e85069cf3df6f629435808fa11dc054609e3de054c12314a4bb87a8ea3e853ad

Analysis

max time kernel
125s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

901KB
MD5

a946e9443c4fbb7cbfbca8667c099696
SHA1

85a6507e2ff6ed26724ca6dce2842b33dd97ef8e
SHA256

e85069cf3df6f629435808fa11dc054609e3de054c12314a4bb87a8ea3e853ad
SHA512

bbfa6b31b192bbeae2a13daa8ef41537a604faa7395c762ccf3eac00b6c82ffffc6c943e67127a7d41bfb591a555aac26dcbae96baef01d0716f595bac496da9
SSDEEP

24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aob4:iTvC/MTQYxsWR7ao

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1960	taskkill.exe
2844	taskkill.exe
2636	taskkill.exe
2828	taskkill.exe
2220	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1128	file.exe
1128	file.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	2876	firefox.exe
Token: SeDebugPrivilege	2876	firefox.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1128	file.exe
1128	file.exe
1128	file.exe
1128	file.exe
1128	file.exe
1128	file.exe
1128	file.exe
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe
1128	file.exe
1128	file.exe
1128	file.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
1128	file.exe
1128	file.exe
1128	file.exe
1128	file.exe
1128	file.exe
1128	file.exe
1128	file.exe
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe
1128	file.exe
1128	file.exe
1128	file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1960	1128	file.exe	31
PID 1128 wrote to memory of 1960	1128	file.exe	31
PID 1128 wrote to memory of 1960	1128	file.exe	31
PID 1128 wrote to memory of 1960	1128	file.exe	31
PID 1128 wrote to memory of 2844	1128	file.exe	34
PID 1128 wrote to memory of 2844	1128	file.exe	34
PID 1128 wrote to memory of 2844	1128	file.exe	34
PID 1128 wrote to memory of 2844	1128	file.exe	34
PID 1128 wrote to memory of 2636	1128	file.exe	36
PID 1128 wrote to memory of 2636	1128	file.exe	36
PID 1128 wrote to memory of 2636	1128	file.exe	36
PID 1128 wrote to memory of 2636	1128	file.exe	36
PID 1128 wrote to memory of 2828	1128	file.exe	38
PID 1128 wrote to memory of 2828	1128	file.exe	38
PID 1128 wrote to memory of 2828	1128	file.exe	38
PID 1128 wrote to memory of 2828	1128	file.exe	38
PID 1128 wrote to memory of 2220	1128	file.exe	40
PID 1128 wrote to memory of 2220	1128	file.exe	40
PID 1128 wrote to memory of 2220	1128	file.exe	40
PID 1128 wrote to memory of 2220	1128	file.exe	40
PID 1128 wrote to memory of 2836	1128	file.exe	42
PID 1128 wrote to memory of 2836	1128	file.exe	42
PID 1128 wrote to memory of 2836	1128	file.exe	42
PID 1128 wrote to memory of 2836	1128	file.exe	42
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2836 wrote to memory of 2876	2836	firefox.exe	43
PID 2876 wrote to memory of 1944	2876	firefox.exe	44
PID 2876 wrote to memory of 1944	2876	firefox.exe	44
PID 2876 wrote to memory of 1944	2876	firefox.exe	44
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45
PID 2876 wrote to memory of 1920	2876	firefox.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.0.1749461516\162897047" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4b9453a-5c8f-42f6-b0e4-109c80ae5743} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 1280 122d8158 gpu
      4⤵
      PID:1944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.1.1075681726\990589727" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5293760c-f646-4921-a608-80bca10702b1} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 1496 d72d58 socket
      4⤵
      PID:1920
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.2.976555765\850173264" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb25c876-78bb-4850-96b6-1c71d9afed34} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 2104 1a4c9958 tab
      4⤵
      PID:1952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.3.1680970107\196319054" -childID 2 -isForBrowser -prefsHandle 2920 -prefMapHandle 2916 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4adc0238-f951-45b0-a28f-2b0274307c92} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 2932 1b8bce58 tab
      4⤵
      PID:2944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.4.1501728150\541718018" -childID 3 -isForBrowser -prefsHandle 3888 -prefMapHandle 3828 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {297f30e0-e50c-431c-a3b7-ed51f8a42550} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 3848 20848258 tab
      4⤵
      PID:344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.5.1057756908\30062616" -childID 4 -isForBrowser -prefsHandle 3988 -prefMapHandle 3992 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14d14fb2-8318-431a-82da-9b4f75157925} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 3980 21ef1558 tab
      4⤵
      PID:612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.6.1288069645\446950972" -childID 5 -isForBrowser -prefsHandle 4168 -prefMapHandle 4172 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e86543b-b590-4632-9185-c34d0cd195d6} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 4136 21ef3058 tab
      4⤵
      PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
b11c9617b1f8def9fa804010e43b2512

