Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
NordVPNSetup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
NordVPNSetup.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
NordVPNSetup.exe
Resource
macos-20231201-en
General
-
Target
NordVPNSetup.exe
-
Size
1.7MB
-
MD5
59cb69a08fdd9cb4b0539e3356df1d4d
-
SHA1
0c773a0a76f821780c002d527bee387b98904569
-
SHA256
bea34078c360c71fcadc1a86ebd397d081f0d589913ad43970c1a3983231f522
-
SHA512
51d4f3d396d183bc5dcaaa0a26cf024fade9b5e5c0e73e1d2ee7663ba26bc55e799beb488d5bab8d8252147b33df6ea1209ebd730124a919940e899758842ec2
-
SSDEEP
24576:u7FUDowAyrTVE3U5Fg23TD2D+Fz3ifFUwo433RfFcdnOtksSm:uBuZrEUWq0t9D7l
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 792 NordVPNSetup.tmp -
Loads dropped DLL 3 IoCs
pid Process 792 NordVPNSetup.tmp 792 NordVPNSetup.tmp 792 NordVPNSetup.tmp -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 792 NordVPNSetup.tmp Token: SeDebugPrivilege 4024 firefox.exe Token: SeDebugPrivilege 4024 firefox.exe Token: 33 1108 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1108 AUDIODG.EXE Token: SeDebugPrivilege 4024 firefox.exe Token: SeDebugPrivilege 4024 firefox.exe Token: SeDebugPrivilege 4024 firefox.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4024 firefox.exe 4024 firefox.exe 4024 firefox.exe 4024 firefox.exe 4024 firefox.exe 4024 firefox.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4024 firefox.exe 4024 firefox.exe 4024 firefox.exe 4024 firefox.exe 4024 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4024 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1160 wrote to memory of 792 1160 NordVPNSetup.exe 85 PID 1160 wrote to memory of 792 1160 NordVPNSetup.exe 85 PID 1160 wrote to memory of 792 1160 NordVPNSetup.exe 85 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4996 wrote to memory of 4024 4996 firefox.exe 98 PID 4024 wrote to memory of 2056 4024 firefox.exe 99 PID 4024 wrote to memory of 2056 4024 firefox.exe 99 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 PID 4024 wrote to memory of 2228 4024 firefox.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\is-KQE29.tmp\NordVPNSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KQE29.tmp\NordVPNSetup.tmp" /SL5="$90058,890440,866304,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.0.234939819\579178924" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02aa811a-9b07-4a2f-8551-7e9a8713cd8d} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 1948 1dc257f0e58 gpu3⤵PID:2056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.1.222831110\118428541" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {067e9e5b-9247-4042-a9f7-4acb4acc1943} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 2348 1dc18d72558 socket3⤵PID:2228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.2.714272085\848251721" -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3260 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1dae813-a15f-487c-97c5-cd2f672999e6} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 3272 1dc29699458 tab3⤵PID:528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.3.1962687047\1646250256" -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 3636 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9b64a3d-bb6d-4d41-a10f-223d199969a8} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 3096 1dc18d61f58 