7d09a69f6aa77fa98e6a6973963b776178a53a6a7c4b48f05a66e573696b0239

Analysis

max time kernel
129s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

901KB
MD5

b0302cbf18ab90a0e43b26f4b4940c46
SHA1

804696c2bf2f8e35ef2dcfeb1b33c50eced20b4c
SHA256

7d09a69f6aa77fa98e6a6973963b776178a53a6a7c4b48f05a66e573696b0239
SHA512

1aa4e5767f4a1948cd0776ccf01865763398bc1ce72cc6df3768e74d6d30ab79006aa31ff0ee1880db99ab068fe0f2c741c55fa08697ed68f5cd54c5d362e15d
SSDEEP

12288:AqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaQT9:AqDEvCTbMWu7rQYlBQcBiT6rprG8ao9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2516	taskkill.exe
2696	taskkill.exe
2896	taskkill.exe
2760	taskkill.exe
2612	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	file.exe
2132	file.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeDebugPrivilege	2760	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	2628	firefox.exe
Token: SeDebugPrivilege	2628	firefox.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2132	file.exe
2132	file.exe
2132	file.exe
2132	file.exe
2132	file.exe
2132	file.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2132	file.exe
2132	file.exe
2132	file.exe
2132	file.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
2132	file.exe
2132	file.exe
2132	file.exe
2132	file.exe
2132	file.exe
2132	file.exe
2628	firefox.exe
2628	firefox.exe
2628	firefox.exe
2132	file.exe
2132	file.exe
2132	file.exe
2132	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2516	2132	file.exe	31
PID 2132 wrote to memory of 2516	2132	file.exe	31
PID 2132 wrote to memory of 2516	2132	file.exe	31
PID 2132 wrote to memory of 2516	2132	file.exe	31
PID 2132 wrote to memory of 2696	2132	file.exe	34
PID 2132 wrote to memory of 2696	2132	file.exe	34
PID 2132 wrote to memory of 2696	2132	file.exe	34
PID 2132 wrote to memory of 2696	2132	file.exe	34
PID 2132 wrote to memory of 2896	2132	file.exe	36
PID 2132 wrote to memory of 2896	2132	file.exe	36
PID 2132 wrote to memory of 2896	2132	file.exe	36
PID 2132 wrote to memory of 2896	2132	file.exe	36
PID 2132 wrote to memory of 2760	2132	file.exe	38
PID 2132 wrote to memory of 2760	2132	file.exe	38
PID 2132 wrote to memory of 2760	2132	file.exe	38
PID 2132 wrote to memory of 2760	2132	file.exe	38
PID 2132 wrote to memory of 2612	2132	file.exe	40
PID 2132 wrote to memory of 2612	2132	file.exe	40
PID 2132 wrote to memory of 2612	2132	file.exe	40
PID 2132 wrote to memory of 2612	2132	file.exe	40
PID 2132 wrote to memory of 3004	2132	file.exe	42
PID 2132 wrote to memory of 3004	2132	file.exe	42
PID 2132 wrote to memory of 3004	2132	file.exe	42
PID 2132 wrote to memory of 3004	2132	file.exe	42
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 3004 wrote to memory of 2628	3004	firefox.exe	43
PID 2628 wrote to memory of 2100	2628	firefox.exe	44
PID 2628 wrote to memory of 2100	2628	firefox.exe	44
PID 2628 wrote to memory of 2100	2628	firefox.exe	44
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45
PID 2628 wrote to memory of 1596	2628	firefox.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.0.1440032940\1885871880" -parentBuildID 20221007134813 -prefsHandle 1280 -prefMapHandle 1272 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c73ebc05-20e4-455c-b255-74f2199a35f2} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 1352 102d3458 gpu
      4⤵
      PID:2100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.1.1770499003\1613443445" -parentBuildID 20221007134813 -prefsHandle 1556 -prefMapHandle 1552 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58f3d0e0-d076-488f-9cd2-2fd62005fc48} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 1568 e74b58 socket
      4⤵
      PID:1596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.2.1761186716\1268068538" -childID 1 -isForBrowser -prefsHandle 1876 -prefMapHandle 1872 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc884821-b122-4f7c-be17-07d2408a4246} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 1888 18780658 tab
      4⤵
      PID:1008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.3.132832401\207291781" -childID 2 -isForBrowser -prefsHandle 2784 -prefMapHandle 2780 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {317af2c4-7ae5-4cee-adca-888b4863e3b9} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 2796 1aeda258 tab
      4⤵
      PID:1700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.4.175671098\1541976571" -childID 3 -isForBrowser -prefsHandle 3556 -prefMapHandle 3712 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f27481a-bb4d-4dcf-8acd-220d0cde59bf} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 3704 1ebb5058 tab
      4⤵
      PID:2856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.5.2115919709\364728990" -childID 4 -isForBrowser -prefsHandle 3840 -prefMapHandle 3844 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2067a5af-9e3e-49f2-ba33-9b42e4c1edb1} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 3832 1ff6de58 tab
      4⤵
      PID:2724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2628.6.1977017238\2110251364" -childID 5 -isForBrowser -prefsHandle 4008 -prefMapHandle 3728 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 872 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a045fdcd-2b76-42fc-a10b-acb8f00b134e} 2628 "\\.\pipe\gecko-crash-server-pipe.2628" 4116 1ff70e58 tab
      4⤵
      PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
7260330e90299d3e7ee3bd3320d2f9d4