SHA1
76e8e890b896fc25c8b05260925c6674b2081a42

SHA256
a8c7a644764b857c08ff1731f23eed2e18c7a56aad8faae594148423597dfd39

SHA512
409ffa37cd45771d0fdeb4d4ffeee0e7623a7af3baf2e9f2bd7f3be6f3cc08c30c367d92fd27aeb4261413b372e2f7fed7e2ef0d9d982a3e61d41508af232aac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
13KB

MD5
f99b4984bd93547ff4ab09d35b9ed6d5

SHA1
73bf4d313cb094bb6ead04460da9547106794007

SHA256
402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

SHA512
cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
413093f3d22b73be8c5edfe331f73d6d

SHA1
224061696991511583af66632567918057378648

SHA256
27951ccc420ba3c91cc52eb26802febcc180b18aefc6905b4d12b2c9d7c57377

SHA512
c0643fefd3162ac4f5a03658904e15106e8d27554cd271f6da6f3de16b34b765841bc785db1cb3205d107b0f2b608d252040325278050708107cefabdb1848ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\8d1c1a9a-d89f-4a6d-8097-ac112a6bc3d5

Filesize
745B

MD5
7b27f251b6ab4dfa16129ba18a9bfd62

SHA1
3ac2749a4eea8f296f215f5ba821bdeda40ef88f

SHA256
1225d0255dba7ac26b69b6f2e44af33787d2924cca48800246bbe709a011bf6e

SHA512
af8afa171a5d5f6f6d5c0e00ce3fb34cedea9095b5ec55932518a38ae210c322fd5cb5d8c6a326992a416854517b16c7e30422b051dbefca181527c0a7d291bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\bd73fa90-96bd-40eb-a1c6-8b5411cf1a7f

Filesize
10KB

MD5
54d8d28240bbe9e16a8b18c3fdf81d8c

SHA1
2acca9be15515d107c9968a6490ececdaedbc05c

SHA256
78bed923c842199ae720341f21b98ec252a31f3d13df6e77da731f7f7e67d69d

SHA512
34404380ccedb3443cc894d61bdfc302d9f4827e21cac0c9562be577e20130f3b16f3c8f981ba7b6685c4e4770d042ac85a2deca99543eb0ed6a6a5a2c387206

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

Filesize
7KB

MD5
7e382fedd67ecbaa8844aeb712a78b93

SHA1
cff8156ad4c9c7f8a1bc861089abe40037a05263

SHA256
b07028727c835dbe23cf73348786e81a0279ce0ead524b31d12567616d925169

SHA512
40bf3fb125985822b21559478dfb5e0750dfaba3e4781e689b2241ff326d88a82b74df384ca8dff693a1af57bcf9e778835f3b0438721fe2584580e4cd5ae8e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

Filesize
7KB

MD5
8ff4ee5f6c83b17051e1f1a49b4ce672

SHA1
8f9aa7b4913ba92b467fb66c3daa95ac9ca08964

SHA256
09b0344f77ae67fc6e270c0de7f9860e42403fd6f8655efcbe376265f7277856

SHA512
780ad0d2f8b889d6cf765d17f3c18fcc8cb083295833917c187b14b08568b66b2a241fe491bc199eae3b1d5410dfd378bfb7f7cc9dba47c117bc8b6b11d1370f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js

Filesize
6KB

MD5
2d5518475702f7d185025a07546653ae

SHA1
165d1cd733d495ce01faebeb4e4c4ba8cf1be20a

SHA256
1657777fac26e00bc188a21e4a2debc75876b3b16be2ec994907ab93a3c4aae7

SHA512
9e46f967cd306e55821a1fec2db445102732114e803cf0abb1fa7113eb090819b9975ea1020dfab88afcf0590ac1b45ae3d0c596a3fd7ee050fcc14b7d11822b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js

Filesize
6KB

MD5
706271437e513f876fe773d49821523f

SHA1
7bd698ee6b1006485423f153efd5c64bda27283f

SHA256
7ea190e9024efee62554b1e46a0124be5620ee2e23cedf5fe4e65469d9597600

SHA512
0d910356b2ff0e6a1572170b7365f60e7989841beff90859910d5f5f726d8b2df91ed06d2618d0d8c82434525ace410ad87ca5fe98140114b93be31d531a0446

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
3dfd27069f4536faabdcea56c9ec3705

SHA1
53fd3fd34973f154cd8c88886d9c238001290fa6

SHA256
cc3859e240fd7855b3bd00abf1e7ea46b52c569749cf958e1c114681b13d06ef

SHA512
59bcda6f36940e3a394934ee57adafa4cc0d7e524ce724111600ebab2f16d647010d9a7e00f64b0baf0e9f0f05979e2b55d44d8516a1f923999e0c29007d7291

Download Submit