Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 09:58

General

  • Target

    testestestestetw/triage - Copy (21).exe

  • Size

    1.2MB

  • MD5

    08b8eb8dd9681bfd0050fa7e547e1fd9

  • SHA1

    f810b716884668bbc554aae7914dd19f1c30c265

  • SHA256

    e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b

  • SHA512

    d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f

  • SSDEEP

    24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (21).exe
    "C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (21).exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1624
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.0.282247149\1205882520" -parentBuildID 20221007134813 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab18189e-4191-4d5b-a083-866a8783c702} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 2012 27e0ddd9758 gpu
        3⤵
          PID:3540
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.1.1042053162\814796551" -parentBuildID 20221007134813 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93cffa04-bb23-4203-806e-53b72b80d455} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 2412 27e015e2558 socket
          3⤵
            PID:3664
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.2.508752205\333733629" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3112 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {982c8723-b07a-4900-9909-0b8f45d1a602} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 3012 27e11e9c358 tab
            3⤵
              PID:3704
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.3.952058351\1131953153" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60cf067a-2ea1-495a-b1c9-e3ce0b96ce42} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 3580 27e0155b258 tab
              3⤵
                PID:936
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.4.1336252255\268606812" -childID 3 -isForBrowser -prefsHandle 4628 -prefMapHandle 4624 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2da3da6-dc58-4cf7-b60a-72be1d3d42fa} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 4444 27e14156858 tab
                3⤵
                  PID:5036
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.5.1014800078\946770464" -childID 4 -isForBrowser -prefsHandle 5108 -prefMapHandle 4784 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bab02c6b-c3b7-44f5-a2c2-751e933a649d} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 5080 27e14662b58 tab
                  3⤵
                    PID:4384
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.6.1208745790\527219975" -childID 5 -isForBrowser -prefsHandle 5224 -prefMapHandle 5228 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a3dc9c6-5b20-4ab6-950c-b83b564800c4} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 5216 27e14661c58 tab
                    3⤵
                      PID:4520
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.7.1771701859\987709039" -childID 6 -isForBrowser -prefsHandle 5412 -prefMapHandle 5416 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9df74b4-86b8-4ae0-b87b-36060fdae2e2} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 5496 27e14660158 tab
                      3⤵
                        PID:3208
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.8.1379098908\376329558" -parentBuildID 20221007134813 -prefsHandle 5912 -prefMapHandle 5908 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a59f640-8045-48aa-8c52-4f2ea492a561} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 5920 27e15638858 rdd
                        3⤵
                          PID:5308
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.9.411667751\657776928" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5928 -prefMapHandle 5920 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41d40285-41b8-473a-be6c-20e4cc1060f9} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 5836 27e15711558 utility
                          3⤵
                            PID:5324
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.10.1191754868\182411545" -childID 7 -isForBrowser -prefsHandle 2876 -prefMapHandle 1664 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8b2f7e8-3661-4c13-a83c-9935b8aa54cb} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 2888 27e15710c58 tab
                            3⤵
                              PID:5452
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.11.735200248\1294184275" -childID 8 -isForBrowser -prefsHandle 10184 -prefMapHandle 10180 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {becd02e6-13aa-4609-9302-6ffefc846842} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 10192 27e1561f058 tab
                              3⤵
                                PID:6116
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.12.1127272687\562192400" -childID 9 -isForBrowser -prefsHandle 10056 -prefMapHandle 10052 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {440c6526-e91b-426f-9c5f-bf14a608b472} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 10064 27e15dd7b58 tab
                                3⤵
                                  PID:6124
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2764.13.927109479\1217294343" -childID 10 -isForBrowser -prefsHandle 3176 -prefMapHandle 5408 -prefsLen 27463 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54014bc6-da12-48d3-97d8-d69d04735f39} 2764 "\\.\pipe\gecko-crash-server-pipe.2764" 5588 27e0156ae58 tab
                                  3⤵
                                    PID:4316

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\doomed\1463

                                Filesize

                                8KB

                                MD5

                                fee4eec2909339e3527793fbc46b7aa4

                                SHA1

                                26e97ac2b670861f97c0773cd6522c4a5d14556b

                                SHA256

                                49b5aa733743ad7a897da667dd6f28a9281c4c3c011e2bf2962af5b56ed85dcb

                                SHA512

                                b878622c5107d6b49460979008aab667d21408a025ce46bc34b75ed1cdb292f032448c4087e0baaf61651b59dcb8a212e6aea7b511ce121583d1d1ab0f88c90a

