6e2f11bf17b03ae0b2351f8ecbc67649dd9d4b8094087aee3d0dae53788ff4f9

Analysis

max time kernel
299s
max time network
308s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
25/03/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

andrew-vasilkovskiy-ak-47-old-top-02.jpg
Size

39KB
MD5

aaaa09f88ad39cffa0aa800c4234ff36
SHA1

74aedb6f54b9e2511dd0f5245b8b977b25da72e4
SHA256

6e2f11bf17b03ae0b2351f8ecbc67649dd9d4b8094087aee3d0dae53788ff4f9
SHA512

30ca2017a89abc79923c2a84cd3980781c8fec685eabed5baff47d75d573f8fbca375cf654e9d43858a18fd33259b5f5344904d337dc4ff71ac8f20e7e4d6233
SSDEEP

768:hLx7VmVcKMm/lQqHuqAGS7S47SRdhm00wncnyYgM/:h15mSFmdlS7iDn5cngM/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	firefox.exe
Token: SeDebugPrivilege	2432	firefox.exe
Token: SeDebugPrivilege	2432	firefox.exe
Token: SeDebugPrivilege	2432	firefox.exe
Token: SeDebugPrivilege	2432	firefox.exe
Token: SeDebugPrivilege	2432	firefox.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe
2432	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 4168 wrote to memory of 2432	4168	firefox.exe	84
PID 2432 wrote to memory of 3908	2432	firefox.exe	85
PID 2432 wrote to memory of 3908	2432	firefox.exe	85
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 3064	2432	firefox.exe	86
PID 2432 wrote to memory of 1348	2432	firefox.exe	87
PID 2432 wrote to memory of 1348	2432	firefox.exe	87
PID 2432 wrote to memory of 1348	2432	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\andrew-vasilkovskiy-ak-47-old-top-02.jpg
1⤵
PID:2808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.0.600634782\383441535" -parentBuildID 20221007134813 -prefsHandle 1824 -prefMapHandle 1532 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13cf6a6e-01b5-46d7-89e0-a12ead4b7409} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 1916 1f9dc7d6d58 gpu
    3⤵
    PID:3908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.1.1745871989\1376648022" -parentBuildID 20221007134813 -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44fbd473-36c2-4003-9c10-e33f8ce6b256} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 2292 1f9d03e5858 socket
    3⤵
    PID:3064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.2.883469996\519304112" -childID 1 -isForBrowser -prefsHandle 3220 -prefMapHandle 3216 -prefsLen 20821 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d39c1d0f-307a-48a1-a429-88a400ee725a} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 3232 1f9e15b7c58 tab
    3⤵
    PID:1348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.3.1695549321\1286284240" -childID 2 -isForBrowser -prefsHandle 2868 -prefMapHandle 2912 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db35e0a3-12d5-43b7-980d-998fa1d330d1} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 3460 1f9d0369f58 tab
    3⤵
    PID:2824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.4.1607492205\805226364" -childID 3 -isForBrowser -prefsHandle 4408 -prefMapHandle 4520 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d92803b2-94c6-4842-a53a-5258b39a8b35} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 4456 1f9e30afd58 tab
    3⤵
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.5.1194042031\1796925677" -childID 4 -isForBrowser -prefsHandle 5116 -prefMapHandle 5112 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {020ccb2a-23bf-474a-bd87-b395d9c99584} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 5084 1f9e1561b58 tab
    3⤵
    PID:792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.6.1011608626\182284212" -childID 5 -isForBrowser -prefsHandle 5252 -prefMapHandle 5256 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5348c53-a0bb-44c9-ba57-e69576e38929} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 5244 1f9e155e258 tab
    3⤵
    PID:2664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.7.1646287963\590819437" -childID 6 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc669ce7-10d6-4fbb-9e8f-fc068dfebb65} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 5436 1f9e155fa58 tab
    3⤵
    PID:2436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.8.1147101831\887651253" -childID 7 -isForBrowser -prefsHandle 2784 -prefMapHandle 1324 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {237f60e8-b333-45b4-8b01-9dab7b4d3183} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 5860 1f9e38ea558 tab
    3⤵
    PID:2412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.9.1844811862\1463434562" -childID 8 -isForBrowser -prefsHandle 6228 -prefMapHandle 6224 -prefsLen 27736 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {850b1b78-3b11-4422-9059-e051a4747f01} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 6236 1f9e53d8558 tab
    3⤵
    PID:560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.10.524801397\791266329" -parentBuildID 20221007134813 -prefsHandle 6380 -prefMapHandle 6376 -prefsLen 27736 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78fbd72b-c1dc-402a-8ecc-bcdbc9a7182c} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 6388 1f9e53da058 rdd
    3⤵
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2432.11.33267599\1787772873" -childID 9 -isForBrowser -prefsHandle 6468 -prefMapHandle 5272 -prefsLen 27736 -prefMapSize 233444 -jsInitHandle 1012 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23e2c420-320d-42e5-92ec-bb7ce723ba91} 2432 "\\.\pipe\gecko-crash-server-pipe.2432" 2828 1f9e3c90b58 tab
    3⤵
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\cache2\doomed\26909

