4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3

Analysis

max time kernel
91s
max time network
117s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
Size

897KB
MD5

86407f0e582583bd91000208e8ad8140
SHA1

8da0e8454eb457f56a43b2edc28da089571795a1
SHA256

4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3
SHA512

db8fb6b559e4d94c5cd30518e7cade0a1655e487b5b3a79064ad1558ff9b4fb1daedb29fae58c3a9e68794885a9b0f550e081ff897fb8f4111d1051d55e1acd9
SSDEEP

12288:0qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga3T2:0qDEvCTbMWu7rQYlBQcBiT6rprG8aj2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	firefox.exe
Token: SeDebugPrivilege	2540	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
2540	firefox.exe
2540	firefox.exe
2540	firefox.exe
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2464	2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe	30
PID 2296 wrote to memory of 2464	2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe	30
PID 2296 wrote to memory of 2464	2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe	30
PID 2296 wrote to memory of 2464	2296	4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe	30
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2464 wrote to memory of 2540	2464	firefox.exe	31
PID 2540 wrote to memory of 2872	2540	firefox.exe	32
PID 2540 wrote to memory of 2872	2540	firefox.exe	32
PID 2540 wrote to memory of 2872	2540	firefox.exe	32
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 3008	2540	firefox.exe	33
PID 2540 wrote to memory of 2720	2540	firefox.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe
"C:\Users\Admin\AppData\Local\Temp\4b74955a2223974aaea59516983f43b93209e025ea1735f1f658f4b25facb9d3N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.0.1661953814\2062208971" -parentBuildID 20221007134813 -prefsHandle 1172 -prefMapHandle 1096 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a87a3525-a68b-4841-977c-1e95ccb738e9} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 1248 4205058 gpu
      4⤵
      PID:2872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.1.1443059284\1700645198" -parentBuildID 20221007134813 -prefsHandle 1508 -prefMapHandle 1512 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a09ee10-628d-4485-a0be-42b524e961c4} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 1536 f5ed658 socket
      4⤵
      PID:3008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.2.1830530475\284485105" -childID 1 -isForBrowser -prefsHandle 2016 -prefMapHandle 2012 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {409246c8-acc0-47af-b34e-d087312bc838} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 2108 1388f958 tab
      4⤵
      PID:2720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.3.674310831\1321629401" -childID 2 -isForBrowser -prefsHandle 2820 -prefMapHandle 2816 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {191096a8-0aa5-4949-bf36-c2922aea2849} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 2832 1d8f4958 tab
      4⤵
      PID:2372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.4.2144450519\972525749" -childID 3 -isForBrowser -prefsHandle 3688 -prefMapHandle 3684 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b10257c8-79bd-4abe-bda1-7a04cb9d7991} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 3700 1ed8be58 tab
      4⤵
      PID:2516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.5.1740857118\309375895" -childID 4 -isForBrowser -prefsHandle 3804 -prefMapHandle 3808 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9951f1b3-6b55-4659-b7ba-cc11b56d8a96} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 3792 1ed8bb58 tab
      4⤵
      PID:1916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2540.6.774310853\1412772592" -childID 5 -isForBrowser -prefsHandle 3916 -prefMapHandle 3920 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 580 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {363cab14-c470-419f-8f22-0637bef21d2c} 2540 "\\.\pipe\gecko-crash-server-pipe.2540" 3904 1f1f0758 tab
      4⤵
      PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp

Filesize
30KB

MD5
5826e74cd6e4c2d7be930e9ef0ae1e78

SHA1
158b030f1abb83c4ce60d3d16f00117b3d2fb79c

SHA256
13f18469fcc7c9e0c27047351a1df24f686ec279c8e9262a764f6cf5b1b63049

SHA512
34c1844e8b11f9fc6057932fd03b8bcfe0a64c28e78116a41efe5b1626c96b08f2d81b2a28cbab9db57bcc2c66752d3d0bb076392a9cd80b6cc76c02fc4e5a44

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b88f9727e02484d4a1ad2d0e761fe368

SHA1
dcaf272b7e01719d48595c6dba5404bc9eb7c0b4

SHA256
0534fca1552f09b87825ffa087c5859e71e0a15a7475fb6eebd12155fcc7c0cb

SHA512
ad609e0b8afec0e10ed7025f8dae13e54f6861b22d580b555e91fe2b15101e2c272076e90078b883c6bc151ee67bd57f3a303c24af21991bcb923f3d739d8c6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\342832e5-e346-4d0d-a0d2-34882b6ccdab

