hxxps://go-link[.]ru/oL1NL

Analysis

max time kernel
1513s
max time network
1509s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
08-02-2024 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go-link.ru/oL1NL

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-334598701-2770630493-3015612279-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-334598701-2770630493-3015612279-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	2508	firefox.exe
Token: SeDebugPrivilege	2508	firefox.exe
Token: SeDebugPrivilege	2508	firefox.exe
Token: SeDebugPrivilege	2508	firefox.exe
Token: SeDebugPrivilege	2508	firefox.exe
Token: SeDebugPrivilege	2508	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

2508 firefox.exe
2508 firefox.exe
2508 firefox.exe
2508 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2508 firefox.exe
2508 firefox.exe
2508 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

2508 firefox.exe

pid	process
2508	firefox.exe
2508	firefox.exe
2508	firefox.exe
2508	firefox.exe

pid	process
2508	firefox.exe
2508	firefox.exe
2508	firefox.exe

pid	process
2508	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 4148 wrote to memory of 2508	4148	firefox.exe	firefox.exe
PID 2508 wrote to memory of 5036	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 5036	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 2152	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 1048	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 1048	2508	firefox.exe	firefox.exe
PID 2508 wrote to memory of 1048	2508	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://go-link.ru/oL1NL"
1⤵
- Suspicious use of WriteProcessMemory
PID:4148

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://go-link.ru/oL1NL
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.0.94473184\343000424" -parentBuildID 20221007134813 -prefsHandle 1808 -prefMapHandle 1800 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc80da95-e5fa-403a-9829-4b951ae0b9d7} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 1888 203ff9e1758 gpu
3⤵
PID:5036

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.1.398525500\915052812" -parentBuildID 20221007134813 -prefsHandle 2272 -prefMapHandle 2260 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de65c04d-09fa-43ff-b55d-705e89648214} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 2284 203ff903258 socket
3⤵
PID:2152

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.2.989299696\1290187817" -childID 1 -isForBrowser -prefsHandle 2756 -prefMapHandle 2864 -prefsLen 21601 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85d52e92-6fbe-47b7-a111-d1aaf6f8bcb8} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 2880 2038c3fd358 tab
3⤵
PID:1048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.3.2126248635\2055131870" -childID 2 -isForBrowser -prefsHandle 3448 -prefMapHandle 3444 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d5d790e-62d7-49a0-a101-5b80cdae0e0a} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 3460 2038d81eb58 tab
3⤵
PID:248

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.4.969928834\552740873" -childID 3 -isForBrowser -prefsHandle 5016 -prefMapHandle 4968 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0631dbc-1b59-4894-b8a4-17ef78457733} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 4988 2038e963058 tab
3⤵
PID:1428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.6.428899835\802730791" -childID 5 -isForBrowser -prefsHandle 5324 -prefMapHandle 5328 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ec1f753-b520-4bd4-b6ba-c078381965c4} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 5312 2038ec1bf58 tab
3⤵
PID:5024

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.5.264078221\2049788241" -childID 4 -isForBrowser -prefsHandle 5124 -prefMapHandle 5128 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ebab9db-a663-4d37-8332-1e58c6c279f4} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 4888 2038ec1b658 tab
3⤵
PID:604

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.7.1011981955\1294995635" -childID 6 -isForBrowser -prefsHandle 5372 -prefMapHandle 5376 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26ab7b77-83eb-41b4-b19b-e06dd894bb10} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 5364 2038e676558 tab
3⤵
PID:1724

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.9.1778080602\1069900872" -childID 8 -isForBrowser -prefsHandle 5216 -prefMapHandle 5292 -prefsLen 27736 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c1f88ce-2750-4810-a39d-546ab2720204} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 5228 2038fd90f58 tab
3⤵
PID:3096

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.8.1280285711\1582950547" -childID 7 -isForBrowser -prefsHandle 3144 -prefMapHandle 5880 -prefsLen 27736 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad65a35f-8413-45f1-a545-3be732c0fba6} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 5284 2038fd8e258 tab
3⤵
PID:4812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2508.10.597922077\473857818" -childID 9 -isForBrowser -prefsHandle 4116 -prefMapHandle 4736 -prefsLen 27736 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61350d4a-1c8b-4772-a75c-017c744d2b45} 2508 "\\.\pipe\gecko-crash-server-pipe.2508" 1632 2038d56c858 tab
3⤵
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dqzncde8.default-release\cache2\doomed\8617

