Resubmissions

29/03/2024, 01:18

240329-bn94hadf8x 3

29/03/2024, 01:17

240329-bnwacaec43 5

29/03/2024, 01:16

240329-bmzalsdf5v 3

Analysis

  • max time kernel
    473s
  • max time network
    483s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 01:18

General

  • Target

    testestestestetw/jasdasdasdasd - Copy (8) - Copy.exe

  • Size

    1.2MB

  • MD5

    d56d4b12a8d0f7d4a5a94c2ebe246513

  • SHA1

    95543e702e65b8fa2a115c9bbd30b2feab11f9c7

  • SHA256

    f290fa5dc611042d27c5bb90f063ea2583053c273b0ff9bc0209533038410991

  • SHA512

    516a94e244e8650ed5eb358c2cd781f0c827dca33db14534570f908d1dc52c83492d8f63fbf0578f15f0db1ee3eb5ed184fc3b784698464184604bec1bf2ac1e

  • SSDEEP

    24576:LdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqBO:LdofGbSIQ177wZvYjiiRDXASat5RgsLN

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\testestestestetw\jasdasdasdasd - Copy (8) - Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\testestestestetw\jasdasdasdasd - Copy (8) - Copy.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5096
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.0.260526784\1011874346" -parentBuildID 20221007134813 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 20671 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d12a46ec-afd2-4755-bbfc-61bb235beb35} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 1972 1ee622f7658 gpu
        3⤵
          PID:2344
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.1.1924828961\272567407" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 20707 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16c85457-6df5-44fd-9784-0d84cf15297f} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 2376 1ee61e3a158 socket
          3⤵
          • Checks processor information in registry
          PID:4008
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.2.438761995\1765889497" -childID 1 -isForBrowser -prefsHandle 3224 -prefMapHandle 3220 -prefsLen 20810 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fdf8873-78ef-4580-b17c-49c1903c7661} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 3236 1ee662f3b58 tab
          3⤵
            PID:2916
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.3.2053501770\1945729180" -childID 2 -isForBrowser -prefsHandle 3824 -prefMapHandle 3820 -prefsLen 25988 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f4bb68b-0873-4fc1-bf43-078fb564f320} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 3828 1ee4e662558 tab
            3⤵
              PID:2356
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.4.1103379397\681201526" -childID 3 -isForBrowser -prefsHandle 4580 -prefMapHandle 4576 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6bb0879-9883-4973-b4b6-ef5168b96802} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 4588 1ee68092058 tab
              3⤵
                PID:5240
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.5.221198609\1833824175" -childID 4 -isForBrowser -prefsHandle 5108 -prefMapHandle 5060 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40087a06-b536-42ff-8b77-22a51c9bbe81} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 5064 1ee6854a858 tab
                3⤵
                  PID:5644
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.6.1555833984\1485160289" -childID 5 -isForBrowser -prefsHandle 5244 -prefMapHandle 5248 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f137ede0-111d-40ab-99ec-fac750b7e1af} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 5328 1ee6854b158 tab
                  3⤵
                    PID:5656
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.7.1251769888\352046792" -childID 6 -isForBrowser -prefsHandle 5436 -prefMapHandle 5440 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7ed2e0a-4f1b-4b80-bcf0-e7169bd1248e} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 5520 1ee6854b458 tab
                    3⤵
                      PID:5664
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.8.1450409492\1701251571" -childID 7 -isForBrowser -prefsHandle 2836 -prefMapHandle 4760 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {355eb89a-0624-44ed-9753-5b97804964d3} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 5788 1ee668fb158 tab
                      3⤵
                        PID:4468
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.9.1537805382\1884360364" -parentBuildID 20221007134813 -prefsHandle 6040 -prefMapHandle 5984 -prefsLen 26047 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1005f893-524e-40c2-a0e0-61dd20d3d713} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 6032 1ee6754ee58 rdd
                        3⤵
                          PID:5636
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.10.7326802\1368802194" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6092 -prefMapHandle 5844 -prefsLen 26047 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e2be2de-1cd2-4444-a1df-7f4ce1a44c3d} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 6060 1ee692e3258 utility
                          3⤵
                            PID:868
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.11.25229014\1903895439" -childID 8 -isForBrowser -prefsHandle 4636 -prefMapHandle 4744 -prefsLen 26301 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {689a9ce3-4bc5-4b64-873f-17a2c59fc95f} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 3212 1ee693ac758 tab
                            3⤵
                              PID:5416
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.12.2031535179\30090682" -childID 9 -isForBrowser -prefsHandle 4808 -prefMapHandle 6340 -prefsLen 26301 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {257b19af-df8a-4160-ba5a-8fac487d8772} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 6348 1ee692e0258 tab
                              3⤵
                                PID:5448
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.13.988721910\1661036639" -childID 10 -isForBrowser -prefsHandle 10404 -prefMapHandle 10408 -prefsLen 27304 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12c7bc95-8e4f-49ef-9e87-80a47ca9b913} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 10440 1ee69946b58 tab
                                3⤵
                                  PID:1460
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.14.1275096971\1849149468" -childID 11 -isForBrowser -prefsHandle 4712 -prefMapHandle 5680 -prefsLen 27626 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a70b6506-5357-412d-a3f1-c16b7274ccbd} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 3592 1ee68090e58 tab
                                  3⤵
                                    PID:6800
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.15.434529191\1093459868" -childID 12 -isForBrowser -prefsHandle 10768 -prefMapHandle 10452 -prefsLen 27626 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c126dd36-5d12-4b8e-a685-de07a165b287} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 10624 1ee6830c358 tab
                                    3⤵
                                      PID:6460
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2576.16.458831937\2014182644" -childID 13 -isForBrowser -prefsHandle 5600 -prefMapHandle 5588 -prefsLen 27626 -prefMapSize 233414 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {380fb921-0234-404c-ad73-56303797243d} 2576 "\\.\pipe\gecko-crash-server-pipe.2576" 5612 1ee4e667b58 tab
                                      3⤵
                                        PID:5208
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3312 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:8
                                    1⤵
                                      PID:7004
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3900 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:8
                                      1⤵
                                        PID:6812

