62ec652b940fed66e05e51fab39467efccef2ec71701dc7578f7e92beea711f4

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

404.php
Size

344B
MD5

f9b740de887c30b02463e2a17d5e46b6
SHA1

9f4b098a82a28c2b353aa6c7f4aa136638c77231
SHA256

62ec652b940fed66e05e51fab39467efccef2ec71701dc7578f7e92beea711f4
SHA512

d69ab78ccedbdc00ee8025be66a97c8f199b913b0323dd65ed58c511d9a15ec017983e8fced54610037dc01b7dea26aa2c3aad3de2b17a8cead550c3da5ae7c5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\php_auto_file\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\php_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\php_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\php_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.php	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.php\ = "php_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\php_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\php_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	firefox.exe
Token: SeDebugPrivilege	2556	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2556	firefox.exe
2556	firefox.exe
2556	firefox.exe
2556	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2556	firefox.exe
2556	firefox.exe
2556	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2792	2668	cmd.exe	31
PID 2668 wrote to memory of 2792	2668	cmd.exe	31
PID 2668 wrote to memory of 2792	2668	cmd.exe	31
PID 2792 wrote to memory of 2672	2792	rundll32.exe	32
PID 2792 wrote to memory of 2672	2792	rundll32.exe	32
PID 2792 wrote to memory of 2672	2792	rundll32.exe	32
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2672 wrote to memory of 2556	2672	firefox.exe	33
PID 2556 wrote to memory of 1984	2556	firefox.exe	34
PID 2556 wrote to memory of 1984	2556	firefox.exe	34
PID 2556 wrote to memory of 1984	2556	firefox.exe	34
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35
PID 2556 wrote to memory of 2008	2556	firefox.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\404.php
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\404.php
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\404.php"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\404.php
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.0.396853893\667238407" -parentBuildID 20221007134813 -prefsHandle 1200 -prefMapHandle 1192 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2911cd7b-07f6-4e3e-b863-6383926dae71} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 1320 105dbe58 gpu
        5⤵
        
        PID:1984
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.1.784995768\279387411" -parentBuildID 20221007134813 -prefsHandle 1520 -prefMapHandle 1516 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {308e91a2-4de3-4e2d-9970-1d8d6983baef} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 1544 d72b58 socket
        5⤵
        
        PID:2008
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.2.1861906865\910521300" -childID 1 -isForBrowser -prefsHandle 2112 -prefMapHandle 2108 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59b02f35-fac1-40ce-8e45-33c1d514151c} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 2124 1a28eb58 tab
        5⤵
        
        PID:2020
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.3.1037640591\1438552572" -childID 2 -isForBrowser -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4869e4b-6bb6-4f7e-81c2-d30aca4b6360} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 2456 1c798d58 tab
        5⤵
        
        PID:596
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.4.1275578663\970399435" -childID 3 -isForBrowser -prefsHandle 2864 -prefMapHandle 3688 -prefsLen 26526 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {041cf583-50e0-48d5-ac0e-c62e96f3861d} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 3796 2085e558 tab
        5⤵
        
        PID:2548
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.5.1340027722\1049172907" -childID 4 -isForBrowser -prefsHandle 2236 -prefMapHandle 2232 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {955530b6-ac9c-463b-b9d0-6bdd829a53be} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 2216 1a2e6258 tab
        5⤵
        
        PID:2972
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.6.556181283\1630307750" -childID 5 -isForBrowser -prefsHandle 4004 -prefMapHandle 4008 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4696854d-0fb2-49ee-a1e8-37f91e927411} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 2864 1c799658 tab
        5⤵
        
        PID:2328
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.7.1966130152\792901198" -childID 6 -isForBrowser -prefsHandle 4172 -prefMapHandle 4176 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d68f25b-87aa-4ca3-9de7-6ca3c1a12a66} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 4160 1f008c58 tab
        5⤵
        
        PID:2520
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2556.8.1876692238\912189755" -childID 7 -isForBrowser -prefsHandle 3816 -prefMapHandle 3852 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bead26b-17a2-4704-9ad1-20ef73c73b63} 2556 "\\.\pipe\gecko-crash-server-pipe.2556" 3900 215bf258 tab
        5⤵
        
        PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
465c3e299e5cc629a88f3dd141f438fd

SHA1
c4a93e4afb031e9a85db2290299866182278013b

SHA256
7289c868c50019702eebc57af11265be4629ad85ac7a138af1b19a972f458e4d

SHA512
42e9aab9e534d17e4493c374f383ab2b7ae6d74279f73869965a9b7bd0fa3c81ff5830539e5f4a1e78e9b9d842b21b7abf4537fca771d0a1aeec3a6ce22c5acc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
c0afe0ce6fa906bef7b59211f897f1d7

SHA1
326e94f6723ec76169bec216d19c05eafaffeb05

SHA256
68f34589f4f6f8e16239f91ad28e9eec8c9d333f5a6e25b8ce417bff61b71e5a

SHA512
e4e8995def10944b2e4b05f7cc1f8ab580e0de51813144874e18c7c2f417dc8d2cd44420b207ca86d67b93870a232ca3260e01baff28ffcf9cd150ec4a2203da

