Malware Analysis Report

2024-10-10 07:38

Sample ID 240615-j283csxbkn
Target dinput8.dll
SHA256 d3487882df2860e6d435b45ebcce55fc301519207878e9701425bcc7b9cc5c23
Tags
themida
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

d3487882df2860e6d435b45ebcce55fc301519207878e9701425bcc7b9cc5c23

Threat Level: Shows suspicious behavior

The file dinput8.dll was found to be: Shows suspicious behavior.

Malicious Activity Summary

themida

Themida packer

Unsigned PE

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-15 08:11

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 08:11

Reported

2024-06-15 08:13

Platform

win7-20231129-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\dinput8.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\dinput8.dll,#1

Network

N/A

Files

memory/2328-0-0x000007FEF5A30000-0x000007FEF6590000-memory.dmp

memory/2328-1-0x000007FEF4ED0000-0x000007FEF5A30000-memory.dmp

memory/2328-2-0x000007FEF5A30000-0x000007FEF6590000-memory.dmp

memory/2328-3-0x000007FEF4ED0000-0x000007FEF5A30000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 08:11

Reported

2024-06-15 08:16

Platform

win10v2004-20240508-en

Max time kernel

330s

Max time network

317s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\dinput8.dll,#1

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2340 wrote to memory of 3856 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 1184 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 3856 wrote to memory of 2288 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\dinput8.dll,#1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.0.1411427500\2007659501" -parentBuildID 20230214051806 -prefsHandle 1792 -prefMapHandle 1784 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e1a53f6-f182-463f-96c6-e43f77caadbf} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 1884 27b6f420258 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.1.69316965\1186708385" -parentBuildID 20230214051806 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ebf6972-1854-4d6d-8b80-5a3af57b0049} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 2452 27b62689c58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.2.1802853529\1220395859" -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3012 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {635aed25-53cd-47a6-a956-420ecb65d3a0} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 2948 27b71ce8258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.3.1114288570\1135666350" -childID 2 -isForBrowser -prefsHandle 4044 -prefMapHandle 4040 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2eeac76b-64fb-48dd-bdd9-80929f2d96cb} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 4048 27b6267ae58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.4.514375207\651568435" -childID 3 -isForBrowser -prefsHandle 5032 -prefMapHandle 4972 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecba69f5-c011-4bac-a352-5b9948808bd4} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 5080 27b7614bc58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.5.356569401\2063076671" -childID 4 -isForBrowser -prefsHandle 5304 -prefMapHandle 5300 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b168cff9-b2e4-4007-92f5-9194f76c5af6} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 5312 27b7614c258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.6.541153008\1250999757" -childID 5 -isForBrowser -prefsHandle 5456 -prefMapHandle 5464 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eba42383-bcdb-4781-819b-4013e205900e} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 5448 27b761f4558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.7.1346190939\1623349847" -childID 6 -isForBrowser -prefsHandle 5856 -prefMapHandle 5852 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d1e5cab-d028-4e41-b480-6face713a7c1} 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 5864 27b74433258 tab

Network

Country Destination Domain Proto
N/A 127.0.0.1:58106 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
N/A 127.0.0.1:58112 tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp

Files

memory/4880-0-0x00007FFA751C0000-0x00007FFA75D20000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\sessionstore-backups\recovery.jsonlz4

MD5 d756ee877e0f889e3be5ba2127a3af7b
SHA1 06e1bfdb29703c0be5cbe4e7d8c6b5f638ea6b5a
SHA256 026b011e5be5a68d1e519ebcbe5e349810601c15efa4c994d984d3b5f5028fa1
SHA512 3cbdccc395f700e24bc0e76e4c07903c0776de1191f07f243d0928992a03502cbbc51b66b1e2723ef55653456aad05436736801b285942e4a84a6e4870d122dc

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\activity-stream.discovery_stream.json.tmp

MD5 dd3093b3a7ad47d93479d815eab6e735
SHA1 3131953ae1a054c347f127710652af0a84c3ca72
SHA256 14bd9a3469c91692699acfc1ac313b57bf693a6136825d131894f26e88932819
SHA512 de48921a50d70d856a43e8863bd4662fbda49335369050d5fac6874cf7644c694a7ed7738e7bfe5cf94fd7d2e854665d687aa6397de42429dfea15d6fa2c0612

