Resubmissions

29/03/2024, 01:48

240329-b8d7kaed2w 3

29/03/2024, 01:34

240329-bzjqpaef29 3

Analysis

  • max time kernel
    173s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 01:48

General

  • Target

    testestestestetw/triage - Copy (25).exe

  • Size

    1.2MB

  • MD5

    08b8eb8dd9681bfd0050fa7e547e1fd9

  • SHA1

    f810b716884668bbc554aae7914dd19f1c30c265

  • SHA256

    e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b

  • SHA512

    d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f

  • SSDEEP

    24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (25).exe
    "C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (25).exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4224
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3076
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.0.412256996\1577228957" -parentBuildID 20221007134813 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0416f47-7ef4-49c8-b9b7-0c4272ac2fbd} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 1996 1e56a7f3458 gpu
        3⤵
          PID:5100
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.1.1904559317\1159853295" -parentBuildID 20221007134813 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2343e9f4-e8bc-406e-b31d-1e65b83d0ce0} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 2396 1e56a703258 socket
          3⤵
            PID:3616
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.2.886532793\590800091" -childID 1 -isForBrowser -prefsHandle 2948 -prefMapHandle 3116 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25dfbb72-7be9-4ff9-950a-9428215b0a9d} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3276 1e56e97d458 tab
            3⤵
              PID:4588
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.3.675544584\1058583031" -childID 2 -isForBrowser -prefsHandle 2556 -prefMapHandle 1424 -prefsLen 26001 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0d05930-51d1-423b-abdb-67fb9edd3efe} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3228 1e55df71658 tab
              3⤵
                PID:5084
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.4.255663704\329796956" -childID 3 -isForBrowser -prefsHandle 3664 -prefMapHandle 3660 -prefsLen 26001 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd68d285-b004-48dd-a2ee-b1ebb8c573b4} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3672 1e56d597258 tab
                3⤵
                  PID:3884
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.5.1638571544\13902474" -childID 4 -isForBrowser -prefsHandle 4764 -prefMapHandle 4760 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90fc2788-195b-4bd9-afe4-d3bb200b0c65} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 4772 1e570480058 tab
                  3⤵
                    PID:1512
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.6.1080322414\850931224" -childID 5 -isForBrowser -prefsHandle 4772 -prefMapHandle 4348 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0245264d-27c3-4b29-87a9-681c664042d4} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5052 1e570b41958 tab
                    3⤵
                      PID:4308
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.7.326117592\1814406683" -childID 6 -isForBrowser -prefsHandle 5316 -prefMapHandle 5212 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {299e5ecc-048f-4f78-a231-e16114a9ba62} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5324 1e570b40a58 tab
                      3⤵
                        PID:4444
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.8.1336307261\1660070955" -childID 7 -isForBrowser -prefsHandle 5956 -prefMapHandle 5952 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00681319-c3d1-456c-b27f-bd28ed9d43b5} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5924 1e572277a58 tab
                        3⤵
                          PID:1664
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.9.1860636683\1568657531" -childID 8 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb428b16-6459-4922-979d-a23773dd669c} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3624 1e570369558 tab
                          3⤵
                            PID:544
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.10.694546196\47464463" -childID 9 -isForBrowser -prefsHandle 3800 -prefMapHandle 5064 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02a0ed81-ee45-47e7-943d-3841433b24c7} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 3640 1e5726c4b58 tab
                            3⤵
                              PID:3896
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.11.1780727239\229227109" -childID 10 -isForBrowser -prefsHandle 5088 -prefMapHandle 5076 -prefsLen 27463 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0e0e064-da49-424e-8f65-ea385bc5d41e} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5348 1e56d1cea58 tab
                              3⤵
                                PID:5880
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.12.329466650\1497824489" -parentBuildID 20221007134813 -prefsHandle 5204 -prefMapHandle 5324 -prefsLen 27463 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {301268f6-441c-49a2-b881-0533fe3b7acf} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5420 1e5709e4058 rdd
                                3⤵
                                  PID:5200
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1048.13.411125049\1207020670" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5164 -prefMapHandle 3616 -prefsLen 27463 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a142b1ef-1696-42d9-a68e-0e8fe57e68d1} 1048 "\\.\pipe\gecko-crash-server-pipe.1048" 5080 1e5704c0b58 utility
                                  3⤵
                                    PID:1324