Filesize
11KB

MD5
8232552ac5d7ab588f09b3ce304a6967

SHA1
eb3235174904a0e6afc21b3197543e47c40a5658

SHA256
a445248caceb2fefc8ace413b43e21cb791d15a4b52a35696d6a9d3d4954705e

SHA512
10d4c57ed78ae0811f9ff39d95a235fda6600f5d46f3ca569653a152abbd466535e4565117532db93ad9bfb7e244e2c0f8e3464203b87775e90ad791fe879e54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\8fa756ff-07fb-42cb-b254-e328da243056

Filesize
745B

MD5
bcd5f8063caf6ed4dcc98a3ae19650a2

SHA1
70ed861bbe1a11c976bbc91b2bb9403a6fc29bef

SHA256
2d43d2dfabd88c274dc374eb868c6b960a6c50286876828ce427f9a9fb195d28

SHA512
1256f317d56d29026b6f6fe679ec19ba1e5f2c838989a7cc51f278dd5956de4538b72e81f456b85f81526e8509e67b205392352e606edd2d3fcaeb4cf064d27c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

Filesize
6KB

MD5
934dd321f1ba1ea14db05d96dbe05881

SHA1
17f578f6bbc0b0cfa902b9fae9987202b7909582

SHA256
08ed7486d15ee8b59917bf1d2a7d5b352462bcd35420ac4815772aa420bc5577

SHA512
a7bbf20adcfb05b4424ff1e6f92d988614e13fa531a4124d80a53bcb3edc6d8e22cb2f037714ae87a8f0fd3c9bd974ea6105a4f6c0778b034a2b4f5a69c7b17f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

Filesize
7KB

MD5
4afbbc2f2a7b15b3cf71f21afbf73454

SHA1
0a6c6ed794a270802af516f2e5f51824d661d08e

SHA256
7191324e9ae27b9883f6ffc38eddb0d796aaf3a222aaf185c5da620b759b5115

SHA512
585a21c326445228d6f26271af4172eff8b6020951a3954e634f68593e69b7f17a68ac06ee92ac3db0c15dc8557cfacb8a685a4e8f24386e6472befcafd70d04

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

Filesize
7KB

MD5
e3a87e9d575b21f19488994dbf2ce3e3

SHA1
88a42d4b2a049383a03420a19e09dfcb28ce04a4

SHA256
55feab8fcbb1f5873cf4264a81ced7e7dcb5a31f32a8b0a1cd6397ec40d9f890

SHA512
efd37b776eacdbb927da75b4a5dc167f92905399f01cac9e343bfa97dd618a00d9f56ba27b34b1467dd42b6e055eeed8bd6bc30f2e44724a114cc6e1c0a088c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
6d911030f8d3d614a9e11c3600cbddf9

SHA1
d2a02951f0f680d8d0b36cd020c339e59e1233f7

SHA256
b0a27d18dc71cea2623e37be6155384201aff26dff7afab02eaf3772565d9039

SHA512
a1ea804f5977c87a23020d767e252077adbb31b3f18c12b0f4d77517b3023727b6f824ffa6146db6fa82c07d7959f4f76f1aaef90557006a77a569b105fcf37d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
935B

MD5
3d2cd3dfb2b463bedb750a1996f6c54d

SHA1
800c27a35545ae36c2ea4bcda2c9355ea58a85d0

SHA256
102c66a213acd1d4c263549f37637bf5037f535a5bf0629d12813adb5c9db0e4

SHA512
e1fb6d8890cba5d92ad45a51011eefb6a329e7dc367a089c9c876b5c8adae38fa51e791a2a04cbcaeccf08e4c2ff0a2276d74f145bdfa19e6ce9adb90d485663

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
bece0acf9d7f19d01c7943c54d2ad372

SHA1
aef59ca4b0fe97f32db128e103bfb98aee3b5e29

SHA256
ce40f79585195148ac86928d18da80b963cc98d6feb83c1c2e75e8b6d6ef39f8

SHA512
105fb01521fca054766d1d1e46cf3bf177b8bab44800f7bbad9a84f388af32e745474b3cc4f70c1fd779b4e7bcf0912502860092e1824f7ba4b52c612ba5a70b

Download Submit