Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
3testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...2).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...3).exe
windows10-2004-x64
4testestest...0).exe
windows10-2004-x64
1testestest...1).exe
windows10-2004-x64
1testestest...4).exe
windows10-2004-x64
1testestest...5).exe
windows10-2004-x64
1testestest...6).exe
windows10-2004-x64
1testestest...7).exe
windows10-2004-x64
1testestest...8).exe
windows10-2004-x64
1testestest...9).exe
windows10-2004-x64
1testestest...py.exe
windows10-2004-x64
1testestest...ge.exe
windows10-2004-x64
1Analysis
-
max time kernel
57s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 09:58
Static task
static1
Behavioral task
behavioral1
Sample
testestestestetw/triage - Copy (10).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
testestestestetw/triage - Copy (11).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
testestestestetw/triage - Copy (12).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
testestestestetw/triage - Copy (13).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
testestestestetw/triage - Copy (14).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
testestestestetw/triage - Copy (15).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
testestestestetw/triage - Copy (16).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
testestestestetw/triage - Copy (17).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
testestestestetw/triage - Copy (18).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
testestestestetw/triage - Copy (19).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
testestestestetw/triage - Copy (2).exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral12
Sample
testestestestetw/triage - Copy (20).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
testestestestetw/triage - Copy (21).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
testestestestetw/triage - Copy (22).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
testestestestetw/triage - Copy (23).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
testestestestetw/triage - Copy (24).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
testestestestetw/triage - Copy (25).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
testestestestetw/triage - Copy (26).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
testestestestetw/triage - Copy (27).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
testestestestetw/triage - Copy (28).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
testestestestetw/triage - Copy (29).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
testestestestetw/triage - Copy (3).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
testestestestetw/triage - Copy (30).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
testestestestetw/triage - Copy (31).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
testestestestetw/triage - Copy (4).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
testestestestetw/triage - Copy (5).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
testestestestetw/triage - Copy (6).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
testestestestetw/triage - Copy (7).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
testestestestetw/triage - Copy (8).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
testestestestetw/triage - Copy (9).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
testestestestetw/triage - Copy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
testestestestetw/triage.exe
Resource
win10v2004-20231215-en
General
-
Target
testestestestetw/triage - Copy (8).exe
-
Size
1.2MB
-
MD5
08b8eb8dd9681bfd0050fa7e547e1fd9
-
SHA1
f810b716884668bbc554aae7914dd19f1c30c265
-
SHA256
e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b
-
SHA512
d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f
-
SSDEEP