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\14144

                                        Filesize

                                        8KB

                                        MD5

                                        cf818e6a97efead726a0c451ea75d914

                                        SHA1

                                        9e91d5e7237a8c35383af95ab69454a2867d6735

                                        SHA256

                                        0a6ca600e0080112dcb9208112beee75dce9f093c08c10916bfe61df68823fd4

                                        SHA512

                                        3a841514f8490da3e80aecbf28d22ec15220926a077aaaaf6607c17c38f8d5497a9a529bf920709f430e9ff52e58063a35355009b54086319d0a9f14e0156df0

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\1442

                                        Filesize

                                        8KB

                                        MD5

                                        def100699691c8d0e4b87063376405fb

                                        SHA1

                                        94824cda92e87175343bedbb66577e66b631cb7a

                                        SHA256

                                        0f2bf6a95d8e468dcb33c5b38019a373d11925b506602947b3758394c1c68d1f

                                        SHA512

                                        e88fd6347df3c30260f2a15d82cc94e9363de01c5eea56a03fa421354096c1d6f10af8c1668af2c7ace111cca4e0b690288cd15d6155bba98dede2f0a5405499

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\1686

                                        Filesize

                                        9KB

                                        MD5

                                        c4a520bce43ccce02ada43ec030356ca

                                        SHA1

                                        df98685d10f5abf5c8535de881b0de2d642fb8f6

                                        SHA256

                                        02790b886204017cd572c43239cb36df258eea8edf83ebb957d7fe25780e1a73

                                        SHA512

                                        d410cedf817fbc0961bb72b7033fad1427b88a003d89f1394bd1ca0d4554fec4dc7fc9f2f1659659b6ef8ab49f6c4f2f761bf48464f8893fcf212786bb37be71