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\12862

                                Filesize

                                9KB

                                MD5

                                571873936158a65b06b2aef2e56d4fdd

                                SHA1

                                18b438599173b5420b2eca285848d019a5fafb10

                                SHA256

                                87f91fd52c56855fb245c0ba25514ec6ab51ddc98f7b8d1b47239a9e72e24cec

                                SHA512

                                a624135d59cb1d09a5f1f0b30a627b4099c2b15fd2c857dddc1bb629259e849c87ff875c59dc778f0afa7af4da4e54c44db648043d6a1d05f31d4f4b859f9962

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\16139

                                Filesize

                                8KB

                                MD5

                                a32229db96d527dc995af450ce1dcc47

                                SHA1

                                28073ecc1af7ca21826a042f67a6ee25e02997f7

                                SHA256

                                49b57e63b18267dce7f1648fd8e22a1cf478018a3ff956b8d92d5b374ce19938

                                SHA512

                                76c24baa4e60a15b25a5202c9b985cf30a1c2cdfd024d546f7bcdddd345b9b57e891a2a89bc840126ff6996390e9f73dd07b1aa408bc8a733aea1edd26afee5f

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\16286

                                Filesize

                                9KB

                                MD5

                                9eefdbff5515b547ed4f6029dadefef2

                                SHA1

                                12dfc8508d3d5c9412596abaf940d639a79e4381

                                SHA256

                                3aea6ac0dc41abe480ab30de688b5dae323cc28e761cf5a857202d3d2c658efb

                                SHA512

                                aba841e2f9106537097b6ebc104ec379689c31fbabf17bd05166baf56eae2b0ccfadf3a798c19bd690b22ab281cc5738e94650dbdfc04d6cec1de5781a7882dd

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\17871

                                Filesize

                                8KB

                                MD5

                                7299fafbe5695ccfb008f7da8dc08eb5

                                SHA1

                                75c10c313f3421ef99bc577d8e15579f8ccd3ced

                                SHA256

                                1e98ed362e66c3e3a9f2bffc4aa015f2d9d072e8ea4c25cd237aa0d1e612c8db

                                SHA512

                                e6d4f2b31e411e037096d1720f92090f86214d34bd0d9cd7ded13d4ee4bc9e49cf76b655b3d02fca78f2b1a061f8a70dffe86d3fb3bbfe19d44f49295fe484ab

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\17935

                                Filesize

                                8KB

                                MD5

                                a7b12b26a34549811140796a9d01000e

                                SHA1

                                ee7ec4ef1d177796a69323a45cf746eba6c0ad4d

                                SHA256

                                2f2fbc956f7ef36a3fc954270431aeeddadfaa4e5b2c7649601a7abdf89f60e8

                                SHA512

                                ee03eee1a00c2143ab2ccf714d8d6dc5db48718f5c0bea99d86f4d76fac7ca324f39df399ab38a70a48dd6e802a8a9ec518caa296eae7d38b2e73dfd173735e7

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\20362

                                Filesize

                                9KB

                                MD5

                                241415d8aeb49df83defd65e6f8b2f64

                                SHA1

                                cc43f4063daf98d0319c92e10e57a26a4ea7dabb

                                SHA256

                                db2c6004fd262d8390ce168c4bbd994ff2bb7f9acdbce991d526d0ac27a13c0d

                                SHA512

                                a9b0c1c3c72219f436e81ae2797c76ee5b67662036665677fb2b539b5466f6c25e6934e0d6c25e4412aa3bd54bc928fc7fa21f30de574f5b72ef5cfd0401d755

