Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 09:58

General

  • Target

    testestestestetw/triage - Copy (19).exe

  • Size

    1.2MB

  • MD5

    08b8eb8dd9681bfd0050fa7e547e1fd9

  • SHA1

    f810b716884668bbc554aae7914dd19f1c30c265

  • SHA256

    e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b

  • SHA512

    d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f

  • SSDEEP

    24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (19).exe
    "C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (19).exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2352
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4200
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.0.763080618\1971767871" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58f7fc18-fd9c-45be-9dfd-ed748a77d367} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 1948 20c0d9e1358 gpu
        3⤵
          PID:4252
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.1.621264569\197413880" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2324 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9e69d13-ea7c-401b-bd91-f54dbdefde02} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 2348 20c00f72e58 socket
          3⤵
            PID:3500
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.2.1966030453\935528398" -childID 1 -isForBrowser -prefsHandle 3092 -prefMapHandle 3024 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31b6aea7-7cda-4db8-a7f8-21669899a822} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 3212 20c118b7358 tab
            3⤵
              PID:4916
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.3.1731565225\1351929568" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {907818c0-6c6b-43bf-b192-047c96b1181c} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 3576 20c00f62b58 tab
              3⤵
                PID:1992
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.4.91799251\780083633" -childID 3 -isForBrowser -prefsHandle 4156 -prefMapHandle 4152 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93e231d5-b9c5-43c4-ae01-fb1d3a042626} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 4168 20c12ae2b58 tab
                3⤵
                  PID:4316
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.5.1828888305\83910078" -childID 4 -isForBrowser -prefsHandle 5128 -prefMapHandle 5140 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcef2710-ee67-4126-a45c-13cc846f2ecf} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 5160 20c12ae2858 tab
                  3⤵
                    PID:4468
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.6.1462307071\1336163241" -childID 5 -isForBrowser -prefsHandle 5304 -prefMapHandle 5308 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a468e96-1ebe-47bc-8c01-87ca63a885c9} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 5296 20c13cbf458 tab
                    3⤵
                      PID:1252
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.7.1021990258\1857032789" -childID 6 -isForBrowser -prefsHandle 5492 -prefMapHandle 5496 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {504c4248-e6ca-416d-88af-735d82b571da} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 5576 20c13d28b58 tab
                      3⤵
                        PID:5096
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.8.756119268\1444744115" -parentBuildID 20221007134813 -prefsHandle 5888 -prefMapHandle 5884 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8853c512-be62-45c7-b87a-23036c602ee1} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 5848 20c14fad258 rdd
                        3⤵
                          PID:5492
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.9.1326114492\1273737316" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5536 -prefMapHandle 5524 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e2e8ff7-08c6-46ef-96d1-ff7cb131113d} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 5996 20c14fad858 utility
                          3⤵
                            PID:5516
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.10.704304209\1435042364" -childID 7 -isForBrowser -prefsHandle 5536 -prefMapHandle 6116 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99257ff0-d3a1-42a4-ac88-21f3f7ef18b5} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 6152 20c15160b58 tab
                            3⤵
                              PID:5636
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.11.1645326053\1952599556" -childID 8 -isForBrowser -prefsHandle 10140 -prefMapHandle 10148 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5433b277-9a8f-4b9f-b51e-6136c8b5bd71} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 10128 20c155f1c58 tab
                              3⤵
                                PID:5132
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.12.1045337983\1570400092" -childID 9 -isForBrowser -prefsHandle 9960 -prefMapHandle 9956 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6274e8d4-abd5-4405-98f9-ba00b06a79ee} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 10112 20c155f1958 tab
                                3⤵
                                  PID:5244
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3916.13.1696716230\610836709" -childID 10 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 27463 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17dd2870-336a-45e5-a4d7-0384a8afc075} 3916 "\\.\pipe\gecko-crash-server-pipe.3916" 5664 20c15161158 tab
                                  3⤵
                                    PID:3752

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\doomed\10037

                                Filesize

                                9KB

                                MD5

                                890b32a2c8ffed4edbbc9417d5240cc4

                                SHA1

                                13db915f8b9ff3c002139970f44d7a8158362ab1

                                SHA256

                                e46c1408c08945ed1cec6d922f651ec05e8f3478938fe1193800a17c4d2f43f9

                                SHA512

                                8bf0f69349efd1cccb3eea6ddd3e9fe78c939402c453615bfca80127cd6db447fa0e6e4dda72cd676b2db98c8fe1dac5209e7e3bb7720129f78ba8d8fd00b829

