Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
3testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
4testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...py.exe
windows10-2004-x64
1testestest...ge.exe
windows10-2004-x64
1Analysis
-
max time kernel
56s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 09:58
Static task
static1
Behavioral task
behavioral1
Sample
testestestestetw/triage - Copy (10).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
testestestestetw/triage - Copy (11).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
testestestestetw/triage - Copy (12).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
testestestestetw/triage - Copy (13).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
testestestestetw/triage - Copy (14).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
testestestestetw/triage - Copy (15).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
testestestestetw/triage - Copy (16).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
testestestestetw/triage - Copy (17).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
testestestestetw/triage - Copy (18).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
testestestestetw/triage - Copy (19).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
testestestestetw/triage - Copy (2).exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral12
Sample
testestestestetw/triage - Copy (20).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
testestestestetw/triage - Copy (21).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
testestestestetw/triage - Copy (22).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
testestestestetw/triage - Copy (23).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
testestestestetw/triage - Copy (24).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
testestestestetw/triage - Copy (25).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
testestestestetw/triage - Copy (26).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
testestestestetw/triage - Copy (27).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
testestestestetw/triage - Copy (28).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
testestestestetw/triage - Copy (29).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
testestestestetw/triage - Copy (3).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
testestestestetw/triage - Copy (30).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
testestestestetw/triage - Copy (31).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
testestestestetw/triage - Copy (4).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
testestestestetw/triage - Copy (5).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
testestestestetw/triage - Copy (6).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
testestestestetw/triage - Copy (7).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
testestestestetw/triage - Copy (8).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
testestestestetw/triage - Copy (9).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
testestestestetw/triage - Copy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
testestestestetw/triage.exe
Resource
win10v2004-20231215-en
General
-
Target
testestestestetw/triage - Copy (7).exe
-
Size
1.2MB
-
MD5
08b8eb8dd9681bfd0050fa7e547e1fd9
-
SHA1
f810b716884668bbc554aae7914dd19f1c30c265
-
SHA256
e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b
-
SHA512
d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f
-
SSDEEP
24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2884 triage - Copy (7).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3928 firefox.exe Token: SeDebugPrivilege 3928 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2884 triage - Copy (7).exe 3928 firefox.exe 3928 firefox.exe 3928 firefox.exe 3928 firefox.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2884 triage - Copy (7).exe 3928 firefox.exe 3928 firefox.exe 3928 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3928 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 2356 wrote to memory of 3928 2356 firefox.exe 93 PID 3928 wrote to memory of 4788 3928 firefox.exe 94 PID 3928 wrote to memory of 4788 3928 firefox.exe 94 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 4940 3928 firefox.exe 95 PID 3928 wrote to memory of 2548 3928 firefox.exe 96 PID 3928 wrote to memory of 2548 3928 firefox.exe 96 PID 3928 wrote to memory of 2548 3928 firefox.exe 96 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (7).exe"C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (7).exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2884