Filesize
54KB

MD5
31417f63a8b8e57bcb6f9bbbcf339867

SHA1
f8407a21c73103b0412969f209f898eef0bbba16

SHA256
e01d50a3b6b73a8f1a32d7fdaffa89ddac3a8dac62e149e444a315589422c3be

SHA512
433934220592143a0bc5e874534d910f4e811b5a534879e69e6e41d6d01852bd1d2f8e718e67eae689e785b208d0c8b4d1cf0b44fa2462be285836bc3f53d2cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\cache2\doomed\933

Filesize
10KB

MD5
8027fc82d3eb842ac4cb846620ea726e

SHA1
d1674edbf5caa0f0555eec4cb365a7fdbc31aaf5

SHA256
ecedfddea2690bdccbc38db7ca44ea3d0ed71cbaf512d0edcda5f6de320da812

SHA512
118102925eb69e27b1c26dd20696e1ad2c93013a014556cba9dc2d1b8329d0631eeac9ec54b368d267cf59b3bc75c57ed281a956388fb310f4c2901ce6847f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
c8c52fa0815fc6dc57ab37aaf16cfa14

SHA1
27a44a9baac0711ba4a2a9932764063829c170c5

SHA256
a2e620c51632b59a26505fd53cd0d3b0519d53b40c1e34ffc93cbf434f915fe2

SHA512
eb592dfaa09c5662b7aedb45fed6039b2e4790c1a682e5b7f381bf8edcf3e1b7d502fb4483660b85c7814e0c97b7a4b11591a23b96b2023996f4bd5dcc21be96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
47c20c236b8dad63c69d424310efa90f

SHA1
5619a7d679825f76840ae23a6eb1f5b65f907cbc

SHA256
a9ac81803d955e174bf42e59a05f1c5ef569f57c584a16d3cde6c7da00e0508e

SHA512
018f757c893ff6ca2a89b8f38bcc0ced1db8a9b332a213cf74ef9514f61efed780585b179431e6fe51157534127ade659f26326ac0895d216dacdaa015ffdedc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\datareporting\glean\pending_pings\52aa75d0-ae01-4145-ae78-65001e48a424

Filesize
11KB

MD5
4240e56b1cf4a040acb05319477fc4ad

SHA1
5b67ad8258289feba012d266fe99cd8fb8c4d18f

SHA256
77764a127e1dff67cd9e59b04ded36801cd440d3a8292a5acd4f499d624f4cd3

SHA512
224ac054b6197976d390b3f350b1c15897af771f830b1ad35dfc24d9fd145147ddb9236f10a68da3057db91abab6188b56b7c13f075cbc3dc7680395e9afdba6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\datareporting\glean\pending_pings\9f09be8b-df1d-4296-b1b6-24bc0523d02c

Filesize
746B

MD5
c202c3335fd38d8cc51d7d3c5ba3f74e

SHA1
c79471316838db455499a0f4d664029e8731b33c

SHA256
f013c420bd595259af6e489a58c4029e3a3c4b7f8741a014b30b2aceda0d4ce6

SHA512
3a6d731ad2c937cadc0f9280439f26fe9b292994bdbb63d9d5dce555b5d8a066c5f2e5d3a74eadb11329b3d3508450d870e3c0ee6c4a235a90a5082346953b8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\prefs-1.js