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\doomed\18441

                                Filesize

                                8KB

                                MD5

                                e5d9035c02964c427e1b81e84241aa6e

                                SHA1

                                410887c63fbac84b8624f6b9b6a2dd2e4476761c

                                SHA256

                                869855c72b2b834c473907945508a95264d7eb3a6654eac8f68f98ee48d1909e

                                SHA512

                                c54fd4376fa1e4bbb4208f4cca565161de2d54418643c18785da2029316557fe30a6c7af7aa3e0efaf6cc4fbfeea5c7ba0ad0d16e797810040f9ba8e94b67ca1

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\doomed\26140

                                Filesize

                                8KB

                                MD5

                                a97fe78e4b95c53eedbeb362ceb9e133

                                SHA1

                                493f15290ee5d6eee3b0023ea57afa04971523ed

                                SHA256

                                bde49e54c7ddb3fa0c2d28f505796c70b9e17588b519d642c98176b4be8780ff

                                SHA512

                                864cd63c727953795119d9bec04fb0f55e6cdd0ae0772aa4b1bc7e4ade21adc06465f736fd4b800403cf2467ecb5b1c3f36bf80139cdaee3feef5867d190477f

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\doomed\27104

                                Filesize

                                9KB

                                MD5

                                bf5391e3afcc395dbcb05238d33b213b

                                SHA1

                                d179194afc07b7ea288deb21ea663faf7b8bb84c

                                SHA256

                                0c1fdbd928d99a1738ec8b598229cb2e3e6997204eb93b0825d28ba732674d83

                                SHA512

                                82536d148c8a842428c11a6790bdc15db5f19960908caa7ceff97b340bea44ee79984c34a669afe55b1c23ef50f089a876476ec09469312debadbf89998941a5

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\doomed\28384

                                Filesize

                                8KB

                                MD5

                                098d4a2fb129b9f8c72c6d3c9b2c4261

                                SHA1

                                f0a8ce758202078882f51077aef0892bace3b791

                                SHA256

                                8e4cd02edb7a0babfde606ee98c62166f56610ccf2d6b0a354d71456f0dfb93d

                                SHA512

                                1d115bca058c5006f2a3de6384871591cf389e6186eaf4479a226829db80243f8ac96bc9216314d766fcffb5a20c8d384a3320446d8edf824bf33622767687a4

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\doomed\29717

                                Filesize

                                10KB

                                MD5

                                3d3127037c969757a4db3f48b1d9359d

                                SHA1

                                381f223bd9c2f2e310822615454d4c9f1d024b5e

                                SHA256

                                26aa599e424660d09ffa62d991cb84fb349a774dc35e5104148e8f0324c5bba6

                                SHA512

                                a5baff8c39d5488ab32b2a5efc30537c6eef4f5d86c978994286348a0b7f6d2c629f97f75cde7f8aaf3f58c7442c413da3496767ffc21887a30df5c7103ce29d

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\doomed\3707

                                Filesize

                                8KB

                                MD5

                                9bfab572b317c7ef1c75b2b6033fa3b7

                                SHA1

                                31294353b71ef5a6109722a4c3ab45905416e1eb

                                SHA256

                                d1a4a0ec9028cd24e637cfac78e1580950323a343a1fa673d4286e5402e88a43

                                SHA512

                                48ca8c914b5ebf79899b61236ddc3a010d53f4957236ea70081d4ee83a2fad8176793a3bdb0775186658ff46bc5b2f0896799f7080e6ffcc9d990edcc9390305

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92qyi9k9.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690

                                Filesize

                                49KB

                                MD5

                                31bb0d16084c1796c355cf23d9f71c9a

                                SHA1

                                558a07bb9feaf653d9da84edcdc5af5a99383018

                                SHA256

                                bcd8abd1a95edb5549fa11997488f084bfa87954b414837943df724fb1cf971e

                                SHA512

                                5f080359ce96490a52f2af050d626f5b12af9f003afba3bae68f414c2894887dff7144dc55b142751efac05ac98d2156e7d9e504a9662776101b8155f6f463dd

