Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
391s -
max time network
398s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 17:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/folder/boseq9fqy60yl/ROBLOX
Resource
win10v2004-20240226-en
General
-
Target
https://www.mediafire.com/folder/boseq9fqy60yl/ROBLOX
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\ROBLOX Cheat.zip:Zone.Identifier firefox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 112 firefox.exe Token: SeDebugPrivilege 112 firefox.exe Token: SeDebugPrivilege 112 firefox.exe Token: SeDebugPrivilege 112 firefox.exe Token: SeDebugPrivilege 112 firefox.exe Token: SeDebugPrivilege 112 firefox.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe 2672 helppane.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe 112 firefox.exe 2672 helppane.exe 2672 helppane.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 2612 wrote to memory of 112 2612 firefox.exe 92 PID 112 wrote to memory of 1040 112 firefox.exe 93 PID 112 wrote to memory of 1040 112 firefox.exe 93 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 2132 112 firefox.exe 94 PID 112 wrote to memory of 4524 112 firefox.exe 95 PID 112 wrote to memory of 4524 112 firefox.exe 95 PID 112 wrote to memory of 4524 112 firefox.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.mediafire.com/folder/boseq9fqy60yl/ROBLOX"1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.mediafire.com/folder/boseq9fqy60yl/ROBLOX2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.0.1559235064\2050881885" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1868 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f86646ee-fa87-4671-9a49-6b6625257a86} 112 "\\.\pipe\gecko-crash-server-pipe.112" 1976 1ce179d7d58 gpu3⤵PID:1040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.1.1243033622\1145535295" -parentBuildID 20221007134813 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3283dd6b-a331-4452-baec-78e17967d570} 112 "\\.\pipe\gecko-crash-server-pipe.112" 2400 1ce178e9258 socket3⤵
- Checks processor information in registry
PID:2132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.2.1962550790\1386093813" -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 3156 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ddfa907-238b-43b0-9784-aff7c7e4f8da} 112 "\\.\pipe\gecko-crash-server-pipe.112" 3172 1ce17960c58 tab3⤵PID:4524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.3.811895930\1660480019" -childID 2 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d569037e-2614-4f85-9e7b-b6a843f05249} 112 "\\.\pipe\gecko-crash-server-pipe.112" 3996 1ce1ccb7858 tab3⤵PID:3716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.4.210411573\87904715" -childID 3 -isForBrowser -prefsHandle 4896 -prefMapHandle 4916 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e729d914-b928-4eac-a90d-99e1d0868efd} 112 "\\.\pipe\gecko-crash-server-pipe.112" 4920 1ce1e41b358 tab3⤵PID:4916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.5.9406\51894152" -childID 4 -isForBrowser -prefsHandle 5060 -prefMapHandle 5064 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11d1bfa9-260f-4262-9769-c53fe0f6bd80} 112 "\\.\pipe\gecko-crash-server-pipe.112" 5048 1ce1e419558 tab3⤵PID:3524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.6.144976118\254031222" -childID 5 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {000a3a38-97cb-4ba5-a34f-aec4cc594019} 112 "\\.\pipe\gecko-crash-server-pipe.112" 5264 1ce1e90f758 tab3⤵PID:1512
