614b14ea6d8e3a234423641b093773a72d59a2fec5ce62f013edac8a49b60b94

Analysis

max time kernel
127s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31/10/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 898KB
Sample241031-ws6bbstlfn
SHA256 614b14ea6d8e3a234423641b093773a72d59a2fec5ce62f013edac8a49b60b94
MD5 6843d7f35d5182c3cca51b7f6089cfb4
SHA1 3c9b48ba4da8a0ffbe41da4aa11872065670f6c7
SHA512 e7053f3a55a39501d0da3bde4e87a21246234366b7643c51b4d547fb0eeded257e0b19147367cbf1f2af23f269434bce0cc4181a88b546d877df0edb9390ce5b
SSDEEP 12288:OqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tb:OqDEvCTbMWu7rQYlBQcBiT6rprG8abb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3048	taskkill.exe
2732	taskkill.exe
2628	taskkill.exe
2620	taskkill.exe
2648	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2536	file.exe
2536	file.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	2668	firefox.exe
Token: SeDebugPrivilege	2668	firefox.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2668	firefox.exe
2668	firefox.exe
2668	firefox.exe
2668	firefox.exe
2536	file.exe
2536	file.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2536	file.exe
2668	firefox.exe
2668	firefox.exe
2668	firefox.exe
2536	file.exe
2536	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3048	2536	file.exe	30
PID 2536 wrote to memory of 3048	2536	file.exe	30
PID 2536 wrote to memory of 3048	2536	file.exe	30
PID 2536 wrote to memory of 3048	2536	file.exe	30
PID 2536 wrote to memory of 2732	2536	file.exe	33
PID 2536 wrote to memory of 2732	2536	file.exe	33
PID 2536 wrote to memory of 2732	2536	file.exe	33
PID 2536 wrote to memory of 2732	2536	file.exe	33
PID 2536 wrote to memory of 2628	2536	file.exe	35
PID 2536 wrote to memory of 2628	2536	file.exe	35
PID 2536 wrote to memory of 2628	2536	file.exe	35
PID 2536 wrote to memory of 2628	2536	file.exe	35
PID 2536 wrote to memory of 2620	2536	file.exe	37
PID 2536 wrote to memory of 2620	2536	file.exe	37
PID 2536 wrote to memory of 2620	2536	file.exe	37
PID 2536 wrote to memory of 2620	2536	file.exe	37
PID 2536 wrote to memory of 2648	2536	file.exe	39
PID 2536 wrote to memory of 2648	2536	file.exe	39
PID 2536 wrote to memory of 2648	2536	file.exe	39
PID 2536 wrote to memory of 2648	2536	file.exe	39
PID 2536 wrote to memory of 2656	2536	file.exe	41
PID 2536 wrote to memory of 2656	2536	file.exe	41
PID 2536 wrote to memory of 2656	2536	file.exe	41
PID 2536 wrote to memory of 2656	2536	file.exe	41
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2656 wrote to memory of 2668	2656	firefox.exe	42
PID 2668 wrote to memory of 3008	2668	firefox.exe	43
PID 2668 wrote to memory of 3008	2668	firefox.exe	43
PID 2668 wrote to memory of 3008	2668	firefox.exe	43
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44
PID 2668 wrote to memory of 2780	2668	firefox.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2668.0.1550369772\1051057087" -parentBuildID 20221007134813 -prefsHandle 1252 -prefMapHandle 1244 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5057d88-39ae-473f-89db-cd29e141d50d} 2668 "\\.\pipe\gecko-crash-server-pipe.2668" 1348 10dd9458 gpu
