Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 19:29
Static task
static1
Behavioral task
behavioral1
Sample
1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
Resource
win10v2004-20240508-en
General
-
Target
1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
-
Size
242KB
-
MD5
541f52e24fe1ef9f8e12377a6ccae0c0
-
SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6
-
SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
-
SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
-
SSDEEP
3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Modifies registry class 10 IoCs
Processes:
rundll32.exefirefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\crx_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\crx_auto_file\shell\open\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\crx_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.crx rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.crx\ = "crx_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\crx_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\crx_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\crx_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 2604 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 2420 firefox.exe Token: SeDebugPrivilege 2420 firefox.exe Token: SeDebugPrivilege 2420 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 2420 firefox.exe 2420 firefox.exe 2420 firefox.exe 2420 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 2420 firefox.exe 2420 firefox.exe 2420 firefox.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
firefox.exepid process 2420 firefox.exe 2420 firefox.exe 2420 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exerundll32.exefirefox.exefirefox.exedescription pid process target process PID 1268 wrote to memory of 2604 1268 cmd.exe rundll32.exe PID 1268 wrote to memory of 2604 1268 cmd.exe rundll32.exe PID 1268 wrote to memory of 2604 1268 cmd.exe rundll32.exe PID 2604 wrote to memory of 2740 2604 rundll32.exe firefox.exe PID 2604 wrote to memory of 2740 2604 rundll32.exe firefox.exe PID 2604 wrote to memory of 2740 2604 rundll32.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2740 wrote to memory of 2420 2740 firefox.exe firefox.exe PID 2420 wrote to memory of 2536 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2536 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2536 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe PID 2420 wrote to memory of 2340 2420 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx"3⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx4⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.0.1105337595\52837309" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1204 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f636738-738d-413b-9018-383527b8aea4} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 1288 11fd5558 gpu5⤵PID:2536
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.1.71345293\1083470260" -parentBuildID 20221007134813 -prefsHandle 1480 -prefMapHandle 1476 -prefsLen 21610 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eba45eb0-5216-4221-ac12-bf830ad012a1} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 1492 d72b58 socket5⤵PID:2340
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.2.831903787\364385840" -childID 1 -isForBrowser -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 21713 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {551695b7-1d00-48a0-8f8b-14acc90ea036} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 2152 199ad258 tab5⤵PID:1976
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.3.410513904\2118253440" -childID 2 -isForBrowser -prefsHandle 2560 -prefMapHandle 2548 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {515342b0-7ad4-4519-9525-1faec3817163} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 2596 d5e858 tab5⤵PID:1112
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.4.419295699\300948011" -childID 3 -isForBrowser -prefsHandle 3728 -prefMapHandle 3652 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ae43395-5e5a-4c9c-83c6-021bf8e64522} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 3740 1aa72558 tab5⤵PID:2912
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.5.1317483960\1308888528" -childID 4 -isForBrowser -prefsHandle 3848 -prefMapHandle 3852 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22c73827-ab41-4f58-917d-4b529455b7a4} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 3836 20110f58 tab5⤵PID:2008
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2420.6.350485015\233706927" -childID 5 -isForBrowser -prefsHandle 4012 -prefMapHandle 4016 -prefsLen 26345 -prefMapSize 233444 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d39d704c-8451-4d2f-979a-bba7f0b22185} 2420 "\\.\pipe\gecko-crash-server-pipe.2420" 4000 20111258 tab5⤵PID:2544
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx"1⤵PID:352
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx2⤵
- Checks processor information in registry
PID:764