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.7.583501148\1301190581" -childID 6 -isForBrowser -prefsHandle 9276 -prefMapHandle 9292 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2658798d-71fe-4c86-8aad-3bc5a19fcdeb} 112 "\\.\pipe\gecko-crash-server-pipe.112" 9284 1ce204cdc58 tab3⤵PID:5816
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.8.1041980759\155576734" -childID 7 -isForBrowser -prefsHandle 9080 -prefMapHandle 9076 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2897c2d-7c40-4542-993b-fbd74fc42194} 112 "\\.\pipe\gecko-crash-server-pipe.112" 9156 1ce1ca64258 tab3⤵PID:2488
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.9.1415993205\2140493197" -childID 8 -isForBrowser -prefsHandle 8904 -prefMapHandle 8900 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed46d151-826e-49b3-b7d1-26940de3cf39} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8884 1ce1fcc4e58 tab3⤵PID:5984
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.10.1740380018\1907994883" -childID 9 -isForBrowser -prefsHandle 8660 -prefMapHandle 8664 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac4e8d02-ed34-4d13-a15f-53a37aedcc22} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8648 1ce20804758 tab3⤵PID:2676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.11.272636864\312974622" -childID 10 -isForBrowser -prefsHandle 8884 -prefMapHandle 8684 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90ce9664-d7ae-4af3-a7e5-7aed8567c4af} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8564 1ce20806b58 tab3⤵PID:3064
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.12.116088625\34212495" -childID 11 -isForBrowser -prefsHandle 8572 -prefMapHandle 8576 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30a4fae4-67d7-4586-b5fd-a7d54dcf26b7} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8440 1ce20805058 tab3⤵PID:5308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="112.13.283255087\1885020985" -childID 12 -isForBrowser -prefsHandle 8564 -prefMapHandle 8208 -prefsLen 26686 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b03e336e-1766-455c-bad2-b498198727f6} 112 "\\.\pipe\gecko-crash-server-pipe.112" 8884 1ce1d89f558 tab3⤵PID:1128
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵PID:5932
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵PID:4224
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2536
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2672 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=5288842⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3776 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:11⤵PID:2064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=3696 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:11⤵PID:572