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.0.2091679634\67787284" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52257c6e-0db7-4b3f-a38d-444480ce055d} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 1724 203c5605e58 gpu3⤵PID:4788
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.1.1249634147\988025208" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2356 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cee46b38-8b46-4b1e-be52-9d8fb749a2a0} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 2380 203c41fb158 socket3⤵PID:4940
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.2.928185914\2120903370" -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3056 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60654761-e171-48d7-b759-203977a4a025} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 3124 203c849c458 tab3⤵PID:2548
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.3.1381018225\956737899" -childID 2 -isForBrowser -prefsHandle 3584 -prefMapHandle 3580 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8413b6d4-db96-475d-bd2a-c6105bd6019f} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 3596 203c9219e58 tab3⤵PID:4584
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.4.1912203752\1472541498" -childID 3 -isForBrowser -prefsHandle 4460 -prefMapHandle 4444 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27b8ae94-da99-44b1-96f1-c46a64204c28} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 4504 203ca09fd58 tab3⤵PID:4468
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.5.345312697\256811932" -childID 4 -isForBrowser -prefsHandle 5180 -prefMapHandle 5176 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad4cc150-8890-4903-8a25-c930b7c3a5ea} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 5192 203caa3c558 tab3⤵PID:4144
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.6.1422836747\1995425612" -childID 5 -isForBrowser -prefsHandle 5348 -prefMapHandle 5352 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22366185-b461-4c1d-912f-c5f06211d722} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 5312 203ca5b9d58 tab3⤵PID:1688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.7.1938572070\930908969" -childID 6 -isForBrowser -prefsHandle 5532 -prefMapHandle 5536 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15f94432-bef6-4aa9-b6da-b34c9c82a62d} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 5616 203caa3a758 tab3⤵PID:2612
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.8.2061482313\499127454" -parentBuildID 20221007134813 -prefsHandle 3536 -prefMapHandle 4192 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4194b54c-14ac-42e0-a0f6-ed443931e4bc} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 3544 203cbb23458 rdd3⤵PID:5496
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.9.2143383131\1716525319" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5888 -prefMapHandle 1644 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {577980c2-feb4-45ec-9113-49eea5cc1aae} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 5932 203cbb22b58 utility3⤵PID:5512
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.10.1994729174\1445813737" -childID 7 -isForBrowser -prefsHandle 6116 -prefMapHandle 6112 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf2a8e6b-8c1b-465b-ad0d-6451c33ec40e} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 2876 203cbcf0558 tab3⤵PID:5660
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.11.608427289\841384323" -childID 8 -isForBrowser -prefsHandle 10160 -prefMapHandle 10164 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01b45411-2288-4e1c-850a-d57450c08c76} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 10148 203ca5a7858 tab3⤵PID:5212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.12.266861734\813408077" -childID 9 -isForBrowser -prefsHandle 10012 -prefMapHandle 10008 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2393cc43-fd98-40bc-8ef5-3e922a5d902c} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 10020 203cbb88f58 tab3⤵PID:3496
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5479e21f470f47b385df8afdb1e2c71f9
SHA1246fcfd16dbcc3aad5c0051ecb937309a63f51b9
SHA256c2d7dba8011d5ea45f20d3454ae722e05fdbcf4d92b0812e5d8dfec6b96c5c1a
SHA5123b6d76856d1cfeb890d7d7d46d54051370e32cbe75f97c9cbf88ba860e59b930795af8e9361c0013436c7b7583b6dd978cac172527e3dacdbac6588edb250ada
-
Filesize
8KB
MD53fd489018a045d9424ce339d5a55a746
SHA1f99df76da7e1a2b30a4cdc3b3e0aca10b2df3dc0
