hxxps://www[.]bing[.]com/ck/a?!&&p=1cb736670ed51278JmltdHM9MTcyMjM4NDAwMCZpZ3VpZD0zNDk3MWI2Yi1hZjZhLTY4ODctMjNiNi0wODdjYWVkMjY5ZjImaW5zaWQ9NTIwNA&ptn=3&ver=2&hsh=3&fclid=34971b6b-af6a-6887-23b6-087caed269f2&psq=squidward+virus+github&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1

Analysis

max time kernel
1556s
max time network
1557s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
31-07-2024 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.bing.com/ck/a?!&&p=1cb736670ed51278JmltdHM9MTcyMjM4NDAwMCZpZ3VpZD0zNDk3MWI2Yi1hZjZhLTY4ODctMjNiNi0wODdjYWVkMjY5ZjImaW5zaWQ9NTIwNA&ptn=3&ver=2&hsh=3&fclid=34971b6b-af6a-6887-23b6-087caed269f2&psq=squidward+virus+github&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description	pid	Process
Token: SeDebugPrivilege	2288	firefox.exe
Token: SeDebugPrivilege	2288	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid	Process
2288	firefox.exe
2288	firefox.exe
2288	firefox.exe
2288	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid	Process
2288	firefox.exe
2288	firefox.exe
2288	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	Process	procid_target
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 1368 wrote to memory of 2288	1368	firefox.exe	28
PID 2288 wrote to memory of 1228	2288	firefox.exe	29
PID 2288 wrote to memory of 1228	2288	firefox.exe	29
PID 2288 wrote to memory of 1228	2288	firefox.exe	29
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 1576	2288	firefox.exe	30
PID 2288 wrote to memory of 2784	2288	firefox.exe	31
PID 2288 wrote to memory of 2784	2288	firefox.exe	31
PID 2288 wrote to memory of 2784	2288	firefox.exe	31
PID 2288 wrote to memory of 2784	2288	firefox.exe	31
PID 2288 wrote to memory of 2784	2288	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.bing.com/ck/a?!&&p=1cb736670ed51278JmltdHM9MTcyMjM4NDAwMCZpZ3VpZD0zNDk3MWI2Yi1hZjZhLTY4ODctMjNiNi0wODdjYWVkMjY5ZjImaW5zaWQ9NTIwNA&ptn=3&ver=2&hsh=3&fclid=34971b6b-af6a-6887-23b6-087caed269f2&psq=squidward+virus+github&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.bing.com/ck/a?!&&p=1cb736670ed51278JmltdHM9MTcyMjM4NDAwMCZpZ3VpZD0zNDk3MWI2Yi1hZjZhLTY4ODctMjNiNi0wODdjYWVkMjY5ZjImaW5zaWQ9NTIwNA&ptn=3&ver=2&hsh=3&fclid=34971b6b-af6a-6887-23b6-087caed269f2&psq=squidward+virus+github&u=a1aHR0cHM6Ly9naXRodWIuY29tL0RhMmRhbHVzL1RoZS1NQUxXQVJFLVJlcG8&ntb=1
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.0.1645464219\596787848" -parentBuildID 20221007134813 -prefsHandle 1272 -prefMapHandle 1244 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea26d0db-cac4-4c46-99fc-2f04c85497f8} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 1348 fdd7f58 gpu
    3⤵
    PID:1228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.1.933552699\790583443" -parentBuildID 20221007134813 -prefsHandle 1536 -prefMapHandle 1532 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43552dbf-5c5b-409c-ad6e-242069ed7926} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 1548 44e3358 socket
    3⤵
    PID:1576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.2.2077964634\2041843365" -childID 1 -isForBrowser -prefsHandle 2088 -prefMapHandle 2084 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 680 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa6e5690-63ce-47a5-88c4-aa5abf25230e} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 2112 1a9a2c58 tab
    3⤵
    PID:2784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.3.246769905\1586013352" -childID 2 -isForBrowser -prefsHandle 2884 -prefMapHandle 2880 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 680 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {34febba3-4f37-4f12-bd3a-9d94f98595cc} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 2896 e2f658 tab
    3⤵
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.4.44576519\1381567977" -childID 3 -isForBrowser -prefsHandle 3728 -prefMapHandle 3724 -prefsLen 26450 -prefMapSize 233444 -jsInitHandle 680 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f43f0db9-2686-4a1c-a3f4-4a5a0bf2d81f} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 3740 206d3558 tab
    3⤵
    PID:1976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.5.1342041818\1998868274" -childID 4 -isForBrowser -prefsHandle 3848 -prefMapHandle 3728 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 680 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90d0d9c2-9e87-4b2b-ad25-ea6993aace6e} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 3764 22970558 tab
    3⤵
    PID:824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.6.393036378\2042503992" -childID 5 -isForBrowser -prefsHandle 4032 -prefMapHandle 4036 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 680 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f37bd4b-2dfc-412e-8557-b3e4b863ddce} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 4020 2296e758 tab
    3⤵
    PID:2132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2288.7.232679996\1349193923" -childID 6 -isForBrowser -prefsHandle 4204 -prefMapHandle 4208 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 680 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ae0219e-615a-405a-bc18-2fa5369bd42f} 2288 "\\.\pipe\gecko-crash-server-pipe.2288" 4188 2258ee58 tab
    3⤵
    PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sexvjvzg.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
0d99ac7474071ba70cc16bf3ccbd1e26

