Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2023, 09:35
Static task
static1
Behavioral task
behavioral1
Sample
xss.svg.xml
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
xss.svg.xml
Resource
win10v2004-20230220-en
General
-
Target
xss.svg.xml
-
Size
368B
-
MD5
b2191c36c5dda0f0099cf3b3f5c08875
-
SHA1
8c44dc68c59453777459f23b82ab497dbb0061c0
-
SHA256
e44901e51a734fc6227e786466c8359735f37771fdcfc5acfb055c197a75c732
-
SHA512
1fdb128667c314877ceae6775f6e68f5bd1c2360783c2661df24a4a4d79d1a8a9443bfce36af0a93321f1fa0d1b6e4e64ab296a4563513b5bf97f6a69549b627
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "505978864" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c092cd20b493d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "505978864" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4959F3F5-FFA7-11ED-ABF7-5603A1288413} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31036340" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31036340" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05bde20b493d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fa868717ef8c04694c723c1fc71d98400000000020000000000106600000001000020000000157b5edb3626f4527b93338bbb4f402e2c3a56be559260cfa1cbd2a18a63e129000000000e8000000002000020000000eff6a86c3741ab493900c319e0585831a5157aa0d6b63195cefb1f5053823857200000007918aa6c2d2ed35110e33c200ed5a8cdf837f8e0ab116a4c3bedf61b4a6ad36e40000000797514e9a29e8b6335e9e03d144f379f7b040f56a70e9186904a18fbbd04758c05d8e630a9a13945d2d2645fe0adb35c69b968bf620e695eb0313f2d98743efc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fa868717ef8c04694c723c1fc71d984000000000200000000001066000000010000200000001134be22de56fe398e1393bedd46c497a644be05950cdaae6bd86b7fe882199a000000000e8000000002000020000000823c7228d663e2ac701da6f4f8a3b52b1bcc829c72c8dd7644129e59a5b5d3d52000000012fea8f0c254dd1c7298c3744db0676d0992a5bb368e65c0ff523bce3422f441400000002f145e2bef66a84f5ec83ea139f7f3694c1bfa200d887487d8ae0ba8c9d12f8008c8c477f2a34874aa03c5ac37de25cf65b14a16a33654be22f7b93f90326396 iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4964 firefox.exe Token: SeDebugPrivilege 4964 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1052 iexplore.exe 4964 firefox.exe 4964 firefox.exe 4964 firefox.exe 4964 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4964 firefox.exe 4964 firefox.exe 4964 firefox.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1052 iexplore.exe 1052 iexplore.exe 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 4964 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 1052 2716 MSOXMLED.EXE 85 PID 2716 wrote to memory of 1052 2716 MSOXMLED.EXE 85 PID 1052 wrote to memory of 2976 1052 iexplore.exe 87 PID 1052 wrote to memory of 2976 1052 iexplore.exe 87 PID 1052 wrote to memory of 2976 1052 iexplore.exe 87 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 2628 wrote to memory of 4964 2628 firefox.exe 97 PID 4964 wrote to memory of 4568 4964 firefox.exe 98 PID 4964 wrote to memory of 4568 4964 firefox.exe 98 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 PID 4964 wrote to memory of 1264 4964 firefox.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\xss.svg.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\xss.svg.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1052 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.0.322588783\1557467231" -parentBuildID 20221007134813 -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cb9b6fd-1393-4c4d-8cc8-cd1512704b2a} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 1900 2b2467a7f58 gpu3⤵PID:4568
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.1.1482422747\526757478" -parentBuildID 20221007134813 -prefsHandle 2292 -prefMapHandle 2288 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {742f7ebd-8b11-4f83-9b42-a95b8c6fc5ab} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 2304 2b238771c58 socket3⤵PID:1264