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5236 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵PID:2920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5452 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:11⤵PID:5776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5e05449695df53a040cc08ad5f9601c91
SHA1863e4e315bc5530c957c6f41283e32ecae31f8d5
SHA256360286058877889c758bfeb25f390a49bfdec4a15c25e137608dcdccb97aa776
SHA5120e795e11fe9f1dd1d069dc9e39e7798eabfd5b941c59308482cefc54c7e88bb02aad8944fd6c3bd9918f36d580d908ce04df7d1a29dcf1e6417913ca73951358
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD52fcd60e2d6d3bc3d8edfe9a1df1242e3
SHA1cb0d6b1975e27657002760ca08368b20208197ef
SHA2563c6d52ebd4a39a05b4774779f1b67849f60725c3834f6c2d5f62fd51a852a7e1
SHA5126c84f0cb214c0e204f62c7def0db3f050b918632e920ebaaa172ad42f83a4ea85a17e0ee3e02cb0a6c39adcbfb014d4b3213bf0905febbbd9b15ab6b7d6d4145
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\d9367932-14c0-4f4c-a80a-e8aacd79f915
Filesize10KB
MD5cbc9b795d8dfeb1b87f9ef74b41cd9e2
SHA1f117cbdc260854c222f160a63aaaeb4f20e03df5
SHA256e2d704b51d41cad079b42da669f92b3c246ec24725d273c5f0d7269247e3e333
SHA512d1ec724c5bb323fa38ce0e16cfeae70bf86447ef53834c6dcf30a3cce31d5044e2c1f1a2bbb5809a537ca9317226f2bef6f2d69a8ea930e5ea7ec4ec3e9a7cd1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\e91b49dd-61f4-44b8-8541-89ac61597b11
Filesize746B
MD5a9f40a940fdda8b8d7861e19054e5db8
SHA1838a4ec2551184938d5be1002cca6518c785ae9f
SHA2562a805168e496e664e205fce878cca410bcf3d1b5d2220f1f15e3d0a35de74eda
SHA512a5fb0bdeb76f8783eefcfff99b60fbbcc21919dc1e2476dcd798249b91ec86d3a861d0057cde4883097a8c290d300c682909445221cf247a9305db52d55ea536
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize2.3MB
MD503b17391e82b9260821583673132ae43
SHA1fcd634265ed37c1cb7bd9b260034040c3258a0c6
SHA256b09bbca427f6ad8ab73601e2a7331db2c73c68c4accd4dfea66db6dd07c06d9d
SHA512290ede8ed1158c4d5730c882a0f07710d615eaec9f4e825340b9265563bbc977ee89c8e2b008233acbdd01bcd32d6357e05cc3dc7e7631c3bd2c7160aa36d913
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD5594cb58d9db79057c3e8a547e5805316
SHA1a8234db038634230132427076a3f84a2b9e707a3
SHA2567c0f0cff921ea1ccd98ec2d04a59475b9a2b3f0ad6f05f2640227f1efe8da369
SHA512d698a28ffcb7f36fca0f5f084495ef70095ff9eed50c01fb27de2397f9443cf74f750cc375ccb46927602fda1a5bd969ab0db1fec3cbd46d652a2424c539d768
-
Filesize
6KB
MD50a2a62c7e9c776427cfc33694d925e03
SHA184ff9ba1adc43e73ac642ae121dbb1334b108183
SHA256e285e1174a6ddc2f7ad0ce25ab44d645fd0df07e751c08c2df2b6c8f048daac2
SHA51292ef8c6104b07b1d057863b5704a5a2d54d07ac1d3cb0cf3ef012b8ad5019cab4981625adb2bfe83c32871434c42f9862266f87a499b1b47a6247a592f498778
-
Filesize
6KB
MD51c37a27808988effd9425525778aa1ee
SHA1861795dd2ba83d8c85ddda03c3f4f3747b69e5d5
SHA256893dc4aafa925f39d672e93b3635b28ed8e17ff874d6b6c9673cfe826f0d52e3
SHA5122e007fb0d09d9091502f19decb77dc476345c2745964a8450e29c325d5421099ef4a1df0a987b4cd36005d69a30831986673bd84c1daa23bf3bf74eeddbd1217
-
Filesize
6KB
MD5409d3a38cc91dec3783c8176e03f82e8
SHA18beb881c8d13a92425b14365710b069af5b17704
SHA2562797cb9708f87edbefe8a5550bbcf155dcf2f3116c809e36d3bb21b733b95927
SHA512001ab1095bf761a0d7b9999f1df9a28498b6223574efac3bb6305fab51b8b122f1cebb9273483b887d86080d6148643f392b0e11910a639aa7b403c62a91760a
-
Filesize
6KB
MD588db53b2a517683cb963ec6487ca54b8
