9e0da3d3bc35541329439c6e0ec64a27af93fd0d6236ceff9f0949a465fff8c9

Analysis

max time kernel
164s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

testestestestetw/triage - Copy (11).exe
Size

1.2MB
MD5

08b8eb8dd9681bfd0050fa7e547e1fd9
SHA1

f810b716884668bbc554aae7914dd19f1c30c265
SHA256

e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b
SHA512

d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f
SSDEEP

24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5016	triage - Copy (11).exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	firefox.exe
Token: SeDebugPrivilege	4088	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5016	triage - Copy (11).exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5016	triage - Copy (11).exe
4088	firefox.exe
4088	firefox.exe
4088	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 400 wrote to memory of 4088	400	firefox.exe	89
PID 4088 wrote to memory of 2688	4088	firefox.exe	90
PID 4088 wrote to memory of 2688	4088	firefox.exe	90
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 396	4088	firefox.exe	91
PID 4088 wrote to memory of 2252	4088	firefox.exe	92
PID 4088 wrote to memory of 2252	4088	firefox.exe	92
PID 4088 wrote to memory of 2252	4088	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (11).exe
"C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (11).exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5016

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.0.1916607538\1046708729" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d941f7fa-0fac-4b19-9744-ff19975b7573} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 1976 251ca903858 gpu
    3⤵
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.1.1038327043\302819783" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2344 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b559ba44-8f5e-488a-8ef6-5278ca20e89f} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 2376 251c9330b58 socket
    3⤵
    PID:396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.2.1148528663\1950810464" -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 3436 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9ae0b24-a315-4f85-afee-336acd367b30} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 3364 251cd9ddc58 tab
    3⤵
    PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.3.64214096\503885011" -childID 2 -isForBrowser -prefsHandle 3692 -prefMapHandle 3688 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b0ebdbf-6fbc-4991-a7d3-60d28e3cd2db} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 1672 251bcf71658 tab
    3⤵
    PID:536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.4.394411119\989556136" -childID 3 -isForBrowser -prefsHandle 3124 -prefMapHandle 3120 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c65c845-7a50-4d9c-933a-10a0a6c54b4f} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 3832 251cc0f9b58 tab
    3⤵
    PID:3188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.5.505473892\1015006397" -childID 4 -isForBrowser -prefsHandle 4824 -prefMapHandle 4820 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fc6befb-476c-4f76-b4cf-223e62b16e43} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 4796 251bcf2d258 tab
    3⤵
    PID:3284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.6.165522280\2095267446" -childID 5 -isForBrowser -prefsHandle 4520 -prefMapHandle 3900 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6f1bd43-fa7c-4f23-9ab3-d8e2fe7747a7} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 4836 251cebfb758 tab
    3⤵
    PID:3124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.7.311440020\2120971017" -childID 6 -isForBrowser -prefsHandle 5204 -prefMapHandle 5200 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ab3bad4-7aa7-4f81-9228-d517b773299d} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 5220 251cebfa258 tab
    3⤵
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.8.1913094614\1968113116" -childID 7 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e3ec9b9-f59f-4e3b-ad7a-9f1d07cc0ce4} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 5708 251d1226558 tab
    3⤵
    PID:4356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.9.1096061223\1989948943" -childID 8 -isForBrowser -prefsHandle 5952 -prefMapHandle 5944 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bde9de78-e53e-46e5-ae2e-e07afaa90637} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 5972 251c9cb4958 tab
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.10.1781881648\193734528" -childID 9 -isForBrowser -prefsHandle 4868 -prefMapHandle 6180 -prefsLen 27463 -prefMapSize 233444 -jsInitHandle 1408 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99d1b0ea-1895-4e38-baf9-f1c1050ed527} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 4880 251bcf2d258 tab
    3⤵
    PID:5444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.11.146051723\1148667289" -parentBuildID 20221007134813 -prefsHandle 5052 -prefMapHandle 5064 -prefsLen 27463 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c10a6420-2978-4993-bb4a-7ecc7752b8f7} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 5872 251d144c558 rdd
    3⤵
    PID:5584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4088.12.1568260113\1370720149" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5868 -prefMapHandle 6176 -prefsLen 27463 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba960534-4df9-4382-a3b6-684d09baaf7d} 4088 "\\.\pipe\gecko-crash-server-pipe.4088" 5080 251d144a158 utility
    3⤵
    PID:5612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\cache2\doomed\14775

Filesize
9KB

MD5
2e4deab87928fa8dd902d9ade2f240aa

SHA1
9959686eeaa02b96aececf73b83c8e01364e58d5

SHA256
74809deb46747fa7d8729a6057a8c047740558ae7975296b19ed1525de158cb1

SHA512
8d177d03ff2c9e5437fc6bf0f0bc6eb5d5270f432318edcf17ca069427e3a30d931a86c48d332eb34b25240ebefee685fa5de6a6685b0e728e2f4bb56a64bd4c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\cache2\doomed\22727

Filesize
9KB

MD5
67f7dd20a7ba3c1d6f478cec9127dd8a

SHA1
aca65cd5806749e5cfdcbfb4d15802c40bfe70a7

SHA256
2b25abb1f8feca30dbdc7df67fa1b1a1ee08108f0985cd4ba5f2d04cf6125ffa

SHA512
200c0c52aa66b528bcfbe06c4d41f4be2a589d08278467d71d40e54e5b3f5f6993499fe67d9a28c3c827ebd162ddff9b349079a5107fd3491f28fab611b065ae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690

