hxxps://anonymfile[.]com/bV34W/free[.]exe

Resubmissions

31-03-2023 15:06

230331-sg741acc3w 1

31-03-2023 14:59

230331-scs5aaag94 8

Analysis

max time kernel
300s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anonymfile.com/bV34W/free.exe

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe
Token: SeDebugPrivilege	2196	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

2196 firefox.exe
2196 firefox.exe
2196 firefox.exe
2196 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2196 firefox.exe
2196 firefox.exe
2196 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

2196 firefox.exe

pid	process
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe

pid	process
2196	firefox.exe
2196	firefox.exe
2196	firefox.exe

pid	process
2196	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 592 wrote to memory of 2196	592	firefox.exe	firefox.exe
PID 2196 wrote to memory of 264	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 264	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 4548	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 3008	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 3008	2196	firefox.exe	firefox.exe
PID 2196 wrote to memory of 3008	2196	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://anonymfile.com/bV34W/free.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://anonymfile.com/bV34W/free.exe
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.0.308049682\239120741" -parentBuildID 20221007134813 -prefsHandle 1860 -prefMapHandle 1812 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12c28062-6c27-4623-a977-0601119e6c9f} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 1960 278f6219758 gpu
3⤵
PID:264

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.1.1761497472\2113995359" -parentBuildID 20221007134813 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d577bdde-728b-4d86-9f37-00861f5231ae} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 2440 278e8374c58 socket
3⤵
PID:4548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.2.802132584\1107895915" -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 2944 -prefsLen 21789 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53aea12b-a122-4603-88a9-0b92ffc93715} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 3144 278f8ee0b58 tab
3⤵
PID:3008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.3.911513560\1586056697" -childID 2 -isForBrowser -prefsHandle 4120 -prefMapHandle 4104 -prefsLen 26784 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f39156e-e83d-4243-a438-a6258045626a} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4132 278fa271858 tab
3⤵
PID:3924

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.4.268270703\1430327087" -childID 3 -isForBrowser -prefsHandle 2888 -prefMapHandle 4608 -prefsLen 26843 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdf1335a-d9cd-4901-8f1b-52502b1508f2} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4604 278f9eb0758 tab
3⤵
PID:1896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.6.1995402940\924380595" -childID 5 -isForBrowser -prefsHandle 4612 -prefMapHandle 4648 -prefsLen 26843 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {158d990a-fead-4f70-acd9-c35f67525cc8} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4884 278fb196258 tab
3⤵
PID:4984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.5.433509217\1429759812" -childID 4 -isForBrowser -prefsHandle 4644 -prefMapHandle 1664 -prefsLen 26843 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7193719a-9f86-4588-a171-ca32b46a35e9} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4584 278fb195f58 tab
3⤵
PID:684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.7.1847213497\1671942098" -childID 6 -isForBrowser -prefsHandle 5736 -prefMapHandle 5784 -prefsLen 28354 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21621e75-6a99-4957-92eb-4c3859d2aded} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 5348 278fe161058 tab
3⤵
PID:4504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.8.1690258976\619758532" -childID 7 -isForBrowser -prefsHandle 4464 -prefMapHandle 5616 -prefsLen 28423 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0b54ed8-24c7-4ce4-bfa2-8ec8c3acb024} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 6004 278f8e11758 tab
3⤵
PID:692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.9.2139181887\1493492689" -childID 8 -isForBrowser -prefsHandle 5132 -prefMapHandle 5200 -prefsLen 28423 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {398f5006-dea3-41d4-b97f-a205f76a0fbd} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4004 278fb5b6058 tab
3⤵
PID:3052

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2196.10.2048423495\1749338919" -childID 9 -isForBrowser -prefsHandle 4976 -prefMapHandle 4972 -prefsLen 28423 -prefMapSize 232675 -jsInitHandle 1464 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b9a2efa-1b0d-4779-b43d-0b66414cf946} 2196 "\\.\pipe\gecko-crash-server-pipe.2196" 4948 278ff93fa58 tab
3⤵
PID:3128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\activity-stream.discovery_stream.json.tmp
Filesize
151KB