Filesize
7KB

MD5
8b69c5386cb17c9f43aae9b9c39dfd0f

SHA1
2e429b9a5fc53e581d39f99fb9c00a55f5d5d924

SHA256
2b54453cfcaa9249641acef922fa3b83221f5bec61ac72fb315175b27995252e

SHA512
3195158c4546f1b85c9a3b99accb8aeb84756286419d1376e4f8dc44d5ab6b65ed9fab0486b8d98f3e3a5f363346a80bddfd853f31e6a3df0074cd1ec78a474e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\prefs-1.js

Filesize
7KB

MD5
7e9fa98725b486b6a6b3f1d1ccf509e2

SHA1
9892c6fca295e66d7c5e9f51629ee1c85a63b191

SHA256
e5366e26d666573321a6d3833ef0939ec8781f6e7bdf58c7ed3e0c0176bfeecc

SHA512
5f7a2c303cad13709a739501830023f80c287360c8a91d6cb26d22dabadc08897bb79aaf30486417d1b8b47e9990a62b8b4f85fe60b9e461519154d6974fc906

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\prefs-1.js

Filesize
6KB

MD5
ba155de58627b2e3515b6742151a1697

SHA1
2437a04a334c7a46330df3eb59066feff139d7ef

SHA256
ea9f77b289945c4fdc87e360cc5fc1bed69c53e3b6548b5b44dec7c015f630d9

SHA512
670ea8f513e3b2eeb3f2bf0a042bdd1a403d33b14e3b70258842db871bbc219501afac115552cdb320398022d78a40438a1f1b11e9c8931959c351baa87a1de9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\prefs-1.js

Filesize
6KB

MD5
b6a5f84d50dc364ac6ace54804994d99

SHA1
1581f929a493dbfaa2511d522970f6274dce1191

SHA256
98876f480b603c28cfd2fc60ddd44a94206ad41bfecedb0113393bef0a26728b

SHA512
a600687ce3c880f33360d899fd4072f8ee97a7d26a5a64cc6f23ffe1ff3b0dd8a48138f0dc04ab491cba9560bfa38cd9a0aa45ac111294a4b1e80042dbcd72f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
8e373f6054e996f26ef9cb032c4e2581

SHA1
8238acd6145bff7c558a4a82cdb8b451a1ce9a81

SHA256
f92d2f0e7aa2b4062a49958eb2edf42963f2cbc03af8069b5ebf29e7a319318d

SHA512
fa6a44e970e0cfa481a1a173197e4b91fa019a3d5fd08e3648ab16526d09e4a8cf3edd8f52f046bb7b932c3b0753048a24759a8fb7d44ce7396ae30668176c9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
9df8375cfa8995bb06cc5f04a0404184

SHA1
9c228e434a238f5d01fa60cbb4be847da731c223

SHA256
01e3df59e78655d9449212c58f954f4b59f5a4321bb77d7f8c9a3cb5c02921db

SHA512
c9aead338d5d05a37b601153079d7ec3f3abddbb978757baabf5acfb8ae37465a5ebf630eaca103494b042761871fe617f3aaf23ea9acaeb6cf66aa73c5bb40e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
10d821471043a10a4eec85f4a62feb5a

SHA1
04f44e69abe005010aed0337bf36098a27fe9540

SHA256
d9565a7d91ebcc96e74ebd70933c919c8ca46f0f89b264aeb4e89d5689243274

SHA512
a9d57499c90cbc38341ece21dedbdb1c5d80ebcdd0b7e4b58436f3bebc70a9d312d424ed15b618bf173d6780e7290a620a11877448b13a55543200b2f597e9df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
46f2acb9dba0a73af1a77891896a54e3

SHA1
9feff48d0e3d87096e4dc903d235b61d32ec5c92

SHA256
e36253f379af3b72ed7735dd7494ddc376e3cfa15a1c33c58caa6529324ea80d

SHA512
7252cff1316b3e541f525fa7db630885191fbd3c5449c35f7279d7bc7e67de7bb6d606cc865754a493ff0b1022dfe26d6474c9580e9b4b37cd2ec4886853239e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
cdb36dabb2a65dad6c1235464c704f3b