Filesize
49KB

MD5
075b9d0612c7c0bd58ae488c6f9744e0

SHA1
5862ba5cf874e0e4a1e577a2b5cbf3181998549b

SHA256
bce75476a2b5017cdbc5d450aeb526be81b4ec87e98bcfe9a7781f8f6d8171a8

SHA512
0cea05aed2f352c8270aa3e7743e3a432c9a5a8ad2abb2fc3e9aa49583e4f5aa8e03436cfbdcd850d55024ae65245959fb769e79bb80260b929eb1d253a01ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
6a0430066fa20e25955b2e0f8a6420e4

SHA1
74822db957e89fb10e94aa6e855112e2b52150f4

SHA256
00ea14abba3f24e93f794b4f71ca52ec806cd3907f7d8c4aa1eae14be179f897

SHA512
c983ab645d9af278abb3ec70a859bd790b3ff1736fff257e108aca48aa3b296b191067466d8df7a62a6166df0c9ede79f1008804d64fed96dcd0dcfe15f6d640

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\pending_pings\51820378-b78c-451d-8ca9-d1fbe88b9782

Filesize
12KB

MD5
b75dc7d7e19e88433a8bc5129130f80a

SHA1
3b0badca1f8e5a88b5d88de66d9e3d05719f6c4c

SHA256
e8dbee2effc8816d36f5b37d2975b9fdb08ae203dfc9aa24ea7b438cf01f305a

SHA512
ed98bdbbff13a88e9eb3c36ed2538e60ede2671653711b9967ce78e17a61c581b5534fcc214832c9c86e3702d5da798f9475e07630550e7d2bca4c1f8a62717f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\datareporting\glean\pending_pings\fbdf21a9-c861-45db-a2a3-089beb2df167

Filesize
746B

MD5
2b0cdad50a767e94134103df8cdc8e51

SHA1
6845a1407ae2fb3431af3ed5aed7a77fdab2470e

SHA256
8d83293a689f30af4f2ae5cc84f4532f5b81964a067cdeff2846432cfe4297b6

SHA512
90a0ddf198dfe15fe5cc41faff8ef289fc01da3429328aef3eded59ac65c7500065cc0549e3f272b8b961526ad56cce135c1ab92adad9749643430229c352d4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\prefs-1.js

Filesize
6KB

MD5
c651186b1646f12c993cd799a688c841

SHA1
2beae4018dcb1d04c0e71bebb8b50f78f65553d6

SHA256
1d56e8da667fb7e0cb3144d712fc997cf4941f22ea85159422639e8202618fbb

SHA512
2c42f926abba804600adc4f56f6b0aa0b4ecfeaa954d9ec3b29de192b40908ba83bdba0da128c8d42fb0d45f7e6f41ad0561d194d35441a873a3c224973b2263

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\prefs-1.js

Filesize
6KB

MD5
7246934edc2ee887823bf2597d119a0b

SHA1
e3f8badb551758d83677ae0f720a26bdc14cda24

SHA256
d4a516db135957edaf1efde90096c1748c411527571d8b9a039cc7197da6886f

SHA512
900404b3f7edd95dc36f8c32969b518e74627d178533facc5ae84e8297b199ec7a1266601e0ecb45562e5215404597a2985cd8e4eb863a806cecb3c492bb391f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
4c04a3b7f9836d37bbddeb900f6bda7c

SHA1
54466fa54ccad9ad398bacbee557ef0f33975aaf

SHA256
2826f532d69def13443c8172bb2c419d749e45db16b1b50c34111ace983d9d81

SHA512
98e6bdf9df0681d844dfda805a2721dd763502b36dc8c270876a2030b2c54ade417f4c4fe65e89e1eac6a23bb956ef5a1f70e5a2d8ff787a0635e090334dd413

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1016B

MD5
53e189fa3c3455ebb57984f1d30da83b

SHA1
becc09cd8adf4ff16953f4bc3291fd0f15d147c9

SHA256
6dcb06e39b29773c01e5c9327ca80bca561a335ed967f4ef9f7ecbaff1e127f7

SHA512
e65aba0a4864c5df1e1f6fb33dec11c0d00748f67069e280669e0d904332198c0792c370007c0be46efc04c4e7af05be03fcd44baf912f0c2a932cdda86a5ef7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
28615807c08486dd076c0c1e7791bfaa

SHA1
510b3ef8fc3b38c0783ec744402aa53061658122

SHA256
2fe53a1a42f3fc6f7e58bc4947b0930bd3361743207c6c6b108fcd94808934f9

SHA512
e2800778b2914c924b425073c3b6e5c6cacb88e27488219b7ca742aca56967c3fb2c58b8e60c2c98960805eac2ff0ed7aaf3ab651683a24ccf243d204546ba3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
16911dedac491c4a12d757799ffc350a

SHA1
782a05a53315bb6c22f3b93f514253a4c04b834d

SHA256
458e8988db1ea84fc758cbeb858843a39972716cc05472f459e94e2bb8c25f3d

SHA512
4618a903e324653cbb90e6f570a071801cf1440a5482b8e4cfe32983baeaddc7010098daed71962eb57cbfd18d28f24806aa662ae4cfc323b329387c05a796c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7nvvjyxe.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
e09371e75db6497cda39d796200143d4

SHA1
6f795ab621166f58d9c8fd3b53f5d75e781b4cd1

SHA256
685825d1bf6bf1613f33d515364ca4aec0dca39c1ae0be0c92507b36c2e6572a

SHA512
612071d842a9985f0d66b289a5a8937d69ebb1fcb5da84cf28802507bf8109486b677dcf0afc699203e03caa305a1a87b983f47905718c06012af68a52b05b71

Download Submit