MD5
4fc8610f256015764f985eb166478368

SHA1
f13194a3980db10f7fc0c0e397a8d909e1ab4c10

SHA256
fa296fd4837537d45cf3fa163fbd353d9c65fb880cd783f9092860b4f0451566

SHA512
f242f818008c9cede7061d3e188d42e1d6231d09775ef265a58695a746ac7385c99c4462e59913a6c0261fcb306f03140f6a8be5a926eb88b720b91d2f2d8652

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\25592
Filesize
13KB

MD5
1376fb75df3c94d970d850b6cb60f8b4

SHA1
f0c3a1e422c761389351d95fd1ff59aaadff8fcf

SHA256
807dbed91c93af84acdb54c0d52f7a5f128c05c236926fd3b9468c4234fb0731

SHA512
edb6a559443af4712368864a576d093f4e4d5b236672472f003c89416acd145e3b2cd5f0861bc9eaa6b38455d0c9ecfb928f587a1903203295fbd8bde903b965

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\26428
Filesize
14KB

MD5
c24c62c75d8d50fb6a7f2bff7ee65490

SHA1
7c5e15a6110aab5c343877555f238038e3195ed3

SHA256
6e46b5dbd0000ac2434950589c0b9b8b9a0b2ef8dc1246615c35a97d8225685a

SHA512
391db8af03b7eef9613b55cdb5ea4a140cd6e90934a2cdef4d3331c331e8ecd7534f60ae0137ad0ad701a2196569040d4a81db5e047aebee83f3eebf491d0b75

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\4487ABFE46FD3CD324FD1C29441207EC4CEF9461
Filesize
14KB

MD5
1cc22ba7e38e07a0f80923bd4604f46e

SHA1
d8121974a5d1a8561ef334809de7e9507852662b

SHA256
2c4d3dd7e3a0a9085e2e65777aceecf6b3b75774976d40738bd78873c8f1467c

SHA512
ce8e250e91f37c11dcd0fc3902b5b87814a8703698651c8b910371f76b3d9eda6ce7eb1acfa16f5c3309de49671286b7a14cc0c08fd3b5ceafbef34b9d75be70

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
6.5MB

MD5
438c3af1332297479ee9ed271bb7bf39

SHA1
b3571e5e31d02b02e7d68806a254a4d290339af3

SHA256
b45630be7b3c1c80551e0a89e7bd6dbc65804fa0ca99e5f13fb317b2083ac194

SHA512
984d3b438146d1180b6c37d54793fadb383f4585e9a13f0ec695f75b27b50db72d7f5f0ef218a6313302829ba83778c348d37c4d9e811c0dba7c04ef4fb04672

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2449.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2449.0\manifest.json
Filesize
372B

MD5
6981f969f95b2a983547050ab1cb2a20

SHA1
e81c6606465b5aefcbef6637e205e9af51312ef5

SHA256
13b46a6499f31975c9cc339274600481314f22d0af364b63eeddd2686f9ab665

SHA512
9415de9ad5c8a25cee82f8fa1df2e0c3a05def89b45c4564dc4462e561f54fdcaff7aa0f286426e63da02553e9b46179a0f85c7db03d15de6d497288386b26ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll
Filesize
10.2MB

MD5
54dc5ae0659fabc263d83487ae1c03e4

SHA1
c572526830da6a5a6478f54bc6edb178a4d641f4

SHA256
43cad5d5074932ad10151184bdee4a493bda0953fe8a0cbe6948dff91e3ad67e

SHA512
8e8f7b9c7c2ee54749dbc389b0e24722cec0eba7207b7a7d5a1efe99ee8261c4cf708cdbdcca4d72f9a4ada0a1c50c1a46fca2acd189a20a9968ccfdb1cf42d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll.sig
Filesize
1KB

MD5
dea1586a0ebca332d265dc5eda3c1c19

SHA1
29e8a8962a3e934fd6a804f9f386173f1b2f9be4

SHA256
98fbbc41d2143f8131e9b18fe7521f90d306b9ba95546a513c3293916b1fce60

SHA512
0e1e5e9af0790d38a29e9f1fbda7107c52f162c1503822d8860199c90dc8430b093d09aef74ac45519fb20aedb32c70c077d74a54646730b98e026073cedd0d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
7KB