tab3⤵PID:3308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.4.990719352\1693168882" -childID 3 -isForBrowser -prefsHandle 4008 -prefMapHandle 4324 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a47fb34-e92a-47a5-9614-9340e9a0ce8f} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 4328 1dc2a7da858 tab3⤵PID:4384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.7.31965056\1079903577" -childID 6 -isForBrowser -prefsHandle 5392 -prefMapHandle 5396 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e18a2b2a-0933-4231-9660-b78b452ef5a2} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 5384 1dc2bee1058 tab3⤵PID:3140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.6.1969646432\928844724" -childID 5 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5abf54c-5476-4688-ad95-9b1a760d339a} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 5192 1dc2b97a658 tab3⤵PID:1604
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.5.140520275\2063557854" -childID 4 -isForBrowser -prefsHandle 5112 -prefMapHandle 5072 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {426c8d01-36d9-48ad-9549-e4f5a99fe73c} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 5064 1dc2a7dc958 tab3⤵PID:116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.8.217236\222722228" -childID 7 -isForBrowser -prefsHandle 6012 -prefMapHandle 5072 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0a852d9-d75d-434f-81ec-461727ccc630} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 5852 1dc2c043e58 tab3⤵PID:2596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.9.2099311920\879430188" -parentBuildID 20221007134813 -prefsHandle 5140 -prefMapHandle 4796 -prefsLen 26725 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb765d6c-4a11-4091-bab7-3569bf8881de} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 5216 1dc2bec2358 rdd3⤵PID:1032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.10.575654286\1300351812" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5812 -prefMapHandle 5248 -prefsLen 26725 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fc98430-f2ca-42bb-8425-f0a51b91c0fc} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 4788 1dc2bec2658 utility3⤵PID:5056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.11.739938180\26061529" -childID 8 -isForBrowser -prefsHandle 4440 -prefMapHandle 4436 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a00a9f97-0ba0-43d1-9374-663b22886151} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 4424 1dc2e4d4258 tab3⤵PID:1056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.12.249669373\2068841251" -childID 9 -isForBrowser -prefsHandle 5348 -prefMapHandle 5276 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6875276-9616-4ac6-b91d-27985cbcc6fe} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 5412 1dc27ff5758 tab3⤵PID:1060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.13.2045526075\2054102010" -childID 10 -isForBrowser -prefsHandle 5528 -prefMapHandle 5524 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0d4cc85-e8ec-4c19-b817-a727b1be61b9} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 5516 1dc2ec96d58 tab3⤵PID:4408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.14.2042359025\1086703143" -childID 11 -isForBrowser -prefsHandle 9956 -prefMapHandle 9928 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db37ab8d-e4d1-4c79-bffc-2019359917dc} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 9924 1dc2fc99258 tab3⤵PID:5312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.15.727810438\89274360" -childID 12 -isForBrowser -prefsHandle 10064 -prefMapHandle 9916 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07c41d59-88a6-4655-82e4-e40bd1983fe1} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 9900 1dc2fc99558 tab3⤵PID:5320