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx"1⤵PID:1624
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx2⤵
- Checks processor information in registry
PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BAFilesize
13KB
MD58ce2e2e374a4053c125a8adfcb28890a
SHA1c03faa362d5986200bc2a7818f6ff38e573fdff7
SHA2568fbcfa475a11e3ec53027e87bb0557ddfed76ba22e6e55fc2859f02397bbaa2a
SHA5129d18b6973642910eb0345c061062ffda6e73d9830c038684ef04240e3a313f70b146c31c4cc14fa9bb6cceb17144e5a16503e2eb50e4d9eaeadc81fb515d905a
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\db\data.safe.binFilesize
2KB
MD5fa0b11367e080289980d215ad4d06711
SHA16731d1c4f25ff38f190e12e5943aa04c81b9a227
SHA2561ed5352e17c1b8e369ba5563e13d8f560c66d236666601ce01536930d3b1ffef
SHA5125f8c55ec12c0df0134e2f566af38a4c0c0ec7813547adc38f5f1bd25a862f759a9bf3bdae34959fdf844bb0cbe540ab3572059e6da5f87502625e4672f802a34
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\37c54884-3898-4987-a28d-33f19108600eFilesize
745B
MD58437a9f606541c2d5ef95f69878e62c0
SHA1e1bda27f9817527cdb762b511e77853a1bb7ac5c
SHA2561661ca9488c84619a034d6b25d5da6e1e9ed8253841b46fefa56e32f8ed08667
SHA5120ade0bc24dd2447102c1ad7737be448bd7c9797adeddb3d75490acbc7b5f731ec3297f6d10cdb304aa9b81c91b01f0b1c5f5d01b5ad66ff4ef6b5d11c0fad906
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\datareporting\glean\pending_pings\fe818a61-687e-4ade-bc70-1c1f8589111dFilesize
11KB
MD5dc8d8c95715853262e05cebf585b063e
SHA1a8e8fe139c853398f312d598374d382f78c1b85a
SHA25664245c6e5f5fdbc97e4ddd81a572b1906e8ac5095b9119914fe79722b8f2edea
SHA512ad6a50c40d68c45bf46205027e0e19db6b7537f49773a2160d93c87e61fefde6a8338a1b7718107dc9dba4e317b8ad634c162ded420a4fe5c0c13bac62c2ac33
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dllFilesize
997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.infoFilesize
116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txtFilesize
479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.jsonFilesize
372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dllFilesize
11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.libFilesize
1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sigFilesize
1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\prefs-1.jsFilesize
7KB
MD5a926b0bb4b45cb838b53bbabfaa24b82
SHA1e7f4f4e11cbb6b0b10b91ea26728ec57f1725aa7
SHA2561dff65a021e80f8eb9349f0e6d57c46b96b0221c1c12f25e05e195aff340f9d9
SHA5125517d4fce3abef57475202800c14414ac30a8c512803f128aad0dea8a552f0a827041db3c0a9a107edaaa2cd8dae9dc87ab95619de775767f9878e8b71ee03f2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\prefs-1.jsFilesize
6KB
MD515daa9cc6a6039b40e1e34f3f15f1e8d
SHA10ab7d475ac08c886a7db4fff98f3a80f1e052f11
SHA256c2ed6391082dd4117b5dce70205b3dc27dda6349074b0e5e0d1faec40a321827
SHA512b810a1f0a5e66cb1989e8621af9595ff85c1a9133103552e85e5afaa649332055c1f63541f1d51e35663f9faf1b4928e7989fbe0f1905fec1cb06e8dada7cc52
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD559f86ec4283ad5f26f9b4f005af7e3e3
SHA1d55d7e12a413d83ed6a638023a3469a9577a42fa
SHA2566441317a89cbfe5d00d281f6e156db9e8bca691344e7e988ff8122fb305c2230
SHA51259b9f70fbda7d7e1a76321ef515aca139e47185cb71d5bf775b1d359e39efe7371d59af76ca62773e2bc1b0135778f2b787c277cc1d32ba6988b8a0a37c552b5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD529facc5db753e5dacdf7659e3e01d3b8
SHA1e9d724077ba747616403e7d61ce2bda454783e46
SHA25682dfaa98ee8f15e3da0bd5121d1f08d88e3b7e7a02e9d9670b846e6137e502db
SHA51277702ad2cf65444e37d3f15e2adcc21d4a0fdcf1010db7a4cfa3b968964b12d4895bcf7f3a55eb9f855d37355967435d649ce702c4a3e4dee6ef8f422e077822
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\sessionstore-backups\recovery.jsonlz4Filesize
1KB
MD54d91d7c9beed32ca0ffa81b53e953327
SHA1befcd49a0291d37353b0cda5e579c22b5eaa7882
SHA2564675360008554a54db99c2de94d2932fd89c946b3114a79def15a20cc9d4c3ad
SHA512500a9b2c7806c07e641a5a0343920ada2846b639d5a5ae2414514b24de7f3701d10d2b1d4642a2cb76590ef8969a6a2e1c3c21dace2d2265bba32990566b20d8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteFilesize
184KB
MD524ef81d1d44aa87a83cf61c79193617a
SHA1e6b8418868619ac3ff97c62a96e47e15aa069af9
SHA256b9028ac5b4d8e6226dae0eb9592fe45c58c930342ce4c5dadd743c188ef9b465
SHA5129e0de5268f5fcd0b8faad23dc0525c908c77f1f47c625d5a7029129805b4e34b5e28fecb2925b0eefd09ae7f809f3d97ff7926645a0e359945360e1a71529a0c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u7g6zvo6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteFilesize
7.7MB
MD55995b021ed22631e5c4bc6ede3c21113
SHA1aec364dd6732657ea6c65c2f0dc8210c98e8d820
SHA2561f0983b79afc338b145f955c92c02c6a8bc74869d5245463caab162f9ca73b58
SHA5128788f0f46770bbdb9c501ea06ae94f3abe8ba909e925b1055863c755acd62e609e6af8ff48bba4bf4440e5ce672f492d6f9e4a95079a7b5430ce714b427a6e0b
-
C:\Users\Admin\Downloads\BLuJDvwv.crx.partFilesize
242KB
MD5541f52e24fe1ef9f8e12377a6ccae0c0
SHA1189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA25681e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
SHA512d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88