9e0da3d3bc35541329439c6e0ec64a27af93fd0d6236ceff9f0949a465fff8c9

Analysis

max time kernel
158s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

testestestestetw/triage - Copy (28).exe
Size

1.2MB
MD5

08b8eb8dd9681bfd0050fa7e547e1fd9
SHA1

f810b716884668bbc554aae7914dd19f1c30c265
SHA256

e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b
SHA512

d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f
SSDEEP

24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	triage - Copy (28).exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2012	triage - Copy (28).exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2012	triage - Copy (28).exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1764	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 3604 wrote to memory of 1764	3604	firefox.exe	89
PID 1764 wrote to memory of 220	1764	firefox.exe	91
PID 1764 wrote to memory of 220	1764	firefox.exe	91
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 4500	1764	firefox.exe	93
PID 1764 wrote to memory of 1624	1764	firefox.exe	94
PID 1764 wrote to memory of 1624	1764	firefox.exe	94
PID 1764 wrote to memory of 1624	1764	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (28).exe
"C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (28).exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.0.63133397\2043887885" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbd47e9a-ba5d-497e-81c9-796a1e9b4e4c} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 1972 14395ae7458 gpu
    3⤵
    PID:220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.1.1474585799\980849255" -parentBuildID 20221007134813 -prefsHandle 2360 -prefMapHandle 2356 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7986c77-19c3-4523-8fda-2289754b8e94} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 2380 14395a03558 socket
    3⤵
    PID:4500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.2.976897301\436066844" -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 3024 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bb723e8-8b73-470e-acf0-8c36ec05412c} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 2972 14399aa6c58 tab
    3⤵
    PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.3.1732628166\641436181" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cc9127a-5b72-4f4e-9440-ed5636a28bc9} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 3572 14399f70e58 tab
    3⤵
    PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.4.1808671561\401617016" -childID 3 -isForBrowser -prefsHandle 3992 -prefMapHandle 3988 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e19856fc-fb81-47e5-97c4-5094e0839b0a} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 4020 1439aec1258 tab
    3⤵
    PID:1192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.5.825883171\1272280345" -childID 4 -isForBrowser -prefsHandle 5216 -prefMapHandle 5212 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2724fd5d-f29d-436b-a0a1-9b160cd9455a} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 5224 14399f72358 tab
    3⤵
    PID:4348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.6.397433760\440893024" -childID 5 -isForBrowser -prefsHandle 5228 -prefMapHandle 5208 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19dccc84-7dab-412a-92fa-786e0d91a640} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 5248 1439bba3e58 tab
    3⤵
    PID:4440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.7.1222559281\1074716739" -childID 6 -isForBrowser -prefsHandle 5372 -prefMapHandle 5248 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73dcb002-d4dd-403a-ba20-606f05518805} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 5460 1439bf08458 tab
    3⤵
    PID:448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.8.1068568330\723695567" -childID 7 -isForBrowser -prefsHandle 5844 -prefMapHandle 5568 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {197f6862-7cdc-4428-8308-f35e435770b0} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 5840 14395d7a658 tab
    3⤵
    PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.9.559342428\1076194392" -parentBuildID 20221007134813 -prefsHandle 6020 -prefMapHandle 6024 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10b26dc6-e988-4650-aff1-8a1d311d6cf9} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 6012 14395db2858 rdd
    3⤵
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.10.1382861313\1451817416" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5968 -prefMapHandle 5964 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c502efce-5507-47a3-a06a-8bcdb15b1495} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 2860 14395db5558 utility
    3⤵
    PID:4932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.11.444913154\2029690471" -childID 8 -isForBrowser -prefsHandle 10168 -prefMapHandle 10184 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c97f784-cd0d-43ea-8f41-3349e5510ca7} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 9260 1439d0f3858 tab
    3⤵
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.12.1995959816\450497462" -childID 9 -isForBrowser -prefsHandle 9260 -prefMapHandle 10208 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d5aaba6-2895-4b91-8a38-a66ad7a71c06} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 10224 1439d1e4258 tab
    3⤵
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1764.13.1615230542\1373389870" -childID 10 -isForBrowser -prefsHandle 5352 -prefMapHandle 5676 -prefsLen 27463 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0cc87ce-1f95-4eb9-813c-cd104f56b595} 1764 "\\.\pipe\gecko-crash-server-pipe.1764" 5368 1439d2fc758 tab
    3⤵
    PID:5304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\cache2\entries\07F5049BAAC219B7CC8E5D0D7BC3FE00CFC59628