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\doomed\11205

                                Filesize

                                8KB

                                MD5

                                01025a8ddeef69eb6003921434e4568b

                                SHA1

                                2ed04be0359579c740806aca71599be271768f4c

                                SHA256

                                2e4ae445af3a3bc7ce6941cb4526f9be1810cbb2a14075a0196a9a21b9791c10

                                SHA512

                                566f16a54ffee156e86eaabac11ad9ee01079bb4dffc75fc09a29747604d9634435047c5cbdbc25c2003677b938d9e6357dce56476d6227473848881edb843fd

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\doomed\1284

                                Filesize

                                8KB

                                MD5

                                7e766eb8d607f635c852a15662e86b56

                                SHA1

                                8ba0386e32c2f2d6e872237a88141101d3581b92

                                SHA256

                                c6ff8188b5b273f7746a0290249bfaf21d529033446a3e57b43bf915f95dda83

                                SHA512

                                392484e2e3112fd281c74201138298250031d6ade994cb8cac846eb60c2014077152ea570b13c7356c4c243daa409175936ae27bca0ad47f12ca479e7cc853ee

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\doomed\23459

                                Filesize

                                8KB

                                MD5

                                fa28e56442a67d64d55c2c414f40e6a5

                                SHA1

                                f1d4f814320b9c581e1590f6472ee2d2f5b0b443

                                SHA256

                                01c2c02bb3d7b4975ad2e76b14f48352f1c3885410197d87d948fdae24b1e63d

                                SHA512

                                e2f61515ec375d93955e38490914fe501fe5df59a326e7d0a7fa3732a1aca3538cb6f3f4fa413f1c788de4f3d52c4623c5b25e32e5a4713763cb01b5e8888aee

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\doomed\26600

                                Filesize

                                8KB

                                MD5

                                91d28c72e65aa7317e481e1fb605ab86

                                SHA1

                                a4e8ab5b8ce32469e7f705718e3709b6a4806476

                                SHA256

                                971fe1c1aa7aa2c91d7c2720a6449189663cc25e591d948ce88b6e926ed4b29a

                                SHA512

                                19f0b63ae05a33b68019976d3d97a91046d7822054768e1e9f4c0fb8b4418eaf555524fbc4529911405a6222a5f0ad43160e1a1c21fc0e005ce771328d4657c8

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\doomed\5865

                                Filesize

                                8KB

                                MD5

                                124819ad206e19f6ba80f902fe263659

                                SHA1

                                d0011c82213cc0c79465f372cfcf4c9a02ff3223

                                SHA256

                                32c2699b3eac5b4f8cbdba657a8b778761377c932982dd6d324618afc84fce1e

                                SHA512

                                8537474b9afb903fdf42886852923a483bea390003552af6706aad6b04c6623f4b11c1229719c4bc1858d292e510080eb28520fa28d8c0a998a20604640dbd6d

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\entries\52D6DE9CB6806448C8C808EA8977B9006B2E8A5D

                                Filesize

                                10KB

                                MD5

                                d65a41e0ed3d2a03b2923b95b9aa0b15

                                SHA1

                                13586c1f3803981ed3122f4d23c6a961225944f7

                                SHA256

                                adf0c195a83d64dafe0016a26bc9a21fef41eeb88c3c63fa09058c41018f6719

                                SHA512

                                017625828f676701fe71238b68351f6f2552f353afcb4109289553f65a99086c8e47dbd1d199a83e7365272ac494131a222ac8fe4f305daa8b7a40f14d87e522

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\entries\954767E890052736025DA0A8D85F7F205EAD795D

                                Filesize

                                11KB

                                MD5

                                35e6548f7ce88848e7cd2d0be5adefc6

                                SHA1

                                9fa2fd8fa91392775605254f41a11311d3d48af3

                                SHA256

                                c4b3994f3caa5f96d97c2a2ecfcdb49ef8137ba475153cd7267fe21922167831

                                SHA512

                                7e3439367df0935d4daccaef88fb8020295cbdddb3e81ee05c6cc934e9de1baf947a76980b97ab7c21dc6f77b4477cc48cf811caee0058e8553110ddd1e91706

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690

                                Filesize

                                49KB

                                MD5

                                51cbacb41a0862d8b41a5aa115e64ee4

                                SHA1

                                f0f183235b1b459e923633a23ffc848ddff9bdb2

                                SHA256

                                1ba6d0f316961c7b55d0f9f3ad2eb9bd0b5061ceb8ccd375b6137acacf6cf97a

                                SHA512

                                3cf8f2358dd1eee3d0d167bed846ee560dae444e3a2ec53ba5bc47cbe73731e316c6b80da6f1bc2e45a1c22314894275e719807b30e05109479ee9ce8dd94980

