Analysis

  • max time kernel
    322s
  • max time network
    331s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 09:58

General

  • Target

    testestestestetw/triage - Copy.exe

  • Size

    1.2MB

  • MD5

    08b8eb8dd9681bfd0050fa7e547e1fd9

  • SHA1

    f810b716884668bbc554aae7914dd19f1c30c265

  • SHA256

    e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b

  • SHA512

    d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f

  • SSDEEP

    24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:740
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.0.1058856798\1787159989" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af509e32-9acf-41b0-abbf-533277e223bf} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 1964 1c392fc6e58 gpu
        3⤵
          PID:5060
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.1.1033598805\172798365" -parentBuildID 20221007134813 -prefsHandle 2348 -prefMapHandle 2344 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27099edc-6d57-4718-b99b-a4be2c611d24} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 2368 1c392f0de58 socket
          3⤵
            PID:2484
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.2.1618763119\1570583960" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3052 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9b1d5ba-6495-4804-b480-d3e6a53aadf1} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 2920 1c3971a3d58 tab
            3⤵
              PID:3628
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.3.168100100\721736735" -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3608 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0fd7f6a-e3d2-4d69-a649-dac25635a6b8} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 3624 1c39779b058 tab
              3⤵
                PID:3908
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.4.918334905\1504595990" -childID 3 -isForBrowser -prefsHandle 4556 -prefMapHandle 4552 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7316f9d-5e30-46d1-96bc-54510b36e1d2} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 1292 1c398c96858 tab
                3⤵
                  PID:5236
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.5.1940930507\498530822" -childID 4 -isForBrowser -prefsHandle 4948 -prefMapHandle 4944 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e737d3b-0621-4a57-9109-df6f1b12d738} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4960 1c39779b958 tab
                  3⤵
                    PID:5648
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.6.560875363\1987205491" -childID 5 -isForBrowser -prefsHandle 5096 -prefMapHandle 5100 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6206ef9f-8942-4d4c-9d8b-22e79a70a0c7} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4984 1c3994ddb58 tab
                    3⤵
                      PID:5656
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.7.938425786\28039438" -childID 6 -isForBrowser -prefsHandle 5308 -prefMapHandle 5312 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8164b439-827a-4a46-a512-5cf65f6f589a} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4992 1c3994dde58 tab
                      3⤵
                        PID:5664
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.8.1653251051\167286254" -childID 7 -isForBrowser -prefsHandle 5736 -prefMapHandle 4792 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {201bfeb3-71ac-47e5-b5f1-381896ed16b0} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 5748 1c398e14558 tab
                        3⤵
                          PID:5156
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.9.47373824\798345103" -parentBuildID 20221007134813 -prefsHandle 4640 -prefMapHandle 4636 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cab24ce8-3530-4519-82d9-78392469b707} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4648 1c3977e4c58 rdd
                          3⤵
                            PID:5512
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.10.246377696\1056776644" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4604 -prefMapHandle 4640 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f670aab5-e8c8-4e00-a4b6-833a3d49d350} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4668 1c3977e4958 utility
                            3⤵
                              PID:2044
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.11.1416922075\554519499" -childID 8 -isForBrowser -prefsHandle 6084 -prefMapHandle 6064 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {729d51c1-0680-47bf-8f00-a8774991eac1} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 6124 1c39a8ee058 tab
                              3⤵
                                PID:5524
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.12.1832939952\1214397055" -childID 9 -isForBrowser -prefsHandle 6312 -prefMapHandle 6012 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfe7ff45-862d-44c3-8369-5f53449a71fb} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 6084 1c39ac8f958 tab
                                3⤵
                                  PID:5420
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.13.1537569116\971164724" -childID 10 -isForBrowser -prefsHandle 5972 -prefMapHandle 5892 -prefsLen 27463 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a95a981a-a968-4b5a-9ce7-71534113c1c4} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 5976 1c39a69ab58 tab
                                  3⤵
                                    PID:6136
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.14.518733874\159766707" -childID 11 -isForBrowser -prefsHandle 4716 -prefMapHandle 4736 -prefsLen 27785 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42b32b2b-b090-486c-b584-2e0cf30cd58b} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4476 1c3994bd758 tab
                                    3⤵
                                      PID:3904
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.15.1646357410\1915622205" -childID 12 -isForBrowser -prefsHandle 5528 -prefMapHandle 5088 -prefsLen 27785 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0d112e2-3e25-4455-bb87-eaa3ad82deda} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 4904 1c3994be358 tab
                                      3⤵
                                        PID:636
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1240.16.439771524\2022773286" -childID 13 -isForBrowser -prefsHandle 7464 -prefMapHandle 5928 -prefsLen 27785 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b60e6316-e524-41d5-b34e-8be54074648e} 1240 "\\.\pipe\gecko-crash-server-pipe.1240" 7472 1c3977e5b58 tab
                                        3⤵
                                          PID:4540
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
                                      1⤵
                                        PID:1124

