4c128e1e1ce95fbf6f20463bfaa690a410acc2d38fe575e8e84053166ee6e61e

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 896KB
Sample240905-sefxqstamn
SHA256 4c128e1e1ce95fbf6f20463bfaa690a410acc2d38fe575e8e84053166ee6e61e
MD5 5c22e55be4b9216e6158e75c0dc17757
SHA1 d46b92b1307ff10680bb1250150e30a1340d7b72
SHA512 07e98468c517fb72985380ef4e7fd331d1f5992f7c9ab3755e746824273e313ddce25668d75603a16a09bd4bf57d478fe184841fbdefbe5a6241c6365dd58cd0
SSDEEP 12288:IqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaDTg:IqDEvCTbMWu7rQYlBQcBiT6rprG8aXg
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2684	file.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	firefox.exe
Token: SeDebugPrivilege	2136	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2684	file.exe
2684	file.exe
2684	file.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2684	file.exe
2684	file.exe
2684	file.exe
2136	firefox.exe
2136	firefox.exe
2136	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2400	2684	file.exe	30
PID 2684 wrote to memory of 2400	2684	file.exe	30
PID 2684 wrote to memory of 2400	2684	file.exe	30
PID 2684 wrote to memory of 2400	2684	file.exe	30
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2400 wrote to memory of 2136	2400	firefox.exe	31
PID 2136 wrote to memory of 2748	2136	firefox.exe	32
PID 2136 wrote to memory of 2748	2136	firefox.exe	32
PID 2136 wrote to memory of 2748	2136	firefox.exe	32
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2732	2136	firefox.exe	33
PID 2136 wrote to memory of 2052	2136	firefox.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.0.965253429\1999412033" -parentBuildID 20221007134813 -prefsHandle 1240 -prefMapHandle 1136 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e3e697e-a905-45c6-81d2-c3faa660319c} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 1344 ffd6758 gpu
      4⤵
      PID:2748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.1.239920670\766112068" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1528 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48798843-c909-42dd-afc9-b8ae9896e4f5} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 1544 d74258 socket
      4⤵
      PID:2732
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.2.1188459878\1881577087" -childID 1 -isForBrowser -prefsHandle 2064 -prefMapHandle 2060 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 600 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {33bf0eb6-67f4-49b1-b9a0-434d9fb3ad52} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 2076 19690d58 tab
      4⤵
      PID:2052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.3.519684792\2102590625" -childID 2 -isForBrowser -prefsHandle 2684 -prefMapHandle 2680 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 600 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2de902d-7466-4ec7-802b-fb315a852f78} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 2696 d64b58 tab
      4⤵
      PID:1872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.4.1755098411\1062396879" -childID 3 -isForBrowser -prefsHandle 3748 -prefMapHandle 3732 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 600 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d77351b8-da78-4057-96fb-cb6353138ea1} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 3760 20184b58 tab
      4⤵
      PID:292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.5.1493090654\463259858" -childID 4 -isForBrowser -prefsHandle 3920 -prefMapHandle 3924 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 600 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80ffdb1c-e6be-483b-8e65-320015e6bb50} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 3908 1fcfbd58 tab
      4⤵
      PID:1284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.6.517206743\266396500" -childID 5 -isForBrowser -prefsHandle 4108 -prefMapHandle 4112 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 600 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7053004-bf12-4738-ad5a-c34cd8e53465} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 4092 1fcfc358 tab
      4⤵
      PID:1492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2136.7.307658400\180070207" -childID 6 -isForBrowser -prefsHandle 4380 -prefMapHandle 4372 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 600 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f3b7a84-89b9-4e90-885c-e59b324caf61} 2136 "\\.\pipe\gecko-crash-server-pipe.2136" 4396 221f8758 tab
      4⤵
      PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
Size 37KB
SHA256 b189c4e8163cc6acb9ed13b206a7964d7c694af7f935c8f2293f41b66ae74fb8
MD5 166cb1873e7322737585dc586de41a86
SHA1 b6a5f5766c91d88343db81d7a0089aae458056c0
SHA512 c281f3185f67ed95273067d5d066ef2d315b55abf521eedc3396cbdc298a1936706e7bece986c465a50fe22ca29f92e9f99d83956a0316784287cebc2921718a
SSDEEP 768:z9zDACM7o4yezTd9cpSUydz0Uod0ZT2opp:JzUCkOSPyUk4v
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
Size 38KB
SHA256 86993f82bcbd8d0f90a9b64b40c5441d1ce9499e2048b86482c675f5a9bfffc5
MD5 7eaac5df1f626d9dcb940d8d8b3f7b94
SHA1 eb303359332b1b97e31fb034d7e163ebfc162778
SHA512 312ef95986fe01f16d283af887ccaac1f340dc2c279ad3de71ea6363cd4412907ee457b87eead401b1705069ee85d8418d6890d35712debcdb1903d0f340a4ad
SSDEEP 768:zyQp/rf9sbRMLbp6hVMuJBydz0Uod0ZT2opp:GQ9rf9CMQPMiwyUk4v
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 1dd3020278e2f32beb488a8211c0d86f103cbab5b257c36a94c5bfbd7aa4240a
MD5 a9a6c304e1814204e9cbe3e52fc281f6
SHA1 6055266d240d992000a70b79e4f72f701606cf6b
SHA512 0aed70dc1dc2e1515bfcd9c7393b972b8c0b69cd7b2f0afb4a891ad63104e543c454d8f7cddaad67d7a673c9ecdc56fa80c32c765590b36e185f61f4d6e0c784
MD5 SHA1 SHA512