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                Filesize

                                442KB

                                MD5

                                85430baed3398695717b0263807cf97c

                                SHA1

                                fffbee923cea216f50fce5d54219a188a5100f41

                                SHA256

                                a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                SHA512

                                06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                Filesize

                                8.0MB

                                MD5

                                a01c5ecd6108350ae23d2cddf0e77c17

                                SHA1

                                c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                SHA256

                                345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                SHA512

                                b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\db\data.safe.bin

                                Filesize

                                2KB

                                MD5

                                792fdfff808b597bb832bcd2521b02a1

                                SHA1

                                cd4f8de0c02f75e0c4d96168820764ed74f8b1fd

                                SHA256

                                021b2d689e7225eb10e63d6f63fc3a0f517646b12d55e6bdc42d8978f08df0bd

                                SHA512

                                18224c1c5603bae24db901f739c8f500fa96252a83a8ff99b5067952b5d03c6e5729c2b2f110bda70f2a7377273c20c49f36deb0b753dea7183b05918462b365

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\237aa977-30dc-4120-9c0f-8a066a123e2a

                                Filesize

                                10KB

                                MD5

                                3d103141a2870a7f1c817daf14df2826

                                SHA1

                                837dcc3d2247138bbd738e28abebf969ca2c2065

                                SHA256

                                30e165bf525ace66f393f3b9a6eff55ebf87c992332a1e419384317b23fc363a

                                SHA512

                                225b156c7e98c5de6fe41e752f39a5551869a8c346ba372241d1ecb958d02f8eef25ee2eceacf0759e7d859fbc34615841a4de896e2699c8a3cc07a3aa970fc4

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\datareporting\glean\pending_pings\948264b1-dfa9-4dc1-b1aa-ab1141c67f2f

                                Filesize

                                746B

                                MD5

                                a3bb5e05af45829bbe814a2e8ddc2c08

                                SHA1

                                ad6ad6dbeeef9cadfb8c77f8a7ec87b354ec2b24

                                SHA256

                                81e1771107fd9743ec31264f50801cc74037d1b29433ebc2e8f4f2171a27b6d9

                                SHA512

                                a22c7991dd135b26995cf1c081e0813a7a042ed96a08bbe014b66b9befd48f51db75810931eb404fbcfb839bfc194f06716088f74181def4ec61eaa1f0ddee90

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                Filesize

                                997KB

                                MD5

                                fe3355639648c417e8307c6d051e3e37

                                SHA1

                                f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                SHA256

                                1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                SHA512

                                8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                Filesize

                                116B

                                MD5

                                3d33cdc0b3d281e67dd52e14435dd04f

                                SHA1

                                4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                SHA256

                                f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                SHA512

                                a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                Filesize

                                479B

                                MD5

                                49ddb419d96dceb9069018535fb2e2fc

                                SHA1

                                62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                SHA256

                                2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                SHA512

                                48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                Filesize

                                372B

                                MD5

                                8be33af717bb1b67fbd61c3f4b807e9e

                                SHA1

                                7cf17656d174d951957ff36810e874a134dd49e0

                                SHA256

                                e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                SHA512

                                6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                Filesize

                                11.8MB

                                MD5

                                33bf7b0439480effb9fb212efce87b13

                                SHA1

                                cee50f2745edc6dc291887b6075ca64d716f495a

                                SHA256

                                8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                SHA512

                                d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                Filesize

                                1KB

                                MD5

                                688bed3676d2104e7f17ae1cd2c59404

                                SHA1

                                952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                SHA256

                                33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                SHA512

                                7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                Filesize

                                1KB

                                MD5

                                937326fead5fd401f6cca9118bd9ade9

                                SHA1

                                4526a57d4ae14ed29b37632c72aef3c408189d91

                                SHA256

                                68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                SHA512

                                b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

                                Filesize

                                6KB

                                MD5

                                6c6dd0f3735745a9867b55e152adf2ff

                                SHA1

                                1f1336d0ac600ce284abba96dbc314ae64a66a02

                                SHA256

                                95764b14bf7e21105b2b9fc35e88617966c6c1c1ba065f1b2650e2f27e5e8ab0

                                SHA512

                                8107d41f2bee7a0d566eb2a1a1230d17bd045661fde28f89f01d4b6097b05dba08acb0e90953c5894fcc2ed9eb7ba6c67a613236895b14bff34bf14f7cc16967

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

                                Filesize

                                7KB

                                MD5

                                6ac03be2abf2890cdc9378529e4aeca9

                                SHA1

                                c2c15a0dbb636ab7793f91cfe9e0e48fa3e45fb8

                                SHA256

                                5d83a7b8c84c7a1950497d40f22be2190f2fe21f2389b12c148938054bf9bf83

                                SHA512

                                fe22ca2dd8b4946c7b521d2c337ca391adbc300a66467ea67495800b3bccad5114e81d84dae5fc526752568ff2fd6d6b13549c7527da35bfc65f35b03f313563