SHA12f71f3ac192c8836c21d177a36f8afcc55ad3a5a
SHA2567aba6c79433b8539d173a52d7f0b96730c06d5d262e362502a1266f3aa4c0dc1
SHA5123bcf3a9920de7e08e5e712eb5aed6057209a560f914a0c32151a723e2ee6f51a6c68d0a388020e2c22f040cdba7ae43d1d1e17415d96b8f25cb220228665fb4e
-
Filesize
6KB
MD5be791c816b7cacec8f6482ed7838a052
SHA12d213012c5180779105c0b7c88db4b826a008865
SHA256f1246b02b4a9f3cfd4f7baba09056a14c22dc1e1524c9c615e9a273a290b23cd
SHA512f824316350051591b38ee7723a195a3bc731b6c791ef10f1fb07a40860f56f1d5b496e9d5f4f5423773b3499f7c18d3a0c1080ff521cbe9c533a6f41ab67dfe4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5c7c5f970d856f31b7a1ab46b2f6291f1
SHA12d2a21fb3309ff44e1cf7bb15a4063a3cdf30aa6
SHA2564dd5dfa93e398986cb8f821eefb7bc926a9243ac136674009359b59376c0f2bd
SHA5127b086aaf5a2b99963ed6e5e801adbd7c7b05fc7bc90f8531fd9d7f044e1e68a472fbddd76feecbfe3f8763f4d496ed4dededf70111218863b5e5fd54ffa79acb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD55fe5332906d65a80f9107008501080cd
SHA1909e426682ea4169089ea5258cf63b964b223638
SHA2561f30af36d916690772ecbf605a164a8cbd540df82bd59bd7850cc18c2eb1aa0d
SHA51238c1d9babc20dd0046c4bc62439ccdad23e9df4d0d459d0bc841df18b440cb48d480b006e9117cf212290f9358cd2d718e119ad4266273477ef35e95563e8c2d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5ca8edf5a3da59871db8697915e6addf5
SHA14488058a2cd49bf6454b1df532c6accea8e6855f
SHA2561c00f1c54e03882f81b747a44846b8654d20bb9a6cdc8bbbeed46e817433775b
SHA512f866c37d6d86185ae53c5bf57d8738b8acf59ff03717648740bcfd60ba25d3ed1f9b02881929496428cbcae25d234cb751e16a679ea6b2a242cc05416325d3e6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5277f29f85e952d7645bc193b61f99544
SHA1b93e784fc1edb1a7a34d9c5ecbc2686b260c058d
SHA256debe680d3f04b099d33eb1bf7856124f5b21f6be4d0bcce3900d4dd7f27fb09c
SHA512f21c8d2f48dba7d5507deee7545f7572c88eeaf77972259310923a6a352ecc8db2b90a6b9f6d9a83e2f80f3c685273a12c3bc71bc47f09f71049f5cabaeafb5f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD596e6260438996a862948f232ad407290
SHA189591c31b5e1bf3d22d5fa47c95f0a97578e8db6
SHA256fa01426754de5dfd4017e307ae6ea9d62f448c441b1babb7cf4e969d81e6ae5e
SHA5122cc6f41164371836894273a010085f7c03c1413a39d45158eeb150fd033f4dd63d778a916d389eaade8b115e066ed3f54d190ad119d187610ba439332dc1b25d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4
Filesize6KB
MD557ab591fdf4ce163049c817bd31786a4
SHA1ad20580e6b8c999966e64e308552320d823fde26
SHA25698d73f7b61b1d0895025e7fa5aa1b077e91f960430666d7abb2944fff0a0a291
SHA512090b31ab8332ee7a097829f09d3f41fd81f682c6cb928791fd56946763601bc668db67319182a3317d025d7f30b80e4393c264d926085401461216dacf825084
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD589fb414d778d11d3a12991de60301815
SHA11d7a63ca92d9ad28930ce2feaac8c71c3f699ef7
SHA256935ba660008416f0b46a028a709944f11f9c2858243a2f7bc0b57aa1d96314be
SHA51249f06dc78f2e08621ba4ed19925d8c7ed040502f13edaeedc7df3d675e77417d8b7b3c0b3feaf7f4fcef989091b363f5af1fa9258de57cee5bd904e1d7a31f9b
-
Filesize
128KB
MD52b38122da50a3c7051eb3bbe801fae89
SHA106b051e1178b92068411370dfcc722f2c87e36ee
SHA256c59b7bec39091e085cc841e2a069b345c9ba36fe8d4de9d5fd30877a2aebf817
SHA512af4e445ac1f9639f42cbe555b9365c72348d2c4f4b4c350a07216f9468d79b3f30e69aeabd87292e1a33f00990ea24b8a339ac66a2fccaf666f8eb9dbd132863
