hxxps://recsa[.]com/gu/

Analysis

max time kernel
112s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/05/2023, 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://recsa.com/gu/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4136	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 3340 wrote to memory of 4136	3340	firefox.exe	83
PID 4136 wrote to memory of 568	4136	firefox.exe	85
PID 4136 wrote to memory of 568	4136	firefox.exe	85
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2836	4136	firefox.exe	86
PID 4136 wrote to memory of 2376	4136	firefox.exe	87
PID 4136 wrote to memory of 2376	4136	firefox.exe	87
PID 4136 wrote to memory of 2376	4136	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://recsa.com/gu/
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://recsa.com/gu/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.0.16122592\523189757" -parentBuildID 20221007134813 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93501f11-1b79-41c3-9cdf-fa1009502b54} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 1756 262c4916b58 gpu
    3⤵
    PID:568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.1.850685640\1410874375" -parentBuildID 20221007134813 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75aa9039-4275-4eaf-bdf3-845c38e3e4c9} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 2424 262b6a72e58 socket
    3⤵
    PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.2.623395491\1726286433" -childID 1 -isForBrowser -prefsHandle 2792 -prefMapHandle 3052 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd56e86c-51f5-4f50-8992-e751d81eceb9} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 3192 262c7838b58 tab
    3⤵
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.3.36684880\570373680" -childID 2 -isForBrowser -prefsHandle 4040 -prefMapHandle 4036 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf8770df-7cac-45cd-a902-a2df62b6a6ad} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 4052 262b6a62858 tab
    3⤵
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.4.1014367130\1828213481" -childID 3 -isForBrowser -prefsHandle 4628 -prefMapHandle 4172 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a2237d3-2e9e-4c62-b67f-562d5fc83d9c} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 4704 262c876f458 tab
    3⤵
    PID:4692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.5.658045502\577159638" -childID 4 -isForBrowser -prefsHandle 4800 -prefMapHandle 4660 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2988521f-a866-4146-a716-a73e8939155a} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 4820 262c9c6f358 tab
    3⤵
    PID:3208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.6.1810306842\1064189299" -childID 5 -isForBrowser -prefsHandle 4952 -prefMapHandle 4940 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebb5da7d-87a7-4b91-a7d4-e7cd9f125ee8} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 5108 262c97a5558 tab
    3⤵
    PID:2492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.7.502241124\656524405" -childID 6 -isForBrowser -prefsHandle 5248 -prefMapHandle 5264 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86f4a6ed-b10a-4dc2-a07e-3dd9c646e243} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 5660 262cbf1f558 tab
    3⤵
    PID:1416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.8.673984812\1970671336" -childID 7 -isForBrowser -prefsHandle 1480 -prefMapHandle 3152 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fd9b517-1633-4a34-8471-18107b54e40c} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 2984 262c97a7f58 tab
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4136.9.1338615868\33578813" -childID 8 -isForBrowser -prefsHandle 4944 -prefMapHandle 1268 -prefsLen 30300 -prefMapSize 232675 -jsInitHandle 1460 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c576d86-2972-4d11-90b6-33478bd0f2ac} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" 4796 262cb2e2b58 tab
    3⤵
    PID:5412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp

Filesize
152KB

MD5
3d722dcc0e6e9c8cfab8e66825faf503

SHA1
7f53d188ec4f348e4f60e7b2128cadb1504a32db

SHA256
c26a8573feb44970ed730c6043ac6d4f230b8c578e4f8bccf25f75420d6286d9

SHA512
51c90996c878d131a527cc787aef339ca89d5b82c5747b219080174eab6fdcd4b98358efe3c7ed365a2b6b88c21404ae2917a96d5ab3a50ed47662bd41a99005

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\1259

Filesize
81KB

MD5
16d95a77ca35945ee7e8ab03d7e3a929

SHA1
3add06281dba5f2ba72e5bfceed322e62114b361

SHA256
67e3b6d612721909b16ae795709ac51fcd26427a900cd4c60eb3d1fc4cd622a4

SHA512
74edd6b8864bb515cc9d01677428dbceb487da69cd47369864641d78c4677e664f6258d9458fa10c1638418553f2ffaafc9206aff672e1aa20b41dc4a82764d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\14160

