9ef0aea5ee3a93f458010a4f6909426ff25006c714d5ec86d136842971957e9f

Analysis

max time kernel
1795s
max time network
1804s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VineMEMZ
Size

166KB
MD5

9a4a5ae9a38b79b9efebb1ca1ce2731d
SHA1

e4c576d1834d78911b91851662a24e990d3d0132
SHA256

9ef0aea5ee3a93f458010a4f6909426ff25006c714d5ec86d136842971957e9f
SHA512

00564f85a8410fc33aebef587343aa5bdee672d4ed6fc511097a81b59263aeb27a59bd73a57dc511275d536dfcfbcbcb10def16bf2ffbc00a632bfb7fb83a45f
SSDEEP

3072:sifpYYmMByrcY5mHZBOjS+rkaSfgIsq1nZEjc0Xz9TDuqJ3+fH2RVSgE29xxspmZ:ADuqJOfWRVSgE29xxspm0n1vuz3b9XvX

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	firefox.exe
Token: SeDebugPrivilege	4476	firefox.exe
Token: SeDebugPrivilege	4476	firefox.exe
Token: SeDebugPrivilege	4476	firefox.exe
Token: SeDebugPrivilege	4476	firefox.exe
Token: SeDebugPrivilege	4476	firefox.exe
Token: SeDebugPrivilege	4476	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4476	firefox.exe
4476	firefox.exe
4476	firefox.exe
4476	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4476	firefox.exe
4476	firefox.exe
4476	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4476	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4452 wrote to memory of 4476	4452	firefox.exe	107
PID 4476 wrote to memory of 528	4476	firefox.exe	108
PID 4476 wrote to memory of 528	4476	firefox.exe	108
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 4280	4476	firefox.exe	109
PID 4476 wrote to memory of 2376	4476	firefox.exe	110
PID 4476 wrote to memory of 2376	4476	firefox.exe	110
PID 4476 wrote to memory of 2376	4476	firefox.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VineMEMZ
1⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3908 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:8
1⤵
PID:2448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.0.282634446\951432012" -parentBuildID 20221007134813 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1d8f503-afd3-4150-b0a5-adb238106199} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 2012 23b18cdcc58 gpu
    3⤵
    PID:528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.1.1512380933\447701088" -parentBuildID 20221007134813 -prefsHandle 2400 -prefMapHandle 2388 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7020721b-624c-4c82-b560-9b26359ee35e} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 2412 23b18bfa558 socket
    3⤵
    PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.2.474526147\1090758436" -childID 1 -isForBrowser -prefsHandle 3048 -prefMapHandle 2940 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fa62656-79c8-4c7d-bd74-0a05e1d964ae} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 1672 23b1cea4c58 tab
    3⤵
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.3.679162741\1688468382" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cd9a0d4-196c-4415-a88e-a350c1cb081a} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 3612 23b1c21b358 tab
    3⤵
    PID:3752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.4.1766894256\1748239170" -childID 3 -isForBrowser -prefsHandle 3760 -prefMapHandle 3748 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce19725d-ba66-425d-b9e9-4d030590b997} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 3772 23b18bfcf58 tab
    3⤵
    PID:3132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.6.1964751573\87215213" -childID 5 -isForBrowser -prefsHandle 5296 -prefMapHandle 5292 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56cdae40-bfc8-41c5-bb00-fe7cf9dd3fb4} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 5216 23b1f01e058 tab
    3⤵
    PID:468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.7.1956474354\1092930242" -childID 6 -isForBrowser -prefsHandle 5404 -prefMapHandle 5408 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d21caca-ab07-4cef-8644-0ad4cb9521de} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 5480 23b1f01e358 tab
    3⤵
    PID:832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.5.1295503545\329106912" -childID 4 -isForBrowser -prefsHandle 5052 -prefMapHandle 5004 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a91c6b6-bb17-4366-9382-202d6cc49e9d} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 5064 23b18cdd258 tab
    3⤵
    PID:3020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.8.2089037770\1642522359" -childID 7 -isForBrowser -prefsHandle 3876 -prefMapHandle 3812 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3c0ac15-76e9-4a5b-8b6b-642d166a58c8} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 3864 23b1ce09558 tab
    3⤵
    PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3856 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:8
1⤵
PID:184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f97d9gc7.default-release\cache2\doomed\6501

Filesize
9KB

MD5
ce68050102f59cde05a6b5e096f118e9

SHA1
8a105d4ade73505b84a52594541dc6ec2a7d29a2

SHA256
32c217f1f5194a36b794f0997f224603ab06b2074a60d4154c756c481379fbcc

SHA512
fca0d0431593c145b2b33be0ebbe2e70ff00eb18e96c42a989ecea3aefd21b50906687300102a5a3bcebe39e0adf6cefc3c4a00bfaf1fb5fc30e9b86a18fd71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
4.3MB