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\10637

                                              Filesize

                                              9KB

                                              MD5

                                              dbe44cdb49b62236bfbb8faff0d2e00a

                                              SHA1

                                              1abcb261783f1b74e2a6e9fd812a2efa1a031969

                                              SHA256

                                              586f9258693b18b5306abf5316166486dfaf7f0332a1d29fc29b5d5350999724

                                              SHA512

                                              6495977703fd01b8b705fff8a80152d5ca2ba24ca727d66ea7db00fe53ba20ecf5dd586b235d8c67b7d7c8498e97b18985ee9052c37ef90ae97039666229ad7d

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\12916

                                              Filesize

                                              8KB

                                              MD5

                                              85245df11b0772debe0d4cfe91a76462

                                              SHA1

                                              b396b74b556b8c04c177f77f155ac14a9c35af2e

                                              SHA256

                                              29f65661fd312818c26674733314609de092995d6cad174850166787961fdc01

                                              SHA512

                                              a0ae388c39c81fcd0c50db10752ac6f89d32b22e6d850730a4332043f53ccf8be42b4e5b78a8f05f961c6071859bbc7f333fadfb8caab1ae7c3348b2d03017d3

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\14533

                                              Filesize

                                              9KB

                                              MD5

                                              5aa9b9e0e4e4423bb48a66055b64ef20

                                              SHA1

                                              88f4a5fd27f4fa510bb22dfae649ea6b62f6c641

                                              SHA256

                                              121bd430d0b04bcf54247d4275af8b5ccc32f4bc0a97077f2da29bbe459ffc31

                                              SHA512

                                              f9e45a44cf29f93df8fc723571892e33b80e5a8317a513a59429b9b6af9848ab2eb6c697067ae64af8fb488fe081774bbfd975c48519c0ef3226a608d7142c70

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\2906

                                              Filesize

                                              8KB

                                              MD5

                                              3535b5730f59211a17eb6b9d71f408d7

                                              SHA1

                                              ea9fd4ae3cc06ca5386db2dd05b001bbcbeb8b5c

                                              SHA256

                                              36a3df98981993689076e1a1085e41d2a6e61b0ae156c8da239543807b393272

                                              SHA512

                                              78b7590417a78253f511d8c6b1b77bcf6973c320e66b0d8c3b387a4e3a3e1cae65e443f9936361764830f55891541fa76350b23b2f9a9d8f45366f2c5cf43d06

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\32049

                                              Filesize

                                              9KB

                                              MD5

                                              cf990087d9948e42881af38532ef62ea

                                              SHA1

                                              a0a1c6936de86937b165247fcaaf0cad98b1b7e1

                                              SHA256

                                              3d7250b090ddf50e529ffbb8116c4489f34104dfc0b322f0eca0b52640daa59c

                                              SHA512

                                              926ddc99c108742486322e7de5bc876bd9c3e45d232af1706e8ae42522f101f0ac0c89bdb525649c90667a565ccf5ac57eecdb437c2125da9e509cff7e720151

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\4748

                                              Filesize

                                              9KB

                                              MD5

                                              28d2390dca9f9a8d01cd57f71a64cb0a

                                              SHA1

                                              c38a149c756b06b42a5f3a5decb12e714346e51c

                                              SHA256

                                              eb4bd46c61d4dab548b4bcc624aa93e5838eb0411ec4a69cd0ac559bafa8c457

                                              SHA512

                                              0fe84d473187ea2f963549e76fd6f31ed84595192ff37d14087df6c1a976d3e8e304f7cc80dfffd33c8c14df9e384bf556c0b1b0b5b4226cbac3e1aa74d9985d

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\9011

                                              Filesize

                                              9KB

                                              MD5

                                              d063ea463072672719c6cd3ac42de4ad

                                              SHA1

                                              5aae7a4de71aa8bd3d4913154c8c83f699db8238

                                              SHA256

                                              9ac44dfd23e36ee2ee3f4c0ec2cc9dbf52315525204eb313b4681e29cb225c1c

                                              SHA512

                                              3cd94c7d320041f998d32cf680a6ad3861521da238c64182311a147667e7cd8f2a77c17a999252fac379d3585c08fe24290ae5b56a9ec669b688a7ebb37bf9dd