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4024.16.918095594\1311752556" -childID 13 -isForBrowser -prefsHandle 9664 -prefMapHandle 6100 -prefsLen 27416 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3a55a6f-aace-45c7-9bd6-6b66f44ae13d} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" 9780 1dc2d3a5e58 tab3⤵PID:5244
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x304 0x3401⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5ac1f89f9586f3ce90af025e62fec3055
SHA1832419c9fdf08de637941a34408d2e698a183844
SHA25600209bf1ae46ed2f2673d46fd919862cadb53f11aef6bc0e053078e4ac4b7ffb
SHA512159bcd49f22e4b135b4174b6d89e6c9b3ca96a3a87d328669ef7ca5733c161df986af82f04403ca98576dca2ea9d61b1a302b2c538f1e2fef9e9efe3f7ad6895
-
Filesize
21KB
MD50a27424d3d6d4160227d16bed60ca81e
SHA10c22216728a213ec4e28735dac801ef080e116b7
SHA2565811830ca6a8d5f95f0549b240b4f61ac1f0775b0cbb9b4f94cb5b193efb1be2
SHA512029e89a1aaa1d2b10bd4d87e52541c48438fa8b60fdc65f0a12dfce1e8f7c3a76d1b3248a692e8ccfa8a3258746017e26c774edd98d5082ae449de74cac23ef9
-
Filesize
8KB
MD55db549e82abd8a48abd29768b3ca4e4a
SHA173899c0404b660be92a224e204f12cfbf9231721
SHA2562c7eb487d395603f306966584417565ef8447fed6161998e0f782864b1ac1c4b
SHA512b7b68809814adbd99a55218254b647735409dec244733eb377bb92ec9014b9856fcde9a1a06a3f5b8d38d3d316da0daf2472e7fb2f4234500e32640956291b6e
-
Filesize
15KB
MD5bda744e7399b2f7b86b6ae7ad4437548
SHA1e8c67b42edc742398bb775ffb51511dd840dbd7f
SHA256f726b0a374b60007e0a261155c3a10e2aa054d93dcece7e10b07793d66fe9985
SHA51202b7f291b497b5ce759baee5cde878750a339b31c0151e13af39b73aec7972ca531aa97c20d0b0173b5a573759fe1d09bd01f98c16dd745b8c0d096d408442e9
-
Filesize
21KB
MD55fc7eb15916e5f30dbc8da0faf204f4a
SHA1fa6f8af3787e6cdd5e0b0eb56f31302caa9d5e3d
SHA2562554b04e93b235ef39623895495923bb6eef5122f512de940bf1691e83be3382
SHA512f453e2a548e272dd8619e1cc7e93b6f0da274f8feeb3029cea7a401c2cfc6c12ac74452ae10deb463f077924bcb7258ffebfb821e5d7be6452af5bf23a8f2e94
-
Filesize
15KB
MD504a4e090da0adf4b8c5b0fd9db9533ee
SHA17e54ebb8ed5888b0b92a6ef9279b275ffa8f92d4
SHA256c744766592e0b12157a71cdf23cf49551e5f47b88ab658350e2cc6adfc2cab56
SHA512872524c53e166d9c56b36a3f83cc35212e2efcc64ca88446c8736502c44ebccd67307c3c2f8d1a771e8e5ceb6385e02995d6cb1a4144000a7b331d2f7bb4dd7d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\04E7EBA40D7FD7317637A9111BC5467D9D51BEDA
Filesize84KB
MD5d6db0863dc0ee4254ffb3640aa6e9725
SHA14bba6b5f4e346461d9f895b8733f0d05c64a53b8
SHA256a44e37c4332f42af75b2dc0aa8a14336c38bedec0bef497e1986672fb5de1e29
SHA512ed647a89b73cbfd84f7909f8040692da12b764abc700612ab8f3d364b0c003e1cc3d8284ef830b28afa0918ad51d4114caba7c072e8b7fef48eb4d45cfb228aa
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\5BDA5ABD1525E2CF01A818055CBA208809B7ABA5
Filesize312KB
MD5aba893df67fcb3ee57ca452e9162eee9
SHA1ecfb988c764d8ee4f21f556dbd372912d8a49abe
SHA256d49f597c2b683637a3f2daa49bec444d18c5ee261396b51579bec191e17a242b
