Overview
overview
6Static
static
1K1XP8K.html
windows7-x64
6K1XP8K.html
windows10-1703-x64
1K1XP8K.html
windows10-2004-x64
1K1XP8K.html
windows11-21h2-x64
1K1XP8K.html
android-10-x64
1K1XP8K.html
android-11-x64
1K1XP8K.html
android-13-x64
1K1XP8K.html
android-9-x86
1K1XP8K.html
macos-10.15-amd64
K1XP8K.html
debian-12-armhf
K1XP8K.html
debian-12-mipsel
K1XP8K.html
debian-9-armhf
K1XP8K.html
debian-9-mips
K1XP8K.html
debian-9-mipsel
K1XP8K.html
ubuntu-18.04-amd64
K1XP8K.html
ubuntu-20.04-amd64
K1XP8K.html
ubuntu-22.04-amd64
K1XP8K.html
ubuntu-24.04-amd64
Analysis
-
max time kernel
1580s -
max time network
1600s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
02-07-2024 18:45
Static task
static1
Behavioral task
behavioral1
Sample
K1XP8K.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
K1XP8K.html
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
K1XP8K.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
K1XP8K.html
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
K1XP8K.html
Resource
android-x64-20240624-en
Behavioral task
behavioral6
Sample
K1XP8K.html
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral7
Sample
K1XP8K.html
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
K1XP8K.html
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral9
Sample
K1XP8K.html
Resource
macos-20240611-en
Behavioral task
behavioral10
Sample
K1XP8K.html
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral11
Sample
K1XP8K.html
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral12
Sample
K1XP8K.html
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral13
Sample
K1XP8K.html
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral14
Sample
K1XP8K.html
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral15
Sample
K1XP8K.html
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral16
Sample
K1XP8K.html
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral17
Sample
K1XP8K.html
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral18
Sample
K1XP8K.html
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
K1XP8K.html
-
Size
14KB
-
MD5
0eb15098b093b3e0c4445b1edd968876
-
SHA1
914cba2c9e1ee951ea0405afd73dff15125087c4
-
SHA256
409e6883caa9352fb6bd0f953f33da3498428f12490896e4c4c30fea8c377eb6
-
SHA512
e7fc83958535721c93d3b500f58bf3b4d4b3bced8aae8eb2fd125b41e55ffeb83b9965477b3af432cafc461f7003eb652e85949901cab290b814229f9b6e085e
-
SSDEEP
192:PNxyShvK9moqTJkNrv23DCBqP2W34g66YHJKBzVEsXo4aLN/lyWg9SRyYN:yShi9boJkNzECBJzgEoNXo4aHyWxTN
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 3632 firefox.exe Token: SeDebugPrivilege 3632 firefox.exe Token: SeDebugPrivilege 3632 firefox.exe Token: SeDebugPrivilege 3632 firefox.exe Token: SeDebugPrivilege 3632 firefox.exe Token: SeDebugPrivilege 3632 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 3632 firefox.exe 3632 firefox.exe 3632 firefox.exe 3632 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 3632 firefox.exe 3632 firefox.exe 3632 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 3632 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3492 wrote to memory of 3632 3492 firefox.exe firefox.exe PID 3632 wrote to memory of 5032 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 5032 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4860 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4600 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4600 3632 firefox.exe firefox.exe PID 3632 wrote to memory of 4600 3632 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\K1XP8K.html"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\K1XP8K.html2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3632.0.756226412\1128345064" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1660 -prefsLen 20767 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2751717f-16ec-451b-9cdf-184e810b6630} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" 1764 1f5c83d9c58 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3632.1.1471181881\57304594" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2112 -prefsLen 21628 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3246b45-a3f0-44dc-b124-de26029e8c08} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" 2140 1f5bd173258 socket3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3632.2.1163289333\779244750" -childID 1 -isForBrowser -prefsHandle 2740 -prefMapHandle 2908 -prefsLen 21731 -prefMapSize 233414 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f33eba3b-dd57-4b66-a9f9-77ebe6790c53} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" 2868 1f5c835ee58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3632.3.90503897\395648665" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1429a4f9-ef31-487d-8972-c217d45275f9} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" 3576 1f5cab5e158 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3632.4.1503577164\673023668" -childID 3 -isForBrowser -prefsHandle 4636 -prefMapHandle 4736 -prefsLen 26370 -prefMapSize 233414 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5eecbc63-eb8a-401d-b25c-0f459da0cb2d} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" 4680 1f5ce6f1758 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3632.5.2099672140\1832716417" -childID 4 -isForBrowser -prefsHandle 4876 -prefMapHandle 4880 -prefsLen 26370 -prefMapSize 233414 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36b56a43-1fc5-4cd8-b067-5b7d866382b6} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" 4680 1f5ce6f3e58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3632.6.594925426\1630519828" -childID 5 -isForBrowser -prefsHandle 4680 -prefMapHandle 5084 -prefsLen 26370 -prefMapSize 233414 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7a2371f-6967-41ce-a73f-32ab4fa8833e} 3632 "\\.\pipe\gecko-crash-server-pipe.3632" 5072 1f5ce6f2c58 tab3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmpFilesize
22KB
MD50aba6f857e40b33a95038adcfef6d255
SHA195fa267daf176be62bf632673ba764cc0a4f97b1
SHA2562d3f3a23105daae4c9204637c59e825b38368f3c5602c97ba546ebf381bfe6b3
SHA51274d33221103443c4c956507dd7b17d2bf44fb4bc76030de45e6526a039415a3d206120938956cceff884643c820e3f1e22f4fa5fc167efb6a122e1d90f501bec
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\14081Filesize
11KB
MD5077907cdbc7e280a01ab268cfb43c714
SHA1d82fd04493f25f59a25f19bc3734cdaf70bab75f
SHA256cec4754cbc8f2b8d370b10fd951b908ea78a55e4897503d6e816392dd9737a15
SHA512d0cee11c0af315d48174113fd681f3a801aec8291470e6868338e77862379d74d59689f138a0b92b8cc7bf3a971dd89e1135ad099a1ddb23bf4d97ae3ff384e8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\8936Filesize
11KB
MD52b17a7896734d4b109c24a8df2969f2d
SHA1b8de8c045b879861558fdd30b8f8bfac21d729a9
SHA2569bcaf1b1b3a9d022578b88a080fc800c8872e4c4a7e6b113853ce1e2be4c6b64
SHA512ccb485da07bd86614d3f991652673ab28ddec7b398c4a524d0742f1ebe02fba1a39a826ee5934cdcc4be760f9903fa6789f89009b6514dff3f4ee8fd8dad9e75
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1AFilesize
13KB
MD50048d0ff52c873c4214ee243d560cab5
SHA11e11418521ac63c2ffec27f6e6cba15076e7c9e3
SHA256169c39901bc2d24555abe1306bf75d2918071c5f7f9ffd662461cea2e57d8074
SHA512c6423ddac5e748e81aa0149b34c38c1d38b539598fd0154826d7909a3894533785c458c241014f5e97405ec3d6e39fe9d250c56af839ad9247da198ad45b12db
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftlFilesize
7KB
MD5c460716b62456449360b23cf5663f275
SHA106573a83d88286153066bae7062cc9300e567d92
SHA2560ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0