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\9514

                                              Filesize

                                              9KB

                                              MD5

                                              55a1ce68492a5b89c42c7fe0f8d6cbd4

                                              SHA1

                                              fa39a73a8f23d4dde7c7df6b56691b041e02ee05

                                              SHA256

                                              0919a06a8bb1a690b960819d930b5bf6752ef31165d299d488d339597f7ea347

                                              SHA512

                                              39d27fb6b74ff523854f14405f1db880706d790d07ebeec8e01ddea206c27f70d60e8ddda30efab20ca2e55a4d16a16adb2799499eab6c2230f8f0fc4a0e9b44

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\9820

                                              Filesize

                                              9KB

                                              MD5

                                              1ee2fc7c9f1a315bc58131b503dc2698

                                              SHA1

                                              62effd07f505dac6873633f47cc3ce32794e6a8a

                                              SHA256

                                              e620123a3af32a629b149f7043d9e33d20a25dd2d9d7d36ab234ee3ef00fc238

                                              SHA512

                                              52eab7bf6f9ce9e0f1a55e7abd064b040ab8ba9b27c37d77d99296ab0240bd9c42a3fab1cf3c121c245dec1779fea26586c2638bbe8a9b861d9614f03178acc5

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\9980

                                              Filesize

                                              9KB

                                              MD5

                                              0b31a1cdec37cfcf0aff1db705f31740

                                              SHA1

                                              f354e7b218b85f9aabc32e6e2fdfc428e1de6f58

                                              SHA256

                                              f3ef9bb1bee9b91d308b3463083d0844fb3358826f225048ef76bef02ed70573

                                              SHA512

                                              ada80cf0b3a778568d5d317edb62689dd24e721ac6ec076700dd31df0a88dc6f1c19afb71b42346b1961e9e2223fa2813a2fbb61be65c8a62c16ab91f2f21433

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\D82ED10047F78B4F750CAA390C240BAAC50F3BAE

                                              Filesize

                                              10KB

                                              MD5

                                              2317ba1b246e07263079cce32bc9581b

                                              SHA1

                                              87976397119d9a694e4080c00c36595147d1bcf2

                                              SHA256

                                              70e6595524597aae6ae2f3c034c9de7ad570bd0a03a7a0883a18dd47263431d3

                                              SHA512

                                              ed3908c1122f721c5fc119e29a6336d82a0b740fc02c0bc6accc76889d184800b6c27d1a30774410045332c63c17bad28741af8362382badc6d300634f3a4a0c

                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\E8F82FF507585AF8655F245209766BE49794B690

                                              Filesize

                                              49KB

                                              MD5

                                              3821ea07ebee752a02d1302856f3d9d8

                                              SHA1

                                              4bd8448b2779b53f0866d951446bbc5279dd3563

                                              SHA256

                                              7fae2bb624571eefedc1ee5076e840d0723a6e8530f7218e4601dfe44a1ab9e0

                                              SHA512

                                              8a54edea9854af78931134c9428fdb070d6f028ad0e01d025dd67e79e79b66459aaa8cf0d3f664166c5caeabd764ad6efbfe880e11ea481c47b287bf0ade07a3

                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                              Filesize

                                              442KB

                                              MD5

                                              85430baed3398695717b0263807cf97c

                                              SHA1

                                              fffbee923cea216f50fce5d54219a188a5100f41

                                              SHA256

                                              a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                              SHA512

                                              06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                              Filesize

                                              8.0MB

                                              MD5

                                              a01c5ecd6108350ae23d2cddf0e77c17

                                              SHA1

                                              c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                              SHA256

                                              345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                              SHA512

                                              b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                                              Filesize

                                              12KB

                                              MD5

                                              863d5c1fb1984fadd1f0ea395bd22426

                                              SHA1

                                              e03227ee4c697f4d2bf405ae5858f82a019b1b39

                                              SHA256

                                              6ef77411b06d3f62df18726802802901904b978d7637843a33e49d9591eb4e79

                                              SHA512

                                              ba01bf6c6ab3626ff19f2657f7c7cd73b3e30d4d701a844f98cff51050d0243eb0d2a9d1197089a500c8fec7bc1ea9d2882d2e8da94e5cc15172843b99aece1f