SHA1
2b694d2f99c64a5713c588010ac1acc8fa0993f3

SHA256
4996aedfdf75e4570d5e5ea178d3c593933a3dfb3d8118d84aab0b10df89eced

SHA512
e43e255814be8d692f20960b51cfa5381e3e32e122107ae53f0b7d74884a8539b3ddcf448aee90d8881c6775c4e3b02e93c689471bc6ef7fa9a112f118df1250

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
020440ebe08ed870b3236e5396270e5c

SHA1
7f7e38d33107e20be2ae222b5a64380d68876e3b

SHA256
6102b05e7f8d68a1d9fb30af19315f9fc484c12f0d61f8151d97707d58d73a05

SHA512
2570af754b78c06de64941f803cdb0d48c997882e7644963090598dfdd9f7ce3f8d46d659618422187fd0f79f6a2a9496305fd2965ed45a53820e5ab7c49d5a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
ed434ae977d41df9af1363ff0e3f8bc8

SHA1
5b87727e15d176677cbb5183f712c746ae290182

SHA256
c6f1bc3268f6317be8c9ebf447d318b412e1bce7d1aa9917d118b4b705fa3d06

SHA512
9ae7a32b2e6ad159c1671943db4d37337e53fd9f92176c638fa84d6dbea8a88e6c230fd2487b541e8a53916343141959a86d536a7ff17294d3e5002d484091bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
58d3fbbf2cf84812185556d4f3673d71

SHA1
8f81e0d9e90edd4e6edb960042ca9e31b146450b

SHA256
9c6976196898469ab6b62acde272fdf3150c15de893f5cc4b81fff6fc9df0591

SHA512
5fa18d1c6cf077b0a69b387c8e9bb5230854c341655b6a5a089d0cb323a8c6dd8a8a2c30e89cb9346b8ae123d9fde4a12cb12a8057e06707f4018e7e06f16655

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ea87ac4151cbfe3efeef30fb9d4b8eb1

SHA1
d6fdfb64d40bdfd9047f1eb233b9ce385a4d0d6c

SHA256
e50670061f5f62121c96e70e57ac840c3c12a73d43bf7a88e80e92b95cbfcf59

SHA512
e63a590e8268474ce2e9fb59692ebf34811a5c1599c0a0ad4a0713bcc44c5a084c7cc1793167e32a0f676306dc3d4f0434eda1e071d0a869dbcefbc0bbc549e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
410fbc95c543febebebba2f4b24dcc88

SHA1
f47a5e41f188d68af0357a877c9b50316f2cf3f1

SHA256
12ac617b4d5bd16bd93660c05b4dcdfbc48f2639dd15b9aaf6381429d5ea8342

SHA512
ca3e3f1239e6457a090d77f4f3d0095aca3c16168920c98cb999be2130eb8482e8e8fa6fb8d9cea4ec6c4f6c4a3d1728085c57778b17eec26506c52b6b50d7fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
e036c8064b421aad8f67ec80e0d18d8a

SHA1
b20b0b315b88b074b21e780186fa71a960675c42

SHA256
3a378cd9c43710d6904102d189b1437c3c74dba44e7066d213ef9967e899916e

SHA512
29977e55539c81e864f67400ce47a510bc5daa509d599f217acb298e08ad5faf27ab82e390f14060c95287693200074f3329613663871d46f0b172480fb6345f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zqw1vh9p.default-release\targeting.snapshot.json

Filesize
3KB

MD5
a2110cc4bedaec6a96377119e3f1fe87

SHA1
dd29c1cdd64c6b153edb935264c4d5d6c3ad4a1a

SHA256
445a4d37badd572d3837534f8bba99a0bf682dbd55c03ffde240d5779210a07f

SHA512
33c0f00d615818781218a734364af5fad380f8d4b6d6daeabd6d964275567eb7d9ad6662e6e0435dbdfa08b6cce499b92f51f2edd0ade98b8c060f8316b16cbd

Download Submit