Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-05-2024 10:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y
Resource
win11-20240426-en
General
-
Target
https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2416 firefox.exe Token: SeDebugPrivilege 2416 firefox.exe Token: SeDebugPrivilege 2416 firefox.exe Token: SeDebugPrivilege 2416 firefox.exe Token: SeDebugPrivilege 2416 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2416 firefox.exe 2416 firefox.exe 2416 firefox.exe 2416 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2416 firefox.exe 2416 firefox.exe 2416 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2416 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2528 wrote to memory of 2416 2528 firefox.exe 78 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 4308 2416 firefox.exe 79 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 PID 2416 wrote to memory of 1252 2416 firefox.exe 80 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://action.azurecomm.net/api/a/c?r=AIAADBE7YYVFSSWTTPABW2XTMLP6W46REBKJRVJZBM6DX6TTBPD5YJ3AJOZRK3RJ6CELNV6LYOUUU67RB6OEWCFS23KKLJSQ5ORPNYGQEBPJCENSZW4BQAKVM4X4RIC7FPQBV4UZIQBQLYOHRQPK3TKBAUH64TY&d=AIAACLPEEK3I6K37IOOVD7SHNHOK6AJIP6MJTJ6I7TXCFTTYLFBBBPGM4QGFKR7BLIYLFARDG3UQSAXXCRLL7HBP7FAMG7EEUBQHILFDGOE2XSZWL3PFPL7PBUTBPICU6FVUMK4ICOUQKY5D6Y3EJ6S5TQBWOMIXXXKHTPGK2NJRS6P2AESGKXFXXBSZFOAP4ODHJCB43XJ3MZRQVMI3EWBJPW3CDKTDJZZYZZYGZRTKUQZIHHBTPI5ZQPAMUNJZT3JZC&i=AIAACTFGLA2N6CSBMONTGV5ERQRJZLQE564WDRDSBL4D4X5HPZYLANBLMLEQQCKZKWM2YKGQ67QYSQRVIDMCUWKMLABRBT5FEF2XT236IZNUJX2ZSBO7FGWRI5GHW2OWYOAFZSFHDIPV3HWBLQ7FJI6DTC7MWGYL5PJTPKQNHWHT5BXKGSJ5RBRMJTCSSCMFYQ7DNW6QUPMCPLFZGWFBWNWAU4ERS66MMDUVKT6QASKPVHN5LGKZT53Z7RGUJL33JUB2I6F3IIIUYQDHQUBQY2NTKHOGC3Y2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2416.0.983477742\1108528204" -parentBuildID 20230214051806 -prefsHandle 1796 -prefMapHandle 1788 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e036d57-7238-49a9-b69a-26037f65bd63} 2416 "\\.\pipe\gecko-crash-server-pipe.2416" 1872 1fe40c0d758 gpu3⤵PID:4308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2416.1.1231260556\734167428" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d89bc99-0a78-48e0-ae15-1f4c8020082d} 2416 "\\.\pipe\gecko-crash-server-pipe.2416" 2420 1fe33f95358 socket3⤵PID:1252
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2416.2.1198187230\1382792217" -childID 1 -isForBrowser -prefsHandle 2932 -prefMapHandle 2928 -prefsLen 22963 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {552e8086-bef8-4ffa-8bc4-941cd1f5de87} 2416 "\\.\pipe\gecko-crash-server-pipe.2416" 2944 1fe43b32558 tab3⤵PID:3360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2416.3.1149072864\1549771809" -childID 2 -isForBrowser -prefsHandle 3612 -prefMapHandle 3608 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b21d3e98-05a2-4388-9d0f-55309bcd9afb} 2416 "\\.\pipe\gecko-crash-server-pipe.2416" 3624 1fe46983958 tab3⤵PID:4656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2416.4.659894982\1259495913" -childID 3 -isForBrowser -prefsHandle 5144 -prefMapHandle 5140 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ffcb51c-47b6-497a-8b9f-f311a709a44d} 2416 "\\.\pipe\gecko-crash-server-pipe.2416" 5156 1fe48d44c58 tab3⤵PID:888
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2416.5.1539741130\716523000" -childID 4 -isForBrowser -prefsHandle 5352 -prefMapHandle 5348 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e5da1e0-3686-441f-9779-8dff4062ce90} 2416 "\\.\pipe\gecko-crash-server-pipe.2416" 5360 1fe48d44058 tab3⤵PID:412
