hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqbE9Jb1BYendwalVjWTdvaWlUWWhzTWxPNG9BZ3xBQ3Jtc0tsQ3FZdmhNdFhhNkVBVDlqVnpSVE95Y21NWnZBWlRUSGRiZ3FydkJIbWFRZlNjNHM3UDZCQVFXYnRMekZRSnFyb2RzaHB5Sm5PU28zZVhNZ2hMTVA5NFF4RTBSNXdZT1hWcmxyajhvNHlya29qZHc3QQ&q=https%3A%2F%2Fpastebin[.]com%2Fraw%2Fh1j3cpu4&v=MrSAkJZ31lA

Analysis

max time kernel
511s
max time network
571s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbE9Jb1BYendwalVjWTdvaWlUWWhzTWxPNG9BZ3xBQ3Jtc0tsQ3FZdmhNdFhhNkVBVDlqVnpSVE95Y21NWnZBWlRUSGRiZ3FydkJIbWFRZlNjNHM3UDZCQVFXYnRMekZRSnFyb2RzaHB5Sm5PU28zZVhNZ2hMTVA5NFF4RTBSNXdZT1hWcmxyajhvNHlya29qZHc3QQ&q=https%3A%2F%2Fpastebin.com%2Fraw%2Fh1j3cpu4&v=MrSAkJZ31lA

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	firefox.exe
Token: SeDebugPrivilege	1068	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1068	firefox.exe
1068	firefox.exe
1068	firefox.exe
1068	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1068	firefox.exe
1068	firefox.exe
1068	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1724 wrote to memory of 1068	1724	firefox.exe	30
PID 1068 wrote to memory of 2292	1068	firefox.exe	31
PID 1068 wrote to memory of 2292	1068	firefox.exe	31
PID 1068 wrote to memory of 2292	1068	firefox.exe	31
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2764	1068	firefox.exe	32
PID 1068 wrote to memory of 2936	1068	firefox.exe	33
PID 1068 wrote to memory of 2936	1068	firefox.exe	33
PID 1068 wrote to memory of 2936	1068	firefox.exe	33
PID 1068 wrote to memory of 2936	1068	firefox.exe	33
PID 1068 wrote to memory of 2936	1068	firefox.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbE9Jb1BYendwalVjWTdvaWlUWWhzTWxPNG9BZ3xBQ3Jtc0tsQ3FZdmhNdFhhNkVBVDlqVnpSVE95Y21NWnZBWlRUSGRiZ3FydkJIbWFRZlNjNHM3UDZCQVFXYnRMekZRSnFyb2RzaHB5Sm5PU28zZVhNZ2hMTVA5NFF4RTBSNXdZT1hWcmxyajhvNHlya29qZHc3QQ&q=https%3A%2F%2Fpastebin.com%2Fraw%2Fh1j3cpu4&v=MrSAkJZ31lA"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbE9Jb1BYendwalVjWTdvaWlUWWhzTWxPNG9BZ3xBQ3Jtc0tsQ3FZdmhNdFhhNkVBVDlqVnpSVE95Y21NWnZBWlRUSGRiZ3FydkJIbWFRZlNjNHM3UDZCQVFXYnRMekZRSnFyb2RzaHB5Sm5PU28zZVhNZ2hMTVA5NFF4RTBSNXdZT1hWcmxyajhvNHlya29qZHc3QQ&q=https%3A%2F%2Fpastebin.com%2Fraw%2Fh1j3cpu4&v=MrSAkJZ31lA
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1068.0.717823859\1362381226" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1204 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb447402-e28e-4d5c-971a-b7a0255bb2d5} 1068 "\\.\pipe\gecko-crash-server-pipe.1068" 1324 108f1258 gpu
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1068.1.1664100369\1019036117" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9de2d64-cd91-4abb-86ff-a1e6f6ab74e1} 1068 "\\.\pipe\gecko-crash-server-pipe.1068" 1504 43d1158 socket
    3⤵
    PID:2764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1068.2.2118602267\1583444055" -childID 1 -isForBrowser -prefsHandle 1744 -prefMapHandle 1856 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef1ae29d-148a-4eb8-9860-3d763a3c8968} 1068 "\\.\pipe\gecko-crash-server-pipe.1068" 1848 10867058 tab
    3⤵
    PID:2936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1068.3.53068598\422887400" -childID 2 -isForBrowser -prefsHandle 2880 -prefMapHandle 2872 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d102b30-b8e5-4145-b93e-37f0081b6b87} 1068 "\\.\pipe\gecko-crash-server-pipe.1068" 2892 1d64e658 tab
    3⤵
    PID:1888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1068.4.1330856795\404583605" -childID 3 -isForBrowser -prefsHandle 3760 -prefMapHandle 3756 -prefsLen 26450 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edd7a40c-883d-429f-af20-5d374ba71edf} 1068 "\\.\pipe\gecko-crash-server-pipe.1068" 3772 207dd958 tab
    3⤵
    PID:1100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1068.5.160598028\1621550512" -childID 4 -isForBrowser -prefsHandle 3880 -prefMapHandle 3884 -prefsLen 26450 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91b02e87-e0a1-491e-80c1-ce7d6b1c4f8f} 1068 "\\.\pipe\gecko-crash-server-pipe.1068" 3868 207deb58 tab
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1068.6.2049286364\1271251250" -childID 5 -isForBrowser -prefsHandle 3948 -prefMapHandle 3892 -prefsLen 26450 -prefMapSize 233444 -jsInitHandle 584 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3daea255-4519-44ee-b789-c0f05b4de84e} 1068 "\\.\pipe\gecko-crash-server-pipe.1068" 3936 214adb58 tab
    3⤵
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nyws1jjf.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
cf8a542d842409a5633766fee5690e50