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\addonStartup.json.lz4

                                              Filesize

                                              5KB

                                              MD5

                                              eefc565b30b1f565871b93b959013afa

                                              SHA1

                                              5d8aad289d0896a37e2797607071f32118363bd5

                                              SHA256

                                              9b2c48678582b72ec0a97b0420841792ffda6e7c9f2da1b01c119d4e55360400

                                              SHA512

                                              5c0376446b65bea560c246677c470f72a4132bc68ba9b0f93bf3b98ef07734345160215b9e8d22b8a5423ffdcb90c56c65d2877b36e229c47e46139259019077

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\broadcast-listeners.json

                                              Filesize

                                              204B

                                              MD5

                                              72c95709e1a3b27919e13d28bbe8e8a2

                                              SHA1

                                              00892decbee63d627057730bfc0c6a4f13099ee4

                                              SHA256

                                              9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

                                              SHA512

                                              613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

                                              Filesize

                                              2KB

                                              MD5

                                              f825a7e3fb940e7da397113aa2c74685

                                              SHA1

                                              eb00899ca039fea809acd70e69f16c8d604876c7

                                              SHA256

                                              2c910588aaac7dc70687bb873f0d3393a8ae0a89abf172ce138fa3a380009ac3

                                              SHA512

                                              c3a32918db16e696a02d160e45ed896766697a2c6652f4c66e975d026eea51276366cd5febf6393b748d4002ae205e27ab20434609cbd35fb1b7b33269006ae4

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\bb374d8c-43df-4911-9cff-6313c17ee9c3

                                              Filesize

                                              746B

                                              MD5

                                              501c0aeab272a503bf72c3520c327b90

                                              SHA1

                                              1d99216f8fe0b46d38c14d07484573d80207e962

                                              SHA256

                                              8254462ba55a657e45693339fbd517a7e324a8e01745b998f18abcb751c10664

                                              SHA512

                                              c92e5f632314a92f37a89d4a9f49c2413cc989fced9ecf7b7c4ec71a181f87309d36b5e412f3d759b1e10f73b4c33a523d06dab1fe9fb6dd4fe38ef59e08157f

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\d429ec71-d687-4d18-a353-09257507e69a

                                              Filesize

                                              10KB

                                              MD5

                                              4d270d4631e7f54dfcfaaf3b1eb2e9d2

                                              SHA1

                                              798b49fda60de060ea7e46b3ea668030dd0c5026

                                              SHA256

                                              97a4b4e6257d0c6c62811de2efabc8bde2a5a20def40ac9a95dc7af6817ec146

                                              SHA512

                                              d0d00982986014029fd379554fdbf1a670135b4eaa45d3b99ad0a7fd8a283f44960eae693980ae64487a08c4be05c2653d2b3ea7ee7325e44a978be74da6943f

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                              Filesize

                                              997KB

                                              MD5

                                              fe3355639648c417e8307c6d051e3e37

                                              SHA1

                                              f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                              SHA256

                                              1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                              SHA512

                                              8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                              Filesize

                                              116B

                                              MD5

                                              3d33cdc0b3d281e67dd52e14435dd04f

                                              SHA1

                                              4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                              SHA256

                                              f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                              SHA512

                                              a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                              Filesize

                                              479B

                                              MD5

                                              49ddb419d96dceb9069018535fb2e2fc

                                              SHA1

                                              62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                              SHA256

                                              2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                              SHA512

                                              48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                              Filesize

                                              372B

                                              MD5

                                              8be33af717bb1b67fbd61c3f4b807e9e

                                              SHA1

                                              7cf17656d174d951957ff36810e874a134dd49e0

                                              SHA256

                                              e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                              SHA512

                                              6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                              Filesize

                                              11.8MB

                                              MD5

                                              33bf7b0439480effb9fb212efce87b13

                                              SHA1

                                              cee50f2745edc6dc291887b6075ca64d716f495a

                                              SHA256

                                              8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                              SHA512

                                              d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                              Filesize

                                              1KB

                                              MD5

                                              688bed3676d2104e7f17ae1cd2c59404

                                              SHA1

                                              952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                              SHA256

                                              33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                              SHA512

                                              7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                              Filesize

                                              1KB

                                              MD5

                                              937326fead5fd401f6cca9118bd9ade9

                                              SHA1

                                              4526a57d4ae14ed29b37632c72aef3c408189d91

                                              SHA256

                                              68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                              SHA512

                                              b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                                              Filesize

