hxxp://904081dc[.]bscontabil[.]com[.]br/?id=solotmp[.]hu

Analysis

max time kernel
209s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20231215-it
resource tags

arch:x64arch:x86image:win10v2004-20231215-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
13-01-2024 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://904081dc.bscontabil.com.br/?id=solotmp.hu

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	firefox.exe
Token: SeDebugPrivilege	4004	firefox.exe
Token: SeDebugPrivilege	4004	firefox.exe
Token: SeDebugPrivilege	4004	firefox.exe
Token: SeDebugPrivilege	4004	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe
4004	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 1384 wrote to memory of 4004	1384	firefox.exe	87
PID 4004 wrote to memory of 2448	4004	firefox.exe	88
PID 4004 wrote to memory of 2448	4004	firefox.exe	88
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3920	4004	firefox.exe	90
PID 4004 wrote to memory of 3444	4004	firefox.exe	91
PID 4004 wrote to memory of 3444	4004	firefox.exe	91
PID 4004 wrote to memory of 3444	4004	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://904081dc.bscontabil.com.br/?id=solotmp.hu"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://904081dc.bscontabil.com.br/?id=solotmp.hu
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.0.259533128\2080835831" -parentBuildID 20221007134813 -prefsHandle 1952 -prefMapHandle 1948 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {868c50a8-57ee-4724-9a62-b1a1db467879} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 2024 232856f8358 gpu
    3⤵
    PID:2448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.1.917118570\1211998043" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfccdec5-9fbd-45ff-8ca9-478543c8420c} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 2448 2328513bd58 socket
    3⤵
    PID:3920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.2.1201343479\793312438" -childID 1 -isForBrowser -prefsHandle 3068 -prefMapHandle 3028 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4767ba7-c162-4506-9882-772796e08869} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 2928 23285660d58 tab
    3⤵
    PID:3444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.3.574619972\887297604" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4d1e049-8b9a-4abd-9a8b-9b6ee66120fd} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 3628 2328a6c6c58 tab
    3⤵
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.4.114436847\2113821238" -childID 3 -isForBrowser -prefsHandle 4852 -prefMapHandle 4828 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37e39530-c949-4a0c-b5c7-51d4f689f705} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 4832 232894ab958 tab
    3⤵
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.5.954213372\348965206" -childID 4 -isForBrowser -prefsHandle 4988 -prefMapHandle 4992 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {272fc88b-17d6-4629-b096-aa179bd1d2dc} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 4980 232894ac258 tab
    3⤵
    PID:1640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.6.1272485480\1930876087" -childID 5 -isForBrowser -prefsHandle 5288 -prefMapHandle 5284 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa40baac-e1f3-44fa-a103-a9dd348438cf} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 5300 232894ab058 tab
    3⤵
    PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4004.7.311095385\724842032" -childID 6 -isForBrowser -prefsHandle 3308 -prefMapHandle 3004 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1092 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aff418cb-7827-4e8c-9f0a-eded4c5f65ba} 4004 "\\.\pipe\gecko-crash-server-pipe.4004" 5488 23285660d58 tab
    3⤵
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\cache2\entries\77FB5EE92C576E2505C8C9FF2EC417D7727F401E

Filesize
13KB

MD5
4c9fa70f3ee6386d289a62d50ece3e4d

SHA1
b4b41eee7f1427bdf715011a6609fa46e75d31a9

SHA256
f566732817d42a05d66e636f8c702e3698eedbae7215ec6c2bb4cc182ec8fcd4

SHA512
03e40d4193ecd7e9a864a5baab6eaa5342c7f26a311b7b6a77a31b2471ce13b0f9266b2f057d6f2ccdd6c89284ade995ab40add2767372ebfc8b029ae26989ec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\cache2\entries\9B520F983EB5D65097683E19E3C047185CD0A9EB

Filesize
22KB

MD5
0c429208d1afae781954255879f8e926

SHA1
ceb53a5b00e7e6852c2aedf6ea771b10acf971ec

SHA256
1ce641298efd5da140d5d3a9166f4f33721b4ed49135fc613e45c39358057878

SHA512
4e8623aa84419956ef30d19695bc44eeff6b4cbb8406814b2952c013ee7278909465362479745c6557878bd3801a524c829d469d76f7db06a966eb5655907c35

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\cache2\entries\B573808F9B4F64D3E5F0B069BDAA48EF4086E712