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\21176

                                Filesize

                                9KB

                                MD5

                                9dc4b48ef747c555b32095dc107e5d20

                                SHA1

                                ba20eab19514cc04092257324c9f09302b3461c1

                                SHA256

                                d0e7927fa3620b23fbfc5851bf31d31f006a2e934b75d9462e4ba6062d77fada

                                SHA512

                                486510934da5166a50b9ccb416375ec7dc28a4b0f819786648613190f22c70cb862ea97d6b26036f6ef6591dac80c8d2feffd85303c75ffe4d009862314b84fe

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\22405

                                Filesize

                                9KB

                                MD5

                                a95f1b2863d5ffee2998451f27143514

                                SHA1

                                27597622bd2d17451067c16c1b9f902f25936321

                                SHA256

                                1714e0048fd177e3a2fa7a3281f91f854b8bd1f1df73eb0d3df0e966043f3d36

                                SHA512

                                8ecb67851ba0c062c988cd1e147949498131fbe2c9908db4265c44f7158d2ec9b738af19e2e463f71fc3e6b2936a461f885e8fe7f07c3232918590421191ea54

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\23415

                                Filesize

                                9KB

                                MD5

                                082e638664e9da7f7f090c587c50bafe

                                SHA1

                                c2de78462d87ca4a5b9459276d5d808b787ab6da

                                SHA256

                                f59408afccd58d140df0b7e28f447910cf9ac3663adbe0be7f4de0e176ce698e

                                SHA512

                                24e0f37a5cc9b40ffe9b5de2659a7fe9ece0acc92abe37e2f67b1e8c1152d0b48262214a017cdf089844e0ddfc8f52cb349f746d35a74672f4d0f242cdeaf588

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\doomed\29149

                                Filesize

                                9KB

                                MD5

                                d24bea30863d36a8c26f420c21a1bd6f

                                SHA1

                                bde5de1141a3fdea92e178655d4f902d0dc37af5

                                SHA256

                                0a2d67b047729dd8825f0a687b0ab3d39e3dddda2f3ac9e105c2679a72b13a84

                                SHA512

                                d8ab20f34225ef4e65331879eab41d7892810426023718fa6a526b020d1813433e02b8d4cc1f277aba0a5d331b98513d11a94c1600f03c8e813c0573e8857df3

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gaix9yhh.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690

                                Filesize

                                49KB

                                MD5

                                530fc147ca3c2194783a20387df1187a

                                SHA1

                                eb15747801a34a67253fc8b27e306aa259618308

                                SHA256

                                a218b9c93d61d25ba9fa02f734ae94e9c5a4a2d89e29c53cf84a6bea9691e556

                                SHA512

                                842579c30d0755bc45085044b6e54a626597b19443ba37101e46ba3baf4f2c042157592f8cc8cc31527ad6d7567fac8c8b2e952956ac21b9415f9686a40db9cf

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                Filesize

                                442KB

                                MD5

                                85430baed3398695717b0263807cf97c

                                SHA1

                                fffbee923cea216f50fce5d54219a188a5100f41

                                SHA256

                                a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                SHA512

                                06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                Filesize

                                8.0MB

                                MD5

                                a01c5ecd6108350ae23d2cddf0e77c17

                                SHA1

                                c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                SHA256

                                345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                SHA512

                                b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\datareporting\glean\db\data.safe.bin

                                Filesize

                                9KB

                                MD5

                                bb6cb35b13106097e21ceb18aca66622

                                SHA1

                                f90f28ccc39e08a5b1d9140f02a398adb67ac22f

                                SHA256

                                c00bfac0e46c7cc781550284c7635ad885d969d751fdaeea06ddc9e9ede466d2

                                SHA512

                                4c4039ebe977ad430998dcc760bd1fbb7e6f42b80a44016a40f79d065eeebe9e4a190371f3f9cf803b33d1fd894c6ab869bcbb7cdcadc288b607140742ce6435

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\datareporting\glean\pending_pings\42255e6d-e750-44d8-9707-9934c8337124