-
Filesize
446KB
MD5b39fe3771073720306b13731e1402315
SHA1149f234df429d4f8a36cadc3e6b52589fb6d9a6d
SHA25656f2da6c56159f8fba7cb9e68623f9cacfae34d1899d640c67a42299067fa16d
SHA51263e829a967864c6c72307643b354e0a318b9c17cfca1e9d95b6c99951d22370dca669a3ec0b0ddb1e6a721e5d46836aeb6ff43b029798f1f2db039c353d99574
-
Filesize
128KB
MD53969b99695786d2d391913e1fcdb0fe6
SHA1c157880eebfde42af07c18c244198733c0a3ca7b
SHA2560466b9b92a682fccbc3ce0e2cf55c664b54f5de7a4fa3a858c395fd1fceda6a5
SHA512e01ff78d4f7afea1b76f82aa20e31afa5c511c5589503f71e35662c795b1bd68d4d27bae30a5bb13d1ca140d42cd90a794d77cd280b5ffd45162a65b129338cc
-
Filesize
421KB
MD58c2daad7cae2d60597531e63e04c2724
SHA14f9c3dd6d2d69f2c760592d70f8f949a07a52c28
SHA256432c87a56d7c20dc4c0a1a30dc06abaf5d52698e4f1e73e787666d97a341d7cf
SHA5127840a5764d845d675178113eafd8b2e3ed78815c3b20c94dde2a2e84332e9332bc676e92bc87ba26f29edddb4867f497cf277db09ad67c2aa8321c77c18e0ce9
-
Filesize
498KB
MD5dbb1a87aae40e9bdba9412aa04df8549
SHA1f2e81cbf17d07d781a9f43eb223e215f824896eb
SHA256d5e57a4c9aabb1c26873fd5c177e63c3958affd4e9792231dae4463697cde809
SHA512c911a9add4bc16af0bc56be073caf71f252f3e69fbd352efbbc81836d902a0863427e36f5c8c0c8b9731fc1fdcd5343df0c6a187142c694342eb94784f78b4fa
-
Filesize
268KB
MD5de739202519ef87021d25cb9f3f7f34f
SHA13292bad669b9ad6c46bbe86967a94c50d4bf92a5
SHA256897cbb7be9cdfb3d47e73655b98a3c724a33769a7a311507db27c3069b5d75a8
SHA51223c97faa740d615f64a30ec72c094e500de8e775c0147da1f4a29935049c34f535d7d16915325b2664dacf2b51d80a75202db2ff658722c3787576dd567cabff
-
Filesize
128KB
MD514369433df9a41dfa421c1976890ccc4
SHA15d5b3c52de83bf91b4c08ed75d05676e3d5cf90f
SHA256d8bf143f85d88123d8088aabfd3d73abb071b55a476b7c485ce855d5a75b6517
SHA512b1752fbd9650b1eb6da6c24cb63321126beb4f3f6fd789d2dcbc4a469a6bf688169cdb77bf2b31cb44981cf147faf011e96bf79adc1f5aa10b5d148e6c2847c4
-
Filesize
293KB
MD5824eb45d4174842eade7a37def894a34
SHA14a5a4843572c81c86ffc21547506904ee9d13385
SHA256bd0cc96df836bb6a3898f61e9b60b8c323ed8e549b435c6899036a4f770e408d
SHA5127300f3fd65d6cdd905a2a2f597adb5ffde49582f581c820eb6dbc2f61c19e3263fbca07ce7a1f21475e666615bf566e809f468ea424c6227205149f592808073
-
Filesize
472KB
MD5890fa7c433bc43e6c4869d1aa2c8312a
SHA1ba4b00c8e8dc3469e10cab65a96e5a7169b90e63
SHA256323ed7769c59d7e48a403f92d7ea33ec0d444d2a2123786d426c2bea526ba3f9
SHA51248bdefc99f4b8b7b50bddd764844b9fd05f3fd290ca70b15b9cb530db437e6920733808d7717816dfca488b5c2e3eaf3aa4d889f3e9c7f2819afcd694f9996f6
-
Filesize
128KB
MD59a1453cfd32133659f9558dc445e9fa8
SHA19d8e385d299b2ec8f52e5efda9096bd83d93b395
SHA256201b19fb7c7bc62e4ca12736cb3493b3c4067daf912249fd845669128363d5fa
SHA51247bc258f63f7db68d432f28cbb4c57c06b2b10b5bfe6d20e2da44946e49932b3ed718a49c43896d8445c3371726115eff5f8b1bb30465c63b5fe3a16af075688
-
Filesize
128KB
MD51f5dac10edcd01f6bbc049752b38adb2
SHA15a817f25ae380cee6c952456e1e2bd7cf4861e24
SHA2569df2f673803eb0fd051e4db94e0b3448082fe0696503eb326b6f99ffbad92c48
SHA5128b0c40231b163eeb2bd01c5728266e0e2aad30ef925f9149fb14724340d271fdfc8e6245b1c005825aca95cbd60ac189bf809b6794e4a2e55ba20ad4247ff0bb
-
Filesize
370KB
MD5decb6a513aa020c204d5198e2e1efc9f
SHA1e09ce34441fb7b324aa82d68b69bfd8144460518
SHA25666a27c6f1a61f3d1ba4a0bd8c25b8bcce021ba5c74dd836783ea5b25de469ccc