      4⤵
      PID:3008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2668.1.251620136\1890076290" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1516 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0977d359-995a-4054-9dfb-312483d800ec} 2668 "\\.\pipe\gecko-crash-server-pipe.2668" 1532 d74b58 socket
      4⤵
      PID:2780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2668.2.2090644826\1483965822" -childID 1 -isForBrowser -prefsHandle 2236 -prefMapHandle 2232 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae555126-e563-48bf-859d-3f23a7110b87} 2668 "\\.\pipe\gecko-crash-server-pipe.2668" 2248 199ec458 tab
      4⤵
      PID:2068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2668.3.119759628\2073120344" -childID 2 -isForBrowser -prefsHandle 2968 -prefMapHandle 2964 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {41b31583-1a21-421e-9e34-b05addaf79ff} 2668 "\\.\pipe\gecko-crash-server-pipe.2668" 2980 d64558 tab
      4⤵
      PID:2880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2668.4.1138751745\40531542" -childID 3 -isForBrowser -prefsHandle 3748 -prefMapHandle 3744 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb54a936-9cf7-4d58-b4fe-7efe69628057} 2668 "\\.\pipe\gecko-crash-server-pipe.2668" 3760 19963c58 tab
      4⤵
      PID:2180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2668.5.815730034\1002722441" -childID 4 -isForBrowser -prefsHandle 3864 -prefMapHandle 3868 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d66517c4-70c8-4fa9-a730-417e7912f321} 2668 "\\.\pipe\gecko-crash-server-pipe.2668" 3852 19964258 tab
      4⤵
      PID:2868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2668.6.349495695\1692401938" -childID 5 -isForBrowser -prefsHandle 4044 -prefMapHandle 4048 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {795c1e7c-8c02-4a92-885d-6658e5824b2a} 2668 "\\.\pipe\gecko-crash-server-pipe.2668" 4032 19964858 tab
      4⤵
      PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bhzluvd5.default-release\activity-stream.discovery_stream.json.tmp
Size 23KB
SHA256 9f67dd2061ec849c28fae570fcf9ab48da3e675c2af9cfddca9e208c3ad705dc
MD5 ac2905fea64038ac3c7a4d75827bf678
SHA1 daca3f4b2949718d8e9a3d10aacc290c63ea8bf8
SHA512 7a18319fa0259d9fe30a5f4f6a9026755cf0cb20d335fcc0d5ae030ba7421fbe110f0e5578238a64cd81e42f21f8e27b7b58aa18930e11c065a234bf0d161d9f
SSDEEP 384:zTXUKGtZaH/ZCWkCXZhZudwS0xbUn1rFZUQUWs0PtlyaW:zTUK2yhCWXnZudwS0xbUtFZzS0HyH
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 b191fe28241c3dbfdac7b773b6d965c5461a4ff9a1e1e8ada0911f3b13412fec
MD5 e088fdeddd57449c223bd831f9d88512
SHA1 713c409bde6a27d9cd0f13af2e10d7c17d5a07b2
SHA512 a991ab62abace365dd143f18d6a84272fded7f2a8adb3906800d7cbade8c19adb64aad2f7bec8c41ac419ce934fef0c1c5125cffb6f0ea19f72429947b187467
MD5 SHA1 SHA512