SHA51231875e9521eb0502992b5b4c283cbea3c382ffdba5d185dcd367042a79d581b716e101e564022e756fef8645f30b084931875eab249eda19a1249727b5a8f3da
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\712286654E0FCCB658847566D90C07055B7A0261
Filesize141KB
MD54271af50710ee3b4a89ef99833d6ab27
SHA11c74c76cb3e16198130f2f56ea8b8af4e2999b06
SHA2564b376e3ffff619a1b56a2585362b9110cca43fe6fa0629306d57c6191457566e
SHA512d55fc04e0dc73cc180aecda671d396c155ce59b0f172e0ebb4b42711fe36f09d759e39884078ae8522a5c8b286d63645dfc8539a1aee5b78a4d620b5823e0185
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\7A1D3FE3CF00644B5E97974DFD56131288390DC0
Filesize355KB
MD5993239a1e46e9b897b6e9bbfe9d2a246
SHA1adfb829dc5a39c955e3b55d9a3babd0859010a1f
SHA256b40881caeaa2580f815417c630550cadc28e3aa91b41acdca68475387d8b7837
SHA512ec2d2b69691865bebec3e57deb02bfe09d3ebaaa5b98646be817347f984483cdfccbfd4a338f9b0c8a08dc41b0bcda4757ce9a90088fb54c4cfe44a469b74512
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\B00F0F6D8C2840DA587DE24EB465A220B59ECC45
Filesize2.6MB
MD5f2c9198077a8604d40a6c9a388bc530c
SHA186a183d1307bbf2cae07ca37b626bd4cf9077173
SHA25665e329450e137f247663efbb3c79dbedd3f8186628507653bbad55b1b2db0d16
SHA512de57bdac8e01b039cdc1d99a044c1910ada8c83e0e4c3c84e625f6346de30112a5f4e8bee35302c08bb3336986cb0af483a45435eb4026d87244818b10c6fbbf
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\B54FFD0230AB94192AD423DF10D70EAF15FCCB34
Filesize163KB
MD5eabba798abdd2050a55151f79c4fc771
SHA17fc6f825b375dcff1d7c8c5945add5579dea8b1e
SHA256e144fbefa73edda4eb393d51dfaed6469405e9ea649c0ce12f31360ed7ac35a8
SHA5125eff725b35b6795d9abca58fd35ae2bc6e92c7bf4ea660ede85828245ed47b9ed1392dec61e8e5cb7c4f37cf938373323ceccacc6db5e9e1ca7a663a9ef27f7a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\C47707CFCA2C01C91C96D699233380EBC6980AE5
Filesize58KB
MD5b435ebaa1d3d79670dfffdc103293339
SHA1a3e64674325cdc02ccbc268cd8adafcdc86a2f86
SHA256b09489c14b08878bcced587934d6b1f5b845d3318c9c597b7bc54fd0f5269be5
SHA512921889bb285e2905aceaf478ef49aecdd553b4f8acf6b0545b0105cb31269192140a841309070d4daecde0d174b694ac7980e8a8421cd452dcfdd430b27c0964
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\D075D33B3EE737A90002F6D65645C9D1C5D6BA1C
Filesize2.0MB
MD596ef55643d2e75f3e8ce56005395b672
SHA1c324fdb8b23c08e236d46b5285836d290b337b9d
SHA25677afec9754dac009040b2c47f1d902090c4944dc126d8e1493049d8b5b886fcf
SHA5127cf824000465d078afd67be7fc1a9d4b88c4d03f887ea67a32230914e0f7d1db40f00d28e6d46b6041633fc96800e8c0ea08bc6e112ea3fdff1dfc4c1e5ef496
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\D6AD197196E930B358D3EB1100D7FBBFFAC2A33C
Filesize142KB
MD502a7c029e395e64c7b37266e21f89fa1
SHA1b9f807a33fd117e10a5d38b3b3aed47aea5cd8dc
SHA2566464870a7d79bc903ba4d8525699c77b3d2d40f4c9be06121d98997a11d5d3d9
SHA51266fa27633b4cd446a20183728cc441d4ab069ea7fa26a2eafd9660837c71e1360198c2e8d610148ebf4bacda152f1b44a56dfc251d6b736d93de72256e06969e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\EEFE6F94EE3532D6DAED4D54CC20795BDF32F079
Filesize567KB
MD59cfdd464680a92d2927b81117836bf38
SHA11d7383767503a781c7770fdd53bc3839fa26b21a
SHA2561b37836516e030cc47a01963596b0a30354573a7c2c2f3acdb62cb41ba2e8fc0
SHA512e2b5c1b4ad8a3810a13a38befe1638d495bd0a3f1f29108876645ee3c41bdc6ba34a0e3e7e85696a4b3937e2eada33d3a566ce6674c5cedbef2e3a8584b26672
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\cache2\entries\F96A1A8368D3C3DD1FA81D170326E6C1C65D342F
Filesize30KB