SHA512476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-msFilesize
7KB
MD5f54a72871668ebd5f949341adba13e1a
SHA125ea0ab2c49cb5810e9fe498d6d7c86cfe666219
SHA256016f55ab0e4c64333cc93c437b8c934f5fb0fc1f18988b14d5621a7f6ac15ad1
SHA512dd89423f1625bdf3196b8dab74ea1931ad902a1fdd96d7c07bade60fb64525944ae2f6f4debde02367c6ab93ad7a4f47cc8484b6bf883ffe1feb27ae0147f668
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\bookmarkbackups\bookmarks-2024-07-02_11_f70S+BIHcjdozL1H+8sV3g==.jsonlz4Filesize
953B
MD514e152530b0003973263fd54064ea363
SHA198a18c46e4980317a1f795bb0f364f02b7524f06
SHA25698818f8d867aabab23dcf95b03d2d912fd8d6106f1bf48e1f04dc9b5af42f199
SHA51221a75ea8970d68bac8100f499d88b38fbdd904d5217e69492f10f63c9026f43f00508fc62e059f54f82d7a1bb6c16b15f14b281c87542613ddd20893029ce664
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\broadcast-listeners.jsonFilesize
216B
MD5c05c8eb286ecb78e5525f3f1184f08aa
SHA158c848d3041593ebf851df949d9323b57f18e2f8
SHA256d5a7ecf5593bab11902fb82ce38eb7720da2f315d9b0a7dcf8bba53f9a3279fd
SHA5125407c6fe184fa30930ed6153fa93c175be8caab02e48866da9d2755d8a2972eb5f87f708897a247569f4be9369e2121370104b7238e94a7bbdb599ab08ffc4ff
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.binFilesize
2KB
MD51b455ea2f0c1e91d94dd7f3195e9fa86
SHA17c952ba070346eadbb87b3ad1cde08ec0f446481
SHA25648e4ec6917ff7d01401415b2e0723c9085e4e2d66f5a5a9964f450e90c9b7108
SHA512bc686b1853c6767ef0935b49022d3c019ef0031d02083eb81e02f3583aef9ef4e0e3ef738398e1dafa3bea9c91d315f200ca38c2d49fc0bca36f01bbd85a8a6c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\6b6cd5fd-e597-41f4-8859-b51292cf2ca6Filesize
10KB
MD53fea1f727e2dd81af14e71ae4fc29f86
SHA1978c8a80dbf19efeafa20731d93da1a24bfc4f5a
SHA256536cc4949cb0137141c30b70eec5c0140406d7aaee8cd5ba3b6dad5390f17963
SHA51280168b0871ed9106c533c900de96ddc8134bdf1535e95ee33481c4586e2865a8214e481d18046e170d74e1685a9eb49dae0911ad824532ead3b1e4a494858b73
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\d03db4a4-5f35-4145-838a-bae018acab5aFilesize
746B
MD5dd4d8bb7684594258dfabc919c9e6c3c
SHA11cad1c287d44a1decdc0456c30686854debf826a
SHA256721569623e7cdc883a110dcfcf37520607bf41f1e405fa2c28649d6cb7f4332d
SHA512325d9ad3ffd0f64ec2dc2491f40363310b32eb673ee10e17b7d92b8ebd9aeff57bd00f7b7e8fdf546354c89aad0abb8c09868b01b2ffb092d12fb24d765435e1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\extensions.json.tmpFilesize
38KB
MD50b530af5e931c691b98fb690393bb80e
SHA14bfd7f78ac3e9c5d45d1fcb9a5baf07cb3c1e1de
SHA256748825192542b17a0ebd8510937845dc7209a929f69042750d8eb75ac1225d6e
SHA51211dfd4b86f59b35922ac803ff39c93df84b4fb126405a6edc7b0f87b8c9e2ae96d9a0762f979306664d1fefc9387c80bdca49feb7e5d42632852f1ac3404e265
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dllFilesize
997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.infoFilesize
116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txtFilesize
479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\manifest.jsonFilesize
372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dllFilesize
11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.libFilesize
1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sigFilesize
1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.jsFilesize
7KB
MD5e4cabcec56d57b7f56f4e88c25a371b2
SHA134b93ccca9d543b0191cbb8f5b95bbe463c29d14
SHA256140ebe7840c00c8289f7904ececc97035874c6f861ff3f3760c097f8733922c0
SHA51202231fc2b34a94d682e6bb760f20f0a51af133ad5e209ff6253fa37d55a480cab93ab10b65b0dce9d7574728090a7ff7d8e81b050bc64f36ee4e0f2d6906c32c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.jsFilesize
10KB
MD5484e938fd27ad45d6ab53d585e8d9646
SHA1388ceb0512af8b35e4f1492083a376645c33c683
SHA25643daab3c9c9d21f264ef7966656a28923da547e922e35d72e1b089e56a3097bf