Filesize
10KB

MD5
721ff708e9f4e32dfd1408b1be05923b

SHA1
117f4553fdb0da2e2053320db29a9e28edf726fb

SHA256
def516f0e8ca6fcfc3b470df9730d70f2ae98ad28411f4b5fdb5ada71c8209f8

SHA512
5cf007347315818b9ccfe84633c16cf1bacf4bde28f31a231783ef3acba4b0cc2b0c5719253e1f4e5e133b4964ffd2bd511c57ac16e1c16cd33c8412ab59ccc1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dqzncde8.default-release\cache2\doomed\8801

Filesize
10KB

MD5
c1601b1ffa7d810f47d4a4571b256497

SHA1
001cc4a7807cdc6cb0ee853ddeaaaa5eb18d90aa

SHA256
ab3533a139e155c076fe14c25db129599a0486aff74e1457326bf0e1a5d5ea13

SHA512
fadf2089124008bab8c73e4055e7679d6458392dbb4ea09209aaf8bd6db5e28bd472d18420dc873a308df9648f1b4cb32f8d6b3793346ac018fdf4e31dc6a1ea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dqzncde8.default-release\cache2\entries\42EA81AC3C1126077844C911C95A783F9DBAD0B6

Filesize
35KB

MD5
2d3325b2bcb4c82cc986d14e972cdb6d

SHA1
5f79a89cf3e33ea51af98e1f61ba43e579710c30

SHA256
1bf89c433d243bf0e9c75d5be1291492d0e8100fe643346873580381ab2b704c

SHA512
e383d5fb38e6b0df9c04db4facbb1e494ff8130166d26f1e58bef15c47a7516f9bb7ebfecd91291a409866e914e3913a79f8c2becff4ae94be7ccc948a4526c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dqzncde8.default-release\cache2\entries\A0E64171A6B69776F5996BD4B659BAA43E523CA7

Filesize
121KB

MD5
c3f9332c0c180cac1351083d8fbda8f5

SHA1
3d5cc3442d2753bde22983a277a9c09231bab696

SHA256
d7af6a7b9425720a9bbe1f743d3db00c62a360a989f04434f28d559ba90cddbd

SHA512
3ffa2ba013210954b2df4e992d1d5651d354163669c95b77c982ec1f14d97d2d7988ccdd7a0bb503aa79c6a775c49cdb4aae6f8ff35906b8b8a30cc25b213f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
22df11f9258957f4c6a09950bf04d482

SHA1
c55ccf142701f4511ac9bc09bd74e63446734182

SHA256
79afeaf8450f68422181dfaefb71660775486a6385fda4a079bde84523279a74

SHA512
1d5c04f7702652b40b953e2b9626d3735b4ae554122b7ea4e01cc309c82eefc2e60385a77c1405c677e8270881202763dd5e89a3bf243f9345bcd9a2805bbb11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\bookmarkbackups\bookmarks-2024-02-09_11_zumuf5BEecglHtr+JgNPRg==.jsonlz4

Filesize
941B

MD5
a15899d0f3d98d49a19b5c537e680c6f

SHA1
824710cff0de63d9c0b6e64c39087cb8fc0db682

SHA256
003efcfc372a27f8a19308a4bcb002fad394da8df2eaa60138c6d7325eaf3bfe

SHA512
555b9dcb71b7b69ec0a89dfb2a67e9a2b7b271c9d8594ed4c4eedf9721464a9cd123e3706a2081b80b656dde6183680a459c1232729e22e8067d3b99478c4165

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
d7f9a00a12e3bc95774736dac41b7fdf

SHA1
d733655f770521a49e5680b2b95bf343acfcd412

SHA256
ed25a3232d661a581140b3fa2f01e40e1888f6195093e3d114cb3cd7be68c598

SHA512
4a5975e51716333238f6fd2c7bcd2881afb24746bc5fa392a6bb4cac418aedc851b136050b22aed1a47f769db85aad10c22cfdbf15d41c99c383d6b3bb8cfe0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\datareporting\glean\pending_pings\121978e3-a7cc-448e-815c-2fc2ea10937e

Filesize
734B

MD5
a54ea29a892e15d9006d0f17bb43bbc9

SHA1
1056993034fc531343f6ffca175dd2cdf33746eb

SHA256
0efc24eac79854720e1687823d0a33b715785f05882e96c0a15fa1a8278b94e7

SHA512
956f523aa7fc5b0c47c114cc5aca179fb10a05fb27399dbc3649a001c10afa3640d9dca5948cf80dda24dae5cc684843484bc5231c1e0ca688a35c098e737f93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\prefs-1.js

