f16a87e183bfe34afc75098a027d9397bf97a8fd2d289abe723d628072602b3c

Analysis

max time kernel
146s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
19/02/2024, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.pyc
Size

3KB
MD5

62e23b0f1c741bf8fb513b41dde8d899
SHA1

c31dc4b94da0cb85470eaaf14e3ccf4b4626a975
SHA256

65f01b4494b698ad3eb3aac70747df7027451b3d64c39f19a7d982147dcbf4ca
SHA512

81470248f0bc91267a9f2169d8adf420b5d1e10f7c2acea4788fed642d661b873c91f12da31ff47d7621173a4b5bc11285c51a5fcbbf9edc2caee0ec6c70af6f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1473553098-1580226532-3330220195-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4396	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	firefox.exe
Token: SeDebugPrivilege	3128	firefox.exe
Token: SeDebugPrivilege	3128	firefox.exe
Token: SeDebugPrivilege	3128	firefox.exe
Token: SeDebugPrivilege	3128	firefox.exe
Token: SeDebugPrivilege	3128	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
4396	OpenWith.exe
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe
3128	firefox.exe
2992	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4184	4396	OpenWith.exe	82
PID 4396 wrote to memory of 4184	4396	OpenWith.exe	82
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 4184 wrote to memory of 3128	4184	firefox.exe	85
PID 3128 wrote to memory of 2356	3128	firefox.exe	86
PID 3128 wrote to memory of 2356	3128	firefox.exe	86
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 3496	3128	firefox.exe	87
PID 3128 wrote to memory of 904	3128	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\file.pyc
1⤵
- Modifies registry class
PID:4664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\file.pyc"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\file.pyc
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.0.896033877\1803132040" -parentBuildID 20221007134813 -prefsHandle 1804 -prefMapHandle 1796 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a239a1bd-1ed7-4ea4-98b7-5e3ca909ec19} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 1884 16a777d0d58 gpu
      4⤵
      PID:2356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.1.1429691759\371582708" -parentBuildID 20221007134813 -prefsHandle 2268 -prefMapHandle 2256 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bb3de2d-2d76-4cba-8e04-8ae323cf0376} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 2280 16a772e3258 socket
      4⤵
      PID:3496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.2.815986129\1584782031" -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 2976 -prefsLen 21601 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba1776c4-3020-4fa0-b45b-af09f81b8cd7} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 2992 16a77763358 tab
      4⤵
      PID:904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.3.1564177036\1294552674" -childID 2 -isForBrowser -prefsHandle 3364 -prefMapHandle 3360 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2824eafe-5936-4a96-9e25-1623c2f971ad} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 3452 16a6b362558 tab
      4⤵
      PID:2508
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.4.1320885125\1727800575" -childID 3 -isForBrowser -prefsHandle 5052 -prefMapHandle 5068 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ece6dbbe-55df-4036-a896-fe14e6e1bc50} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5076 16a7e676158 tab
      4⤵
      PID:1452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.6.2145361786\177764319" -childID 5 -isForBrowser -prefsHandle 5416 -prefMapHandle 5420 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2a11722-71d5-44f4-abd4-085b08a1a805} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5408 16a7fa5e258 tab
      4⤵
      PID:2360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3128.5.496981944\2100148314" -childID 4 -isForBrowser -prefsHandle 5216 -prefMapHandle 5220 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1160 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3341e4b-4f08-4d26-94b8-41c4bf0432ea} 3128 "\\.\pipe\gecko-crash-server-pipe.3128" 5300 16a7f5d5958 tab
      4⤵
      PID:4672

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD

Filesize
13KB

MD5
e68a546d3802f8522945d6dd2c5c25ac

SHA1
70c2d7babb09c6730e9b2ccf4c04a7c6d855a80a

SHA256
b6ef668a1a7caaabf31671156740e0195dce1f1ce11cb8d0c049da0b20ea3423

SHA512
65993c5d6c75ca2d6474befaa29f57b5b24b32509f55033899726c86d89cce8587a36f3a6bd35c8781146a85e74e971100445d054526f576ec88ec51fb74cdeb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308

