hxxps://youtu[.]be/uIYVSkKfFis

Analysis

max time kernel
125s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://youtu.be/uIYVSkKfFis

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

firefox.exe

description	pid	process
Token: SeDebugPrivilege	1488	firefox.exe
Token: SeDebugPrivilege	1488	firefox.exe
Token: SeDebugPrivilege	1488	firefox.exe
Token: SeDebugPrivilege	1488	firefox.exe
Token: SeDebugPrivilege	1488	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

1488 firefox.exe
1488 firefox.exe
1488 firefox.exe
1488 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1488 firefox.exe
1488 firefox.exe
1488 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

1488 firefox.exe

pid	process
1488	firefox.exe
1488	firefox.exe
1488	firefox.exe
1488	firefox.exe

pid	process
1488	firefox.exe
1488	firefox.exe
1488	firefox.exe

pid	process
1488	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 3028 wrote to memory of 1488	3028	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 5012	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe
PID 1488 wrote to memory of 1228	1488	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://youtu.be/uIYVSkKfFis"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://youtu.be/uIYVSkKfFis
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.0.12046485\100115893" -parentBuildID 20230214051806 -prefsHandle 1728 -prefMapHandle 1720 -prefsLen 22244 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45d362a1-bfb0-4642-9306-03aee869edcf} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 1820 250e170ae58 gpu
3⤵
PID:5012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.1.1437417069\2145696696" -parentBuildID 20230214051806 -prefsHandle 2400 -prefMapHandle 2388 -prefsLen 23095 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45315e00-f2c8-43a2-8cd7-2f5eca616b4e} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 2412 250d4986258 socket
3⤵
PID:1228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.2.391056442\1917806780" -childID 1 -isForBrowser -prefsHandle 2776 -prefMapHandle 2632 -prefsLen 23133 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3723b3b5-b2ee-4fde-87bd-03b0823309fc} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 3004 250e474a358 tab
3⤵
PID:3836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.3.1172580070\232323294" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d26977d4-0ca7-4dc8-b5c4-fc41570adcb4} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 3668 250e63bdf58 tab
3⤵
PID:4836

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.4.202749353\1420559421" -childID 3 -isForBrowser -prefsHandle 4988 -prefMapHandle 4984 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16a83c88-86f1-4ee8-a636-c36c990f0362} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 5004 250e79d8b58 tab
3⤵
PID:5076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.5.406714654\963558100" -childID 4 -isForBrowser -prefsHandle 3216 -prefMapHandle 3220 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {640dc2f8-8f78-46c4-a9f6-628f77c208c7} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 3004 250e366bf58 tab
3⤵
PID:1712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.6.1710751317\781947403" -childID 5 -isForBrowser -prefsHandle 5316 -prefMapHandle 5320 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1815988e-f9b2-4c3c-a20d-3b2a145355bb} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 5400 250e4e3f058 tab
3⤵
PID:1992

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.7.1714013282\135588902" -childID 6 -isForBrowser -prefsHandle 3852 -prefMapHandle 3356 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9de5e5a-7f69-477c-8f85-ded76fed499a} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 3004 250e82d7b58 tab
3⤵
PID:3416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.8.2039342312\204023311" -parentBuildID 20230214051806 -prefsHandle 5536 -prefMapHandle 5732 -prefsLen 27697 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5d3bb7c-3c45-4d45-8def-4a0d56dadfbf} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 5524 250e8640558 rdd
3⤵
PID:4100

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.9.921849101\1315895189" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 5568 -prefMapHandle 5584 -prefsLen 27697 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd1741f8-347e-4122-80fa-01f43c42a3bc} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 5320 250e863ff58 utility
3⤵
PID:3184

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.10.198003219\923624430" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 6316 -prefMapHandle 6312 -prefsLen 27697 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31b9c162-97eb-46dc-86b2-7784ddabbf0d} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 6328 250e946b258 utility
3⤵
PID:4612

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.11.1035734621\1084497127" -childID 7 -isForBrowser -prefsHandle 6560 -prefMapHandle 6556 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac273e11-33e2-491a-a3b4-84efaf86d70f} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 6568 250e946b558 tab
3⤵
PID:5244

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1488.12.485022420\1079469534" -childID 8 -isForBrowser -prefsHandle 6860 -prefMapHandle 6856 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5971f6f1-0892-4f9e-bfde-2a206ef297b0} 1488 "\\.\pipe\gecko-crash-server-pipe.1488" 6872 250e9f2ad58 tab
3⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4032,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:8
1⤵
PID:5344

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\activity-stream.discovery_stream.json.tmp
Filesize
27KB

MD5
a50af627ec4f122ae9206631f9a7778d

SHA1
8449290148d4d6ff4354b538cf132bb7b272da59

SHA256
f701c9094ca1fa8ab7366489abcde094e1c7fff04d3c897673c1c6024d8ecc21

SHA512
e0f992f1b2960628bc05952a0f0f5b1f00d764535a80d33351ed778b9bde892421d3775cb2fcb715090ea05515ab80c4e8c900b326226fb3bbfff666954ca2d4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9vxbo99.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Filesize
13KB