Filesize
8.1MB

MD5
96b38b5e4a1c7dd6c46df3b582e81fdb

SHA1
8bf67f3e45c91971a0d24c9757ff68a7a6ddc3ff

SHA256
85c8ce91dcdbb36b8a388a453e07af79e9fa363ad61b9e6d5684900292b59400

SHA512
55d94e953f6f02f36f1773df01cea3933f6a79e464c005f9da2cbdf9ff89eb874155f9e7e16e18f367567b54af79df069ed1e2a37bec4f638ff99c6f75ebafef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690

Filesize
49KB

MD5
24f7ac5998a9950bcd6c825c6e2cd612

SHA1
be6ca6e3daa6ac6bc128bc508a3feec5b3a8f5c8

SHA256
a98b65b5af5c7d2556bbc2a639717aee1799bdd9b3fd1656f57af9c88177f25f

SHA512
9cb3096b66e75c3b6d421ff46c2901640a68f60c364c8dce511bd089bf0a9fc26a0471c6e34c25614c5bdf984367ef765f486b329ebc1caa5cf13a113d705cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4a8fa42e18d01834fe74180dd27c2fe8

SHA1
5aea88d7b743ff57b0de5242d2e46b0680886efe

SHA256
b40e6e8c24e1e229849f50fd9cc9d5f8adb8f0c2baad70d8bfae0565e55ae9e9

SHA512
2b576ce5a2e5df1151392aa994d902cbf329244002fc55a3b959e2f4cf277c38b870aaeb6cca76d670bd0976b8e7be3e245fe1b001aab2bdde3ece86dac623e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\pending_pings\120966eb-d0b1-4cb2-ae11-609ae6c8b9fd

Filesize
11KB

MD5
b963217cac8bfeca393c1fb804901074

SHA1
8a196d497f4bf81e18ebaa7e70b12d8ce9f65b5d

SHA256
b290c7b8615e94cf2d466caa7465aeb01bc262565e74964a8d2b88fc4d7f220d

SHA512
4dac0d64c673be3a870f612d11284646a98962ef59f0415e0e9453d64de05eaf09c42f95316049bb13408debcb6d4cb8d8e43fea20764b279d1d45a4b31dda1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\pending_pings\e242ede4-72c5-43fc-a74e-5df7f860b2ba

Filesize
746B

MD5
f4732d0af67e659e0ecf0cd7623e5769

SHA1
2aa52124380f7298052430f0482a6cba240b6c18

SHA256
c8b1f1fe6755904fdc21d2ea894fa3125a10c148af183f42ec13f0f4b0a2ebc2

SHA512
faa4cd3caf1613d00c31b5da54ecceeaa823fd4400f1eba4f1f151e7d8c2b39eba16989e47f66cc453a1a9c08d5d15bbd713f3c9e62862419060a210e30db1af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js

Filesize
6KB

MD5
0d2ebbd331b5cb03f6ed30a3d66c1c89

SHA1
e58748337a51a3bedbc4e493c475a469b763cdab

SHA256
dbc9229521e133f0fe3fd4748f20def7b3d1ece08df5960b56689ae872948ce2

SHA512
aa188dd8f7265d40e800b9e54d2ce29d9c273016e1438c6e99c3a2a29067973f3c5e3f767ad59d3d4370b99be35ed97e4db0345b489d13dd5ab89130595f51be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js

Filesize
7KB

MD5
274325400b33e09f40606fa6a0985ae6

SHA1
0817a82aab4822ace30e0bf182cedcb35b8f919e

SHA256
a7495a8ab32d5e802381a949d976aa94ea41cda32984dd55880d00c510ea6067

SHA512
31fa4c2ca28133dc5c8e5ec21b59cd4fe385fb81d0c0936ce234f57ddec7c11b0ec94e7490629cbe680b62137411352bb2f577d4ff25287f817a9553aee1345d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js