Filesize
9KB

MD5
86594f873bff07583a527b288c876e12

SHA1
aae8d769ca884045f7497ae9d13eafb8fa7b5943

SHA256
f963c9020d8d4732f1a99d5664bfc7cbe6df1f263eaac1fcdc345eb19be1ecf3

SHA512
31ed37e9d830aab05085336e9f5b5459b48431fc582b9cb757b1dcdfcec28723e1a0bc723a180cc58c6a091b453d9ed7ef8ba08ef44a6aba85448612430b60ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\16729

Filesize
30KB

MD5
161871177a7b2ca088642e0b8388bfd7

SHA1
cef18a5612713434cc1f72cbc868cdf9cfd01952

SHA256
ad7b3075c164810b9581f04f00a8d471780435a407d08a0745101e22fad92cef

SHA512
d0abe2f12f77d601167d7763cb18a8a48767b180494ed30fe8ff2cb50cb5caffddc3f65fb3ce6a9bce34e02fb233978e3b1ca46f81fc672bb2f9c34add89667c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\22711

Filesize
16KB

MD5
3060b9fb8101d3de917daba3c5071b5f

SHA1
335f10e0d5516d9cf53d9e9e0a82fac70b390a8e

SHA256
0295e9826f9b5a1889f4a5432f6839c868bf53627306fe9727d35f4c5ad24347

SHA512
9f229edfe441de956f3e7926b0eed03a56b4c5993aa84ae9e1ab4506a6890ee7747d5b9e3383392e8a2642072fa25ea514a3e299814afd56837bc59fdbbcdad9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\25191

Filesize
74KB

MD5
9dd61dd3142ec5ca3c3738bcbd3be3c2

SHA1
2e92d1a108b9d22e8fd320668a77ffb727d80697

SHA256
25ecf9198c09c8c4daa52dfaa421d25b21a36f9e33bb204719ff08b5b12ea893

SHA512
2f4e0d88d267fcc0ef360dabc897c0542ef0ac4e7ae560c86c540c2344704a30a7d6c552c5b348209fbc07faa06019d418c12377336fb01a30b8cd017c19d071

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\31622

Filesize
9KB

MD5
c320dbc783812b928e9e0e171a120c0d

SHA1
9b5f3c1ea7c48f1224cbf8a3bc19d8d630b12a96

SHA256
5b9ecf90baf0e1a9f5388a22f738a0bf2c43bd88a30fe5f4ae37b1b5aaca6c1c

SHA512
1cad0d646a3b06fed74b8884fd31cb3028a55a52c2515df6c420f7649f841a971aa733d53d28d478a1d42c3885e62d15ccfb5fc026bc17a48aec3f2affd5f810

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\3342

Filesize
16KB

MD5
9793c9166983c7e24aaa988461b61462

SHA1
55117bca6e568a318b7c344861e8747f7e4dbbc9

SHA256
db2fbc9bbfa42c02af5de0c472e8cd9f36fd30bdc30c4d87e293dbd0f985072e

SHA512
6f02bc9a347a7b2c35d42994bdfa1a5c9006a8538b0935eafc6e65c45ddfa65dc3b9556d7c535867459b1f1ce628209088e2eb487d4d28f98828bb6dcb67429c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\450

Filesize
9KB

MD5
d586fb93fe354ca34d793a00106df261

SHA1
574c40a3ef9f82857d9ec1a1d7a649100247ad07

SHA256
758e154936b754456c971566d00e3f92081664ce79a9a922380e36bdafaf07ab

SHA512
3cb0038041cabe467980976c4921fabea93a24d3d1d4d867479ae88ea6ede73d02bc3550a02ab075c612b7f2290fe2c47fe7459142adcb327f300b4ece6d9ac6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\6376

Filesize
17KB

MD5
f0dfbecb191219c4bc314008e2bfafe2

SHA1
2a05869788d981e6d0106f5945d223d63b231751

SHA256
f4aef9017e0f24ce8f5cbc3292b179568e1012e8b2b001afa853a2189e2965b0

SHA512
3f80243c9c2a6bb9ed45c8e9daa3133fbd64bc84a626280d974d0206b8180c55d5c0d2a981b83a65cefc55ac2a38909d9e00269b04305bb7f7f771973ba01a98

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\9787

Filesize
16KB

MD5
d7c95d4ca3f18daabd2da9b17fa7cdfe

SHA1
c14dbc512d372a167a903f94d19c690b46644b08

SHA256
13cc9097a9f5b1a32c731983e0420e97576b58a0818f9e05f484e81281463af1

SHA512
95cf9ee5093914d1ab5019232a55be859a693c252017018dfbe9a160339e53d34dfc9226d90ad3ad66fa3793b7903fa9e12fe8b5f58629bf815d84788d663930