SHA1
e63cbf6dd68e50a8ed0ac94193ab19f26921ffbd

SHA256
0c07ca0e5fef03457fffa280dce64f1d0a6665b9bfdcd46a264ab9baf3906491

SHA512
8fdd0fe854721ef260d602ab6b970a0cbb624ec566f97b175318c751ae32f10decab5b2266e07eec04124b31a424c6865df80c187d065598454b258e1213cabc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sexvjvzg.default-release\cache2\doomed\7667

Filesize
14KB

MD5
e0c6d2e2c5a193b9ec9e993198aba639

SHA1
71e2bdd4c5ab5bc775818cc90011071ebf4bb181

SHA256
be4e89e163c238573db920eecf417a44be0649897f9a929d46f7e04b875ad4e4

SHA512
a82a1861620a3be66b560ff8275a627b0ccebc34c78d4ae9ece415b6d0a89f9bb304bdbb16054fd347eb46df64baff97fb69565c129d7ef6a42b23721fa59ded

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
4922657aa5d6707b07ae4499473290b5

SHA1
f65afabec925a62d321866742c4a99308b4b77bb

SHA256
adb65faaf24d5499c9384100e7227f52352fe2efbc95b600f4e30258d23227f9

SHA512
691bde266a974950dc5632f2b696d1b0490cafd072e8cb02294c1adf156a24a977a75893a89fee01e1457a18efd6a2462123ba222bc6c8d601fa1741bd8aaadc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\bookmarkbackups\bookmarks-2024-07-31_11_Grb9Gj1IGR2vckn8KAgQ-A==.jsonlz4

Filesize
947B

MD5
254006031e1c6cb2c7e52db139070fb0

SHA1
c1c25d38c0ea9ecac254b0004a67c3ec1012f37e

SHA256
054c39c0b30b2cfbdb7ee063124b078f9b3a041d9c79f8711e5fe242e83ee4b3

SHA512
2e623312e26e4cc3c130bd5f6413bbf0035ff55493f59d79dd196fa43863ae97e14e13169a387ee9c5fa856260e9489b4f2a108db5a7145b753b92189fb33899

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
d31b9e1774c508176d4e69ca1afcf93a

SHA1
a6a06477837c41cfbbc785cfcef57d4268a8c3ff

SHA256
6e058f2dc4818af6946040faac4797b20a997166bc252d7c50db38683ac9d847

SHA512
21c6f3ff2e19ebf85a57475c307ed3d86d03cfc0f6676361eed557de38ef384556fef27416abdc17d7f525c4cdc86c7a4700e911a698915cefb3232978d23a45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\pending_pings\69de95c2-c50b-4652-87fb-fee46069365e

Filesize
11KB

MD5
2b6a7d271c6fc2dbcd4b0767ad3382cf

SHA1
5b8b9b58894bcf939ad802849d7284a97701b8fa

SHA256
d86ad887bb8c5bdd1d2428248f52b779fcfdcde125211695b40f342f5eb7a1ec

SHA512
c7ca6e27af62d170590e8013dc4439d55de3a2032532b4a461f6caecd5fa3f05c8d0efa04bb62cd112bd0a9bd5e8f80e80d80cf9326604812cb4fcb56413c0a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\datareporting\glean\pending_pings\f6a5cd14-7fb4-46d2-8485-871480c6a048

Filesize
745B

MD5
7b247ffd4544ebb6bb95e4fef24446cc

SHA1
f8baac02fb6f185d3fe301b73b6f25447fe63bad

SHA256
44dfa084595c665b31a0232c3cab27de18d1e673f26a150bb55610187ffda3b7

SHA512
2b6ec2dd5ca33705193a9305a786b3cdd8f713b805d009c167b6b5111322a86489901e3e9c8dce18f2f867340cba6f74ca7642afbbb2a09a8c383d75c799abc2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs-1.js