MD5
563c687dd134b55071bd40c0c6730b48

SHA1
657fd31ab07515f678b1463674778b6bd9d61445

SHA256
8d519320e5d4032b54defcc653f8ce893b53177d1b946d42711b38e86df99ef1

SHA512
0980ecee351059febf6603af7bea40a80e8dd1151d76930d27fff9efafd6da9dae5ad3eb4899de7728ee5a1c859fe4f7683c1e3335a81b89de4339297b91edff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
54ff6f91049cd4260fa6c447335952df

SHA1
8532758313d1b70812f39bca10bc6f025e3d91f5

SHA256
684ce36837a8e8730ac47481b6b3843f8d5036252e858f42511884457a73b0b9

SHA512
489f150dd1f3f6aff9fa0de36bf51c1f713fcb75e575d2e674b3a31bc6dcd959319b3c28ce17270c8d5f7871eb00d181d78028daa559a8e5c76e203d5c96ff29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
27ed9ab541aa4921660060b5e5384faa

SHA1
ff03f21f45175320f19b6e215488f73e5d607516

SHA256
776da41c3e4eacb4164dc7373ef05c0b83cf51b163cdb41cca353b1eeb592be2

SHA512
5e45b7fa3903198df2516885a4910d1c5af42c3fcd1c678f1ee87dbf036b3d6b4abab570b6ee5c4fed37d797088345acc25c93bfa0d7b5cc2ab46827d42e1713

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\bookmarkbackups\bookmarks-2024-02-27_11_47vPADsxW7vnEuNc4tFS3g==.jsonlz4

Filesize
952B

MD5
3fd2bbed04cf90d7d9119ee273e2f9f8

SHA1
08e8a10ab1ca13e0cffaeed7e20dd5ed8d9ec915

SHA256
0436d371f2a5372585dfe705739ca5e27c1b71505c97156927c516729102b972

SHA512
4b394a66dcfa18e65241a2b075b1f26cad902c30d23f4f289be68876ff113a3b77045e0488703ea5be8e2c2bcdd2a7f5cddb145c9b028edc0e9e84a8534489bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
2b42ceddecce0bc1f8e9fa1dc8a3d2ca

SHA1
0b16e28ed9290e0a583fc4986c9905c3e5702a27

SHA256
53b574bd91114e8a94e03e44691b3c3cd9443f2b7422e83364475864feb39443

SHA512
10becf38feac6ba13676d23cea86962c83c80ffbdf38d0a980a3ebcb5262848f4564c6a13357afb5af3812154a0d44d16f130a62109bdf3c338742ad503ab3b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\pending_pings\0fdd16bc-1747-4e09-81bb-78c6e147619d

Filesize
11KB

MD5
4fe2700d1df2f9a7b33301b5bedf173b

SHA1
6ff124805ccccb64001093b38a239c85476a4e94

SHA256
1d809056b2af27dcdb5f05c8c2cbd4b0ef948b69550fa1c7424b50a9d3586596

SHA512
ce5a685b7d01a5efc69fc54560b1ea52bbecb220d1b45d1eb0b8786e7b2590849c103e009f09edcc88dd58e2c36f7cc66322cafa4129b42cd27e133dd087492e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\pending_pings\d6e3eed3-a806-4b63-926f-5f6dc45d667e

Filesize
746B

MD5
58143d5d8554d55ef6abe3437b218a08

SHA1
e9f91e9df1431ddf79ed6e23ed0d727228f3ef9e

SHA256
c5c9ce1db64c00915b7f319d36b804d363d95527ea2578c0b31a1eac3926e570

SHA512
2fbb5775fbe2a00c61ac245e4b83c979db53eef81ec7f0bf4fd509456d73ca3e9b7cb46d9e70574ed859a6989ed2ef8ea7de123ed7f99db63321024b89a0296e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
2.4MB

MD5
08453fdd850f1061d5a034baf5635a9e

SHA1
6d282659865236baad7df331554702fbcc3f0696

SHA256
eed9a1cbf4689d7849f2e0a410036e16ff7d3b7d9abc5a3733d7246218db6513

SHA512
cdaa0598a919b3d3dcb911abbade988affd46d575d0db7ba93b213ae78d097bfcfa7640bea7c2a9721de2ff2f56a52b294fb16decc81f7b25c55fbe8b2a9704d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js

Filesize
6KB

MD5
ca68409e038a8329277bf0a85caa2f83

SHA1
799063186211277bd685814b767797d51b04a183

SHA256
ea59373de50f8dc4d4997969abe2e4ac337002e1cd8861c14b43a656d18e1106

SHA512
4f6783a26e57ec7b336a20327ed9f52468313d7e01648f91d77206c81a454d1ab2139e03f11d4c6dac2ff152659b597f45201a46595d0f9a99d60847d51ac1ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js