                                              7KB

                                              MD5

                                              b5b4da9d300f25e1d9be57b53b07c913

                                              SHA1

                                              abe92264d9d2a1033f9cbdca729950197580f4dd

                                              SHA256

                                              d173e5296d5b98f7e8b2ac8e90d9cd99029798e47224e5b92add6b22293f5cb5

                                              SHA512

                                              f9fa2584ebc3e975afcf7b76abaf3a2f2edc31b4d8945ccd0c81ae53c2b9ef09e6be31b794f06f8aa70ea813c3a2f39cbb301dde7b3d5b76ffff9a0389672aec

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                                              Filesize

                                              6KB

                                              MD5

                                              b0cc3264b7bfaa421855020c7dfc240e

                                              SHA1

                                              d1a639c572a912ae2962fafcdb8b0580e1ae37de

                                              SHA256

                                              af792d24e60a1f02a029d93aed22fd72db1b98355f2a5d2623cc75d8010af1e6

                                              SHA512

                                              0fe9dd2af676362a5127085539d905d5c71b3ea96fe963679e4708bfec3ab5588f656f81e8e6cd6d585f14f3681624a0e8de3a7f648e423f6dc301a51fe381c6

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                                              Filesize

                                              6KB

                                              MD5

                                              3cb5353d6cf6d84a94aa98c456a0085d

                                              SHA1

                                              b827748cc3473d530ddf6d18c0d480d6ca843161

                                              SHA256

                                              6967cac5bdcaee60dc6fd3a81d1045bea9e939d7307dadf86f76295028d9a82b

                                              SHA512

                                              710b6a1cdfb842adfafd73b4bc776118d549be6b58dde8834072a7522e28bdfdaa76844a12f0ccc292d456991a99d4be8fc433fe18a95d2f39bf37f524922456

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

                                              Filesize

                                              7KB

                                              MD5

                                              faff5134d925cf9cc2cda27690e82107

                                              SHA1

                                              a9341ef9b6197ca57c421d60aebb54569f3deac7

                                              SHA256

                                              01c84ab8730a6e1a5548f6a4913e984f50d1cbbd6ddce94530aab95487e18eaa

                                              SHA512

                                              d87cfea16902801d724adb246a03fa4a4efe957fd71b7be83e3bf13ce8be0965bebbb55abeaee0c81ea68b40ebb8304e5f7133a2fec8a553e442895aa42dddf4

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

                                              Filesize

                                              6KB

                                              MD5

                                              1be94651f830ec79eccb771e4478ced8

                                              SHA1

                                              1fa1e6543fb6f6721b74baa56600ffbf5e2be645

                                              SHA256

                                              548f1bf3f99e5ef6ab87700d64570d86a1c1809b9843c0ad354af1ab67da6af3

                                              SHA512

                                              49b8cabbf4d5cdc1c0bec129e01a6004e05e30dcc7dcf3efa2863075270a3ba08693e8468baefdb124c296bc3aefa4a2e45f403b7739b2058d37338cefd6fa05

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

                                              Filesize

                                              6KB

                                              MD5

                                              6403185e6e268a441bd63bf3b6eed361

                                              SHA1

                                              5768227553757fa42be26f5a3c5452e348e314da

                                              SHA256

                                              50786322aa3d660190e74231b36ddd45adbaa6216e51e39ba04e9e72ee65f008

                                              SHA512

                                              dbf1c7444469d10870e463ea9006ba35c6113d136c72543ae98d2822001893f5ca423db88c6c6cec342992b336d69d1da990237c73ec6d41f5dee3366058ea37

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionCheckpoints.json

                                              Filesize

                                              90B

                                              MD5

                                              c4ab2ee59ca41b6d6a6ea911f35bdc00

                                              SHA1

                                              5942cd6505fc8a9daba403b082067e1cdefdfbc4

                                              SHA256

                                              00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                                              SHA512

                                              71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              5KB

                                              MD5

                                              92c49f50320f3450e5f76604f5dd711e

                                              SHA1

                                              a309d7cb27dfd9d986a6a6b4c9b7f545a75a2242

                                              SHA256

                                              3520c62871e9e3ea054d68fd75022daf6b3421489ff2ccd2b862c79c5e0fa9b5

                                              SHA512

                                              1865a3b14c6fad6487ea60bdd5483c3e40b9883d253a44487999ccab1f37557ee19c0a2ff0af89180b194e964ee0c26f5ef04c69809e24f9cd4ccbb4e40e5be0