Filesize
7KB

MD5
cabcf7f2a3d2baa39dd916a922950fd7

SHA1
e12fed02aa4339455f3628f8fe073a0618654196

SHA256
1592981b7fa1e13f04f4a50a3b0090db022732e6928cc8dbc926e4cb23ec22f1

SHA512
22e0cbaf4e9de06c5bc291d22627746214b6179f9aa45d5c0fb1c56286f2857abeec2ef48bf7720800a7cc679b958be3ab0fb1a09b552bdf3eaec9af83259e4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs-1.js

Filesize
7KB

MD5
bd789a19d23c66c40efeccbf31d14f0c

SHA1
ec5d8fb5ff98518ef4e867fd840488d3c30046f3

SHA256
fe4aceb65798090362904f3b114b01a3ebc633c825fb88e9f8a3480e2e978429

SHA512
8600078c18f4c3ad198e6d20ba3f295b8b9f311797ed47260040ac380efebf98efd69b5e0a707237952adee09775ca8fd8509706207e1a571eef86f5aaaf0336

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs.js

Filesize
6KB

MD5
3f4d0b305f6d8f218eaf5eb529751012

SHA1
2d407cf8e104e252936c22524100458724faf7ec

SHA256
f3b545efe1ace304e90646a9fef906175a8b19cffd35bde32f110190f618a864

SHA512
9c76b575292b12a5c69b2169d46b0f23d1cbcd9d15e04e65ce122f3679a5429010ac896c79d8d522023e4216d83a84e7273910a509d3f4af7f2d5b494db1abb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs.js

Filesize
6KB

MD5
c1eea2cdf31d242bf719a9f363b374c7

SHA1
b117b3c12b86ad4416226e1ea0e4be24639bdbce

SHA256
4ca59658c6f2ff20cf823ecfa7ac94df1c165b9bd166a1d44e1e7d86d9198abf

SHA512
458c7bb3bd55886d1ba887822fadbe761719021e1983b2f1aabf137f3172a1aaabcf7b9df9109936bc72dea9c74100823c21d6bd6db6634e89886fad4dd6af8e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\prefs.js

Filesize
7KB

MD5
a60715e18528456b99f39bf20d97bcb3

SHA1
664ed9befed4137b87f39c2723cd7a0da943013c

SHA256
46930087319b2a666550af090cdead5869c58977dc5b43e99eb727f33911adf7

SHA512
6485e0a28cb1e261ad79c3bc5fcad2586031b3db797e3998cac5e74e4994b81ce352dc79f487c2cd51b9eef25f76bb733d12de51e62ae3010b0d318ffaa0b110

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
5f48e2eb94e4060e913cfca271595ca6

SHA1
a17bb6bbf89ce38d303162ded1d5eb94353007e9

SHA256
155b93edf57751dd19989b12e5d72ebb8d0084cd9e630e9d8afd7ef01affb2c3

SHA512
b8bae9e24bc29bf98bfb993672ded5c787014bce81f7c72aedcf248eb583ca40051bed54916d77faee1390f089e195fad2d9221c79db267467feb7f642c71a19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a70cc20d85679731b4b61338b012e3eb

SHA1
4cc134c9f1185e90f3cdbcb592591c021e8210f6

SHA256
ca4843cd30e8429f85ac17e5d19769f249fcea4999eb99b8fac98a6fea2bd718

SHA512
0e7e9cdb487c147b84b19b98e7472380236c11505a29bd5741a7ccaabe25a1e255ed7e10d4928ea7c697c67cf9f531e441f41ad1b729f2efa3168ea2a4ed6016

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
b772738a81d1964c51d0e176a8541d0b

SHA1
b0e5af37f279da7846454cf1399cf49b9a0a1886

SHA256
44ca63b6e9b0c323c8a39be468b41b6c39a1bb56f4338f13c39dc092e903b0a8

SHA512
3ad8eace03bec67c43d9ae9ae9c70490753c86ceec5aa333ffaf8a6e93356544cd7bda50ba7c83447e71cf650be76322a2440b7a542c0668f0577ed711c51129

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sexvjvzg.default-release\targeting.snapshot.json

Filesize
4KB

MD5
ee8d3490e1da65d0ed0c5d501bd469dd

SHA1
ebce893bd2642d09e1576c55a9f88b9a66eee3d0

SHA256
78516875334ddabc76d41d94ba8fe645655fadd6e5eddb04c8f3f533532a3dc5

SHA512
bcf8ff655c5319b8b0c477a22b88b6f30e8ecf59be8041eea5938b0f67aee3894c997b7a3c1faf24f8bc7e4f7907a795bd8b6e58434dc448a353c289861a472b

Download Submit