                                Filesize

                                734B

                                MD5

                                ce422f67d8ef9bf81121d2dec0f74108

                                SHA1

                                4103f95c9a7530dc4508c44ed87a9222445127c7

                                SHA256

                                cec0d2d1b669c7f786c23d9c4e8483a1f795930942c3d5dd2ff97a947916f31c

                                SHA512

                                0a2438910d46bba511fb633d561bf18e375062e78caea4383ac7445a4b5e9e317c50ad97c9a5a6f95f16dcefb82d0b676745dc7d6cbc071b825114ff0e4c6ae5

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                Filesize

                                997KB

                                MD5

                                fe3355639648c417e8307c6d051e3e37

                                SHA1

                                f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                SHA256

                                1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                SHA512

                                8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                Filesize

                                116B

                                MD5

                                3d33cdc0b3d281e67dd52e14435dd04f

                                SHA1

                                4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                SHA256

                                f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                SHA512

                                a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                Filesize

                                479B

                                MD5

                                49ddb419d96dceb9069018535fb2e2fc

                                SHA1

                                62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                SHA256

                                2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                SHA512

                                48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                Filesize

                                372B

                                MD5

                                8be33af717bb1b67fbd61c3f4b807e9e

                                SHA1

                                7cf17656d174d951957ff36810e874a134dd49e0

                                SHA256

                                e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                SHA512

                                6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                Filesize

                                11.8MB

                                MD5

                                33bf7b0439480effb9fb212efce87b13

                                SHA1

                                cee50f2745edc6dc291887b6075ca64d716f495a

                                SHA256

                                8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                SHA512

                                d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                Filesize

                                1KB

                                MD5

                                688bed3676d2104e7f17ae1cd2c59404

                                SHA1

                                952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                SHA256

                                33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                SHA512

                                7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                Filesize

                                1KB

                                MD5

                                937326fead5fd401f6cca9118bd9ade9

                                SHA1

                                4526a57d4ae14ed29b37632c72aef3c408189d91

                                SHA256

                                68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                SHA512

                                b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\prefs-1.js

                                Filesize

                                6KB

                                MD5

                                c1cff759155f85d3d546c7d424a7fa00

                                SHA1

                                7abbe28b6340cab4c01f1c2024007e417aad317c

                                SHA256

                                ca54be882cd680e007230d61aafb2915f0899ee318391186cb31d1b03c0e3182

                                SHA512

                                bfb9dad4f0a0743bb3096abe379aa9bbcb16386bb378e52dff8506b769bd69c82f8adf1493d0dac577f072d0cb0f96e9675843a163c1f232de9996a82de5cada

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\prefs-1.js

                                Filesize

                                7KB

                                MD5

                                f335775647809003562d6cd86cbeb3ee

                                SHA1

                                7419a600c62473123449a8d59544652023402b61

                                SHA256

                                08bb9966fd8742fe6f066a24bfaa25bcf8ec9ada4155b3d2cf8a1ffba23669d0

                                SHA512

                                9ce1df85e3b457064b4a28ac3d45e77adfa2b0cbb9c94a504b8a1f12f40a02a41c14ede3239bd3384655b70ccf4be7c3933cfdbb0b82521690ff772e0cb581ea

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\prefs-1.js

                                Filesize

                                6KB

                                MD5

                                739aa2bbdc94b7bc704b278c3087fc91

                                SHA1

                                d47b51575a806f47f6e077b513846f59cc8e7d4d

                                SHA256

                                29899e3ba4f9fe7186a6e52ce448e662a2ddc87998bfa918efed0df6f80222ac

                                SHA512

                                2190e399ec81b4a68363e3830e5381a64ebd92cdb8ae68d47bc463ac4493742fd8310d2880ee3fb3f16afb3bb11258b6865bebc3940079083739d77fffbf89fd

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                7KB

                                MD5

                                9c56f91d051d1d59297d60cbe31328df

                                SHA1

                                4768c4af0c108bd4b73486b4ffa9edbd580e7278

                                SHA256

                                96997284c7b8faf4d643f56b8199410793a0678acbe0a942df8b22f8bc4e4a45

                                SHA512

                                3e1ae7d142ef74bd0f5890c09b44827d33a5c3e74a4d68e471848d9f9b67ea4eca7c5eec26005aa45d8c11c6d025fc064d13c72fc8aac107fcdbd0c341b12fd1