MD5520f20eb4d7ef7d74d8b6472896a64de
SHA1e650f7de20d20a8912c3803dc2828355b65f7086
SHA256075e673449a2bb92c00afffac7c3ee1ff06bcc8870f5d019296d4c06ea7f760b
SHA5121421e5860f1de5a3f3ddf1f985e10466e29a0b0bd9622c04e2b9ce79dd93f62a203cb4dda07f9739054fdd20a9448453cdf6d6158a382f441385597929b7b0bd
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nbjxj16p.default-release\jumpListCache\x_YNc3jgCRxsA0tiDzI4dw==.ico
Filesize691B
MD542ed60b3ba4df36716ca7633794b1735
SHA1c33aa40eed3608369e964e22c935d640e38aa768
SHA2566574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8
SHA5124247460a97a43ce20d536fdd11d534b450b075c3c28cd69fc00c48bdf7de1507edb99bef811d4c61bed10f64e4c788ee4bdc58c7c72d3bd160b9b4bd696e3013
-
Filesize
3.1MB
MD529ca787f3a0d83846b7318d02fccb583
SHA1b3688c01bef0e9f1fe62dc831926df3ca92b3778
SHA256746b972e21acb59e4086b5b25fe53ef2cddcecfa94dd56ad68c8e5bab9960c3c
SHA512a6c21bf5590dc91a5d9bc729d9c04c20b54341d3270efd2fb7d2b548d7dc7b23a1a351147a07dfd569e901a608cb44533304de10725cb02fec781cada80b8e3b
-
Filesize
40KB
MD5b18bd486c5718397bc65d77a16ce2593
SHA158fe73e27c5c04e6915c5358f698f7fe8c2b5af8
SHA2560bbf32b0553ca1292602e8c2c0458e075fdee2c8b6ef8ea81e924a86bc065f3c
SHA512f4ffa1c8983914c41657fecc11c9324caa5899ad875b9687da8ffcf79ab189f19d6f926e16f09f240de9e6b22e26691fae785ed95657af310de5bf6c58ce8e0e
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD50484c92972f6c7c99adbae1afa8a96b5
SHA176e04bb0e3a78cdeac1047f71668bc78983f312f
SHA256dcc199e47dd226031e90fdeeb5b8b216514f97844f2924be3c64d376603dbd2f
SHA5124bea68d0d8c25b04775d400297c21b4d97df176471b7377e20ad378e0df8a83956a2abf763477edfbc18bcc6304008c49ce4ea2bd4c31bc75a2341f61f5578cf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\pending_pings\4b232cac-51f0-43b6-897d-a23818efa2ac
Filesize10KB
MD51eccf477ca7d7b6ad37ac4b198183a32
SHA133561dcd71123bd12a792f8f60321393172d289f
SHA256159b3e4b0b936fc38e81895efbb967f4cb5442d0d6ef920bae1e3a9d4f7d0a98
SHA5120533d38efd856f10e700d972d06b754bb151b4154400e94e895eafdd685cf1cd014d6a0a9e01a92fb7afd79b424a2b201b64e234448a9ab5f18a0637fdb1aeed
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\datareporting\glean\pending_pings\f3cb3f8d-c4a2-42e2-8d2c-1483774bb75f
Filesize746B
MD546ef4c098a378ab3eca8fbf2c8622ad5
SHA1e6e95eb19e5a19418da7377cf1204bb964396393
SHA256ea6eefadcf5798e580f6d58855f36e5984161540cb72d8ce8722fb1549618e85
SHA512cdfc667f227df2fac5f90d0d79c6b7845ec633b983b20db2942cd0d0655b2b276c717a8c1049ea611adf94c76bcfb8839747e503936d76dcc2aaf9abd5c96c4e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5b0ef4ac5a480bbdb1692d439cbeb4fbe
SHA111d4ec8b49c342095b86bdcc34b0b6746513ce68
SHA256000a82543dcfd98ecb45c9fd4c21720b2ee9ff8ce17ff231e698aaa4ef101254
SHA51264474fb8c0549311e5d86066d1b9673c8a27d22e87b876d9e4cf6fe2e4e325dfeb6433b576f6cb5ec485b6888f540a1586114d4aa29ff373d20abbccce9d074c
-
Filesize
7KB
MD52bfe981ce24a9e09a3eafae120376359
SHA1ec6993d7686e4cf9c5940b7428d900dcd8a3fd58
SHA2561b83cfe78face18d02209816c6c9de9fe10af65175050e2a47ce95133f0e91f3
SHA51271337f65009548297282ce928f9797039e1f7083b8b6398af683da1dcef3d02531102ebabccf29279b97d4246c41c90c4baaa116abcc0d0c9c75caae19300548
-
Filesize
6KB
MD5cad76e190e56011b04d5120b9dad24bd
SHA126c9eaf09dc2115663a5f64915cd02d27c711c2a
SHA2568d7f23aa2619ae8a2188de252932438be16980e05307ac0cb0cfcd4ae7326f03
SHA512fe7f10a6f2e542291c136a943ea1bcc1231579570c5975f78cc3f7d7ab3905f983d6092b7e8baa95f37a2cff0bcd9a97643e2769a37aaaf19cf49f25b940fb0d