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\1709

                                        Filesize

                                        8KB

                                        MD5

                                        4d1400a6a68de1865dd29a92af464d34

                                        SHA1

                                        e6b3abb94a49355d2e4bf9a274f421392a2d57aa

                                        SHA256

                                        94cc9bd1b5bc10cdec8f06904ad86a15e5cb5429d45cc57b2fb0b0e2681d4482

                                        SHA512

                                        2c62359e6829ad2b21690cb32cdb1ae7c960d94df6befc51232b705a1ebb574eb4e39dfbe2cb9ad166686eeeb57ce0e4e2be7ffcf0ac704484615f9bd78c5524

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\24873

                                        Filesize

                                        8KB

                                        MD5

                                        98a7004f6d6d06326fd0355eedb71e2b

                                        SHA1

                                        87c7b57010e94f79bba61210580b79f1e8abd356

                                        SHA256

                                        e3c4f8cb687d0dd7c3ce2e3d338a2dd7fff3b234b00557f06bed66521979871f

                                        SHA512

                                        7a8b3c02585ab2b772c1eab9c654265fbb9526c9257bdf7ef3b7a667a41df5fec5dc5cd371af4309fea3aa2ea173356404620f019a995838dca9192dc7a53499

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\29439

                                        Filesize

                                        8KB

                                        MD5

                                        b3ab375e20aafb613c1d05d2f5a5f3c6

                                        SHA1

                                        1aec4ed0bc526dc6fc2d5b3b9d87f8232aa338b7

                                        SHA256

                                        685630a0c3c7a5a3a48c292d5406251cce8669d1aa31242e16b2cb12e4c360f6

                                        SHA512

                                        33f3bad5644156b29fd3b27077fcaf5620136338dffd033e44ec4c1a021f25c1fff1d715c6c4d13958258325eae39d59792074e5a8965411c30d573c41a00646

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\31447

                                        Filesize

                                        8KB

                                        MD5

                                        a72d27c2e693bb4d8aa077154c4fbe98

                                        SHA1

                                        3844b9b5babb37dea0a1abec6854f23b168bdc71

                                        SHA256

                                        0eba280069d7b63c25eff4a6c54ffc09222ae2c12411cfa621e3398fbf900d22

                                        SHA512

                                        73c0bebba46be8ca72ed05127c05a586fc8347f84c3940395dddc84f1c9d669b08caba738fd6f6345f381fc247d12853f20d2112e8713ae78bc13409e6ba1500

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\3550

                                        Filesize

                                        8KB

                                        MD5

                                        dc929475be18c7a1c62c0e70db914d0e

                                        SHA1

                                        ddadf856398813057be770a49e6e34f4573d06f1

                                        SHA256

                                        765739e7dd8283905a136a3696b93b391783896e8d4f2bb1c6420392f9581647

                                        SHA512

                                        a47e9e7742ba572cee842ba5769b1be460deac83e6f3a6c6a94ebaec0d9c4c3b7c7395a984cee9bbc5cfa6e36437d58690e9588bdcec91358487003827f94259

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\8902

                                        Filesize

                                        8KB

                                        MD5

                                        137bbaac0e1e8ef44f72f20085caca8b

                                        SHA1

                                        e06d05d7517f880e7d54d8c36e78a06aa6cc8bcc

                                        SHA256

                                        e23a6bb9a9e29e5453ff0ef60bdebb9ac3046dccbde03d4e2b9e74a888445e9a

                                        SHA512

                                        859e9da74c6c031c08505206adbd0a84d8a32f51f92c5a3af330b6f562521837887f920a86e7d32cac05d6984a0708e6fd2aa990b65676bafa4023dbe1c6a215

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\s7sufels.default-release\cache2\doomed\896