SHA5123ba39d031a3e9beaed6f812db017021d62fd1216788c79a55887be68ac9a7d3d37f20832d1e0a09d5eef5885deae1a9e8c43281807098e996914b206dfa98361
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.jsFilesize
10KB
MD5ceaa698542df41c1e32f2eeefd72ca17
SHA1a48eb5737c85f000ed97a4b0b80106ff46db95a3
SHA25689f671fc6f218b3c9e01e2407679d36b8232c018b963c7b2f1cf5851081a09f2
SHA5128e8b71d5a47c471c5c498ab0cea8320c7233b4ea04d48882fb8f239d4c3751cfd71dd01f527bd28fa5c5b67f3b6df5c804a394f8cf4a24602900e7b4c6e83c30
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.jsFilesize
10KB
MD5038abaff185d2ab2e693e6c9550101e3
SHA1651b0f0d7fa6c1ff2f7dfb78463078253e29d67b
SHA256a02c4baab4c5e922aa79dbd3cb185f8586d4959bead4432d83a124e2f05df50e
SHA5128586115b6ec19e6fcd1c340bbbd2dce406cd422f2191d8b7131e56160ffa4af1bb8cfab1c04e73a959e4fe4702128c980e33e67aa46ec72cf6e16596e85e9b41
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.jsFilesize
6KB
MD5828bf326d6a3211664e7cec223477cb9
SHA1f457cc16d6aea11208c4269c20f6f5c57cd1668d
SHA25654b51ed2513672d095bb6f832dfbd068108c951172c76540dc830a616a61187d
SHA512e4bfea5e23c6d95bbad162ebc17ea720efe1cd89a8ce3f839b0ed7d1bd4dfda4a3aa8c15520e1d21f50ee3f1a91f9874214bdd330961394683aa95b2aa22903c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.jsonFilesize
90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD5b2a969593007f983f12731ab8d41a145
SHA1500f03b15eaedb4308d73a9373ab42c65129445a
SHA2562dcda57f51891db97e43148843816b264ebcf05f4ffbcda0d3cc0b59f9af77f5
SHA5125d5d7f9fd7bd5eb617d0d81cd64630e9b9300703dc2b65ac4a6d6b9ff5e98b323308f216d93a1f1764caa8d82c116d9c8ff5c89ff46907af57964926f9dbaa39
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD5b0e033b2a4cae3db5d2eff813918578a
SHA1e886cdf5cf5203c2cd825be8970acf7b1ff4c1ee
SHA256610f455f589838bb222b955a30ad6455ca3312f9a6910f0aab485f76773a7197
SHA5127e57d9b47bd0203d4a1014716d6156b2aa86be4681772594fe9e5653ffaec1c6ae2d416a9e6e118d07b8a425322fda5f45d1e1bef10eb77ea2214960fee9c32f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD551c306c1749bf9b36444a58ed729802b
SHA17ad2cc38b270f97c1c81e585ae515797540f1dab
SHA2560cea808cc32ee87305bcbf93b26d5f3ff8457d3417f9739ce93bed2db8450462
SHA51247c113ce64966fb016553ed852644d445a53388d0fc37e0961c3c0c55d3a0f63ce8f2a389ccec7ca111dc0d0e31de1e2aecb15f5c326aaf7886da51749eb5fcc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD5f3d35e9187b9232025e321d28c176dcc
SHA14827942903049fd6a42e3b9c7ca9d4ed99f32123
SHA2560d033f425caa010d69896cbf88f7a19f2f8f78ce3783252d2d389fb05a743144
SHA51253df89bbf3aae4344888516b3a36b49ce7d003961e968d0e93adbdbfe7cc31ba60a10edad2e89b98374098b3805882f56a56d34619ad721d89cac20a5f520954
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD551c457712c35c25ebea14e44586508db
SHA123d3204bdc094758398f05a2da4d8e482e4dd668
SHA2561418aba3c57c63598762f0740ac72cdb875abac5da04b29d1535ab890adadcc1
SHA512f34e854fd1943459da10b018d647a8b5c7449554e4cb6bf03abc26802852e370749cb94401c83e0626b06f7f6ef49b2d6e17ed3eaca8f1871eb330d3ff5ac0f2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteFilesize
7.9MB
MD57e68bd04af36bea762941c4f55887c1d
SHA1a8c54762b78014865272e62f16dc743d822d0b43
SHA25631da9f58f5ed5081a50e0e0c7ff7d326312f9858943bf218d81645730bba6699
SHA5123849e56d3b430565e1163f4a27c856feb9ec9fb4ee84c192e7f1ba10a06ad913443b638866ba47b6bc23de5bc8c7e3aa06e30aa202c1c374193a061e86836939
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\targeting.snapshot.jsonFilesize
4KB
MD55c84bce645b1ca0465039c83280550ff
SHA144159ec1782e134302edb8c22411d8bdc26f26fb
SHA256775a2a5a59d102fc53536df12caa7f176f2530517c220b1ad3ac30cb9832cfac
SHA512203a74c5654f1036e2f6558f29b282f717fe143761260c4b2c0d9410e3ccbc0dd3e970b12792654ba78bc366b54895e0130b60acc117ec29f51167d779cf5541