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs-1.js

MD5 b3c6bcc6ed604c53c3e8857b2cdbdcbb
SHA1 8c70348ab31d09d6b42a30cbb5629d7b69965b9f
SHA256 e9b783af259c2d843dfdec289599be75caaa922737d4ede02997c8aae67ae3f0
SHA512 b5b361670875c1321036f169473b5ae0fe59bad283b85999a37ea230b697eb6cc89874cf86e496b933825e14c5f340f7ab1aae3d746bf6df00a1d08b9013d626

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\sessionstore-backups\recovery.jsonlz4

MD5 214e776757cda42159dd6cda7d460c28
SHA1 c6dee038ec906a79fb6a14d1714044a71bf5b683
SHA256 eb2ce16280522c7afc1911980373fe04e8a16e34e437a105a630c9fc4708fb30
SHA512 f96213309a75a2a27b0e3a6c17e40a1eb74fb823736059d87b25bb3cf18c76c2fa2626f43c8dd6894650c4c9874ce56a3aa9376bd1ed93b5ccba65c746318984

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\sessionstore-backups\recovery.jsonlz4

MD5 2bfc3e72a60fd7f81266fdd00ce9b53e
SHA1 7d8b1047b06436dd0ede962b38c40652ba96820b
SHA256 a7ade8fa9f4ba710919e2748def31e09fba437d9d32e2346392b47cd97e646d8
SHA512 9707bb434fd684efa7054476e39db43c6650241753ceae75bf1e25ceaf78ba27933e0eb5d964419cdb47e24336756ff555905c5acb1d0fab094c2f06399e924a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs-1.js

MD5 d09655b4983e533fd1311579a311b123
SHA1 a7d848c03e8ae99cd3ead987ecfa75fca2be5b11
SHA256 f1e897b1b2ec49922ec435897122277754c4262c9359c2518a923bfedf3d88d9
SHA512 4ba84da3816bf3a309626bf919bc95a43e43cd1b54a56b51aa572751ba0f177ac07dfa77f3f524b722ee7f6c32a6879ddd2ceba2ffb3bb4afb2b8d990ce0e3ee

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\broadcast-listeners.json

MD5 72c95709e1a3b27919e13d28bbe8e8a2
SHA1 00892decbee63d627057730bfc0c6a4f13099ee4
SHA256 9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
SHA512 613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\targeting.snapshot.json

MD5 18c17c1f479dd3035f6aeefa10c49527
SHA1 0fdf2c172eda9f919748c048c26866e95302700d
SHA256 4a33a9015b0b588efe407346739b2a7a8bcda4be1ac1c3cb502ad5d32258076b
SHA512 f3763be40bba513646d7aad0483f69a5c7c09df5f8af43ff3d5a316dbbe6ec7b66970ba13af41afb6e49bc4c1ed3d3b4014a7d3cc5273983fdc0f2ff197b1066

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\sessionCheckpoints.json

MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 1ee3bead367020be6327606603d4ed54
SHA1 60a38bfe586c60df90f1e51ccc414935320ba3bb
SHA256 11d23dabc026d1543ede544c780218bb4ffb1a428a5e4839cf5763aa1cfaef9c
SHA512 4a5a5b625a447a86f2617515150783b628fd17af501de11cb742c97e3630db62f4df67ac4f77f4ebbe1baa74d31bd7a153f2acc5cab63af2d253a8d3fc50910d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\bookmarkbackups\bookmarks-2024-06-15_11_sEInrcbjNuQU78LVjPjgjw==.jsonlz4

MD5 438e9000da555630c15edc578fc888c3
SHA1 bd773d897b3740a635cc9b5769c53ea2b4bc8fd1
SHA256 bf7e59f07dcb198444cb7c15c5ebceab10b0153cd4878019df4b8196edc36909
SHA512 632de477ff13d808ccf79c194de42c47114fa4fd2dc0b695efaabccf2d4deb575e23bf20b04e94b7437d9538b8dcbd8b63b3e57503ed5e2e3c9a7f1c54088ce9