24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4144 triage - Copy (8).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4924 firefox.exe Token: SeDebugPrivilege 4924 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4144 triage - Copy (8).exe 4924 firefox.exe 4924 firefox.exe 4924 firefox.exe 4924 firefox.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4144 triage - Copy (8).exe 4924 firefox.exe 4924 firefox.exe 4924 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4924 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 1348 wrote to memory of 4924 1348 firefox.exe 96 PID 4924 wrote to memory of 724 4924 firefox.exe 97 PID 4924 wrote to memory of 724 4924 firefox.exe 97 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 3224 4924 firefox.exe 98 PID 4924 wrote to memory of 1380 4924 firefox.exe 99 PID 4924 wrote to memory of 1380 4924 firefox.exe 99 PID 4924 wrote to memory of 1380 4924 firefox.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (8).exe"C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (8).exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4144
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.0.1163178628\58757847" -parentBuildID 20221007134813 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68e96abd-09d6-479b-ac4b-8799e2ed7109} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 1976 1fe7d8bd158 gpu3⤵PID:724
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.1.1062653779\1351756124" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2352 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a5e26f1-3bfc-4326-8f59-7dde1f6b5d69} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 2376 1fe7d7fa558 socket3⤵PID:3224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.2.472218300\2067187744" -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 2888 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cad24d3e-b9a0-4b58-887d-f28a698eaec0} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 2992 1fe0229b158 tab3⤵PID:1380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.3.2139617512\1660200835" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {818873fd-492d-4554-8023-e9c9b44681d4} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 3576 1fe027aeb58 tab3⤵PID:4084
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.4.770092727\1310879993" -childID 3 -isForBrowser -prefsHandle 3824 -prefMapHandle 3844 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {423870e2-eab7-4870-8c6b-50895d9d82f3} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 3860 1fe033df158 tab3⤵PID:2832
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.5.1873159645\1147910137" -childID 4 -isForBrowser -prefsHandle 5108 -prefMapHandle 5072 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b16055f-13b9-4197-8d69-022fd53374da} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 5116 1fe043d5858 tab3⤵PID:4636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.6.1182364660\632014406" -childID 5 -isForBrowser -prefsHandle 5132 -prefMapHandle 5124 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95bc0315-8ce8-43a9-88f1-dfc386b3a0bc} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 5140 1fe0447f358 tab3⤵PID:2596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.7.874855529\453706160" -childID 6 -isForBrowser -prefsHandle 5264 -prefMapHandle 5140 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48530783-f527-47a8-9c1b-e42afc94c8c4} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 5520 1fe0447e458 tab3⤵PID:2704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.8.1609129829\697335124" -childID 7 -isForBrowser -prefsHandle 5836 -prefMapHandle 5780 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00a78d45-eda2-411f-b7c5-0b9ff8105539} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 5784 1fe02220858 tab3⤵PID:5900
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.9.8984502\1713519736" -parentBuildID 20221007134813 -prefsHandle 6036 -prefMapHandle 6032 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d7d6b3f-26d0-43d1-b91e-8a0a71a1a20f} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 5932 1fe02278658 rdd3⤵PID:6024
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.10.969048030\59292317" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5780 -prefMapHandle 5924 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f38bafca-ff09-40f6-9b73-5214afe36427} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 5760 1fe054eb558 utility3⤵PID:6060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.11.1813064021\1052765364" -childID 8 -isForBrowser -prefsHandle 3176 -prefMapHandle 4312 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7378862-49c6-4c04-9325-7904a68f4dbd} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 4000 1fe02221458 tab3⤵PID:5284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4924.12.2027801667\290367426" -childID 9 -isForBrowser -prefsHandle 1748 -prefMapHandle 8836 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ab5747c-841f-40db-ba06-523d339fd98e} 4924 "\\.\pipe\gecko-crash-server-pipe.4924" 8824 1fe05aee758 tab3⤵PID:860