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\250EE2BC03AFF526F1A1C3DB212A79DE3EB60D5E

Filesize
14KB

MD5
78499567fb71c1cd404afce17aa2b0d0

SHA1
01204bb62db7948ddd4a755917ebbde0bebd9d48

SHA256
e1c545364aaaba45a282154fd9c734696d4439884dd32027a818451000431236

SHA512
1d95e2bd3b2f3cf57f5e0b882b406c1b51dd476e63bae86b30fb22878d9dd3c61aa07a54ec5bafcdae059059a6517b0f3fa455a324976845c9f1bf1ff5326f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
10KB

MD5
7c48f4606a5652a8f8faa969d966b373

SHA1
b804499a666fe933ba3e96e489eb8711855a7d94

SHA256
f12d3cdfb62be38260323e97a48b24c72b1825e7d5c93c1c6196df1a0df27663

SHA512
118a39d4b707405fe3e0458eef3987c17fa73a1090fdc4b61eb8e1ae00b783c5dc21b9527698c646fe58833d67619f5d440176d2527c87e5780bd70fb3dbd1b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
01a4db699ce948c82dd1222a1da6d091

SHA1
3b67066df0c66b41a52a78c4bcd14a0bffcfea59

SHA256
80efa790f8ca2affb5a7720098d3e475e401a1e75708d22fe0c3b389e8ade6a8

SHA512
6548432b84adf8ab7d1cd710707056c3b28c1684e69ba5800936a619b796206a8fb39feeb7e9a734306ef556020a17b0eef0a8c3b94272d444e516ff0cc4c510

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
6KB

MD5
2d650892f73a551903af0434f3efe4d8

SHA1
fab2cf860696e2423d20144191243f913f9d68e8

SHA256
cfcdd465bc853148fbf5bb4f222a5f189c9b859e3d9c5815493a37262fd00f08

SHA512
f11be27b00ea004625211d31c0c703097c81c03565e38267044141406d1f3e0a6b616ea31c77d3cec9369656c90b7a987ff071ce00cddfe37fc9ce7d67db7810

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
7KB

MD5
393fd4a1f88d7773a1a06c27e09efb48

SHA1
2402afadd7d39d2f56dee89bcd02c5d589ae4066

SHA256
9212a0db59668f0358e8c91c53a737745edfcca954a24ba1ffc81f3c2b9a9ef0

SHA512
300722458420d31efde6ec8afd9529ddf96925a8f70509888bac4d1ad996b2b32af54adc1eea32683afe5b9109163c6c7b9a5430ab28eec5f547d0118373903b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js

Filesize
8KB

MD5
77dcb350a8514bc4a6d2eae4d52254e1

SHA1
292c7587d0d4e42250782c76842a9447338f0caa

SHA256
be76381ceb9a91f6b08b96139acfc740837e2ebd0d4182258e827a912c6ecb03

SHA512
29c4f0a599c1d59bdb6b447f5b62df302e181af2cfa932a089810d90001673a8cef2fa601db6808f76b3f570f7ea9d0fc37879d1fb546a0ba7c8478f42989817

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.js

Filesize
6KB

MD5
108b97b1ff7efbdb1aecce96d55ff2e5

SHA1
bb72b2e0c3d859fe5e821632307a32df331b55e1

SHA256
c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e

SHA512
e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
314930c47e1aef782e5ef8b33684dab1

SHA1
be2dc5fbd516af1d3e3e16b84f01a3e2edcb240b

SHA256
4ea1efb215991b559ca597ee2e58ec9c8934905744d481164bd6944e912ea7be

SHA512
d9d3cb2a16dcb7902819608dbe6be5dcab9d1cf71bf1f759cf926e02f5d36bf4127da1373a12386cb098db66095f964101cdf2c3336d413bc32221bb26c19b1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
7511914bb2a8d46e7dd15e29fa5be5cd

SHA1
c11efe485f40a943ac2d44ded54631a35e7f8626

SHA256
7d293022351dc7df7ee22f5d7aa88eb69e0729044912a707bd5be330623577f7

SHA512
bc3c82e96f99f08629f08497d59bb02c75d5b94ba2fd17f65e653037be4eda846a9c3a5b3b941f8583627b5a3cee00b95484fb80ec8b9c40bfbe4a0e0c0d0cb7

Download Submit