                                        Filesize

                                        23KB

                                        MD5

                                        c38907884b517039fa186e1cf13271d5

                                        SHA1

                                        7413c5126a5028a69a7a228bba25642a41edc8db

                                        SHA256

                                        5c2b287775756e0ab30a808e9e4a6da8604702eb02e6949f6f4e8d43a97cc8a6

                                        SHA512

                                        f595592bae2cd5594d21371dda4935c1ae052646fa37599cf1ec2974bc9640950ac2462a3ac4a6aba43dd1384eadcd4e119df6d2f31b297b6fea0e21d7134f99

                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                        Filesize

                                        442KB

                                        MD5

                                        85430baed3398695717b0263807cf97c

                                        SHA1

                                        fffbee923cea216f50fce5d54219a188a5100f41

                                        SHA256

                                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                        SHA512

                                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                        Filesize

                                        8.0MB

                                        MD5

                                        a01c5ecd6108350ae23d2cddf0e77c17

                                        SHA1

                                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                        SHA256

                                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                        SHA512

                                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                                        Filesize

                                        10KB

                                        MD5

                                        e9484c16b73d6ca30b1e6b23d31205c3

                                        SHA1

                                        6bb70fdd536b38cddbe796243aaa5e0c05f8cb98

                                        SHA256

                                        3f89279f27200b5efb3d7735fe1779c140deb5090ac59189c3a8b53e574ec23d

                                        SHA512

                                        8d6ca31c09c844e9f629cd02ce8b2ac5c7c64834a92e3c9fea7af77621b2aa7b354d046addfe8eb3955bd1bd11c246c94ad1655853e14bb087cc65c8078d1961

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                                        Filesize

                                        11KB

                                        MD5

                                        b533842a68f154ccf8adc48d6d0b5966

                                        SHA1

                                        81cedcf7e0711332468a81204098bd2ca7e38afb

                                        SHA256

                                        254aa690c6f3d74439df060a190f0c19d80485559675e2c2f79454eaaa4d5a96

                                        SHA512

                                        8510c0b1135477f8346eff2041d5850dc9e5713e08f27f0dcf18c76285196ae8393aeb29957d8c15478423f0eab2fe31dc55223a4310d984044226143fb08d5c

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\broadcast-listeners.json

                                        Filesize

                                        204B

                                        MD5

                                        72c95709e1a3b27919e13d28bbe8e8a2

                                        SHA1

                                        00892decbee63d627057730bfc0c6a4f13099ee4

                                        SHA256

                                        9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

                                        SHA512

                                        613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\datareporting\glean\db\data.safe.bin

                                        Filesize

                                        9KB

                                        MD5

                                        13fd803eb5733d5ef93143f30e06e23c

                                        SHA1

                                        7a37cb6d749300793161d468618c44f755b40f2b

                                        SHA256

                                        374018ada026fdf8a87d35ab5cf84f99c199e1213abc52691de78434710b1c24

                                        SHA512

                                        0f34a2ae9cbeb68422b5659c6bf42cd4c56311d2f02022cc062ba65f89c74145a29d5e913ab2e620fbf24e7c40df7f1d27b6f3f2fb785cce6596026e2cf16334

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\datareporting\glean\pending_pings\e424f517-13d7-43ce-93da-2832e01cf04e

                                        Filesize

                                        734B

                                        MD5

                                        6b210217ce35240c107399c1e58e9c3a

                                        SHA1

                                        d786520a44fda1db19b5fb133afe04b554df4525

                                        SHA256

                                        18f168b849a0500584504bf19615ec672180f3bd9d119b5b38d45f5d68c2beda

                                        SHA512

                                        7c8ff90b62e36cc387e7013e6f61b75517f9bcf1a9b1f2f3fc84fd67d9ed048d08d4c1efe689b4c19ce13f1250e6d7d53139b1cfec2b890bb44087d5c447df8f

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\favicons.sqlite-wal

                                        Filesize

                                        352KB

                                        MD5

                                        c4ec0418273addaf8975288fb429bc2f

                                        SHA1

                                        52f2f5bcc9cef5a8ad42974501d379e19d74f758

                                        SHA256

                                        d11f9ab5b4346143a2d1a8c1c40b4dc78a8e2353087b54cfe84e90c9db020b0c

                                        SHA512

                                        e90b97b7c7e9a590ddcdc42af140d3761968a65e32f2bce6f94a151b1da5736570ad36e236ecb6f3af5d3c36f773262b90df98d8e03ffc7aeedc6af606c9cdc0