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:81⤵PID:5752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f97d9gc7.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690
Filesize49KB
MD5ca7e5f7afd88c7bae26c1c77da5e2648
SHA16604e9c4db937b92e12009cc739ec94ce94a69f6
SHA256301e58cadbd43ee56d5f8f735ed8f767814da8d191c900cf64d3c24c75981388
SHA512ee614670925abfbebb3f7510e3f668d9067252bb7a021e0e2be9115bf91391ce25f12ea07728ec1f125965a5853962df77c44ed101827bdd58a1200921dee568
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5c64b55042fa52334491b10deeb92760a
SHA1ab7a5c1665727dc77d0b7c419673bac790dcbc35
SHA256a26241725bb2535fe42b793e01a767a7144131193d5b5c674f6c934cd474fbee
SHA512f2479764e50b2ee2edb739e0468a2ee9999b4b2546c94c3c39792ed8aaed912d6fe1ae721e2704f88082d1f104a90ae5aaf0eb3e844e3be452c02c7979a4b518
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\pending_pings\97bdba82-404a-4274-8777-c03abfaa4f6d
Filesize746B
MD5817ce021978222d8031c6a6e4ea029a0
SHA19cbb816ce121999ff3be0ab05f3c85ad7107a077
SHA256f34cd224c29bf91a95eeaa8bff2633a7b3d05cbe0074dc7db30a5edeba127b7d
SHA512aac0b32552829b304f0aaa0bf63b4322b83fc0b01183d96b8bfaa8796f912c397b109f984a9baa4c72e82165413896c86b950d3cbf9ffc98f67f65ebfc905e01
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\pending_pings\f86c1443-7e8e-4512-a10d-b504ba287cb1
Filesize11KB
MD5efde10b0cbfd43dcd5e4a551857afaf1
SHA1a2920a07cf6585d02d622a63bcad8160b6c68bda
SHA25668d14eae36190c173866831d4ab273fa5c473133d769898e4cc150f2ac0a6432
SHA5121863b4e97b582b600552b39cdb48dbbcb947ff4faa82130f1695d9b14edec6d6e44265ac4e5001f5c50b76035a98f78f6968be19a181d9610397404fa7ed1570
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize8.2MB
MD5a818b991a34821badf49fd1f24c6b4c5
SHA14001a1f3c5f8f89dafc806d360b705b18dfba841
SHA256ac11453cfa42de5261bb5edb91110619a073dd55068deb97895b7b1e97694de2
SHA5124556edafed1d1b163eae8c1737899f8a369f879e5e2d881429db35460b2a5064cf27c18a9ce1eea28a771c566a796c447d8afd4e99e7f294daf21c2475b49ee7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD535230aafeae2957c62de7dc901bc0dff
SHA1382e5690a367bbeffe0f4af19a8b170a80540408
SHA2567243815dc1255b3ad9c19129dfb5fe6869fe25ba94c0c63f1241d922b8539d6b
SHA5126135d9f8e9b29a96159685762132268854a93220b4ae0a946cc60264d83b53e26eb6e0a65b19010e18b0dcb3f5e6140f0a05d8867482e67ecb458a0a07a5b01c
-
Filesize
6KB
MD5d6a0b3482e647a8d63d634ab9393c468
SHA1bb8bc6a6b583cb4cc144b15e3ce580e057d40a02
SHA256c35e4c8870e20c800d70eb72552b7012f434139e39704df37f6800b208e9f473
SHA5129667518501cf129887e3d3358cff8663df2cdf8b13ca1a6dee3fd589da06e59462a4e7c2b132d24a925074bad40f99b23c6ab2240261fe080108acc4ba5ca731
-
Filesize
6KB
MD5dbdf4e4bf83390dbb99b0afac17f2314
SHA124aa2ca6b8ec0c9bea99e728c6ba2b9a73aafb67
SHA25683914911757b31e59cca3d76adfdff5656f83e19f6a0a10addfc2d6e4558288e
SHA512f70a72303186e189ee8a48db65623f034fefb9de2956fa57657b482d6ec9c5392b65e5b6d155ebab0a09e1d69201c4c384c97ec0ab9f9660d7c278463cf7a010
-
Filesize
6KB
MD5ecc842fecaa8eed2e4669d3c92e9f42c
SHA18d57a142046500b224e50b0ffcc3d4fdc257b6a0
SHA2566fedce97208aa0302837669530a7ff501f0bb907836c2b79688a0295e1a8d6be
SHA512ba441b77878a445fb37a771ef35d3166be41a30269f5149af00e899efbb59b46f69d9dbfc5eab1f1f139ebede9039b1bf980cebf33009c910fda46310f75b916
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD532e23e9e6a76c55743cb8d5e43a7ca40
SHA11be2af7b230e53198fd2c7578c831d03a5ec3f92
SHA256e6e63aea72d2836040a3a3a9d15f25f499b57a94480b6e67ecac93a7948d7690
SHA512568eda66325fe405ed88120b2b6d67f0b1fe1ed2a613e3c5a0a2a239eb193fe3bd941bf21e32cf4c3bafdc667a6cbae4b5f43da3c7553562b4e7dc6a261c0e0b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4
Filesize9KB
MD5f4de079bca2718c217f28f36686c0c75
SHA1c2a1746f8b9485d2e099a4c058450ae789666e0f
SHA256f31d3dd4effea4d8619bafea4fa89e7d0c52b0c1fe12efdfac27d06411df98b9
SHA5129e2c65ce9846ce760010018ca64a80badb3f6e88b66f70413be7ea57cda66ffab02c21f019e8715b74409541b5605595bf784b910b0b5ba151e3091333e27777
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4
Filesize9KB
MD57a66131a452ba20797e32560ea1ece3e
SHA1040ddda2e5892158c4eca00ca037cb02b62220bb
SHA256d3ce001ef04478c71d58b6c09c0c9ad81d037a4b6b7c386380ce168748304c9d
SHA512e2389dc453db6dacb4b857c1628ba388cbfc8a82b9a1263b3fad004b313917c17d394f3c7c1112d709a1b12592c41d082dc4eb816aeac34508d0a644415df2d5