Filesize
6KB

MD5
35b21666f86683f4998a93f60ca387c0

SHA1
26cf41ce6817573098f49b0354905d01184d5b71

SHA256
a0c1f9d6052c4dcaec9dd7727fd690d958c76085bd18f804b42393a2eb185927

SHA512
98c91735b3f7b3404a0b846ca71d5de6185805ff5f4b7ae5eb7cedd91bf12217a2d3e8174fa1a7a3bba8704250f695059eb0f5a2917a03693127365b1fc63c8a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js

Filesize
6KB

MD5
24a31dcefce51fc5e68ae8182a4a8fcc

SHA1
5010687ba310eb8ce43ef81d3df7fe567c8fd501

SHA256
1549b5e285d96e6f52b95a1d234cd946c44ea2891a00237396a198c043e692ae

SHA512
83f6563052a275cd71170daf37159feeb1e55b5c5a89fc30335be9144246a378fc44d2604a479a8927c460f2f37f379b377222555ced25589713b32bd8e2f64e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js

Filesize
7KB

MD5
b633ba35e24b682f0afdfa9cf7489b60

SHA1
73407d4f2b6fa2b5ecc1fa37ce2f12b31ca6892d

SHA256
abfb0d5cbd039bfe2e3416e2c8cd30d6ce5ff38168184371efffc9ab1e58d401

SHA512
cfecfb95a458a1fe2680671964c504c273e65106a988964050c63d014d9c65e0af73a637c2135b257e0be6dbefa0be5d641d1decc36c15d5b79263eb915f30c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
3d0b0c6672c56113d759b4b01d611aaa

SHA1
aa419c00149ab4fa66b643258d1092084bc66169

SHA256
1fa76f1afb0f947a866bd5b3176911aa3dc1de5365d5ad79a0e8a0c29af40ded

SHA512
bcc0e3e45449ce630df0ca759f6ea2dd3a52633f43ba3e3ee9170fd663372ade362a6b9180404c8056cb31f419649e932ed362ed2400f5e703c1852b9f42a811

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
8c360ef0a49eb457d527ea4cb204b117

SHA1
d46a00d1dd6b611f0c6032e39973ec9693c6ed98

SHA256
bf1759d59507415ccc09a3cbe71dc34135aff27c43402cbf51e18d188bd0941e

SHA512
05a417b6000f813b88718516852127d477b304c8bf20ce0696afcf0d5b8546a58962d3a3a626661e9717e9cf007a685e5fa4b27a9dc07223457ec501210ffb1e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
4afe2a58edfd038e03d6c3258dc3b38a

SHA1
3267542326cf69a0457ecec4b099856193b282e2

SHA256
64b5161706794caeeabfc773d37e2f0a71b52c6f3898caee816b924dbd789fac

SHA512
fb7e40ca7045c093b906fc3a953ed6e9369f362173c9b5006554f18d1b9db57f5fd5eb6b80c7a4ea08f5742d01ba91427451e6863dbfcf19b42a31f6950b134d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
80e21d56bc6ce530f63a3c333d84b840

SHA1
b4a43303ea1b5f2092883cbc7669cac52421fab8

SHA256
05622ca1069c753f409c54bee26c1ffa4e595281d6e5da83a8548138d4b7a5eb

SHA512
f5de8bf3974bb773feae392ff8a47423b90a22b4a05adad010b705f5cb0d41e7c5fce2b5afc568f44d6594b348cbd5fe08a23f04e8cbb07bddb56be0dfa637f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
02c801ecc0c29c79bf733364a7770b87

SHA1
42d209d4e7450160d8d3c19c2d25fe950300a9b5

SHA256
b7481dddf6aec3ed8578bb71d51c4cc2685507b126833a73a6302f55314f0915

SHA512
35c4e33d5271263da0b313c48d0474613bb83836686b8cdda012236ab2386b5321c67813af07555b31448b21bfa4960846163b91dff1840580db2f175c1c25fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\targeting.snapshot.json

Filesize
3KB

MD5
d75f8cf55e931a3500e89f61fdb0c7e5

SHA1
1f463894c99bd59691da91bd1a239e778af3a01e

SHA256
b89d565d51a30ccaeca3bc55c5f1a677a5e4cd025dd4e17faa7d8af74ca7d6cd

SHA512
e4bc7a50ac7aefe97ed22e65b933d9e42677cfd12aca71b508a0901e55ccbab2b40299d6c182e0d67bc5099cc33cfc2d547d87f526bb18a480a81b2d13fed423

Download Submit