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.2.1227578747\701365598" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 2784 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {119016a1-d6e0-4474-85fe-73ee012b235b} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 1612 2b2494f9e58 tab3⤵PID:1936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.3.933450868\1578417832" -childID 2 -isForBrowser -prefsHandle 3508 -prefMapHandle 3504 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {871369cb-4ab0-49a6-85c2-318424fb0c49} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 3548 2b238767558 tab3⤵PID:2388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.4.1871626181\940213299" -childID 3 -isForBrowser -prefsHandle 4048 -prefMapHandle 4044 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eabb65ac-9068-41ee-8d4b-1597743cbd60} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 4060 2b23876df58 tab3⤵PID:4672
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.7.692776034\1685678845" -childID 6 -isForBrowser -prefsHandle 5504 -prefMapHandle 5508 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {866fd8fd-41ee-481d-9bb8-470a3292d7ac} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 5284 2b24c39d058 tab3⤵PID:2076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.6.924993315\1730928787" -childID 5 -isForBrowser -prefsHandle 5324 -prefMapHandle 5328 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8dbefac-060a-4689-b8f3-11cde5f65d2b} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 1660 2b24bbe8758 tab3⤵PID:3288
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.5.549309318\348220055" -childID 4 -isForBrowser -prefsHandle 5164 -prefMapHandle 5160 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a72709bc-9dd7-40a4-8570-ee2de26b5269} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 5172 2b24bbea258 tab3⤵PID:2628
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.8.347358179\1762756519" -childID 7 -isForBrowser -prefsHandle 5932 -prefMapHandle 5928 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5505c409-0153-4e23-9726-226e3e6b7e41} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 5936 2b247f8ed58 tab3⤵PID:3656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.9.659169664\1862526448" -childID 8 -isForBrowser -prefsHandle 8688 -prefMapHandle 8532 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58731b6f-c483-4b46-8ff4-95a01b82b2ce} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 9272 2b24b4a3e58 tab3⤵PID:4956
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.10.528836638\897700999" -childID 9 -isForBrowser -prefsHandle 9188 -prefMapHandle 9192 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9bdd35f-5a1b-4928-86b1-4db79eccad22} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 9204 2b24ed7c258 tab3⤵PID:3132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.12.441747967\2102606510" -childID 11 -isForBrowser -prefsHandle 8980 -prefMapHandle 8984 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f49fbcaf-24e6-4bf5-b137-d22de73e3e33} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 9016 2b24f05be58 tab3⤵PID:3220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.11.905044409\1780369292" -childID 10 -isForBrowser -prefsHandle 9192 -prefMapHandle 4756 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cc00881-ea9e-4cab-a5e7-663d1a2ac065} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 9000 2b24f05a658 tab3⤵PID:2032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.13.2037513995\1125842471" -childID 12 -isForBrowser -prefsHandle 8568 -prefMapHandle 8572 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e048811-93d9-4244-af85-c641b754682f} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 8656 2b24f1e1d58 tab3⤵PID:5068
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.14.1762455883\124851985" -childID 13 -isForBrowser -prefsHandle 8428 -prefMapHandle 8424 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9f3dc80-b946-4bcb-9336-3b850bb1f32e} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 8336 2b24ef7bc58 tab3⤵PID:5172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.15.1120109996\160463614" -childID 14 -isForBrowser -prefsHandle 8344 -prefMapHandle 8220 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3dfea4c1-96b6-4290-8441-e996f8681f1a} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 8140 2b24e80de58 tab3⤵PID:5372