SHA1
98fb7720ba0d8f70daee377b5a57aa7364d19dfa

SHA256
c0f5fa9fdb3f545bb3801ffd5dca6c8035b20dcb0781705b999a65088af798f3

SHA512
de0eab92072ef736aa1ffd7a05bef3e25d693521297af9b180501ad6eef5ff1e1546d70a985f3a0965167f86ab0138c3f547ac7a4219abfdbf73373db0ea9fa6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nyws1jjf.default-release\cache2\doomed\2965

Filesize
15KB

MD5
38ec289529f42bd7ad7b360a6b90440e

SHA1
99f30dafee24eea5027fae4dbf7a6c04e92662c2

SHA256
2d2c641e3d9e33f8e0d9f3e58c5777f6e6aecde1ed0925f7e34897a9d15957a2

SHA512
b06df15454bb862a76275f46cf66fb22f777f3cd684885a52e4b6af99ec88b77576162a7e423e0c34e0b35985b6c52a37d962bcf7bafc2a61bdc471e7929e2d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
bb65f06c37c0f74480c4184d8a11b258

SHA1
aab985aa214580372e668d2f6300e5b818f799a9

SHA256
5e38e81f3de55a625d4ba471425a0e17144d4e18a5fafab3012e6c91a1b56f5c

SHA512
1001712aac4fc1479deb1c0fde44ff6db830a4db68bd9c7c00ff7843b27cdd7401e15f7a6d515ff667590cf0600dcd4a318a356d12fa502df9796cc7e254339f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
41b618353b4d2dcf9245fc2b705941c8

SHA1
8da3f96ab69fc7c83e43b3a0f7b04a945fc0bbbd

SHA256
c222e352ebebbcd99e31b336b837b236c9ece69607d6238bd01d40bfd07261cb

SHA512
0f05b4173827eb2e3840ef8eaa7c56f729d7623570b91b126d634a4b057505214f466268a6670602cdde0eb549bc40f367c7a74a562302d5342f5b5c749b5a8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\bookmarkbackups\bookmarks-2024-08-02_11_k-PozTETHt6fhzgbtjurZw==.jsonlz4

Filesize
945B

MD5
3d51709d111f1dc0e9ff50769d909199

SHA1
b63660e874277d13f65082aadac3e5129c27b671

SHA256
2296864a5031604077ad9080a817a493875eeb6ca70c6555c99eacaf404c5ed7

SHA512
fc4f8bb48e7f4c08226a7f2f2f6b6825d489ce1d2b90fddaa20f77a7d568136f223a7e01f06feef868a836ec77c3cf59a1102c140b5f7b64eea9afbbe0a9011d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
3ea0624ee613eb2162b3248aef96fa6c

SHA1
809dfc6b7956628dc18c63cdb28668f6e5a7e047

SHA256
fd76d708763e9b79af88167f05cfa33d73a6dcaf678981c17fb5211919683717

SHA512
f795a3e72b66283dd46612d500dc112a0e4f8dc53ef441a1113695a8bea938d3ae986e3a0fcd6a31cfd6eb9fc56617a1850ba9d1d1a33d5770c55db2326370a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\datareporting\glean\pending_pings\e593339f-bbdf-44ca-83b1-ecbcdc5fd434