SHA1
0f36bc1ce7adcae3d9f5451ef076b516b7f17d92

SHA256
cf6595e7ad6afa99e5c5c86bbeb134d3f66bbf0b235e3180a2540b37388169dd

SHA512
54d6ce141b7877509f6d605ba82baf2cad14f13b0ea49e909a706af90ee8137ca5ffa45f3dc51016b123d9d50960d26dcd17d7961235699ba274992a37a3f819

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
13KB

MD5
f99b4984bd93547ff4ab09d35b9ed6d5

SHA1
73bf4d313cb094bb6ead04460da9547106794007

SHA256
402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

SHA512
cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
2ad9a93f6ff09286db6e5761f2d4f72c

SHA1
e314489280ad203ea5d4a76424205a97efe2e107

SHA256
7df1c6da958208d10e1eb20291dbb8dc9d1490de3cb841306b186cf264ea5ceb

SHA512
9b77c0b43f51343c18c75f3e74d61c28da44a676f5501a7884ff2a78dd9f3e3280d029a35c4d54fc5c748b834694dc81b7fde255b9c9369b07d3b47c3b377cf3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
f0bb53a08377c37304cd6cb7ee560bf5

SHA1
b5fcc4008addbebfbc0a19f807f59650a6a42bb6

SHA256
99866c896cc6b0f52c8b8ff486c063da82cc12daaa9293c1af3b1d27e1d2a42e

SHA512
cd2489268c2f8c59f70f7a21027521d219b368fd0d6501c3e59c99eca1f47fe9f30a3c259e33c1d04ee459534d763ffda1f4e67a5604f70dbd9b96431b29d388

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\7e361025-56ef-42cf-97ca-e22560c5d875

Filesize
745B

MD5
8eeefa11e57df3ef5e4d3b0ec28579c2

SHA1
11e6c344f5fcb4dd38dbaa9a1f167d61fd40ad4e

SHA256
7f4e96c90f29756881fbc6e85257bca824024dc7b2b4a7df42622ec49a3aef71

SHA512
48ee2ba6b633754b92153f8d2c68d9ceda5268ab3c8fdd6de4b1ac22553a8d9788f062eb096f8b5314904358285c73ab902500a2ca13c8a04593cb732890bb6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\a9cd7a9b-4376-4139-8315-fbc8844ceb69

Filesize
11KB

MD5
ba79d5a844ab4ec4805e4871341bdb30

SHA1
64b77c70df22c32d39c95c0082f256c22ec5e328

SHA256
0f88438295d03d526e8421de8ceab087b3ad0ce4037fbe57891a25b25978e7d2

SHA512
4b89d81f8d87bdd9d146839aa7b4915b4cf8ea9af011daecb94a5b285a20c86e569fa92796c521ac2f2c5b631476f0801efc3a96466d784ada9a06f52b8de498

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js

Filesize
6KB

MD5
260901d665335d8be3f4a5d38caa126b

SHA1
991a7f219e850ed689001e3b14f1907445988829

SHA256
abd9926ca843262ead2f08bab092771919724d102810d7a9b9b0047b688a990e

SHA512
0a3d271a996d61b8e76ed18379bf237b191114746f278a74dfa5986614e6d5892f758199adbe4368f6f8aa3f09059de76c17eacc1b1601e2f1d90a8cad8eafd9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js

Filesize
7KB

MD5
04576a9618e270d05c5ad51e308792b3

SHA1
8ceae21bdda20b0c8554ec4e9b1471aba70c7248

SHA256
a192175b78b327a14f810a226597dc41ac3b7a998bf91993f8dca4319a2ee443

SHA512
2bf94025603c6a71b17afcb86f5b40bfe314e17969f65d6b193db186838a3108c79768c5f08e42f7eacea015e6661934c3927751389aff2bd1d2d5558576f708

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js

Filesize
6KB

MD5
20c85ec82903ded0ab3d45908f9e63c4

SHA1
d11b793607b1dc0a1cde4a7beff67f1a4f64ac41

SHA256
3e3dfac5174173db034e05fa6c2da2d7b58201caf162f6a49a01121378cefdaa

SHA512
433a905ebaa5b5b14d498186ae701fa99fc3ecc0062959048bff930dcba09a809da274ac986982de9eac3611a8f9faaa9dec14b5ab36610af579efc0365b633a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js

Filesize
7KB

MD5
a17033bdda0c82b413341ddb61c4e7c4

SHA1
5fcb5d678dcba6522a014634dc5770557ab730f2

SHA256
ebc47336a5f6c321ee59073618247ebfb155c47b734046d6d8005b66c5a36b7f

SHA512
7ce83950023ed58c5818d00699bd4021a6bc6a51b803108ab6c0d83ff74b413cb5fd6f0d36dfd8d235928c883d71785706ea13c2bb0170705daee9238f271daf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
d24ab785f3b8d278244d68bcf969c6db

SHA1
06ec904af9aa1ee160671c88c58dbc115ecebfd8

SHA256
2a78ee6c30aff2910c814ed80e445d2890ae380918e4985d2aa7fe78923e9253

SHA512
6aa71a63a4a9a09073a3a2e71329e82ae96874482bb1c32a2f3e0977c1561d4e0934b4fa92c0766d7ab6b8e11f1b59f1d396fcb28b9b462e32db783bad656705

Download Submit