There's one bolt with a 10mm head that goes through from the inside, just above the hump in the top of the HVAC box where the evaporator core lives. If you look on the engine compartment side of the firewall you can see the bolt sticking through. The rest of it is held with somewhere around 7 screws with 10mm heads, black, going through from the engine compartment side. You'll need to remove the coolant overflow bottle to see at least 1 of them. 2 more are in the indentation in the middle behind the engine but they're accessible. Just take your time and don't force it; the plastic will break right out of the box where any missed fasteners are.
Richard