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2416.6.1093049815\1099744957" -childID 5 -isForBrowser -prefsHandle 5316 -prefMapHandle 5320 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {734972db-3152-40ff-89c1-ddb530fe8825} 2416 "\\.\pipe\gecko-crash-server-pipe.2416" 5304 1fe48d44958 tab3⤵PID:1320
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2416.7.326235664\834812838" -childID 6 -isForBrowser -prefsHandle 5756 -prefMapHandle 5840 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1340 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {835fa5e7-66a0-428a-afbc-96eafa8bd7c2} 2416 "\\.\pipe\gecko-crash-server-pipe.2416" 5852 1fe494d4058 tab3⤵PID:1164
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3b1psp2h.default-release\activity-stream.discovery_stream.json.tmp
Filesize24KB
MD5654e055536946c00060a9e7bba260b50
SHA1f464ae47f000113aa541c8106bd6736f61c687d2
SHA256270f99870199c22975ac9a14b6122e50a3b744fb09cbd0a1de08d1056c3d6527
SHA512c8db6058827040e6ca9fd3aada328a4c8294d3eeb780d5bba65e45176418f9603f476703ec8f33cb14cbec57150094b153349301f1e4b6ee848a7c3f49c7a011
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3b1psp2h.default-release\activity-stream.discovery_stream.json.tmp
Filesize23KB
MD5cb05d8dd76b3e7852ffa5d70838f8aa5
SHA1e5ee1ff239b63dc9a8674277ffc1a42df6baf696
SHA2569306a4fffd936b35ef89b94fce813c81e0d5ed65632485fd025eb0ecaf22fc35
SHA5124c9ccfefbcb8e0a6c51a2f693eb189cce4d87532f47416b8e866f8afd4d89f3326e6f8d0a780bb6447a6f9feda03fced647e40e42ae229c6ed34b5e30d53fef8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3b1psp2h.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA
Filesize13KB
MD56b7d8ed1d053e1f115a8c901d4d2ea58
SHA19baa36e2c8f311d55cfd6e751513dbb11df7712f
SHA25622b4c7352b4e30a04d12f330a195243dc78557d5877435521341dc0edc611133
SHA5121e10a2cfcc6d1154661bfc2622bb2503f74cc0dbca4564b1858fbc709ae14ef01c9939bed5799be850adbb5c3b7311fc36db36a2090274552016a9a835ecb3d4
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
8KB
MD5d22d41da8e5278c872a6ee80715c999c
SHA1ceaf164e6389c6dd7201b08ebb3b67421a10ce78
SHA256032c166bfba94810689b92d5d2bfe25de4ad5a203aa743d088ae3ca58e41dd30
SHA512a45bd06df86bb5441fff2c1bd69a35e2f2358103fd0d707aeebfd592e1211bae713f984fa7ee4fe9e2e92150ee8ab4a9446bdf48dc4ce5b6688d417bc57999ea
-
Filesize
10KB
MD589d53dfe9d246b17fa6649a1cd6e3949
SHA18f5c77c5d1af26503a0e0df93941171e61e09627
SHA256c2841837df2583bfa47139a789dff6ad1580977a531e7e8b6602f4a6498902fc
SHA5128113d8fa8c149a84a4cb6dd363510a966b79f4d90e08fc0a4b9970dd863312c8b4656b394acebb4c345188ffacd616b1cb665428a745682d3e4b48d89293667d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD51332229e4092af1594f0ea3a03141bee
SHA1c4a24fda0a0569eaee90c85b1b90ee5a764de601
SHA256e08d8fe805d3ca0e471d15d421442a000ce276942f6260e3ebc438ee46bff585
SHA5122b21923f92964b5bb2fd815dd5aaf948ffcea1be6486b2f2da374e2fa5c58acbbd68804017e7899dc8b5051cb6e6420db792556e544fa779c9e4b3a1a014807c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3b1psp2h.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD50470591c6d0f84cd07a3b4abcaca75d7
SHA15e0b1207d4a5baf558d549983caebaf0d182c9e7
SHA256a26654b51729f7e53d8548cb3a45ef72618cb851a5a01b6f2ff36a7c6378358f
SHA512c7c5098a1cf9e2f67c0389224b9f8d6120ef524e83206f691eaa6cb23491281279de1a03e9afc08a7174cc6bf44a83959d032e3534b2bc4a0294c7b4dd851677