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.16.1931268543\636336546" -childID 15 -isForBrowser -prefsHandle 7860 -prefMapHandle 7844 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b6d09fa-6b4e-4994-9d49-d9c5a3d09e80} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 7856 2b24f724158 tab3⤵PID:5912
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.19.404450795\2143329814" -childID 18 -isForBrowser -prefsHandle 7484 -prefMapHandle 7480 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {33e609cf-0894-4b81-957d-e424a7434f6c} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 7496 2b24f6f0b58 tab3⤵PID:5952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.18.1740916418\103024757" -childID 17 -isForBrowser -prefsHandle 8596 -prefMapHandle 8600 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac001dde-913f-42e2-9632-11a4f3a3310b} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 8588 2b24f725958 tab3⤵PID:5940
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.17.1705630238\2022927225" -childID 16 -isForBrowser -prefsHandle 7700 -prefMapHandle 7696 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20e26427-60ae-4b15-a7d0-ebdca53a40a3} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 7708 2b24f725058 tab3⤵PID:5920
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.20.539832613\1725257227" -childID 19 -isForBrowser -prefsHandle 7872 -prefMapHandle 7464 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {358cb7f0-4724-4575-a47f-44b46cc3a7d0} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 7184 2b24f32e658 tab3⤵PID:1756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.21.232142731\122899754" -childID 20 -isForBrowser -prefsHandle 6988 -prefMapHandle 6692 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5afc5b5e-2bd4-4e8e-b929-f6917561a117} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 4956 2b24fbb4f58 tab3⤵PID:6776
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.23.2009249726\1324062707" -childID 22 -isForBrowser -prefsHandle 7844 -prefMapHandle 7860 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62ee0ab4-d310-4f8f-bed2-c91009bff3ab} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 7676 2b24b65d458 tab3⤵PID:7052
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.22.1734463608\1486532027" -childID 21 -isForBrowser -prefsHandle 6840 -prefMapHandle 6956 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a301f6d-56f9-4ec7-87fe-abbd3a7d93b1} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 6828 2b24b4a3b58 tab3⤵PID:7044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.24.552608384\978085036" -childID 23 -isForBrowser -prefsHandle 6448 -prefMapHandle 6888 -prefsLen 27250 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fa913ff-8c34-431b-bc3e-61f71bc51f2e} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 5124 2b24df58e58 tab3⤵PID:6752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.25.1303784477\1944296875" -childID 24 -isForBrowser -prefsHandle 6124 -prefMapHandle 6716 -prefsLen 27250 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0257ef06-4133-4825-bdb9-8b72913ecfe7} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 6900 2b24e8e9658 tab3⤵PID:3488
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.27.875198138\13083180" -childID 26 -isForBrowser -prefsHandle 6160 -prefMapHandle 6156 -prefsLen 27250 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb4b6ea5-fe29-40e0-8ccd-98e706d7e095} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 6168 2b24eaebf58 tab3⤵PID:6156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.26.384578936\1055536379" -childID 25 -isForBrowser -prefsHandle 6280 -prefMapHandle 6276 -prefsLen 27250 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c63ec061-679e-4d94-ac7b-e8bbc9c3c165} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 6288 2b24d83ac58 tab3⤵PID:6152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4964.28.1606467163\1867007091" -childID 27 -isForBrowser -prefsHandle 5268 -prefMapHandle 5280 -prefsLen 27250 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c38774e0-fe97-458a-a5f2-afc6acf2f356} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" 5840 2b24eaec858 tab3⤵PID:6160