Filesize
9KB

MD5
a38996dd953832c86bb297b8dedae7ce

SHA1
4a9c05a9f9cf3b70063f5f775b6432861b228e77

SHA256
7a8c6c3fdfe1717aa3df1db5a7b82adf8bded9d0cbb1e31b75e933554884ff6d

SHA512
7f28c6b62aeef43a4b8ea4ada27a9a7bfe5b4b95da03d99993ee9023919b4e3a15c90f04b42534f66c634e724f1c79f9f5dcc738f8615fe6a75c12d707fca060

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b6e8c47910afc7e06c705403199a3390

SHA1
998de9372bba336dffc44a83f134758ece7c7dc3

SHA256
ff897bdfc1a66abaed23fabea0a6a4d0cc4154ad619e17d55f4074312ead27d3

SHA512
8edc0d8b8bf31571261bc4879470ce46b20ffdf1f10283976f6e5c710bba911fbc083086b8f146a30ed1ed633f6f435a95aade924d8a1e04e23919be3baa36c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\datareporting\glean\pending_pings\6daa0bfd-51c0-4846-a172-bfca52bf5e1b

Filesize
746B

MD5
84e3f7d4e42b380c66a26b2cd2d0cdc3

SHA1
719a2790cae0908213b4d7fdf3027baae7e6a41d

SHA256
abdeb745bd02c6dac5eab8d195a89f9558c82f53d09afa7033b08e6fce19f755

SHA512
adf8d44040ba5e12be7ad4f4e6d4c97fe793ce5e06547382328d4923de7a61b97e800c39291b318e7eb8674e607363dd9eecf6f7b2f87ec7aff2ca3754413ccb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\datareporting\glean\pending_pings\d03c6adf-7f76-4795-abd3-a15b08230538

Filesize
11KB

MD5
e9a20cd2a2498e2f5965a28e7e9cac3b

SHA1
df685a50deed9e17bee1747edbbb32f8922e2386

SHA256
372e399f1f0b191448209008878cbda215f82897a32a47b856ff613cbb8797fc

SHA512
7fbd1764c6985308f90072fdb544812e1ad0367c14f089db5f63eeae9a91a1db0390f8e9553f29ab00438df85798b5028bfcee6ed0807c2308753f619aec8f48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\prefs-1.js

Filesize
7KB

MD5
980fd998af330630f6da303947681d23

SHA1
a2d5f9047703eb6f36b62c1c5120b0e29c3fca87

SHA256
82144d72eabc6272bd7333ee792b79367d75daa627704a8cd63a5b4c39db0b57

SHA512
12a05e338225773b6f23ec580e60fbc40d5066e6b9ff9613d10ddf31469f2691d5ef1c3a7396f146ce03cff7639250f11f19ab67e83fa916a24e1cef9ada5878

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\prefs-1.js

Filesize
6KB

MD5
6891cb0c7be89e33551a7ae409779256

SHA1
d1659f3a884346a09f934b669a9f556556a3766d

SHA256
3d67cef8a1113bcf110a87bb1211d5d7a056ae553ea32d9fa2f3696a7f47afcf

SHA512
23934354031cd32c7582c57b472222cfabc7be76d02ea4867684671eee3cdd3d3675cd6f6589a4b7dc3a397834bba313375f9c1cf803b79036f4205fb71b02c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7wcv4hr4.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
994B

MD5
21fb1208f5927a5711a81176b4dd21eb

SHA1
3ab8b4a0915d0d0d18dae151b489c114bc5c020a

SHA256
ebba99307f69996d800334ea12a1be8eed91537ecdb89f82526209b0ceba4b99

SHA512
7b1c312777985c265676dc0f2b4dfa4129bfe2493c872409d61c37757d84baef6818b6edac1680c995d21079ac935c26ee133f3e49fb0fc72b72ea69a6d4e16d

Download Submit
C:\Users\Admin\Downloads\F9LYFwZl.pyc.part

Filesize
3KB

MD5
62e23b0f1c741bf8fb513b41dde8d899

SHA1
c31dc4b94da0cb85470eaaf14e3ccf4b4626a975

SHA256
65f01b4494b698ad3eb3aac70747df7027451b3d64c39f19a7d982147dcbf4ca

SHA512
81470248f0bc91267a9f2169d8adf420b5d1e10f7c2acea4788fed642d661b873c91f12da31ff47d7621173a4b5bc11285c51a5fcbbf9edc2caee0ec6c70af6f

Download Submit