MD5
df7b2ab5f5819adfa3ed33a04cb44af7

SHA1
ba2c2804ce33ad9f7cfdf994937ed7809e76610e

SHA256
e055dd6cddccf5803e51d71e26d72f80ac04445f4458276fc1b6524e6787162a

SHA512
cc9a563b173e0183114a82fb25b0e292b0447f86f6c5f7317d2c6dd16d86e1ba6fe387079fe8ec7567c87a5aceb8cacd6bca053e8d7cdae2b70adfcf8afc9ea4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
6KB

MD5
254dd82f86a1e94f473f053402073089

SHA1
8b74dcc6e1b1d0d6bedec6eca11164b3c69d1f33

SHA256
93d7167113c7ebb31d5def21fc684f7bfadd774679fe59a9b998f20c930ed453

SHA512
2d0b201b6b2f21fa1a1c90b8176590093cc06a9a8834a71ec1e5413c65c6034241058ad5f0791ce4d581efb9096f5a8081649a81e0f2209f2c874ec72efdd67a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
7KB

MD5
827f5be324a407a5dc2db55f3809a446

SHA1
08c72692e38d8020bf3ddfe18fc1a1086258f251

SHA256
21b7d71ccfd33b235970ad2008e81d46e49f8a46f31f350f2ccf25c4a64480eb

SHA512
9bb63bf3ea8c1f413103bab553d6c7b2c681732fee420ba01c56cb014fd12301f7b329b9c0343a36a75ef5d21a36007efd800f04b90b9e911b5095949af61969

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js
Filesize
8KB

MD5
52d06db30672c92b375d79ee5e1eb987

SHA1
72557bc1eb1370077d015e3bc4b1b02a0f030db3

SHA256
f5a6e21c9076045b6cadcd8ba7a7c800387a642ac88a35f40ef84a15c8a21ac0

SHA512
8bb3fca3f79c5c8d83f81be9903fb7f30484f2c0d9ae0fead06ee4e7fbb28778687917dac918f56ee01a79256e562baa2c2749bf209094bc1e8303648e218278

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js
Filesize
6KB

MD5
207077fed406e49d74fa19116d2712aa

SHA1
3ce60cb9b4fbd6b00a9ae26c599b9fdbe2b6c5ee

SHA256
b02701ad3c4478f891a550eac65f0a8c183999aa22a1dd171bd698b990124c58

SHA512
0c6398230b3eb103a0ce280f127515d998a6c9ea8908b8b248b132782f8166141ba8e1faabc7ace4b80e9c925bc5d7885f0fba8c16cb2e7798055727dc66190e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
2a1faaa541039518149146ff41771089

SHA1
63d2c80e99fd276300deb6a21defe0c9d709c623

SHA256
e640f76e5c7e0c5d419d3f377ffeb291605d946c95f2bf700a10e1b7c9b0099c

SHA512
3353bdb20ee8c43ef6ddba60c69f087f6bbdbb6f80d272a0902a3559b5a9b148a4cea44ebe6312e295279c9446e44db7883835effa24cea03d45dc53192ec029

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
0c3884c2c640f4f2097de93d0dec323d

SHA1
a09d66ad8b204de738bdc227524bbd53a5ba2d3f

SHA256
d373a5cf215f983cc6c5a48c998be19a1c4206c70ef47afc6d90b482d1edf0d9

SHA512
54c86c42d6be5a91b9b554fec545d6a956c50b2a7d334b32c14f6b762365a9f8e35a0b976ea417a511aec213d7fed996986f8dc1e31d6af6fbaff9abea6e18a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
0bc88f5f321e2a13cda3bf5f44f46cec

SHA1
633e2098dd0c01776185ba761224289cf84db07b

SHA256
636f8086472b0f73aa6ab5a638dfd02d57edf9b23ad386ab130b3ac0b81d50ab

SHA512
b807f10d650d95f6aadcd04d55fad60db232e4db9751d2913fc2968606da6702e5c75b3adce9d6a3545469c10486eafb337027b0342b34e32a47d575a3399594

Download Submit