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                        Filesize

                                        997KB

                                        MD5

                                        fe3355639648c417e8307c6d051e3e37

                                        SHA1

                                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                        SHA256

                                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                        SHA512

                                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                        Filesize

                                        116B

                                        MD5

                                        3d33cdc0b3d281e67dd52e14435dd04f

                                        SHA1

                                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                        SHA256

                                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                        SHA512

                                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                        Filesize

                                        479B

                                        MD5

                                        49ddb419d96dceb9069018535fb2e2fc

                                        SHA1

                                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                        SHA256

                                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                        SHA512

                                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                        Filesize

                                        372B

                                        MD5

                                        8be33af717bb1b67fbd61c3f4b807e9e

                                        SHA1

                                        7cf17656d174d951957ff36810e874a134dd49e0

                                        SHA256

                                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                        SHA512

                                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                        Filesize

                                        11.8MB

                                        MD5

                                        33bf7b0439480effb9fb212efce87b13

                                        SHA1

                                        cee50f2745edc6dc291887b6075ca64d716f495a

                                        SHA256

                                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                        SHA512

                                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                        Filesize

                                        1KB

                                        MD5

                                        688bed3676d2104e7f17ae1cd2c59404

                                        SHA1

                                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                        SHA256

                                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                        SHA512

                                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                        Filesize

                                        1KB

                                        MD5

                                        937326fead5fd401f6cca9118bd9ade9

                                        SHA1

                                        4526a57d4ae14ed29b37632c72aef3c408189d91

                                        SHA256

                                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                        SHA512

                                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\places.sqlite

                                        Filesize

                                        5.0MB

                                        MD5

                                        b9ce62d574dd91bb8bc1a6c814f25daa

                                        SHA1

                                        e54841cab3618c265faac60b676464d60b39e148

                                        SHA256

                                        f8cec65395592df776e9af26d5f938fe01e25ea366107ab0bf9a4cf588b08bf6

                                        SHA512

                                        51af27adaa992e294c0d5a8312475b5f4b7961f34cb21b4ca8417cb03535ab574266c85b48f8b1b33ae08a197dc090a22a578ad66607a9b9ca2de1d184cbfb3b

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\places.sqlite-wal

                                        Filesize

                                        3.5MB

                                        MD5

                                        107a1c695990b5e498acca1f8e67bdf1

                                        SHA1

                                        535d4415e2ff9f87c5ab348f048a4819e208ce21

                                        SHA256

                                        f417b0ec105526d2e4f03703adf7dbfd1d051b90cb2ae66ec166e38b6d8f9b3f

                                        SHA512

                                        2c6829e949fb43c683055f4d78b37078d4880020170626b6dd5f6c745e7cf2977f88438465c766c5f6661f094b8b2ada72be88426c9b0837de73ac50c5adc989

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs-1.js

                                        Filesize

                                        7KB

                                        MD5

                                        1a8e551e202ca203e17f1427a5013bbf

                                        SHA1

                                        cd197a4cb53044262006eeee122bfecb9971cf4f

                                        SHA256

                                        df842bb61769e6b2aebb59f7b6a645fcfb3ee4564b53a95fb6856bec50b3a42c

                                        SHA512

                                        cadcd3eeefe3053f39de51fb4874b5d2507563ecbf0b91556e0f1fbfff5a032c17ad9277d5b0d0235a36245abe5dbdfdf71a5958c90f1f725410e887eb9b1f19