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\activity-stream.discovery_stream.json.tmp
Filesize150KB
MD5d2b2ce106d713f068d7f861867a991e1
SHA15f9423acc5fe0d0f69ed9113bb15b03c9e3c1ccc
SHA256c8f4931c75ad4236ddd264a7f35cd547e2b706f219298408859070283659588d
SHA512406b90d66193e89be5a406e4b2bb2a1a31254749afbf9231b720dce93569cabf378c804f52e324088535c6f2ac1bd42d651d1a3d6c68f72abb4e5e41feffb424
-
Filesize
14KB
MD5de1d1464fcd4bc51dd0a5eb2f63abd20
SHA161110ae607a42d7ab89602fd512f814bfa0c5a27
SHA2563f5ab3a69155d01bf5781806af0106c584fec8e2f91a894b728ca5b390be05f2
SHA512bb2256b3405b84471e2b28ff11be57f3103fcc22846bd4c626839facbb768d9ef860b7d93242df145178987c322b0b55d380a90c47ed42f4165f136f4006e405
-
Filesize
8KB
MD56e64eadae72610f56470b0330d6bf518
SHA17c394e28e34181730735282bd742bc9c71f3e658
SHA25697470319fa76a9b35f2b64f4bea8b224604ceb8042736d65c467fa93043850b6
SHA5128aba709b00f2386ef8518bffbefe53341c30e7fbda851fc441beaf21abea6f0916a9454feb667b59a57f93d34be95f2f4a9631c34ed3bf33b84acf111515bd20
-
Filesize
8KB
MD58fa1db29bd5751967b1650f4cc3696f0
SHA11aafa9a9d0b438bdd13c4c8576b459cb991f6a4d
SHA2569bf5833f2f8706cef09b1d4f3ced90e6c2dbdf4b90cee69fccd3644ee91d4c66
SHA512f39464cae704ee0e34e419b7e9b676cd234cd241274f35e5d68a4cc3253c57ef03b6601be612bf6f99505df1cafec0a545445872e44c340fd10999b5d6ca9c58
-
Filesize
15KB
MD51cca6f48a2c82dcc81979bdffda2703c
SHA10d6bdda4c85057f3eabb692c05ed3509604344e6
SHA25696402fe135eb8b3f685cebb08dbbc9db632c3c69e94da5a1d7bf1c15755a02a9
SHA5128758a640afd1e99af10cda57bd8744df3ec1e6b1fb91e097498a4775871a936eb97d8370eb3226d68dbead700c5e96b4be2197804e915f3ca089840a91d9d4db
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\04743FB1F2C14929BB59255128D28638E1807DBB
Filesize6.0MB
MD5034a83fb12f0c8b5da20497fe28db35d
SHA1fbbc19bf942b950b0c26a76542e4cdc64d1e08ca
SHA256d89cfb707e296aada1ca5aae9761035545e8a6761d3cced0aebafd74e4dd1c3c
SHA5127ae8b957ba8243db1a4a1a079d6ce53690392f41a03db4a71fbc4843aa0cd7b4f07c48b0daf16d1a7c0d4381832dc69695ef3bb11fcba3e636cb4b62e894574f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\420F1897C5423AC90ECC3AFE4DFBF739D0C400C5
Filesize14KB
MD587d1e977897884a45bd04e11fe047074
SHA18df873a15ea3a58344d12d2ec7bc83512c005343
SHA25653f0d77debf62f0648f52ec200882b682d1dbf8c21508a0d51705b58aad581fe
SHA51229bb7d16d540aab712f0751b06ee32d7fcaf90caf2949be4becfe4df8dfafecd9e39c93b7a4f0530d8f41b4be58ae832bcf9928831d2a0be572b7f3781452953
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\677B80A25A006EDCC273545819E7C8B9A97E5201
Filesize42KB
MD57f00205fe0fd09d17ea0b94b6d88cbfb
SHA18b42b04d077966369f39720f2f5e215de6abf583
SHA256326c9bbd732b09d566198228b35b9e1cb1ed9ddb96f992b3ef1e5e2561346192
SHA512bab869fb38ff8b3cd261b25e03baf37e61aeebaea4868d8fbae4c519020fbdc6a29223ab6b3ed6dc04fc9327cb7e71c1dbc33ca1e1b2f58c4af0a81476f29cc7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\83694C4B0C983BDAFFBCCD945F9254E4CA2AF6FA
Filesize535KB
MD5ef335af9e5a450b687cef9076d8d48f3
SHA1f21a0da6a574d2a35e1217952b907a11bfb76f65
SHA2568372f853eff2717d4f26c08cd6085e91e4a29737d2ad79ff18188fb36db5a34d
SHA5121e8fc2f3d81fe89904a1fed4858b83be95bf82c36332d8fbbc75afdb84225b99549191a32ee56cc6a8a65154c7d44b0d5ab9dd8099f2058350938b6ae92244e5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\917E41E135032D6BD66E5D6F84F0988D37234A33
Filesize14KB
MD51a64236636b553dc05df681bb2de6f92
SHA12a8b47da7d98d8f70b3750d38e693acfb2182c9d
SHA256722706f2b4d509cb31c54ac1ee3ae6a637db8a076fba74a64c7673ce5aabcdf9
SHA51267e7b39eb4494aad00e3f96a322805c0dc65c7c75a1ed5ea21d9704034ff9e4b10e34804fdc28944e0be74d1cea89e405f540d4b613c2119e1ad515115148ee0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\94425B87988B8BF3F8150D6DA7ADD03E0C4F2271
