db9f2504c99b6e20ce32937566ccb5

SHA512
1f029c403791f2454057d9ed8a003b3031a65838a6132323743c6ebd66009b3aa19b5d873a7d2b0ec4563bbd4e7fc62bcd008431d5753ef5e2ad7ba1396abd35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
ae770ad509a60394139d1f937cc83abd

SHA1
86c610646f55c20a8d9145de4000cd2d511c84f1

SHA256
45959ad9c379eedb77c5af6eb63f28cb1b44c09d0cd3516e1adf1f90eec94e03

SHA512
fc38f149c597c7866ccb026300ea04b58f7aca4e3d31774809d148c899283d2c886bbede2960b516a2c41016c5e834811042efa91668db04a7ca822452ad8c89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
4edccc399b1323aa381ed31ccbb25930

SHA1
e6786681d1ac0aa4e43c0ddd2b6d5cb8e8f6f177

SHA256
654fa0f6df30fe9112e93438e4681407abf340f38a36afcdd3bc5308df9e5d33

SHA512
f22e7aff06cc82cf9fdb860d58f8b99ff35d298c133dcdfc637d990878bf766535423ad311c490dc660c98285508339d0b905fc5975b2dad3aa5b2a4009c0a9a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\58c6f5bd-07b9-4eb3-b717-90da5aba689a

Filesize
982B

MD5
fe2c9a1c061c94f5574a61b947bf722d

SHA1
9fe7094a0e4efbbea6a1281b82eebc516b538e57

SHA256
b0b4bb9d633a69f51bc26472aab98634f9c0ce1e2d7261017f2f9ab823ed8e25

SHA512
2e6082a5911681bfa80bf9345ee8f46f81ea9f117cc92442700b45f3d890aa2f2229b40badbad41c2b8614e58bcdc5c0919d99113b828a4945da7bb5018ddc35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\90706441-c2e8-4e87-b4f3-ef0795fd5d26

Filesize
26KB

MD5
39c9446a07be36589f5a91effb1ecc5e

SHA1
416952d75ed02363fb3440cf5fbe4f4701192ebb

SHA256
994b8961faa6901517873d35ef617d55dec97985465c55e658728d187f137dff

SHA512
7803dbd5fcd8f7aa67602aecd7487c699beabcf8f083604d53ec36d8c1fe6607d9b23377ce300e7e53b9328056c8f621cb77b17f50c05141110651d9e4b9cc1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\d55b3037-1830-4d65-86b3-788b4802fd09

Filesize
671B

MD5
324a28c4f2c0169d21b7e559b52d383e

SHA1
31d6d08d4a0f22739c61dc4a38d6df32e377f162

SHA256
91a987344004602474e3f606dcb4f9340160ec7d17a779f3b123629b128d1fcb

SHA512
dbbe1fa2f7f211ed3854842c785998dea35be5c13ec99a9611b821b47142a715ec46fb0f35dc02020999422a3d150556c3765bb0649d01fdcea21540ebc70e68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
10KB

MD5
bb8ea65dd410eb00bac1531bf318d1e4

SHA1
aa11b1337c1bcb25334afc36e957002dff96fbe9

SHA256
68f58898cc960f8327ade850183075fcc372cbed3891a15c1e832e95ce955aa3

SHA512
264c95370d16a40539f062e2950b9eec6636ab770657534b4c20a602b9127ba9b7ded46b46c292587626405128c815edffa1c9d64f4ad9135e4e97f0ef9b9c34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
14KB

MD5
e9baf37985503e2f23fa1b1e3ad27f52

SHA1
0d4e3b5a2052002c9ca84cba4797d7095ab65eb1

SHA256
09435d06b232506bf504dab69144fa25e3c5dede943cb06ee8b2e069915be164

SHA512
8ac936068cc704ffa67af97b230bd59f577f7f11aa253f0f36d98617bcc23e2efa8d08c8e63cac19370edf015966de0322baa507a543b4428401f0adb3b94a91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
11KB

MD5
40c2357278d1e4613532b2da21a84704

SHA1
177a9aa6bf3e213be223936e52474363ebaec196

SHA256
b54e80b4b75eb012daaa292e565eb2ca2f8d517a27b73d85f9bc1331ec8ca8c4

SHA512
e0f132f49849f1e1fc61da772fa824b8e27a166e702d3ea3ac451fe26ba7c456a516d0718d5d4a70cab7632982be8022ccb5b28e6737a37a8e22d6b7732c2c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\sessionstore-backups\recovery.baklz4

Filesize
40KB

MD5
c9a52752f1f138088fd6228c8e3be266

SHA1
a626a088189d76f08487beb1d8215f258d4b095c

SHA256
408a9dc6ac96bc5a769c26437227f189f1f70f9f1e03845a1dad897fd319cbde

SHA512
c105e454c97b2aa5292fa932c991b31421ef5b7a2b2923517e672f3a6a5f6c4e1d00b26aae81d8e723104aa6eb98ec92364e3257bc0c048a9ffc5f4ad207f55b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\default\https+++stor-steampowered.com\ls\usage

Filesize
12B

MD5
cdd578b59a5e7d64e1d6bf0b98b3e81d

SHA1
280b1d7aae0947a448c68e6ec22d9b68a0a005c0

SHA256
043cc32ecdbb208c7481c554e8165c85d89eb1385f5541929dadd5ef6bcc3486

SHA512
b6f04959ec6eff93b6adc9b610aed13926d0e2c767bf335c2e3da2ab5bb6901ce1bfe7be3ca619c6a8f86e4b301cc9b39511ab959d0b388d38dd87bbe066327b

Download Submit