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs-1.js

                                        Filesize

                                        6KB

                                        MD5

                                        a4df9f2e420631b8f3056bd53ce8b68b

                                        SHA1

                                        8bf53ce06c2df25ca01a3ce37e87f698736bd539

                                        SHA256

                                        55ad706d7fdcbc71a7bbdee0a6eea3567f08866d7acc2de91557f73390592e83

                                        SHA512

                                        f922d62bdd2e19e9397339559789635e8b02e4d30ad7cbddb4f3d7392f798e67eee504f00708c7d85f6cd7e281ce880649f57f1cfd36b72f4338a4bb4fb7d343

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs-1.js

                                        Filesize

                                        7KB

                                        MD5

                                        58e615b7af9ac295b0f139cb8e0b8735

                                        SHA1

                                        fed8a14d5b29441a48fccda4b5ba6d6732b5424f

                                        SHA256

                                        2229784c894020413da819c650d3e4b58e114e07e06b9fd417101b8da1b5af3c

                                        SHA512

                                        22f61fe77c76f0ebabbe9c939d2eee3338b80afc6086559f25aa0a857d24cccfee381e18e2e992226f8d83c3271c4af7e54a3791a83b3e65c24e120932310371

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs.js

                                        Filesize

                                        5KB

                                        MD5

                                        b670ed8d8a90669a01024220851867d9

                                        SHA1

                                        c7be8a160d98d18cb342811fb9f5757ccef76477

                                        SHA256

                                        c4dd887ec07b703c46e62701a5c7bf6934f24b7678f1cea30a4db8dfb0284925

                                        SHA512

                                        992dcf6a4c248c41d7d19cb88bdcd8b28d992650cef48caabb388a4c7d321055765e928d3a64668bd7c2cc24339174d22072d42b8bd170b4108583596762a46e

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs.js

                                        Filesize

                                        5KB

                                        MD5

                                        8b7b939854041384f1e0993040ef7080

                                        SHA1

                                        b2b057e79da0fcf9b8f84dc8728a4ce961449459

                                        SHA256

                                        70c362dbad9192ff1a5c4f202b34989a463ce4b4ff9b4687c66e80af3a1fec68

                                        SHA512

                                        2602945d50c60f434f098e03d7dedbf01526d6906a07088d931681e3a5658434a29f3862eaae637dbd195b9ca09692742fe511a68aa29e640cebf209b6242ecb

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\prefs.js

                                        Filesize

                                        6KB

                                        MD5

                                        68ae7eab40ef65866568f069322f6ce4

                                        SHA1

                                        88fad0ced45a21fdcba0fbbe302a99ba749a0409

                                        SHA256

                                        84d8e06b4d4a5322ea9011f7451e1c9fdf9957a0331b8a57b71d2c32df2919a5

                                        SHA512

                                        4c8bcd72154563c6e485b6516db291f7aea544bc8cc7a45bf9b6e2f88851cf0c23bc23d5eb75c4ece9ea931997a830fdb258bae3d15838918081e8ac5b325ac3

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionCheckpoints.json

                                        Filesize

                                        90B

                                        MD5

                                        c4ab2ee59ca41b6d6a6ea911f35bdc00

                                        SHA1

                                        5942cd6505fc8a9daba403b082067e1cdefdfbc4

                                        SHA256

                                        00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                                        SHA512

                                        71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

                                        Filesize

                                        9KB

                                        MD5

                                        8d0cd55b804d7a62922c4a78e3b8f711

                                        SHA1

                                        33269d66da7aff8dc867deea6990b4a3ffb91444

                                        SHA256

                                        edffe86315d56d2632ba299ab33d2524492e754697ab1f95d2b051ff0507c4e4

                                        SHA512

                                        6bbb610a68c73be959421e4acd7468647245c48e94d62fb626b463ea7a4948c61a3da70a7920c2f71200516160e77930f82e568026fec0adf94a6a2d887b0f5e

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

                                        Filesize

                                        9KB

                                        MD5

                                        64b1214039cfe90c6262fbb34a995a5b

                                        SHA1

                                        e3e8e177d0069b687f7a17065d98408f23e226d2

                                        SHA256

                                        51a9c9a6b2fc34571d3f54260d686569a758e00dcd45239d07b59a0a0db0ad09

                                        SHA512

                                        a54881e61af05af925b46f37803d7e518da3b3390f4a0d3f79a415dd81ad1c4e5e62b5c854921f28907b5d8409a1eaa0b3a02e5b4bad1ddc87f11ac066b60f2d

