hxxps://weaponxband[.]com/mp3/

Analysis

max time kernel
243s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20240709-es
resource tags

arch:x64arch:x86image:win10v2004-20240709-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15/07/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://weaponxband.com/mp3/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	firefox.exe
Token: SeDebugPrivilege	2496	firefox.exe
Token: SeDebugPrivilege	2496	firefox.exe
Token: SeDebugPrivilege	2496	firefox.exe
Token: SeDebugPrivilege	2496	firefox.exe
Token: SeDebugPrivilege	2496	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe
2496	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2496	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 1040 wrote to memory of 2496	1040	firefox.exe	83
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 380	2496	firefox.exe	84
PID 2496 wrote to memory of 3192	2496	firefox.exe	86
PID 2496 wrote to memory of 3192	2496	firefox.exe	86
PID 2496 wrote to memory of 3192	2496	firefox.exe	86
PID 2496 wrote to memory of 3192	2496	firefox.exe	86
PID 2496 wrote to memory of 3192	2496	firefox.exe	86
PID 2496 wrote to memory of 3192	2496	firefox.exe	86
PID 2496 wrote to memory of 3192	2496	firefox.exe	86
PID 2496 wrote to memory of 3192	2496	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://weaponxband.com/mp3/"
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://weaponxband.com/mp3/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1872 -prefsLen 25759 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aeef1b6-0069-4f1a-a025-23afea1e3caa} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" gpu
    3⤵
    PID:380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 26679 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d82f6b3c-254d-43bf-9db4-b05773754d04} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" socket
    3⤵
    PID:3192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2716 -childID 1 -isForBrowser -prefsHandle 1232 -prefMapHandle 2960 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c76e621b-46fa-4508-b352-a2b94dcd77f0} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
    3⤵
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 3656 -prefsLen 31169 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63db950d-5462-4fb3-9a87-189ea4a2f81a} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4608 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4672 -prefMapHandle 4668 -prefsLen 31169 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85d493dd-9dd2-4694-bece-7348f9ed9739} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" utility
    3⤵
    - Checks processor information in registry
    PID:3832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 3 -isForBrowser -prefsHandle 5416 -prefMapHandle 5412 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20791a25-4ac6-4c72-b6d5-eba9801a2938} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
    3⤵
    PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 4 -isForBrowser -prefsHandle 5552 -prefMapHandle 5556 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36f51fa7-96ed-4d62-a2a3-6eebe6c7f37e} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
    3⤵
    PID:4680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 5 -isForBrowser -prefsHandle 5764 -prefMapHandle 5832 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42114c37-23dd-47f4-aa23-9231c57be41b} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
    3⤵
    PID:4712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6020 -childID 6 -isForBrowser -prefsHandle 5404 -prefMapHandle 5400 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74be4379-7c8a-4f55-9ceb-db0f221ec325} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
    3⤵
    PID:2528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4900 -childID 7 -isForBrowser -prefsHandle 5572 -prefMapHandle 6108 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d7a5a2e-0cf5-4bc9-916f-12182e742303} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
    3⤵
    PID:3692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3768 -childID 8 -isForBrowser -prefsHandle 6216 -prefMapHandle 6272 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1060 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdf576af-bbe6-477e-921b-b0c81872076b} 2496 "\\.\pipe\gecko-crash-server-pipe.2496" tab
    3⤵
    PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onffaicf.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
e99221b8a63816dd8294b75b1af3ea34

SHA1
edf1d268fb075ba27a830423f35debabbc5650f0

SHA256
3afbd2d168885cf390243d961ba47bf3a8cd0ceeb8e628b5b834e00d8bbf9032

SHA512
830cb00e6f5889a318f14371c03a8b18dec429363bdbf7a21f87ed90c813eccdbf86fed38424f5e1325234b11eea340b703dff415a939db74e6b3206558fb721