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                3KB

                                MD5

                                fe759244d1d32e24c66d5f29028fb6d0

                                SHA1

                                82c6c8677e738dfc46b7bb0d1b8fc83d2bcec291

                                SHA256

                                1d44d4e2bf2befb04e3c620fdcf6b1c9a1c76f224e3aac97284237faaf8bad3f

                                SHA512

                                3853a63c997ce013367c32201a4348dd642b2a2bb8291921ef0da0226401508ee2ced296a0cf75895990037782c4917dc5e1521491c2a1cc53249a9a39bb262f

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                4KB

                                MD5

                                90bb37f0f80e7265d4d1e3317ed61fde

                                SHA1

                                2acd6956ba5c4ec18a0c82cb1727bb60aebe1b69

                                SHA256

                                16b9dd259e57714d3fd3129bf76a9706f2abb16431db9454da2ab0fdf652367e

                                SHA512

                                0397b98ced0ce50a4cf195121a168be4a880e48467b0ebdd7e4cf9dcfb20d8f0e65a7713949d60df6f11a2c00a24cef99d2671008a88523fffec1aa823573121

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                10KB

                                MD5

                                8ad88a3a334d032db585310052ff3c88

                                SHA1

                                f496b17977618b5e70c14bea80900977a2a5e616

                                SHA256

                                08c2faf6118eaff6a2b7584aa31aa2f90ea313e5f4ec7db1f080d87ceceff921

                                SHA512

                                076f9b382e2669a2acf7c08226d35b6649d1bf62634b5e9de8eb958bda662662d71ec0dc56afd1724d774024cef1b397b0c2c360d5f210df336855d62d56e644

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                10KB

                                MD5

                                2c5f5823b4707c1aced9d6f76299ed4f

                                SHA1

                                537936724707e73f594223b8c0c849b0101df928

                                SHA256

                                7f2e58010c3ae25978adf39a3bf4cb017fc22aa1f8ce115200d742c5e419d5fd

                                SHA512

                                44f0901212c82f4fdf777096ada9229942a840e7a1aad10b3e4d8164d3a5727268816c2493f70d371d9f123948a0001f8285d6a4e38e5527aa5e91e42e2b8dfa

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                7KB

                                MD5

                                8f0b5e62af328fc1ccb699914b79a874

                                SHA1

                                64c5759dbc4edeb2cffe8c4e4cf5931228a0dc9d

                                SHA256

                                924f27442a231ad66b90276ea06867a6c1636eedcddeb898f877522e7fd40a2d

                                SHA512

                                4c063880a9e98a51a9426530daafdad6bbe39d080102db1b9a47911c4c539e5495a69ff8370171310e1aa6c233641556166407f36871f1b260957bf44daeadf3

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                10KB

                                MD5

                                e0e749d34a95ecda61ff74709f8a9473

                                SHA1

                                46d096786df1fa9f3d4d7e784596d1b661615c44

                                SHA256

                                0b1840d768f061ca2af78c1f99537b4a60d0d979555243e145ed713c13b3547c

                                SHA512

                                9db6f12cf84551a81b1ae574af5dedd96b71bef37be953217d21fa5a418e8f2113d333206976db5a71dac7fcb5bc4ddce6902b1f0e3c14ae8261552822838f6a

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gaix9yhh.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                4KB

                                MD5

                                0d8afdf22509488161062feb8e1f2b3b

                                SHA1

                                75975ed38b77f83d09cbb45235fe677e96fc15fa

                                SHA256

                                c24001b7ec4f43da94ea5564d5478cfca5754142a7f8eee6ddc77e8d5c3cf23a

                                SHA512

                                068a98d146e2d4ba1c2871dee69549368c15ceeeaf90fc6ab735c8a25bd5cbe2d7f2955cce6fa7a2309bb51261e239b9cb5f351b5e724d6171556b294e30b8b1