Filesize
13KB

MD5
39f12d9cd55a4446f2cb3d73d40d0536

SHA1
2aeda509e51225c3cd7b4f00753d369c3516dc92

SHA256
acaf04c78861861ad77e924daf9f03dcf133a847eb4db6f6f675877ecba671a2

SHA512
13bc98bb6f1c0a447180ac451f57cd7de35ce360a60f3ccce592f90c182591e3a44e0a53151e3c85a130eb2b12da60122c075c8a1a8e200023b645a17f477aee

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
98dd3a0807b28ff10079f66180c331b1

SHA1
de0410d3732f93bfc6cdf34271e9a09a29697c9f

SHA256
2d9ed415f66df92dbb4ce55bc0cf24dd9401ca436bc18d59b93b27729233db4c

SHA512
7513587c4fbea23cf26603bae70db6f4b9de76d1cfa4f3f0141e33d26b379bb8402e3e3efeef8eb2653799bc80d8f73e81d8e3faa1547bbc17aca124d8d01eaa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\datareporting\glean\pending_pings\0a7c650b-6bde-494c-9003-32e3015d9378

Filesize
778B

MD5
54cf4b63ab50bd253f779056aa9b52bc

SHA1
eb9350a18c0ca0e5bc786a9a86a88eba956d42d5

SHA256
da16d93c4a2a7cb6171ac6645355f7eba09f82ff0145e2e931df33392837f31c

SHA512
15c6b306f4caff2d3243dd05b968b841fb2e5ebdae3f53aa89f31416f7b1fd0208fdffdb0dda0423ce97b75e88381f35383d146de1a6a227764a27057298e805

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\datareporting\glean\pending_pings\39f61b97-1eb4-4bfd-9dbf-97b59a647bb4

Filesize
746B

MD5
aa6d1bfcae677820614794cca3c9302e

SHA1
433147f06cef3362965cb38b00974aac7cde5115

SHA256
168fde29ab781fc283ccf60e7cf72b953334f832d7a4648017c4ba5952467767

SHA512
a999c030e8046d5031288fe9a2e8f52c43ae31cdc3e986414443b3cea3f9fe6e55051df899892bf02416e2c5f6c44bb5f381954d0ed38ace0b9a0849385ecc74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\datareporting\glean\pending_pings\ccd383ae-b23f-45c3-b5a3-f1ea2f06853c

Filesize
11KB

MD5
c1731a0bf357aa77fd84c28071f6b3e1

SHA1
77e6ce6d7cac03a4475e19eb00430a29bba0d33c

SHA256
f7534332e15e4de391722de862877b397c549bef8edc542bbff716f78e96d8aa

SHA512
4a61c56f82ef553b01ded365da8ad841bbc7613168b326c5e8ad53069d6ac299f47c0a6db15238a595b931c458d62c0b2461af1e647a68c60b8910066c746b6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\datareporting\glean\pending_pings\e8ecac70-e7d9-4784-a034-5e1284df2486

Filesize
1KB

MD5
6a2ad66374a34e7f2eba12f35a3d0673

SHA1
b8f8632f1f445ee989ae8f776d7042abe1cd91b1

SHA256
1a1ad3fb1937f5c967e3cea8fd24be0e5a111bd110452098afabb384d9fb2f45

SHA512
9ebd6b9325c1b2e38ab4ca5ad7b7900494d3dfa8e28ab06375177a7b7092422de915d7681eb2450a8e10ee62e3e41a55305c1a9c9a31fd67ce087770af2273e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\prefs-1.js

Filesize
7KB

MD5
7509575f1707f0ecbae39cb0cb468cd3

SHA1
35e433ef869a3e8e4784341069b850b63b572de5

SHA256
3381d03f496ba4267d1d33ab7829873705ca7f189b9ec181db4a42ce5a3f7274

SHA512
7fbdc1532f83ac11cef4aaf638d33c445d22a20e815de519923776354f93324353cf97e04623a1a0e2f813b784a50ad7743c86ae7f402759ad0d85f34fad6253

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\prefs-1.js

Filesize
6KB

MD5
da203449f3cc351933b00e430a05ce60

SHA1
be7469228b60ea9c8bfb131a0e9f6898b8f01623

SHA256
5588250fd65cd87bb8a400fcca983769b8fa80e899909711b253a7493c77b78a

SHA512
279ef33faf31168a94f5d8a5fd3154878e72a1131b93d0f333be54321c4673eb267c341432d71a3fe0b0dcd744926072c10c8642c9c6e5ae5ef080c7c9cb81a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\prefs-1.js