Submit Download

4db1a54f-ad8c-43b9-b746-6ca42f42de58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\4db1a54f-ad8c-43b9-b746-6ca42f42de58
Size 745B
SHA256 e24eac29b6cd0292d2d9a7de52adedae85623ac5362e28987b3feae7cb9460c7
MD5 b54ac2b5a2a6f5c3b6d363f04164f91b
SHA1 929ac624b0372507a8b729c55202fbb3e41568f1
SHA512 c37f3381806ad1839d7178aca82e9bcf4c3a2d03d95ed8059cfac06228f934a87b1740d37488143d0bf2f036e348cefff1097977d6551fed3706d07f17a968cb
MD5 SHA1 SHA512

Submit Download

e526d531-a92c-4549-a5a8-ed3251d46701

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\e526d531-a92c-4549-a5a8-ed3251d46701
Size 11KB
SHA256 7ffdbbde1b0cd177d0c6799746a35d5d85150cb309dffd9f772192e283037101
MD5 60aa611dfe5d18978f80468d219aaa56
SHA1 88b4b5c491937e26d9ca281402f81f4d6986f4c2
SHA512 01b089c55a7b21ef082091cf6792126b2a8dc5938233804db6aa0a68678fd7c35cc9877adb8b456c8edede00969d208bc8836172d734dd4788d0c53e3038a262
SSDEEP 192:j9OpCIUDAJ+Orm0rZRXDm+rFcsQtt2irHkO7lCmM/OpVcckdpxXFpcIp0z6Nz3:JO/s5AMazFfZNL
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
Size 7KB
SHA256 c075f6684a7800fcc9e4c378e7d3377d39665d427ea5fbc1a27a8bb3c114fdd9
MD5 741589167bfdfe582bec6837da5890fc
SHA1 ad58da6fd819875e2cd0f67db77bce71b8fd4e9b
SHA512 5687f4b8c23dc84ad7a6f23c9d695a54175dfd4ef0b9a0bdbbcd9073bbb38e5e63c27898d1ed9b6b925d3b4f0b359c8d68d01e825a15b4bd55c13221e31795c4
SSDEEP 96:xHZ5nUTeqGqhdax0eOTzS1PXAnpjtHhz2ZmtBw8H5Q:35nIRhdax0eTPXcl8GBw8H2
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
Size 7KB
SHA256 05c6e82e79d0d8ab516586930bf53eba200bc6f2c3a0053f71c7b2a6c3417c95
MD5 2cf36477e5b4ec5073015b2d1f23296c
SHA1 b03124188dbd4debd74941ee3d065d38af0e0326
SHA512 a04db9b2440229f903e3be4460cb7ce3159c48b5c1a9e963584fff96ad6b394abbd59258d01d78e444bf22b90c132a68b1a8f3de3c2b5990406ecfd5b5505422
SSDEEP 96:xHZrnUTeqGqhdax0eOTzS1PXAnpjtHhz2ZmkRBw8H5Q:3rnIRhdax0eTPXcl8LRBw8HK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
Size 6KB
SHA256 e7f8c2026ccba56d84aa184007f3b80b96dac62b808b479e08e1e5745c102eca
MD5 cb5dcc67c550de4634f5afaf3804cdcb
SHA1 291462374310b4837626eb10ae405d0bc305dab7
SHA512 9c1b24fc18bf66c578318f3da29a668d06ba148dc8038d2bb0e680d0f2a9e32b42dfbc107540d31e775ccec3b5d3c1633a776b7ec2d3c523dd3e2e9bef6ee962
SSDEEP 96:xHT5nUTeqGqhdaqoeOTzS1PXAnpj+8Hhz2ZmiBw8H5Q:V5nIRhdaqoeTPXGl8RBw8H2
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js
Size 6KB
SHA256 f2fdf6d1c92307dd4371b752117fd9c24ee18c037a030daf5a0fd6be82f971e8
MD5 03526a31089ad0d3e4d53a2b04b4349d
SHA1 532a93af0c8f590349654b077ada4c02db9157b8
SHA512 b7766614ba0e632a9db9a1cbf12233261bf5421b54f1f775c2067ea2c404f307ff0d9ec7a6216339c3d011e0f28c55bc645e3b1f884ca9317eac5e3f62c89248
SSDEEP 96:xHT5nUTeqGqhdax0eOTzS1PXAnpjtHhz2ZmiBw8H5Q:V5nIRhdax0eTPXcl8RBw8H2
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 57b73878563a0a8a6a84e0f8953a31e7abd1e143a368dd2716204fdcbef216b6
MD5 33a28b50c24788aefc873a963f574d06
SHA1 e8d232d9d5679e22f5120fb8e3276b83e34e8f9a
SHA512 664128593ed33a35158fe6d9a1a8b1f7c56dbe2d90951534cc71b0870575af1fd6c5c9e9cef314af4c0da954bdf518cdf806e89b4fbcf232a3a9ffc8a7dc2935
SSDEEP 96:R6OJeC6a9M1aEGJF7hclMZk0zf8W8Qge3ZwS22QRZCxs:RRUZiFOlMZkcuemaQnCxs
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 65d5f1e7c2cc7174af0b0f2b472f3ee6895ff60e384f8a3fdd16e34cec8967ec
MD5 5336e4ab6295d8967e0000654b02573c
SHA1 8ce25b35cb6c70b4fcef82030ce14da042c3ab47
SHA512 13d74e55fc7960c31795c3029e5b2173eb3b34a1a6d9b7063d5a1dab60cd4c188bc237629c96a8d2c18284934157f1126673fc16a4b65064a93ad682efc2498b
SSDEEP 96:R6OJeC6a9M1oEGJF7hclMZk0zf8W8Qge3ZwS22QRZCFs:RRUDiFOlMZkcuemaQnCFs
MD5 SHA1 SHA512 SSDEEP

Submit Download