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PSF1PS89FF22JX669X6M.temp

Filesize
14KB

MD5
80f403ade39d3cd68d0862cfc39f56ab

SHA1
3326767cae23e2f3960eecc56690ff419fb133ee

SHA256
d11e47a7338458fffd133d1d6f9c6bb9724f5ecd7e2d51b68424f55863ac371f

SHA512
e1d1fc17c29092028b781353a51d4d2d10fbca5d9e20cd7768f52007d77772b2d0a2cbb2f66cdef9f7c0a96e0ece83831fb1d9af2b16293b5e8d460bbc83d8ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\AlternateServices.bin

Filesize
8KB

MD5
80e4c09a6092395c92b200c3fb12f5da

SHA1
3c21157be19f6d9458b8f2520fea7ea88537334e

SHA256
de55802a6627dcab1c53ea79e87549d1c54141f1034236e6d30fa7e41b1a31d7

SHA512
327c2cbb4871d64eb02987e7a6698db9f504822a15f26fbaea0ca95860901683f7ab8162b433c5c48875706439c4b2deff87c668bbcff8523e9788a6fd179a9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp

Filesize
26KB

MD5
7293e024f2e2ed7474eae6929f070915

SHA1
7b58b9a7513eb9a8b1dc85075f42534f6919aee7

SHA256
56b2131848a0fe85eb494422f87c1315bc03d88bae1617ff1b45c903861b724e

SHA512
5a551ba5e5328540623ca23909e496b334efa49aeb23ab2ef45a15b4ed3ca937154e049b2e2dc1c0e2fa1d3f23b1875d6d24a7b78976dbce048c5364933be2a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
0ef476f6ab314ee73d161192923878eb

SHA1
716c6021d10d87a91fa54bb1860145f5068b68d4

SHA256
7470d14dd8247889fb20dbeb4907ee62a309aae08d00b50e76a4d7ddb607bc01

SHA512
dc0e35e62097076434ab5e7ee5dfd672b3eee75ef553297ac9fac33fea619115a3184535a7ddd34b4f2bfa5bc4611754a366183bd0f228d768b470394295a4a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e91789c1ba4015d999557910d36a2fd5

SHA1
dbca6c0854f3641e2ca54aba54b00e6acd79d91d

SHA256
692786367b870a1977459d5e7483d16cab8607889dde2bb7ba6d8695cce7a028

SHA512
26a2e61afde81c75ca0ae00806b6bff12b42b4c14328fe81d7fb9bc1164369f882df9c5a4a13a4f149d3ceba1fcb88a9c10872f39edefd2982394b5304fe3d2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\6830f93d-7722-40c0-b1ca-afe332632128

Filesize
26KB

MD5
b423bd3d655b0b613122a6129c177898

SHA1
c7c9ed69fe2213c0f5311098d29771d7ca0f72c7

SHA256
d5052bbbf07734ea19229afe34b55e3042a6b0cd5e549a74ecf45766f03c4a58

SHA512
285cb1bffa2b0798ff0f5398dc685c4122fc60a3597d39203557e8fc001757f02065c0a7e395f80f9fa27653d10f3156bbb719dd4a561e6153357cd10773e8fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\707f781e-bac6-494f-9dca-26dc08a79036

Filesize
671B

MD5
54725bf773fce534e0bb173ec90ac1c7

SHA1
65fe500898b51ac66179b4624001ec050e6617c1

SHA256
948b258464c0eabd07286760b111e20ad5298315a8e51824d4998bd34702ea8d

SHA512
dcdd818db53fed149aea40a56b1fafa5044da2d4c5881bbcb6af676a466713a227c2b6eac88d2cedb54aeb8d0b1767a540fc7deb06e687f5d031bfad5cdee22f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\datareporting\glean\pending_pings\76cd7e1f-e3a7-40ea-bb3f-c37ed69e571a