Filesize
6KB

MD5
293fdd36a10a641432d636159c001667

SHA1
d3301e1ec16ae8087c61d431e6f89348bfac5490

SHA256
6b0924c14a8c465e32d5fa0c8f8af665cd50ea5ad0648252c77bcd5f123aa12c

SHA512
8fd7bdeba1126b74069482078223a95642beda4f793a149460e7a59452c563af38b02c6d90512030f15f62257536abae7dd13180f278a79124157aa4edb1463b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js

Filesize
7KB

MD5
227c943417af0edb578bb092486ec9d3

SHA1
3adbf09c6248eaef1b75e941ac83b270012255bb

SHA256
678cafd31d186d88056e7b556c995900ea016382829923fc93a6e1c56ee4ce9e

SHA512
a4d836159bb02aa020f837766ccb8b217f31bf4dce779c7facd5ea48a33018a33006d55d2b15e898403b62f59de92536936a8ad6c1c7f19a8c24b238efe5f88a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
81bcb3439a9c2dd3b8ed3d68ac2b4c53

SHA1
4d616f8cee4fc0253f2d232b5c13978d805828bd

SHA256
b797a47e5fb55bfd099922a2a7131d5d7888fee52e694768b12fe87a2213386d

SHA512
57f42d33f2f1b9b159c77b1ce8bc989fadfdde8f3f2441a58ad236d4a62864a51cb3e0bda2a836d6109abc5990fc16b87e6c76699ac3e4a8592b982a2ae5f56f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
98303593d3e5579da1c0da6ef009bd65

SHA1
13eee58c85ffc10a69a7a5505aa988978a341bce

SHA256
82282fb3365010d448d4545700f59bed7b84500226ad13568592840e454862b3

SHA512
56516420fb54419a43e9a25f044febfff97bd36e3c24e0f603e508f018db7481c3acde3cb8609b030e20c87de976271801fd2980e2d6f79e1dfee6fa68db1f84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
8fdfac22014ad5348f74cb6d03452aa0

SHA1
4789ff68d6a6f10ce30f98b449f3bea3cd18da13

SHA256
8c1d2d552a99799c39390edb0eb1c331cce8d56df98fb3d04a3533d3f01692bb

SHA512
4f9f6463453cd8e187d580926bc14bbf85209b5884f0c595cce12df584433faf918e290656d261ec20ca522b64eae8aa1e4b39014c7e589fcbf22fe336237036

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
1ae8f6835f20a7f4dd5ee6be294a75e0

SHA1
75dff3067af3b78eb3e2e8a422edfb91c7292c49

SHA256
17ee6a55d1ca258d8dba4fb4ec0fed004508a11bfa986849b599a1f05b048b65

SHA512
68470e3a25201b4482ac4950ff52efc44c0fc4d35bd5d45bf4bd8c6668c97a9a139f97f18a14827ce37e55ab0aad56d82680e273d7ea425f02d8e3e976959128

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
9766bf3379e68e561b98dca840bbfd92

SHA1
7cd48598bce066157382e8662b92ed0af834d1e8

SHA256
b367cc1b0bd8dc4eda05ae59f6f78f6618a242537b7372cf3671986e57c379de

SHA512
d38f139b2a271a6b1c4ef798d52d24464fe547b476ea5f99b3ea33d7895b21331816c78bd426b78010a63e54871c5f8ae8387b00ef8d075fdd1b6bd747fb6fc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
e0e247370e6eda80d13ee43b70002fef

SHA1
aea4d216de84d31f8373ba778f66a2def70bda45

SHA256
56505ad4c969b85e6002f0a6743842fec32ca1b0465219711bab8ff0d6506db1

SHA512
350dafc5cfc3fff45a2ffc693c4a179bdb4bb9008bfa0d869fe19de3c8cf850f7a4d42c06cba17b3a8612ed892b7a3c3f4a0c672173dafbd4441734e5bbfd163

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a8ab3f83ff9cfdf374d46cb2a0725250

SHA1
fe1d43ce95e7208c3f80c2f96e59e790777ca03c

SHA256
4dfc2ad9c7fe245e0523782dcb66cb82e15a3122812ab31af95371f1f8f0dd35

SHA512
34e37ce93a6f6154e487e32ebc083a1cf9b81fa5f71ed16e7955d811a3440168ce340dbd27cde33f5634e18d710d725085dc5e1270c12483665067893f2de8b1

Download Submit