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                Filesize

                                442KB

                                MD5

                                85430baed3398695717b0263807cf97c

                                SHA1

                                fffbee923cea216f50fce5d54219a188a5100f41

                                SHA256

                                a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                SHA512

                                06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                Filesize

                                8.0MB

                                MD5

                                a01c5ecd6108350ae23d2cddf0e77c17

                                SHA1

                                c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                SHA256

                                345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                SHA512

                                b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\db\data.safe.bin

                                Filesize

                                2KB

                                MD5

                                e1a256c39ef3980ff45ce0815d2c32e3

                                SHA1

                                e1251b2e86159f21daf84b95a8faf7e554a72b40

                                SHA256

                                ab869e17ccd20022c349db3d3882f69d136401f2f3f4dc5b2825eb6eb5bf5bf1

                                SHA512

                                e8a51577e9b339f3384bdc4f8ad89467483862486522361dbdb03df4fe2190ce8076e3032be706cb8106df93618836ab06723b2e2f7202ad6f9918706f516e96

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\8b075dc2-38d9-4fad-906b-c61a816d92ae

                                Filesize

                                10KB

                                MD5

                                2a9dd29bf63a3a39bf1ac3371195057b

                                SHA1

                                070bb5ef3e5f4cdb22a0f2003a4d6a20cb101619

                                SHA256

                                f6ef2b29dd5ead58ebb3bbdce703b39534d7904db084abe0bd38cd1dc44f2846

                                SHA512

                                1e182f3b89ef796fbae913c43d4603813fe737f2699e501cbdab1f58ea50bd4365cf98d60fb5dfd414eea1b4f9ed51068e1457f0d778bc9ca375127f8f39b671

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\ff709b11-218d-4ca3-a282-5311d7b979a1

                                Filesize

                                746B

                                MD5

                                a5fe7dd9327a9c6aaf087759ea2c88e0

                                SHA1

                                c89799da253f1f0d09f0ee738091a5b3a25d45fb

                                SHA256

                                94ee5b1b9910c825036c7d966fb75d6b9864209441fccfe95c2d8460acd4b5ba

                                SHA512

                                3ec4511af2ace043298e9d1ef0c628cdcca58954e59c6b4c0a412552d694e61d62452354c7bc7640c5010833e73e344c80376b6bac59dc0290939cb843aea44e

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                Filesize

                                997KB

                                MD5

                                fe3355639648c417e8307c6d051e3e37

                                SHA1

                                f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                SHA256

                                1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                SHA512

                                8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                Filesize

                                116B

                                MD5

                                3d33cdc0b3d281e67dd52e14435dd04f

                                SHA1

                                4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                SHA256

                                f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                SHA512

                                a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                Filesize

                                479B

                                MD5

                                49ddb419d96dceb9069018535fb2e2fc

                                SHA1

                                62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                SHA256

                                2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                SHA512

                                48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                Filesize

                                372B

                                MD5

                                8be33af717bb1b67fbd61c3f4b807e9e

                                SHA1

                                7cf17656d174d951957ff36810e874a134dd49e0

                                SHA256

                                e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                SHA512

                                6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                Filesize

                                11.8MB

                                MD5

                                33bf7b0439480effb9fb212efce87b13

                                SHA1

                                cee50f2745edc6dc291887b6075ca64d716f495a

                                SHA256

                                8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                SHA512

                                d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                Filesize

                                1KB

                                MD5

                                688bed3676d2104e7f17ae1cd2c59404

                                SHA1

                                952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                SHA256

                                33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                SHA512

                                7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                Filesize

                                1KB

                                MD5

                                937326fead5fd401f6cca9118bd9ade9

                                SHA1

                                4526a57d4ae14ed29b37632c72aef3c408189d91

                                SHA256

                                68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                SHA512

                                b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

                                Filesize

                                6KB

                                MD5

                                564030f4bda8e50de57ead50a93b048e

                                SHA1

                                af5626718774ad9516890e867982eea1372d4d98

                                SHA256

                                656b6e57d54b9dd86bcb4a8a6ce2fd502e40f82075b4b8ff75b9494bf321e74e

                                SHA512

                                6aed51f4e8880864ffc9031914dad02d35cdae0fb565d70ff214e31fb5c4b6e0a5ca53d1732dc9e35808e825301a4fd95df0f5069c6de04e64d1643d855f827f

