darkgate | hxxp://google[.]com

Analysis

max time kernel
166s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

darkgate admin888 execution stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

kindupdates.com

Attributes

anti_analysis
true
anti_debug
false
anti_vm
true
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
VjpTnzOY
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
admin888

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

resource	yara_rule
behavioral1/memory/4424-2149-0x0000000003D20000-0x00000000040BA000-memory.dmp	family_darkgate_v6
behavioral1/memory/4424-2150-0x0000000003D20000-0x00000000040BA000-memory.dmp	family_darkgate_v6

Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs

Using AutoIT for possible automate script.

execution

AutoHotKey & AutoIT

T1059.010

pid	Process
4424	Autoit3.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4852	powershell.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\1.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4424	Autoit3.exe
4424	Autoit3.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	firefox.exe
Token: SeDebugPrivilege	4432	firefox.exe
Token: SeDebugPrivilege	4432	firefox.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	4432	firefox.exe
Token: SeDebugPrivilege	4432	firefox.exe
Token: SeDebugPrivilege	4432	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe
4432	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4568 wrote to memory of 4432	4568	firefox.exe	83
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 2716	4432	firefox.exe	84
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85
PID 4432 wrote to memory of 1356	4432	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://google.com"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://google.com
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.0.1656774102\1159728199" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cea7a53-36fd-403a-8e67-a0e77403b994} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 1864 1d9a2607b58 gpu
    3⤵
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.1.949150355\746103707" -parentBuildID 20230214051806 -prefsHandle 2432 -prefMapHandle 2428 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {decb6c0e-1c29-4cf2-8b77-7b0551ae418b} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 2444 1d995785358 socket
    3⤵
    PID:1356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.2.662224537\1854067527" -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 3052 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {faf0e7e2-8a23-45d1-a837-513ab226e014} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 2968 1d9a5520558 tab
    3⤵
    PID:3756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.3.1317930950\1423610202" -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 3620 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35000eaf-7bfe-4bb7-ab69-b9729cff1b99} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 3628 1d995776558 tab
    3⤵
    PID:4224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.4.1232571895\418535726" -childID 3 -isForBrowser -prefsHandle 5072 -prefMapHandle 5068 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {159369c0-1da3-4335-b156-2a9a8e820243} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 5084 1d9a8cd3758 tab
    3⤵
    PID:3404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.5.163552416\29278844" -childID 4 -isForBrowser -prefsHandle 3232 -prefMapHandle 5068 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e39127db-b445-4870-a9b8-7ce9e39a8cb8} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 3160 1d9a55b7a58 tab
    3⤵
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.6.618274096\315339079" -childID 5 -isForBrowser -prefsHandle 5352 -prefMapHandle 5356 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {846f73d9-b92c-4507-b70c-e774d2a08908} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 5344 1d9a9551b58 tab
    3⤵
    PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4432.7.1506566763\1578739282" -childID 6 -isForBrowser -prefsHandle 5556 -prefMapHandle 5560 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31a8e3f2-e063-4bf7-9280-18de52b89ab6} 4432 "\\.\pipe\gecko-crash-server-pipe.4432" 5432 1d9a55b8c58 tab
    3⤵
    PID:212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\Downloads'
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852
- C:\Users\Admin\Downloads\Autoit3.exe
  "C:\Users\Admin\Downloads\Autoit3.exe" .\script.a3x
  2⤵
  - Command and Scripting Interpreter: AutoIT
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AutoHotKey & AutoIT

T1059.010

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
9552f55991952bdee3416aec9cf3a453

SHA1
9b347ad9cc2b819985e776ae71711081bb8bbfa2

SHA256
b2f199c7ed86b16230584b8f1b94f18def84084b9e4fda502c8146582149f740

SHA512
2f9987e713513a9d2e263781227db42fe2c806007d4393909027f8216cc164c0e55d884b58bcf3cb6b04ceba34ddf9a6c17031091270ed29cb38a024b983ec95

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
7eb20fcd9d6596cc19cb83a090e4094d

SHA1
557b7bcb9741bf604a7945d7a5913bbf8f4feb90

SHA256
e42c35f2779fe24aa67c17599d7a6a01ee1b346dda7baaea947609c8ddd275be

SHA512
2709157728b93767b449b2eac2f4e7fe7d9d9974d39ba2f7d9b6849cc5d864578b3c59d4a409e77e1c0326d4c23247790c74ab97f2eb538fd1a91173f35be4a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

Filesize
13KB

MD5
d17b5a0f1acf9e7b19fd2c8a243ea9d5

SHA1
c95951a123d10812225f69fc31054c06fae24fd4

SHA256
56417fdcc7985cc74a31e969dd43d5dd909b1781d9777558bff2e41fea2c959b

SHA512
7b888e4565ea4d444008eae9e01dc1a133ab8cc9e43f03fc9c472f1a1da3fdecbefa88d7b5d5fdf070886b8b8a274020f3e793554f2db3d8d6124a8d98a9ba19