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

                                        Filesize

                                        1KB

                                        MD5

                                        55ac43552bb942e3d27b3fc6d29a62d3

                                        SHA1

                                        7257dce7e0bf0c625757cb3a81aa7f92d6629e4f

                                        SHA256

                                        365e1cf29cda6ae82a46da59e1bb00ef29cf4afc368e62ba675a5fec2701618b

                                        SHA512

                                        6b4ea47c7efe033de74c8809afd5c0962d8ca48e8c948402070498883a8fea19f3cf926a7dc4407665343e4ab62868e34b8135b393ff293a7ee1c98b4a09881d

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

                                        Filesize

                                        9KB

                                        MD5

                                        58a75da8d64f620456d470aa3438db4e

                                        SHA1

                                        4e98a5af082cd109cd2dc28863a352266c2c6ab7

                                        SHA256

                                        5aa02d5c74f2966f7e4b32d68939ac268cc666522db4d986ec4f5f6c6bb31ca1

                                        SHA512

                                        e57a4451ffc86fc883f520698c6660941b41b3886ff0fae42f9cbe59eac831167481ade4b59471dc30709a4cc12404443818524cdbe004632b35d661a8aa312b

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

                                        Filesize

                                        4KB

                                        MD5

                                        784a9eb9ada30c57582a65b24a2050d3

                                        SHA1

                                        b162486fc9ebd85f39b4bcd39c67f40f36b74dc7

                                        SHA256

                                        49f76d6586b99e92bec04fbb39750fbeb536d2ef028b567f090fdc56a0382dfe

                                        SHA512

                                        47c3399f56fecae14b2fa325343c97f08541e464dab25f7651e710953d8d7aaf82a9f4a23f031705d8eabff8bd688fe4dc035a2dfe190626e981bb0441276bd2

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore-backups\recovery.jsonlz4

                                        Filesize

                                        4KB

                                        MD5

                                        997313700fbdf0abec6ca5c5e7931c50

                                        SHA1

                                        3df5c1d68a6916a6c2a286efc6a684b80e9eb75e

                                        SHA256

                                        20c01cc7914d19bb2769fd95e8a00a703e4affa8e17f2c8a62c1d0a53a39b79f

                                        SHA512

                                        8be4def415337e0fd17b542c4ac3456be2a9d488b8138159d726d8de65087060653517f761d513dffccddc5f3e83db3933bae62fa3837d86fde377744367df94

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\sessionstore.jsonlz4

                                        Filesize

                                        4KB

                                        MD5

                                        8d2bfe598f30d6f236ade25531093aac

                                        SHA1

                                        34a073e57d220009356c7d3df5b3edcd72a42681

                                        SHA256

                                        fd88c289cc6eab531be05600a44896bd040e9cc98ce315f8788ce933ba7a9e20

                                        SHA512

                                        5cb35f1de66d23c3184c0067d211190a1c1153387e4ee1f594f1118427343040abba2eaa5549d1b8ff9bddd51c87740dc09c6edba7fe0b9bd1234a4e8fb1b194

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s7sufels.default-release\targeting.snapshot.json

                                        Filesize

                                        3KB

                                        MD5

                                        af34a71c5992603fbef1499d78d0c7dc

                                        SHA1

                                        a569fc55fd7eaeaec65615a05cd3bc82e078522d

                                        SHA256

                                        7fb18b626dae5d3cde4853f9c5a088d3de058e7c4ce41ce8e45afb1b12d078a5

                                        SHA512

                                        7ce8222b46e772df24955146b7ab3c189ad7a7bcd1ac9f31ae5c07bfaf3b9b225e671d523901ca034fee9a42b3ae9bd5389af42c72cba4d0a792e085afcfc9f1