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

                                Filesize

                                7KB

                                MD5

                                c29c085fff070a4475f0982a8899d7f0

                                SHA1

                                d3f9151252fcde306d0ec7939cb6d76293a643f9

                                SHA256

                                933c0cb47f1b110bcdc5ec62827c25160709358f20077663a23ec5635727a2bf

                                SHA512

                                5e4a314dcb5de1904e5150b710300de10e6dae1b2a84211367f9f026cf20b63c387ee47c543c110d164642bc34700c86b436c8febd7bb08018c69a86385f27d2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

                                Filesize

                                6KB

                                MD5

                                282899da2c86a40b4cb1f3465a403da2

                                SHA1

                                e662d5cee5b7064106e8daa3c0f06d0ac6e39bb3

                                SHA256

                                9e19f3cf96ed9f2ec8b610764a6b5951f2fd196c7f6b3b8a8e1afe7add6c88ba

                                SHA512

                                086c91a97ed56a67f0a636054774cab7a43061e56419aa1535a7d599ead0b8ee7736f04b4439fdb1b6500153a12ebf6faef8e9cf239b2f1e7c58540153081a64

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs.js

                                Filesize

                                6KB

                                MD5

                                a0cd0a24afafc08ada2327ef4ca04d0f

                                SHA1

                                a43d41cea3f73ebe3f138b363094e8ebadecc43f

                                SHA256

                                4df947d472c440951ca8b8bf3b55dd718da6ebb5a98ca937a046072669b1c9ff

                                SHA512

                                355cd921fe09f333796a122d0f6de17d6d4d0e1a7601203fbc69b14414669c158936e8f970ce74ffbb27049b504f2479c242983e968b4f161e1f693bde16423d

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                2KB

                                MD5

                                9db7c834afadbcb14bd80c71857eb671

                                SHA1

                                6da3f8f02419be6b9fc37ec41e4124e2605e5535

                                SHA256

                                7ad13043e8b47910f92579f59065cb05eb953441db4d77485ef1e656ce5b8b40

                                SHA512

                                ccf717321676f40bb67071a51dd33f9d87ea09a485cc005a6bde0ced88385ecdc7a0057cc10caac6d7eb7694855e793c5cec25f1eb8043e8fcd8bef3818e173c

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                9KB

                                MD5

                                d58eb97e13903dbc3be7732234ad2765

                                SHA1

                                2856fd49893c2a798aa165ed989c7ccc67453459

                                SHA256

                                560bf2e978694a38b3d8c64a6e0b34ec40441d8a830a9a432ec2585fc8f9b0c6

                                SHA512

                                306819136d21f1816478998623ba89ab45a580c2a8c757907364b364883dc6747444848b78bba062c73ca935d93118801c656c4a0c48dd2c293fe31f01e434a1

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                4KB

                                MD5

                                a751a2482346046fb9c7fe83fdafc175

                                SHA1

                                e9163047b74d672b85a6846f696119a624f86428

                                SHA256

                                0def45d5f3313f83d3cf0c350bc0d16926fdd8bbc7c9d46913e16cd5eda4fba9

                                SHA512

                                184dafa4367a380ff3299f7f0daaf3a23514926d2cd1464b689ea90c0edeeecde05d6a28cbb46e296bb357c40e99c92f505deba2ceac966815db1d871348bf50

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                9KB

                                MD5

                                b20661b2fdf4332ba0ba27ee9d11bb89

                                SHA1

                                429320912fa17c5634a905e73608703f320b020a

                                SHA256

                                0df30ac4fc6d602a43df1a0f1e8b032a189c3865af9138622c4aace14a5aa364

                                SHA512

                                dcaad0926c7e475cd73460a934cf05b96173c7ceecd86e170bc696eded158b11cf0d717518249b393fa3735f6c04e7783dfa80452ff7a395c3e9a0c3871140c7

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                9KB

                                MD5

                                3b4416fcae5a4401f019fd19d10cb321

                                SHA1

                                6571aaa72ad6a7e98e2053129172a4ced2be735b

                                SHA256

                                6554eebebb8ef7b5fad60f51356ba7e350fa8faee44a2a83dae11771b68a0a2d

                                SHA512

                                aa6dd7292f7175eedb22053b42870f7cac126b562e617960c664ebc5861f1ebd77f151041291473d3f5e3f79b15dd0668deaee9295a79e131e53fe2101df5bf1