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

Filesize
13KB

MD5
9a70708713d7c2e9fcb6e738b41b094b

SHA1
d86df43a89984f611a11c38718d866b8436b5b8f

SHA256
2db59bf631ae54d4324089863e3739d4bad74437215e4d9e38bba1741b8e6433

SHA512
ebf36aa73ae2a8082d9b483675c929cb3ed676ec77ebc9e5706f98ada72e9aca226e082db5d3d6d04135efc4becc52921e810b38e04aea50609c53cc849bc3fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fe2hma2h.lgf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\prefs-1.js

Filesize
6KB

MD5
5779b7e49fa47bf78fa87235cb5fb0da

SHA1
c45f64c8cb7dc649ca6279a562d408cb72210a34

SHA256
15a0d55337679cdfd540e15bf9eceaf94f6e2bd99e8515239b2d032942d4a2de

SHA512
96dd2dac750907e1d6479abc867a594402b37f31516a76b1da5a4c64ca8e3b80690f32c5680de7b8667ac15caa01d07f9f7b442c154a0aeffec85064c32b499c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\prefs-1.js

Filesize
9KB

MD5
4173aea568304dc9be72929f8d05c3af

SHA1
45e65fe337abd05271d5ae3ddfe25bf97b2bf8f3

SHA256
952a59544633e4e3caeb3624a2d63914e11315fae3716c70f9abdd6ea84c6742

SHA512
1c6d51d13cc763750d1ddcaec4008088b7d8a3b6e81ea7d94065337a1edad67654a675f5b956fd3fe3451413c5a2154d91b66be456d6f3a5aa167a17fc6c0862

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\prefs-1.js

Filesize
7KB

MD5
e4ef5319ca9b4381ed74bcdab17208a3

SHA1
eb9d7cd1232f3d95bfa3aa101859401ab2018aa6

SHA256
09d439306f10a3ae3e0c86fcae84db06b701d8367fd44a5040f5fe0da8a35534

SHA512
c2359d8dc6393b656b0c9acb2c898e04a071b82c187984cf82c10a818ce052e207bd2385aeb0503dca950437a050b93467f2c804e1ddcf1f6e39b7138bad1d6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
e4b6f2b57caea930378ab9a82826b42c

SHA1
ddbf8862bdbf2657c093af29b1de042d95420c70

SHA256
2bc14c2fcf064a4055d8ef34f1f053d055809d9038a0acc7b0c06db80498c1da

SHA512
e2a1033909c593ebb9474516bfd2f1c425127eb35e0c34d9526af8878180d4c463f6702dc68e11a6a2d696485ae6e9e5596b3672500f7584fa4a0dd36ad7bb43

Download Submit
C:\Users\Admin\Downloads\1.ucCVfwmg.zip.part

Filesize
228KB

MD5
017cad03771b0c8bddc7e7e1fbb43518

SHA1
53ecffb19fd1c05f4ec037273d46ea5ca7b80bdd

SHA256
7bf93bf57af0b73522441e2791e25e116090b8789f685f3f33fd10652cd78be1

SHA512
6b12c4975202f886aafbb484f3614877fbb4b8ad6f71eff29ebcf5490835d2de536f2a580421e5252ca06de63e82e7564743233c47fb029727bbb2951ac381b1

Download Submit
memory/4424-2147-0x0000000000DF0000-0x00000000011F0000-memory.dmp

Filesize
4.0MB

Download
memory/4424-2149-0x0000000003D20000-0x00000000040BA000-memory.dmp

Filesize
3.6MB

Download
memory/4424-2150-0x0000000003D20000-0x00000000040BA000-memory.dmp

Filesize
3.6MB

Download
memory/4852-168-0x00007FFEF7530000-0x00007FFEF7FF1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-158-0x000001B96FF30000-0x000001B96FF52000-memory.dmp

Filesize
136KB

Download
memory/4852-190-0x00007FFEF7530000-0x00007FFEF7FF1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-189-0x00007FFEF7533000-0x00007FFEF7535000-memory.dmp

Filesize
8KB

Download
memory/4852-171-0x000001B9704E0000-0x000001B970556000-memory.dmp

Filesize
472KB

Download
memory/4852-170-0x00007FFEF7530000-0x00007FFEF7FF1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-169-0x000001B970410000-0x000001B970454000-memory.dmp

Filesize
272KB

Download
memory/4852-2144-0x000001B9704A0000-0x000001B9704BE000-memory.dmp

Filesize
120KB

Download
memory/4852-157-0x00007FFEF7533000-0x00007FFEF7535000-memory.dmp

Filesize
8KB

Download
memory/4852-2183-0x00007FFEF7530000-0x00007FFEF7FF1000-memory.dmp

Filesize
10.8MB

Download