Filesize
6KB

MD5
a52c997b83f5eeefc58db0ab1ea5ef40

SHA1
65efe3b07804385f8d56a255d7b0f53ee2003d75

SHA256
3162151d547f20536a1964aea24a25ba095d5358b2d252c8d9fa837f60855906

SHA512
a99f89760000857524a385378ccd8f7af1877cc928e953c93e9962419a5570f27143ce32255fe2e3a07ee1547fc1d1d191ba6a6610760eb4117daa48a3ba54df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b29b3b03bb262dadf847472760c72206

SHA1
f773285ce3bdfea110d4adc71439736f67545813

SHA256
00af0a3f2611a8850f438ceaa5f486aa98b4a9c826b34921a892cf09aa2d445f

SHA512
c522436854cc0ef9e7e03dc5d3438829ca071b66fd3b520271d651484d40fd05e1cff9deed8b073e10996092cb47a5f43ca806e2377ab30bfb175d329aabd2f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
82b5cf4d1a4990080861abd2d439f77a

SHA1
b5149cda2ce30b9be1957f7c3b6557c9c64c8120

SHA256
3d283c93aa3725124522fb08ec0032f24a201d596fbe238b82ce2f751c5a4a38

SHA512
4c8c4ced8b851996014ceafc14f3ccfc363200da7f69864677f3473c21295240b789fb52022e95f7dc42d5a696c3dfab5c9733edfb9ba4f3d3545ce9bfd1503c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
cd8421a91bbf742daa8967a82e2fb080

SHA1
ecdeaeb97cbd14732375be30846c954e4cf47992

SHA256
e7a65749f58628215ce0f75c98531512f4b0f8673b0e44428344e37f7b5a4625

SHA512
82801dbea0d0100762cc6de756404cb53b334471f664837741047e22a367b529ef0de16c8682cb16646c78bbb6c964b4efe761bb55b1bc693c572f46c6749304

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
8649d98b3bf4d5d208154880f0626c2c

SHA1
8562fe42fc99c0117d64ea4110c6006c62032650

SHA256
d4a02fe3e27ea9170600cda7174405c99d97c3f5f3a874c6f731f2388f49edd4

SHA512
2fef423d4c5ec6ca562dab1b7799082153592019402aa5175a5af58896a04622a8936b8624e1cfd18f461ca9118760e3fc0bb3778a80046d0cb3670f39aa4476

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
6e21170a46744ee97826077f3319eea2

SHA1
9d8c3fcabd6ced78fb2170f892fc1763aee5e242

SHA256
f18f17aa113b5e3717f89c5e6d1cbd4e60e44d29b8f81b8788fdc512faeac848

SHA512
5c776ba924efcc2fa7d4d94e1c68043b1273447505c472ef173207adbdf9b0ecea2a6715249cb26a34adb262e9ce584a798b88c1f7a8e81cd410df59bd0d5e90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
bd184fa0fe2b0765a6b328cb7b8a0d63

SHA1
efd7b9f7bdb70487810a1b7016b0d944108466f0

SHA256
2cff46a7a86f5b22c3a92b6872d935c830c34e6c6cfd8984ff83f346e309d1a3

SHA512
9297db8304b04e6185da340d4b9313cd3e2a5b57302e9244678b8dccfcc61b664cb569b17e99fa9d19cc9ada594e5655565a29b83d73a31372c9d387f8f9bb54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
4a4a18de84f6d40cf566649fbd8a7c61

SHA1
c29f1a64b59a27b964a60bda788bf98b5c5d72a1

SHA256
bee5ce295fd5ce7c830b45651f95a8cbb667fccc819d338785df502144aece92

SHA512
f1a358d08a14ed26ce7b9d80f28de80be30064b9816e8ec353f1aedfe1f31379d944bef788799e582043ade04bd17307a51cd74eaad38320c12155fdb015c616

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b17a2d15bec98d3def8c6c1c387d231f

SHA1
8121e37a7bf4e1d11815730426e3e7da7b48e38c

SHA256
b4ba2d326445454fa9f67c5c1734adf5dff0e1a361191d42bdab268c52f71650

SHA512
13835f5b8c1f60d2bbf445ec19af2100996e5d1db3f4e0a6ad64a0d40799613adeb20a8c81859df796b0ab0198d897bdeaf1ea39abbbac93c56bd24dfde7a0b7

Download Submit