Filesize
11KB

MD5
713df665c08717709b608465b52ad338

SHA1
329301019b5eeec010c91238cd24759d04b26db5

SHA256
b77867ce1e91be938a658dcea37c3e93ac4873b79c4e3c79c6ccebd61e70afd2

SHA512
d8f39401e1ddba55262fffdc8ef8c7069075c4014e1295ebd670066fece9f1fb645d3aeb5ae6e3a0c3634f87d707c76cc110c4c3fc7fde925484681db0a81f15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\datareporting\glean\pending_pings\fb9b5151-faa4-488e-8613-ac1cc70c04bc

Filesize
745B

MD5
4d57335ece35516ce476be1e478559e0

SHA1
6266b5cacbf3bf4782b95a1eeaa94b995763f397

SHA256
e00005716ced5ad566e60f0e6824eb8d131688ff325b463e2b58607fa3bceeed

SHA512
fc955c92c45b46fd87d8ba90029862dbe9080a086acacd6b314dc41585f7d05a9a93c91df4825ce7fefb612fe9879432e05b8c58477db76749905ec662e3a866

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\prefs-1.js

Filesize
7KB

MD5
c3d092818c1fd082f7bfee552da187c7

SHA1
75a3fb4f5f3f62c26463b01235aba8ad7fc47043

SHA256
7857378810e3519deab53266f54474e3381296eb59577c06b098a6600201bbfa

SHA512
a2492329f5d014090580a39ec70579065354cc6a2dd8c04684c4005baa547c2b0048ade09ddfaa903c63a7a6c34cfeeb12d9eeff700bc2c76c8c29f8629d2982

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\prefs-1.js

Filesize
6KB

MD5
6780ea6470a147af51b00843408939b4

SHA1
54477a0af84a3008393ce07cb5c22c134be46fc2

SHA256
8223aca27306e3e6b7192132ffbc702f5983c31660239ba30ffa8d87347f2b83

SHA512
31b76f6d4e7c6483a781de3e1f03a57dc8e1aa43c5bca2334e7a30b4b6fab2fc170bf7195d5690a593e61d9fcda4a8352b5bce65066a9640d61af28608f26944

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\prefs-1.js

Filesize
7KB

MD5
ad6a8c122ce684b88ee19abba99a32a1

SHA1
429902133743ebe9d5c9c7bf1c1e9daa8518229a

SHA256
a261132bd43b40a43fc1a2593a12df175471dc785fa479aebd6d74ebac356bae

SHA512
0b0b257158b669acfa0425865b0fb61c6fb708381899f96c008763f1da8b88df95eb98ac8ca0b89431fe5e329f8c79f266f2931c343c0599c09aab4b21e20e4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\prefs-1.js

Filesize
7KB

MD5
b2111f7362ab8848068b1bd9c5fe182b

SHA1
f06f98f7f9fa6181ad17b0c4045d8471b5b74906

SHA256
ddecf9e6b1208837bbaf9b0ca03bf429a6127b0e41d1b8506294e2457e07710e

SHA512
2ad1ec7a8128c9fe0a7551bc5a3e7f49aec6d8d691878b48e007c12b246fa6211f8aac5eb34a9fdce4dfce965787e64caeacddd31ca2f79d750da8737694d85d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3167f7231f7b03b6870c36e05b1e360e

SHA1
0d7d14005fe31357603f80ba74333f2eba2e01c8

SHA256
779078609bf6fc6a4af433ab2c3b2b53bbe96ee6424427b255ffd6b439f28881

SHA512
18a88ed52c6cc38b6954df641a75cdefc23547a59fec29fccb943f29e50c4fd9fd8eff8af8a0e9720de3758ace26c6283f1f6dbb99c03d3e84626209dc403d66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
930310edb276c992702c569771bd3f3b

SHA1
df748d61665201c6014fac5b650b24820f261410

SHA256
5988949d36cc85738ab86f8c6e5827a5cc643151aa8f24abc1516426539b480e

SHA512
c6eaae81196a6a37be0ce249e85abc2506e30168535c2bc4b7f1c6bbba559e1cd0225253fa44b70c63d2bb42e407420d2872bd5d2bdac28c1385c17a9da87953

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\targeting.snapshot.json

Filesize
4KB

MD5
17f8512a465ad46fb988b038255fe0dd

SHA1
6a39f3094aff7811bd30515f79babe19ec9d2faf

SHA256
0f788bfac76037f3de65dd64da1864908abdd0e0613d7beaf40613096d082e21

SHA512
67747668f7651271c03fe6076b35e63cc08bf60a3fa4c570622fcdbf772559c177d42c84fb38574633820c2d622970b7aac843fd728c9264f8c3122b712496e6

Download Submit