Filesize8.8MB
MD52d33d4c0e9bb7799f5562808d85c7970
SHA19a4d106a942fc36eb82d224027c2a0a7a34bdf6f
SHA256875471983a00fcf709ed22d60ed7c4e132dd0f3f1bb2a4731225aa505f70db98
SHA512c5cb86e1f3da7590b80021a757268b8b72ad2da0c1de178d614b21f90235836beb8bb6ac12587f98e8ca240db78a4c92e456281fc0dfa1579b61df8b6202e356
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\A6F7B71D1D1EA3AD215527B31823776A48615414
Filesize11.8MB
MD5cbfc0f38fbe9fe34f01c766599348783
SHA1e2c30c32064e5c4e7269955183fd93ff63c36395
SHA256f3d04501a943c6bd884c77a696f41c7a9d31b6be9ecbb6a11a61379ca33a0577
SHA512fe98db6bb31740bc6723382aa2bb3d0ab3f89130245491d9fa91987c546bc755c9cee417ecce78ecdd515fdc6af7b3270005e174a297ae42c7cf233cb2e445eb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\CB4B495399CD52A9283BCA39DCCBB4C6D4C5D712
Filesize16.2MB
MD59b661bf7d143cd0f540067942bcbd037
SHA1206da0efc90ac3838876ab21e07ed1b62233f58b
SHA256acc5191efcca174174ca326743ad8a007315b61d19931220f2e8fc3b2cd4bbff
SHA512f3db5f0e8a4086f9f5373b7af686786f2cd621fbbab329979460ee05cf9f7ac6ff95c10adcb313f1f38ccaa7cd9842b28c89e49e71a2ce39510601a9ae838efb
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD541df005e3a4491d708a67b33fd4b591a
SHA1c84e98ea321458de3c06f5e4d4be977605be3bac
SHA2564b3b06dc7b865dc8e51d40e91c6af4e8a8fbe593080b264af9b0de7f673a4fff
SHA5123205462b77b75667939d47a41880267c44b95ea11faf6219175e35f1a823132e97e12f1f442d4ca0fc8665beb7bc3aaa6a15b2fdff07c5cb2cbc2821c933c7ce
-
Filesize
6KB
MD54ed53652aacf81bb2c30a77fae56c5fe
SHA1999104469ae8848524c34af5c6c7eab147344e14
SHA25665715336477dda00e145fc84558b241e59425f546a004b1e265446f65421a9a3
SHA51296939c292c32dec318bff75b0210d94cac243da47cc93deefc7632a47145f8cc40f9352e0d613629223697ae60e793026c270cab3e30d679e58a865d7d40fd97
-
Filesize
7KB
MD5358520bf7692821dbf0ef05724454e9d
SHA1c7b3267386e1d7f197e5c96b44d022225c709804
SHA256a95236912701b62bb0b826a4997271b49d9ff4c0a2b3b5aa570a652817225fe9
SHA512c2572bd7659ad3d466ed29830b331a49f786ac57bc778cde2a60dc535bfa1ac7442749209e538a2d71fd32e8e14cbf68c02ea5abad57b49e750c11cb376ac4a7
-
Filesize
7KB
MD53382218b76697e1084ec33f68d24be19
SHA12a4bdebc7d7f70661bf04e40ee143cbf5bae8964
SHA2561a2e209d3a30ca11afe8f0c4c6337768c4658829cb2529b37612b6edd48ffeba
SHA512ea9c1a74d32220fd3011e896455e8fd0f9eb9dc8e1d73012ae4069bcbe561ec2ad506dedb823a4089f30ea233d2cfddc90396a90ac04c276d48d4c9377fa49f6
-
Filesize
8KB
MD5aa9e540c9492f7e12df299dd8e00e93f
SHA190b5c5785b7566a87ded05205f26b2d6c5110e6e
SHA25613166b7b1e630f6998ef17082ddc1af5fc18e4ad96e0d1f4f1781b7146da2dd1
SHA512a4ea4a6e2613f0d1b82539729fde142578a6e6090dc8e5c3098f5736a51d3bab6351a154cba95d851ad7ef612a0f8b4c1ee95f198f4e5cf2470045e1f4780cd3
-
Filesize
6KB
MD5207077fed406e49d74fa19116d2712aa
SHA13ce60cb9b4fbd6b00a9ae26c599b9fdbe2b6c5ee
SHA256b02701ad3c4478f891a550eac65f0a8c183999aa22a1dd171bd698b990124c58
SHA5120c6398230b3eb103a0ce280f127515d998a6c9ea8908b8b248b132782f8166141ba8e1faabc7ace4b80e9c925bc5d7885f0fba8c16cb2e7798055727dc66190e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5bc4523737dcb2febd5724aa9c9e90775
SHA18afa45517cde0631b4089cecf53f76ae317a3599
SHA256b4c208f415bf1685b20abb4a4a159bd48652c97a08235532355be549cd65fc0b
SHA5129f8b550bfae6c2b65b48455e07351c99aadbfea573136b379453db2df95107db6c6061b46ccc8055f341c396685b0576816da6aaab3ba96d3491fae893c301aa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4
Filesize10KB
MD5f2eb8678fbbc7f4d48fff8d0b2b8bdc8
SHA1ac99e5e7ba82d8b8e6ca572d3f7198be722b6694
SHA2560dda4f8f3e10bc91767f071e863835ea94a1889325352a2b612e5a30b338ded8
SHA5120ee6a9cb7edebb383a54a8559077ad40518aa7aef691b60782d33c752f59f9f108b2619aafc7f9b3b1165dfaec99d54fefb8ddb1200326877e2654a27480a164
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.1MB
MD5659747af4d9195f95bc83c1a6d851c5e
SHA1516cf039dfa014eb0221d3f704974e5d7f2e3805
SHA256fef06cc2fc1f0d2ddccbb4855638c2720191a7245014fc3ac0af73bb81767100
SHA512c6c6e171c38b13d597075ab26c4a0debf7768e547f93527155b2357effc985562842f1574fe8bec832a3308f66da076a54ff1710438f7d0878e82935570d1b17