SHA5126a0c5d698a78f1df1aaac1c39078aee893c07443374a6ea0aee3a2f5acb662a4a6499235349cab40b2951129f2ee44f2b51fcf81e8ae647f486e4b30055abd52
-
Filesize
128KB
MD5d1b4564cf3291bdc77083556d843d4c4
SHA17491be2bcc7948520f612ae0785b6b785800018a
SHA256521d625146742d29e228d8a1012faea13518bd7a49dc31638edc5a42f34a7183
SHA5126fb2b56cfd90bbfdb4d3131ce01058454a4df3418c0ac95af7a6afd5b3bd37443006768f54d81a51f93d10a87436d8811900153ba2f7e7bfcfcfbe961bcd1597
-
Filesize
128KB
MD5d3ed7507e0c550bd1e6cc4bbeda5dd2b
SHA1d86292c35464c54dd2e4ad68c76c9e2c4014d4cb
SHA2563645ae0a8dedcb2dfe5fec204990644d92c928f9e1eb8be2d82fc17300314a6b
SHA51298eec7ee2b15b3f5034bc58b34c46b73b94e7eed93984609966213632ffb633978ba74780f577261696a825dd3d0f94212f9481923afac776d83e3bc2b261e4c
-
Filesize
128KB
MD567d4c3ee9f0448c73f2f47ac956941d4
SHA1a94b6895ed417928002983c3328ece9b3e213882
SHA256969ed0b705ccc27af45deda1d7d9b86c95931cf710a4de3878b1c7dd9a3a2975
SHA5127676b0b851eed40c2bb868d5f62019e2861ce8c796d2bc59a832372ee9c8a2718feaba9e8cd1ef704374eda2ea08e735d7d59b17f5ebefa9466cd54a142fc7cf
-
Filesize
128KB
MD59a89c06a93bdd59ae7ffae6856c695ee
SHA1aa2dfbdb7c16a2d632256d67aa53732c1e4c5e85
SHA256c2898905a22715d887963f8ebd1b3c846a16466478ddfe906c38f0702bbf6f5c
SHA5127ffa8fa44a1b4c9b685fe910cebdbe575aafbd119e63ee4024bfb6ad7c2f6507d354606a34116bcdda0633320e66c73bb1a09ac9a6706e82ed7510732fc3696d
-
Filesize
128KB
MD55f53fc1add249e5a200ead2641510acb
SHA13f4f2ff71fa3e6420625d10e47e3e17f395a236d
SHA256fb3749e97469bae033c6899f269e95cbb6cfabd5448c2d2dbca90fef7bbf0cf5
SHA512ddfb4c516ae16bf0727029997420fbb71e3d2f32044bbdf9c9b10f29fed84830386890f4ab27d9f49b96cb3bdeef36eb9c6301e9c3f0a18df678492fb51ac368
-
Filesize
128KB
MD59398a763a2524db7425d6984f003aa39
SHA119df1c4aace4d06845fc97acb813615f867b9ca7
SHA256524badc24682a82fd1a863ed7c9d5c1f07e271074e4e5398ba9521860b386600
SHA512af4f0f4451496eebb54b7e8949a01b240532429d22b8afe59ce11bbfe8250fefe1201cfaa851da24f186182bd0123515d0ad1aff1e6ca5ec500aee412718fe77
-
Filesize
128KB
MD5a5e1cb712cf361d202822e016940aedc
SHA19f4fd3603b9fa890c19b5b957c3da97954c64392
SHA256eda68307c42d54577c41b16e91ccd4db36fd3766359b64082e27e993e438fd0d
SHA512050cd19028a5fd759e6cab4aec2e0a9408101828d47183b67dc6e38f35ed6e256f8cde76295d8ae820f3499f5a6d42758cf6429496e8d785ab327ff8dd13367c
-
Filesize
128KB
MD55cb495e6452086f943dd0ba4bc7d7916
SHA1e375a8954ae1b48d298abfd81a1f28db435de047
SHA25610fa9fbb03c279db62372157ec1623820a66419278350b7044de37180d316542
SHA512e73f67f49f238fa3be423a83647271ebc4a4fd676989042e95288a782455b93e3cf173e56a545f68e74f1b66e820c1cdd24eb455897c19492d00043e59afd635
-
Filesize
128KB
MD5bf135997bbb646018dee69b108a50c7f
SHA111301a975671a0ec04e7d7a1c6ff96a81126cbda
SHA2567d9979ca2a532497c4aed6fc7243686773e86ad0611cd5a360072c875b5f7461
SHA512da224c1dbd4d0e184aae17d7cf8c1b0acb799f19fc726d4574a09af96393f21cf8634b468029f426610375442f2402ccfd2816dd7b2149ca748377be5696ab00
-
Filesize
16KB
MD59f707a96f844d18b64b514c42b3a6201
SHA19aaef38295f410a64e50fa100e68e58a80ddbc84
SHA256e0490164fbb1c1db525c0acde5d4b28fb87e6718799ee4a46ad57f8ca326f05d
SHA512cad9f9334d40a7ee851bc0ac483d63a5d4e51afb13f7dce05e742ed1810d7673a6a5eea5d48d6429bf3aa5cf5f3b3d235475c618d385ebbd8d1c6dd884178ab9