Filesize
6KB

MD5
15d44961a2b75bd64c77036685e3b564

SHA1
975de04429ac028aa0d4cdd5215e0ea36e6eeed4

SHA256
234bf86b732d29b75a7760996f2f91736aa47801f8330c8f1523670f59239afd

SHA512
33f88ff9234b75d104067c48dce0f8d1a2fe3f63a15396079b63947d0cee43c125da5e33ecf204239db7c21e5427e7bd6acd125782495e66985c6cb6ddae1e41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\prefs-1.js

Filesize
6KB

MD5
668bb228512321b89ec8e7e6995c0833

SHA1
01ce28bd4e39f72fd480cfe3261d423bcf165554

SHA256
46dae601fa4f031f43e42f687855314f9dc8be650a528d89355a46356e53041c

SHA512
62630667f319b2fa9755da9dafca534faac8239f48bd992abf56353e749531844164a157d2d5ff724396b03cd3ce225b1cb18560ebe2d9d08eb3b0e23cb80145

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\prefs-1.js

Filesize
7KB

MD5
47b7745009af57199c9f7047759b1336

SHA1
060b842d0cdfee3ccc105c2176b0118f0133da0f

SHA256
9e7da94eb4453af711764f6c5f2aec5c6d878d78d6655a3d1b1fc2e1e0943b39

SHA512
b496badc932e5ac4a9e1f6986b6db045f9df2a931aeb5d4d22fe603483966331042591d3d56598c7bae161d98ca5fdb45c3d03f60de0b746ed97ceb4473151a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\prefs-1.js

Filesize
7KB

MD5
635cf0175cfd1c96eff6ebe8f8e41827

SHA1
4f62dcd21a6473f00d56ca77cca2fe8b83c7bbc7

SHA256
508cfc1188dde8b9d9aedfd0c86cbd7128d56e9deceefa2d9fcac30d105a8074

SHA512
40a4e0a51fcde5d4157247d474d3535f7e4b82a49bada83fc6d14066c4dcc130374f981913ebac111c1ec436c5a2f7ee05c5f6a34293238c5c9267da9f5742b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2166c8cf30e3d9d9a7790a675859e7e8

SHA1
fcda997d813ac7c19163fe3f55331ea8e54283d7

SHA256
13fc7ac83de89680bc0e7ab281e4275f2341887a2d5d03b6ac9fdb25fc7c0781

SHA512
3b42a4d959c6a56ca3c2eca1bde4c2809b43d102720842fa84b9def391607921921d0140c16006753187b28561ce01198c41016d54df21632cd77274062a8a62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
21a92181025831c20ddab3d24da99cf7

SHA1
669d34c99814741ea20bc90fdeb30519e91d825d

SHA256
f7165f7c6a0f70f9328238c45d8e7472e5ff00b5446d8604683caf58ed98093d

SHA512
2d8e548c8b4ab012aa09fb908676b9fa26368edf95ba563972a35f9ea82ca040ffd06a0605dcc143bc8841ab6eadd9f045d9c9e528581d5041de4bc1c3cdb006

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
208KB

MD5
40c343f93db1a44a0d0aa096207e1dab

SHA1
35c2723b1b90c5c54065a572281bb2623bd143a8

SHA256
bc5a39d3116bbca2a2bc485fe0de37b8d5ce1525d64ae9ee1821009ad7577995

SHA512
e4f93b88a8e863c7407000cf2a85d4961613f44395f4b71c7c30e2fb730dac08cda84242b1777ddb0d24935261a08439aa392e089dcd2647f85f5605f73a340e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dqzncde8.default-release\targeting.snapshot.json

Filesize
3KB

MD5
c50dbaa3a943a161413865b7c2ec6dc2

SHA1
8438efb9beb6ad786ddc1e03152e65d47d5fc2b9

SHA256
8f4c104dd256c0735c97945021286532bc4bb885006a147700e200e9482e2c08

SHA512
da052b0aea1fd61a4c1d8b311848b9a26e00479d84a76ffa1439fe86f27b39cfbabfb082810cbedd6b2c849fa0b8df707bdc35942285287a0dcb91ff8dcaa2cb

Download Submit