-
Filesize
6KB
MD5627ff455202209a390b833e5af5236e5
SHA1e4c688c5945fb504644ebb77f8494e7e3f2ad094
SHA25655c174a4b250491e405e4003eddf74b68f3d5d0817b0a303576a8b5dac81c117
SHA512ce9b218c35c34ee45badbd8e70239ef0c50e57051579648b3aae2e74e46afe74b187f6be8b26a89e55e798706da3913654e0acac1a12814d31de29178be76d8c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4
Filesize7KB
MD5ab47150b994919ebc2240b9fa85b9491
SHA15bd0a108679f0e1a91eaf84ef86d6de9d75556c5
SHA2565faae356b349a7451ed11409295b7ee70334c9eb02e574a3defc49f28da4048f
SHA512e422765e6011800a77a377aa7300fd5880581aa62ec24bdb0152a69757b276ff319144d9e9b11d777444499b8e0436e19a410f8a9be19333099a1b20f7445dcd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5770c4be6dc08bf42d163e0831db07bf8
SHA1d7ccc137c6edffe33ef7fe3cf3d96498336d986f
SHA256c907b95d3a5df186795016a325534cf398f2d4ae0bccd94ce1dfec18ad76900d
SHA512b587d760a052d4796c72f74522e68c59f60684dadb29d730e264618fe2c22b71f3b9de99d7a0ef9658c36dca4bc88181b9fe6f39ec510623e85efe8180eeebb1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4
Filesize14KB
MD506c2de593c2512cf26c422aaad681234
SHA18d3c1e96ccaac56f1aa8622dea5d501b3b5967b5
SHA256835262309dad52ce5c8a5333f81dc26911cf8f4bed721591f5821513b8c0bcb1
SHA512bd944ee4348abcb4b19378831d06ee13e85dc36259bf7b3273307fd0896f6f16f6894c66630312ce866ef7f1c1a902b7817bf9364d5ecf1a6b858de2b65969f5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD5b7aa0240932088c74832e5ecb5d5a387
SHA190972998095d7faaff8deb8ccc2406c83fb2aa30
SHA256d5dabe7d4c98119a2aa0731b27df1460e119de4a2099ceda3fe5e1bd5b818be8
SHA512d1d5e256d8be86c4887581154329f754fab1eace4f2c0be286c9e63e162e164b2df8b0a3aab0fd08c8cc4d872ec8c71bb92222a29d3728b0b020f2f991aba131
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\sessionstore-backups\recovery.jsonlz4
Filesize14KB
MD5f04deedb1728f7454adb6ac03694b916
SHA186129fa612bfe899d24d1e27affebc3fc31d786d
SHA25633be0f3b5617967b6fa29dacfa0dfe6fc1903512e2f83187b453a4483bf2af22
SHA512957715aec15f24a468feb671dd25b745835e46838e90c5def960a69fc49545dba732aa766aab00c1eafa9a8f934b81205828e1ecd61703759f197c547d69a413
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\storage\default\https+++backrooms.fandom.com\idb\3683324260srielfvreurs-.sqlite
Filesize48KB
MD5643c41fe398691cc7fb9ee832e3c4969
SHA177e501a5d15864849ebd4dd61066410120224f1b
SHA2561e1e88ccf7689971971ff6bfb114472e3556b4982d55cbe5f0ae6c6ac22552e0
SHA512dfc26b100b47bf694f728f7e302ba670fc5a68041564ad992c8f3aedeca1ce4087fa264c823d9249621fc4c4bcfc9e16918eb4f5d9504e3e08fa2e0120dda9b1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\storage\default\https+++backrooms.fandom.com\idb\3683324260srielfvreurs-.sqlite-wal
Filesize16KB
MD552252ffcdbe42e4555fe76b4cce3c8b2
SHA1d42f840cccf2d46ca51005d270f0306c8328e891
SHA256e50b6d6d6b6161515d7381d6a99a41faf169e633cc3d3cfa553722332c6d1c03
SHA512e3206c548eb320e68c0879b76995f18fa6a5511c89e0df75cb5f239b80bf81ba00a0f0f76d9ba982322ffd122ecc5854f890089671319a7c4a145e407babbbec
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nbjxj16p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD5b4e248b8f969358a7bfa32c68bda5789
SHA1201120599bc3a747d419adc989473b524b7bc56c
SHA25653bba6be73ce1c9b4ae9b1810a5225aaa7dfa9abd0ac1eb3e9b9bff37b266443
SHA512bd21e656c602c09e140eb153225054a947e3b446927d8bbe0720e2e6cfeff0b237e0a5deea5d575ee170479e0b8472799f19c553cf3955982123e32cca006c35