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
61c9577775ae74b20255e0b4167ecc31

SHA1
83b634d948a2b84dadde14c2cc5a40fef6d93ae3

SHA256
1359444b704019be8b22c82bd1db25a8fe2ff11e0334f2502d3f5093b9a225fe

SHA512
5bdf2c5b9de7f0fd063731ae49766fcc46332750823668d6378990409275028dfcb4b8c0904ed1722af9ee5c6d9836ad2ff5e6c910bec40c350141815e29df54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\596f1a19-4015-449c-8ce2-7299306595c6

Filesize
11KB

MD5
50c154891d928c951c7ad63777dcbecb

SHA1
6807fcf5d3bd1ab34127c0ab331fa193669b4e08

SHA256
2de6c94b5579674286dad1e5dc7e275c832d18e02e4a7c09d53e5a458b1f8e34

SHA512
f921181df220f9a76c670c1a2b1b3d04b5900d0edc32f4ec701ad54686513551965375aa46a2830b4f825233dfb1f14d2b6a01ea80141cc765181b3e39ed4f16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\fa1c1050-6f9a-4906-87dc-b19941a10856

Filesize
745B

MD5
0d96dde2143f8d88f55f8e1901ee43ec

SHA1
c6924955a51432a82e93a9ce867f0bc5f74b026a

SHA256
cd66d52abf2b3dba032cf5e50270b0c6f9a14c0946b682fa2aa21f475aa4bfac

SHA512
824559c90c820c935c294106021a3dabdaadd618eabdeb1bdaf4f0f9e4417bec7d312997a1509f31edc1338854a5b9f32d0777e8d609a6cd0578b4ed67e41c65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\prefs-1.js

Filesize
6KB

MD5
5c64f7448c105bf0406b44de5d4f4874

SHA1
a95f8065501ad12ee94f8eb8a821c8189e81ec71

SHA256
55074fa9c0c8e085d95d6237aef1bf1ef85c9fd4bcfd91fcab8426b4f7f3e959

SHA512
9310e3b9411d3fc27e5f9323642dea1b5614a6ba2a3066c5b865b7a022631a52962c8668d81fd10a6f74c4fb889926fea5fc2afc17b108f824b0784542044dea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\prefs.js

Filesize
7KB

MD5
11c4a5e4affe912c5505ca0ac42acf70

SHA1
73ab5394d5492d9e476e2361ed139412a1d4db74

SHA256
0c3a962a70b46c7aa50cdc489bee90894cc0d42368ce134844c8126ae9cbac24

SHA512
ca2f0aef3d450916f0dcece853d9ab43dc440dcfeaa98ddd0d5264dcbf024a0d54325b6d3e2ef99cb376f0d9b4d1d84ad97047872375aa03e4af7d8d1f5e9bfb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
1299daff628721a9b1dd31487fa92682

SHA1
b19fda0ad351be69f5d07ea6c4d5db23c5941cb2

SHA256
47da3fe2d4daf8dc81b2a3b386f69467dc4a7b5904359d17903d0ef0716b1d88

SHA512
43cfbac01c36b92bde09f4d90b2fc42acf1a9102ceff68e8c5c42a6e3b359691c05bb0181737a372c37ff78ff685320378ad801b1822198dcd44c4335b0f9ce9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
1bc8055bf9fbf3d2d4eebe964f1c7fa7

SHA1
05f95631c6e4f0939073957a628dc17c7fb3ad7b

SHA256
89f40ad9319100a23206d336781b45843603365555685d75dff8a345b4f9b2a6

SHA512
3d5ab0969842c6584a1a2d3a9ea19ce9eb45c9a58e7a55776d49828e1084d0e27f3d24259b9c3958ecf58489c5044a58255d731b4a091087a0de3cd5c9b09d11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
fa143aade82733ddc19ae7fd566a5c1b

SHA1
b40d1d528207ef85c4fcc4c98352ef1d582acb8d

SHA256
5866a02ecbcc16df5ffe2a6f0662f02d1bc8c579b9114deea0403d172c786161

SHA512
47f623cb24fd03c9dd9c21677d9368e5947f4da9dd6b0ab91505df18378be146e63346072114d3f798dba9ec75cfad21af593853b3f88eaad979d27f9af1088d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
7270083229e9ae75dacce9240b9998b0

SHA1
64defa62b5c87cfc010d71d82a0f9fd3e7d359bc

SHA256
32629e60507e8150602332d2c75324bf518a06d79ff9c4d50f7e1bcfa3922957

SHA512
8ba3b550c5c728837aecd1671e29b0875e2e37a5f79bd7a365bf58605e7a300b3ba5c570b8962c21d8c976008d15d00a93fbea15cfab39071d0ce26278a64abc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
e0ad990a2bcd9f4aa34cb4c9925ccc67

SHA1
ff747907cf995cb92e8d2baef5921511358c1e32

SHA256
d35febaa84b262bdc578d0ae95d8edaf1ef2a2ea8b94d9cb6045c3beb75a477a

SHA512
e0250115c9f7d294dad643d0a79d0620cac35292bed319497ea0e80db0ed0b36bb481b60a3d5b1b43721e58855a2d1c99e91fc13b90d96724a856643c09df930

Download Submit