Filesize
982B

MD5
2bfee46641540fabd27fc7f0b76d3fee

SHA1
d76e69bf186a01d076a070ff66a798ac82b042b7

SHA256
f70d751166ca3f51516aa2d48d19e430b9954d81d5237ce9ae6fde2b55ace16f

SHA512
b263575b4b830202462d3df27528a9783b18e0c44f1a50f2031f37aecadba1b56a542d3e52461615aa9b4fa78095de421e0fe70923c2fb90313d6b42624105e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js

Filesize
8KB

MD5
da19cab350ccaa5f96ff0e2eae5a7753

SHA1
9c3636dc26fe865aaf8db3f487f19c9cf071acd2

SHA256
29dd882a6318342f9818efd1e8545499ad800eadf1b2d9a73156ca3601e0060e

SHA512
3ad5f38207fd2b9ade673fa97b5a12d25aa9d15dbb44a5700461809853db7480f1666fdec05f2f1de8717d8fd2433c945561249d52a1c9499d13e1e3f8283b53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js

Filesize
11KB

MD5
2190d6da8c6692739e9203bc4540e247

SHA1
3d247bcc716f495796f66a7937ad86fc9f2af9bf

SHA256
4779937eb276bc67db076ec7b91e269deb5102142e3523fecd83fae0454396ea

SHA512
d4c5eefbca240abd45f86266991df7700754a7193110c340678d4d3da588e91c9b306743a55593a96039162b65e893e68f3082169898119ca628717eb103a449

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\prefs.js

Filesize
11KB

MD5
3e5ba68184ec4c077d83952822d33f50

SHA1
1891f2fb5a57f4e6ee9e586ea3031cce1e0002ed

SHA256
4c360d71213499b271778046a224fa5de902b0d7a2f87573142b0b67d0ed1c02

SHA512
8959fe1cecb017cd132a55d439f575de59d697032cbc9ba2bd32b72d361eeb90dbb81c2e9d28168e95e56f78eb1a52a8046ddd8146a431f72b4f64b471f2fc6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
de91a46bbc5db4a39e9d89b605a8e981

SHA1
e2b7565c4e65260e0e6dbb8ee83ce0fca2282def

SHA256
ad34f0b2ab60dc6efda8242d4cab3709741ff8b4fd59b9dd2e367451bc8a262d

SHA512
15938923e77c69d9f9498acd1de443108d620e66bbaa6f27228cda83625ca34a0e711f6b196f5fa29a6c4e49a7ad9bcaba177aaefcda3584908c6f35b9668f69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
c09e1af213f4e6f03dac6e4bf1a56899

SHA1
a02831fdaccaf0a7e7e66a71ad63c21cc0c02cf2

SHA256
18d9edd796aaf9411b7497a818310486eb363dd615a963e7bce1f465c540a9e2

SHA512
e7033923f08c682bfc1c4ed63f2a94040369ef85b650eba6ec0568ed084f4bba7cd0aceb8585554e6c583e3bc825c1d9a8aa51c0ae51003d93271b02041ff960

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
1d2ff23410c74c51b2f091036019583e

SHA1
2da10f9cf342be99475aeec43181e4315db032dc

SHA256
48645728eb76d101c4048750310abbfef8aae89744e6ed5a27f7f55e559a8177

SHA512
c97c262bf11c41b1ea6f427acbcf587a99ef0f1ff6e4a43742a924b0dc2e3cdd4951941ac455c5321c02652bc045baad576cdb97b198aae4f44c0a3bebe51af4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onffaicf.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
8a4ab3582e468239f7391a18360e36af

SHA1
4446d6b78e1daf0017b5d0a2eb02415e6c86a196

SHA256
cc1e13a99dca30a697e44926599770136cfcae25c65884b8a020c55db3ed387e

SHA512
0fd15a268d850ad320577a04a16f6a10c13938c1dc8aa7e5b1ef36f49a45f3c4036ec93623b4d10eebd28a99549e745a345a7163dd3c4414e9d2f7bc9878cfbd

Download Submit