Submit Download

3bf1cf4f-6727-4264-a3b7-be6963ff5c89

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\3bf1cf4f-6727-4264-a3b7-be6963ff5c89
Size 10KB
SHA256 7f77b853866dc6bedf02c3f2181d2518d85384982054d322d6f3d4b574f54848
MD5 2978cee7d102a083571b7bc2a8e8c060
SHA1 9c31ce0b7344285a294641f91594d80881ce9051
SHA512 e27bf7df7f87c41e164e8fcd7d001f2900b8624c11044880a16ed38eca80f56b212024d2f99c48a46eea80a874e1a3d54d403ac92c79e139b14e377054d86624
SSDEEP 192:+xotO8oRAuRE8GH1h63VvkDNj5rY0+vhUhBcYKMli9ox3cIbxpnH6DpUBXG7:+xosLDWx5m2tBy
MD5 SHA1 SHA512 SSDEEP

Submit Download

7dc56079-f2ea-4259-b4c0-477259f3fc69

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\datareporting\glean\pending_pings\7dc56079-f2ea-4259-b4c0-477259f3fc69
Size 745B
SHA256 b40fd6479b48f49c52f199865112be4be5a673100e99eb8467f1afff68474e8a
MD5 2b40b023ba2d8c7c24bb8de73022209e
SHA1 d0c3e959e2310549e25e316cf99d3c88bad755e5
SHA512 2351ce44adf659743f40a8e97230b15e91aa017eaf906360eac2ef7b8fa49698171597a2569c59b1ee4ae045f973972e7228c48fead021aa05548624de0eef2c
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js
Size 6KB
SHA256 392ef7f4c1adb38ccf82d176202378706b8073811289be6539fa2025004812cc
MD5 10c3f091329c9d24dbab199b27ce76e4
SHA1 10d70e4f818adb33e75e5c57195dd270c775b45f
SHA512 bea3667c55780b27208c662fc71c45357296c767ad873ee9179ac1fab997617e085df3aca32ced3e7be5db97e4ff6fe05bc4fe01af6028ddad89db326d54ed5e
SSDEEP 96:xHxD5nUTeqGq6dP7ZeOTzSNBPXAnpjQEHGZg4+fBw8HHtu:75nIR6dP7ZeDBPXG8yfBw8HQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js
Size 6KB
SHA256 94b5a83d61427bea9ababbfb8a088cd116d7c03866571b161ff06b7ac7dbabdc
MD5 330fc0e3a3ef268bc491ecfce2b34eb9
SHA1 c514cd05e841ebaaffdef42f91ba66791cf28e8d
SHA512 4386a0ea554a8fac596333e9b60229df0545c2afa0f361f6ba1e945b07692f14a7c367edb719b7cc42c0a449c2891c789e02487f1db0444d8e137438525388dd
SSDEEP 96:xHTD5nUTeqGq6dP7ZeOTzSNBPXAnpjQEHGZg4+eBw8HHtu:x5nIR6dP7ZeDBPXG8yeBw8HQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs-1.js
Size 7KB
SHA256 5de1b4ddd7c0dcd2ddef2c4015290f84b62c8961074f0b6d28473be4942bcd06
MD5 356d23e839de3e6eb04585eaa7e287dd
SHA1 bb456c154382d21e036a64b0e83f817cfebda3e7
SHA512 7da5e0a19fb382667b0fce53cafe9539881b40d60a7b9d7cf6220801ef3e754a697b613429c39815b27e379bb0bc155eed364b40db9fcd918dbd04230f2a844e
SSDEEP 96:xHxD5nUTeqGq6dP7ZeOTzSNBPXAnpjQEHGZg4+kRBw8HHtCj:75nIR6dP7ZeDBPXG8ykRBw8HQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs.js
Size 6KB
SHA256 7aa2fbe358af85ca803d782c014d1a414049b0cfde249fecd75b01841663f468
MD5 40c4e1b3fe8417d1ca32103208989a9a
SHA1 edb833a0e9591c5d2d01b8a79ec49b4973883aa8
SHA512 95eade97a4e7ba38dc5996c5443f724423e1c5c2d5cb9a3e2f1abbd4acca16195014409a7b27d13f8171d6e35d8aca6770c096ea9d55fc2589b206105c2c8659
SSDEEP 96:xHTD5nUTeqGqudP8FceOTzSNBPXAnpjQEHGZg4+OBw8HHtu:x5nIRudP8FceDBPXG8yOBw8HQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\prefs.js
Size 6KB
SHA256 ce7355c4069097a2c6c61218286a5623f2efcd9e2db9ffea78495ea95535d149
MD5 7015660ee5e858d12e9c12d7d50333b0
SHA1 fa650436a9cbbbaeaf4f40153c179db723cfcc3b
SHA512 99b34ad537aae1d5e869a5b7d5efce984ae147c7bde53480972131a93681f896ebdd5353090dc8aae237b2a17ca1e9a40b6b490bb06e5e8b16f152c27975fe5a
SSDEEP 96:xHTD5nUTeqGqudP8FceOTzSNBPXAnpj/HGZg4+OBw8HHtu:x5nIRudP8FceDBPXu8yOBw8HQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 8daff2ed680b2b887422802bcb49e2d4cbcee2affd9f04af37ef3f78320d614e
MD5 4f4e03bbb86c3beb2aab69ad26bfdb85
SHA1 109935bb68e16bbcb421424af553194bb6b8e776
SHA512 d2ef98816c83746b1f6f4db2d7d3b822394a7e1267fea81f3acb765f282a4a09533bc2a2382452cd3010d7c7f7eef1b8c5387fe5062ded2600786321e6cec59e
SSDEEP 96:azZe6It8GTrEGJF7xDM7k0zf8W8Qge3ZwS26r7t9hxZT1m3:2lGQiFxM7kcuemOrLl16
MD5 SHA1 SHA512 SSDEEP

Submit Download