SHA256a107557a9764385729f36ba9bc641706cf43c212fb3d63d420cf3e04dd174d52
SHA5121f283e0e10e2c60aa73b87072b46ecafffe2e0ba93e3dd5f0678be2e3ea196e13f05d85a0c1214c50a96537e3b4f5ca9dc4c47bab4d2596bfe979c4ac9f89f0c
-
Filesize
8KB
MD5293518136d95a0813be7197d3ac3045c
SHA158a75001a11cb88b2f6b2efaf74ab04ffa05de7f
SHA25677f560523e46083998d930e97dead544dbd0ef1156f605b43d8d24450198166f
SHA512826ad3e4222dba412730826808f72903b101fa49907202916617f51b67ad459ee49c1580182c650c5b66c6abbd7378a512609c0f13c1429cc5d00cdbbbd0e121
-
Filesize
8KB
MD5a97fe78e4b95c53eedbeb362ceb9e133
SHA1493f15290ee5d6eee3b0023ea57afa04971523ed
SHA256bde49e54c7ddb3fa0c2d28f505796c70b9e17588b519d642c98176b4be8780ff
SHA512864cd63c727953795119d9bec04fb0f55e6cdd0ae0772aa4b1bc7e4ade21adc06465f736fd4b800403cf2467ecb5b1c3f36bf80139cdaee3feef5867d190477f
-
Filesize
9KB
MD58d330ed39e9738e1d0a5d20a20262730
SHA10b165895184f0c2514ee44a70d242cf73a85f0d5
SHA25617189b87729cda70e1524d249be07b4b1b892670a8ccd1102dd16446b95df934
SHA512cd0d9436adb871aeaa5600e5fe03db143dd92fb116cf5808057920599eb4367892204ff9487d58982525681a254cb54ce20b1d78439fc6dd8b6609d62fa0bcb5
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD50328613dbf975abaa48d7ff2418cb792
SHA1c1b72af59d44c2b6d29f93ddf53ba2769b735f72
SHA2567b047fdadddde55de2f182f021e54ba59a1671563e00998835f880e4385224be
SHA512faa9fac55156425389a71dec217a55a930cc97f0df862a29f3fd5da9ac775eea799ff2997c6dab0280b5a4c424e2cd65db7ffe49e2ce9cdd2f06ca344f534539
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\pending_pings\1627c24f-7514-4ee1-aabf-74d7ec4549b2
Filesize746B
MD548e8c2d9d0b452ebebd20b56fb777aff
SHA1b5b0c8914fcd60a69420312428fc4348b09ac7ca
SHA256d5bf08fbd3f085496b85ece5c2080a050d0be4604e4b69723cef0533c22be719
SHA512014a65359797ff72ec7e2f168aa96d4b86c7663b39f96c527fb011e15d4e3a2f3cd2e404f116186f0379258f63b7c4a3c116113de3f0f770f0652c4b0c770dbb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\pending_pings\7a22b2fa-16f9-4a14-a30a-ebb1b1b5250e
Filesize10KB
MD50d3fc6b9fb934c4c54e09e8806c5ac03
SHA1f6f74d8ffdb3d4f1ef664a8d7b28a0b45bb29ad3
SHA256d1bad13e9d57436edb9ba79c3122823e25acb98c6b59308c872cc5df254e220d
SHA51215b6f591b2cc4c2dd613a4f1b3488f12f0fffcb8514855d8bf210ed31afbf8545ff13da150f3e766c79e961d6ec82d8b1a5c6fff314ec3c6737bfbb7c59318ba
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5dfaa7922a491a56f2a633f48dfaeee5b
SHA1f9f4dfba73da12a417961a6d0e8fb006b7dd8e12
SHA256c6d997d4dbbec38dd66521c4e397c810dbdf5228030c3ae5bb052d3aa00aeeb9
SHA5124d11046f2faf061f0220343cce9881d1006bf86f6882ea27299a8538815681cb3413d3ec59bbe4c48e7628917b7ade29011fc3a454e1ac73f5ddf22e47337a1f
-
Filesize
7KB
MD51ccf528ffe7a55c38e532eded53aa972
SHA19cf3ba66ff288a5b56a5346c7c6c5735bba2bc38
SHA256951790e9efe022801ec9b21adb0d39095ce4f2721eef8decd6108d7649dd1b68
SHA512f4723d0cea18ea7401cf03c5d3bb28ba816ae8c1c7fe3c03bad75f63483f86a54b752eb7a692713f36fa7166394266f087737cad7f1567bf06b68490a7339f1d
-
Filesize
7KB
MD59e6d2937e3deaf0082450679f33f4102
SHA139fdae6ade6da5b4ef32e8b2d04d4386bae14a4f
SHA256ca648d300df7041ec113b17ef4519c7f139b01d65aa33406d3f1877bc148d07e
SHA51227a74b9794d0308d6399cb43ed4cc80d5214618d8791900b6947f0df30870d192911c160f84a57fd14a41e3404a5c9fede1b5a3f12ad71852f2ab0c00a0ff05c
-
Filesize
6KB
MD5d47bdd022f9c9588c9330fe524115d8a
SHA19e8581829cbdef523a8f94e6606ee7df79a2623f
SHA25696b27e410fdc018ebc3f40bddc2b0b50679a33cd2e182d4a7492c5e0583fa498
SHA512e5d4863b0144703332ac751ad48e0cab32737f448728110314c8c09502903dc2126dfff3aaf019b775411534144562d6f40c15e33a4a4caa10826937c367e98f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4
Filesize2KB
MD5500abb22261b739cd5492563b65f418d
SHA1d5035c241814b70985aef53ed3d6ab8694b26d87
SHA256adfc07d978e5830c052052df7f719689efe8525a49638e54423cfeee0a5ebd84
SHA512b7c0d9376e696beb70e360b22e58528da2c0806a4db62bc57faebbc92dcb9408f91be5d2cdfd8f06dbe69b1f802d5dd37f2291626ec4766b0cdd02fb86c0ed65
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4
Filesize9KB
MD543620c1e11db034173539815e4a6142b
SHA191542b5a8b38e691b1eedd89391c023283f57ce8
SHA25672f337acdea7f657611d137863c5407cad3f1573ee7bc4caa4014da2782e73a0
SHA512455cd45a05796ea9f1572610abc4d6ef690398e6b2ae727b8a131344f3e73423e298dd440c437e5fc6d3a37d3d93c3ff1fd54f9255e52368626b99c6adc55cc5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4
Filesize9KB
MD5cd4b05b451f1e059e4be5cb8428fc496
SHA1ae1b43c7f29047ec4d7343897def3afe1fbf7e59
SHA25655163592206f0f03598c09f11a49eae147786636a34167ac3b7661bd10052ee0
SHA512485c631fb2084b39e75f1523a789d34385fe6a0f62937f14df1c8d249a203ee529294dd29fec4eaa792bbb872f854b43bfed5491409731968d5159856d9a5d0f