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              5KB

                                              MD5

                                              8b92f1afc6d9889273b19e8032f9c118

                                              SHA1

                                              61e257de8a4ac2038d6df4af240ec5211f321b75

                                              SHA256

                                              d0bae38b8b755a6b95dd4f8947b41af0c89411b44c6ea180a102c00b1655ee98

                                              SHA512

                                              65794dbbcb76dd043ab7b6856a23f386d461d146e5341a5687f348f033df6415ba52ef19a3b3aadd8d58a0acee97423e62a3af879b72feb177b9487d4faad000

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              1KB

                                              MD5

                                              03c94d9a6ba9b5c87862c8b81f5015f0

                                              SHA1

                                              383233d9e66a18d57b9886a446f75d4cb8a75acb

                                              SHA256

                                              62a05842e97a3b04db0052c829fe0d1aa270c5bca23bc9bac5ce28350415fb8a

                                              SHA512

                                              b407d4681f0620e09d992336e532db2489ae7481e60ba7e7587140e8203d04c22bb8377f98dd0f536d72aeeffc8418dfbfa1cb127d15729626f422d757cbc37f

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              9KB

                                              MD5

                                              b7c24e09066afed3607e2924800f55c5

                                              SHA1

                                              9f655dbe021f32ce687ee6a19b669dc789226e31

                                              SHA256

                                              2ee9a68dc56ac619bcf6624407dde2a208413a9da2fc239bce8b46b8da09ffb1

                                              SHA512

                                              d39e223ac0e0c39bbcd207d99357a8e16f2998b988a1be308c6da0361a83782f3392ce49dea7efe31ac09687aad015044a6d132486270c6d96ee29436f730d45

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              9KB

                                              MD5

                                              9a7a1f753ab1d3b912f63d61bf896e26

                                              SHA1

                                              0152f4ae1064b0de9e12e5ce430f7c5181c37d5f

                                              SHA256

                                              cefea16650d76ddeb8a27ac9bac5b9174a3e4964736a3759590c8354a41ebc9b

                                              SHA512

                                              f277a08d0d310ded60ac550a98bf6af1975a238253d318543cbbb7ed6d38a20099dafab2d50860c16963838dae368b8a92959e5cf0be27ae815bfb36534d16b9

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              10KB

                                              MD5

                                              9b3c0eff47ae293fd2eb59262c2b3f2e

                                              SHA1

                                              7e37ec19ec5b1aeb7717ee3e2da6f870b05f9a3d

                                              SHA256

                                              19f37a53031ed5b9d768481ba48fc147acac48e97c0692f8fb314fddb11e19ae

                                              SHA512

                                              b8811111feb6850b77073139f65addc6b4e66a5d089741004a22a14b94750f9f41e8a1b3fba14cee439d2f91f195fdd7e1fccbf2ba727728a3ebf9742b682d74

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              9KB

                                              MD5

                                              e54f11c4f80d6ccbb3be48ce43ff4257

                                              SHA1

                                              359a9040cd2efeb832e1ed3feedae4830abb0fdd

                                              SHA256

                                              aeaf23d7f4f6899bf336a17836b4a59666dbcf5b28208bd6e37fc86ff1483e90

                                              SHA512

                                              0248c870436bb3c8d3e05b8b152f7994b5dfd782f56d20bba45a8c6aa0f2b46b1db383caf97f59a500d267dfce34d459bdc63d2d84f69812bd847318819acd4e

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

                                              Filesize

                                              4KB

                                              MD5

                                              265ecd86543d25a178bdfc73f76db711

                                              SHA1

                                              fd596c5ba472751d0c0634273bdacf7a1d5155d4

                                              SHA256

                                              6378d0bd05ce77405f218c6bf9356543e645a35867bc2f7b050cbbf6fd35d6ad

                                              SHA512

                                              33eeefd4917c66066b84e788df57c320e0a667ab92a80804168143ffb9b66ae12d9d8d7376f25928c45e82a787226eaf34fdcc5ea8410050b042d78f67b05222

                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\targeting.snapshot.json

                                              Filesize

                                              3KB

                                              MD5

                                              8c7651515bd2ab81eaac8512348c2ef6

                                              SHA1

                                              80fe228df6e104de37313d363da806b03fc357fc

                                              SHA256

                                              e068479687b4c6034d7fdebee315dfc64822c9151dd5aa70e977a41da16d18a4

                                              SHA512

                                              af768ac255b7a1bb747bb42bb417069c39c40dc6da0c408abf1d15acf88345e49937a57e24132766e45e4ad03d1cef923b90fdd38a1e1f7a3a5e0aad7c27eb59