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs-1.js

                                Filesize

                                6KB

                                MD5

                                df86f9bc24d43448bbcf4ac636bd82a9

                                SHA1

                                4fefe2b8147aefa0c3b1283108a22cc71adc8327

                                SHA256

                                acfdea29c1642be2de60d8716f62c5d76bb942d5262cae7b163015b850cf9863

                                SHA512

                                242010150a78f5dc543aa203616ece4fc44a21e6c8ddfa0d2563c7e9c66291037f4ca9b1e462ef04404b14614a1502709c3a76f3aaa0936909d0d632d9de9097

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                9KB

                                MD5

                                b71421e42598bcd54ffb8c3604f93cd5

                                SHA1

                                b763db124fd0279ed0071312fde767832c180dd9

                                SHA256

                                a70c28c33cb36f5f2552f94aae501e9189c296fcb6e08b415e614a26426a9c22

                                SHA512

                                4651384d209d0ebf27362e7b35b195eee80ac482978a0a801a8f5b3778118e8d0b20ff35460bfde1d0a76973f41b19a5a295131518c8cf7987cf31508d6d35d9

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                4KB

                                MD5

                                e3df72334a066940426180c1da04515e

                                SHA1

                                14ba943661c501d8b897110605a52377c26ca913

                                SHA256

                                a136f4ec41ac0447be950b84622f1a701a0be29604bac166e3635e573be75973

                                SHA512

                                409237165889a2d0ba46a247559b40d7f9d4cfb18e2199c78a917997514c50c80094e8312af718dd71b3f06a791e9ae16a29c53e544efd53c9459489b1999388

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                1KB

                                MD5

                                5d9e7412ace279972f71da8d5aa1f844

                                SHA1

                                e8111f9d19f6d4b829a05e9729c4e1a53ca863b2

                                SHA256

                                796d0b27dcf238ab7e70a404ce4b0b68dfefad51b7c1ff82450c4f17e7fbb404

                                SHA512

                                c1c3d896b74e0e5693279200ab9cd0c52010875c66464502953e2db7a7c5cfb5f78d38f63f149c2eb08a685e1167903682efd074585fded5d90f8e0d0cdd80e9

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                9KB

                                MD5

                                ba7ae3ee74cc25cf8759fc41969f9e09

                                SHA1

                                f992d4b373103e062df253be45981d69986b014c

                                SHA256

                                0fdf0d798398a18cdff642dba71a2e1b480d3d77e36b2cc5e546fd8fea473934

                                SHA512

                                76b168480cc4e7c439e22411378786cc16d6c6e8dc716eebe25c367c9f385aa3f5d92f0f6fb0c0564a482ea466219ac11e6ec39653a699fb286de7fda0ca2c2d

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                9KB

                                MD5

                                2736dca77266d3ad736b6c47a35f55d7

                                SHA1

                                7aa9f304c6b43feb90d6e4c45993535a0571e3e7

                                SHA256

                                69b1ae7350bf7353120bcb217e31ca35b9d1961c9060ebb580a69f2411b3f910

                                SHA512

                                77f680e8726e275f9e34b1bcb5cc5c06d6dedd4506f069dfc12adc6e00e63e97fa1800c7b0adc698021f48e3a9708960e34a7f83afc3bb96ed7b8e93227a1bbb

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                4KB

                                MD5

                                4cd848a5a671de5eb11c0d80d7458be4

                                SHA1

                                522c1b5c52ebf651836ba74e4185cc3d34ab6fff

                                SHA256

                                ecf3731089121694e462eaf8ee0ae696e773ccff1d31422e02ae78fc2255a797

                                SHA512

                                ee81dac2c3af193750f99cac18bfac6e023a2235a3b8b5f463f9c8f952a8b2691f113c7b59528c43ebcf967a53d9965684d47e23e16b61e604c33ed6fa5ec8f4

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                Filesize

                                184KB

                                MD5

                                feacfeaa6370d0dd460a0609e1e1435e

                                SHA1

                                1463da69f34d0efa56e61d9dd55ac1f435237b5b

                                SHA256

                                d57b87db93a487d521c52be8e0d599fcfb17e8012f6066c303f4e48e92c3f439

                                SHA512

                                61097d4419f67e7b364a5f0f3a248d801e0bbff2283ffce8cb89a5d43309145288c20ce1a6620217c81256db7da81de7d184a0c7eb769ea237902a5abbe5782b