MD5
6fff3e4790196b3e6c3d744e08e65160

SHA1
d0f412b6147fc6a942b4573eceabf5361f39a1d5

SHA256
8700153789c2786d0d863ae53e5222072ca4614938da544b477144d2d43d7211

SHA512
be5546489ffea62ab4920a97877307963e4cab23fd4442fb015775ef2510f0074a19e32e10522224ed3a8b6af320247afb39718e31eb17140dd2f173bc0a1f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js
Filesize
8KB

MD5
9413dd6dc38397c48ed71379896f434a

SHA1
380ef1cbdb7882ef77ab1ec2a3e4b6c68f2b67c7

SHA256
537fe99957b500712028f94406d79b7b310c8e837435f95d1af804eaa7637a10

SHA512
944e4896b3c308f807e1886a0bcfd47b0c3e0efec156e3b712d0c8d8b13b3d9dedaf35a4a6740ea62195f2813e72a6c5de6bbfe2ab974f35c16166ef3e5fc113

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js
Filesize
10KB

MD5
0f6e31564cc2f647c8cb40e0a3bd0034

SHA1
92a5f3d00c7a74c5d215c8524063efa367e90d3a

SHA256
8fb308f5997af40b06e2e3e1ce97f584ec431a495828c047b914619d4ba4443b

SHA512
f8dd212ec8ff5b9de7d1160364e83d95f220641b73d3fc49aaab85bb4f75c86b35471bce199fc9c0047ba5ab1d678e35b9679d5ffbc1a0990522456540d0bd29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs-1.js
Filesize
6KB

MD5
9efa3cb51d61a7c79f83dd210e4e47f6

SHA1
e782769ab0dac4d7c61d2f276a1eb321e74f5d48

SHA256
968fea2bd5e8d2281f4443419e6031f402977c1dbc4225db56cf1a31ed509438

SHA512
d189f58a8377a7d4bab21ce9d9ba3111dc6c12b44704b2a0183d400d465dab624c6d2ddfdc6501e3efcb97256b2ef9809c8825d4b5c1f67f53ac174b060aca18

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\prefs.js
Filesize
6KB

MD5
5b9434f649788aa2806d976a343c4df4

SHA1
0caf15d1416cced5bd41a68e8472efee67c9c967

SHA256
ca38c3e31c036bdf981f93054fc4a3f956f7a934ab442169dfa8e5b4592b11b7

SHA512
ef70f73973f69768d6cd57bc64de093ae1e63f1730025d8336a40f142eaaa865d8111d8cd2055eea7431f43750de7fdf3f78743cbcacf125bd644500552acbab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
2025666d5bdcb056c344dbcd0bab7e03

SHA1
1a2454593e1e0271614c06ace90c883ecbd97f17

SHA256
c2a1fd26b2ea012e8edbf14100d4815df952841fef27219cbd586c891ea91348

SHA512
1840f7d8b645dd272dc882c49d7bfbc1a85f4584cb7ddfe8a8f947abb08084ad877f5645c1e65dbdaeb26391e9f3b7896489cd963d45d48e6463b41f397a1492

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
75203939a312005997b98af215e747dc

SHA1
f1a633b9d015aee33786c93be18fc356d45537e9

SHA256
f2f7acc88a4940a228215759b3e7a262716b4ae7303a4250e540093de9aabfd9

SHA512
c70885e89ffae6fd293b2e73ff81650662a0cc5d70e2b28120609a0b3f80532c16d99fd630c0ed9b0b025096656ebb9e00f215c24da2d9b49aa7f67e08972be3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.youtube.com\cache\morgue\54\{04749990-e07f-4be6-ab29-2d1828380b36}.final
Filesize
192B

MD5
2a252393b98be6348c4ba18003cc3471

SHA1
40f75302fcbe4a8ac2e33a8d9daf801abc2a9598

SHA256
04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee

SHA512
07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\default\https+++www.youtube.com\idb\2232182701SeesravbiacteaWDosrgk.sqlite
Filesize
48KB

MD5
8a031ae08d1f894bee2a3afd33085b3f

SHA1
7c1e028dfff84d124c1526dd11f5e2f221d61c03

SHA256
74f90e53d10c27448c0fb79dd227bf5b8b5cc149dc899dd0d6148903576fbfdc

SHA512
b796b23e50012081777fb231206ea1d3d3deee4499926874118045126102c7196fd86ca0d631b62d7942a4d0bfd4d6a7c8f924d49b231d7ba4fd4efb5318f14d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9vxbo99.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
192KB

MD5
a8a32bd66f44fb0656c2cd001f3fe614

SHA1
c66d606b728d2da31aaf781e85334e7ddc084e30

SHA256
6d1213fc9f26cce370958ed6d0a8aa9862cd87f6376aa0031030a320bef9b1a3

SHA512
13dd6048ee5343716b3d7fd19efd85d3154faca4488d1cecb1fce26993ff2f076fb165e171e542ce295b7afb0dd83a769618a00e789e2fd852dd4ad2e6aa43d3

Download Submit