Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    76s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/06/2024, 23:32

General

  • Target

    Beyond Launcher.exe

  • Size

    42.1MB

  • MD5

    1ad4d72f15334859b11376940e945d70

  • SHA1

    3abbf8a55ad3d3c3652718bc6c999be25c5b9fc1

  • SHA256

    6bcc1b10e0f06f6bd0e894de8491f6f27b490845376618a361a1c0d997540b34

  • SHA512

    4014a4f59f31d10d8e827080c9ce1bd3b55af61c06e7f2e19a20dfe8343e1538ef8f5a70a7c775af0d5afef579075d30a687bd26a4a55943a49367b1f26c7219

  • SSDEEP

    786432:UIMMNMTaaQqd/4snzaws0uXEUkpB9EgzWZGvHBYE7p1tVjriK+FA5WaPZZ:BFrW/46+KuEU01tVjrxvZ

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 4 IoCs
  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Beyond Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Beyond Launcher.exe"
    1⤵
    • Checks computer location settings
    PID:292
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.0.897520018\189823517" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {580d718c-dee2-49e9-b565-e4f7677520df} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 1776 2a8380f5258 gpu
        3⤵
          PID:2960
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.1.2006758925\1957162745" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e26622e-3550-4bb6-8895-cbd4155feaa7} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 2132 2a837c30858 socket
          3⤵
          • Checks processor information in registry
          PID:5056
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.2.896060336\1729193124" -childID 1 -isForBrowser -prefsHandle 2848 -prefMapHandle 2920 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93993d82-abd4-486a-b31c-477ea144ccc5} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 2624 2a83c29be58 tab
          3⤵
            PID:4164
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.3.819684916\1546430345" -childID 2 -isForBrowser -prefsHandle 3180 -prefMapHandle 3068 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e72776af-9c41-4d28-a189-f2243124e50a} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 3580 2a825c62e58 tab
            3⤵
              PID:2752
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.4.1260604876\1018785932" -childID 3 -isForBrowser -prefsHandle 4304 -prefMapHandle 4308 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2bc3880-64a7-4146-a1d5-38a767864fe9} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 4272 2a83e0d1558 tab
              3⤵
                PID:4652
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.5.461424137\1526587018" -childID 4 -isForBrowser -prefsHandle 4748 -prefMapHandle 4664 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {244955bf-ce43-4752-afb2-5f35d23d26f6} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 4756 2a83e0d0058 tab
                3⤵
                  PID:2912
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.6.1877396733\924838736" -childID 5 -isForBrowser -prefsHandle 4904 -prefMapHandle 4908 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cc3e64f-e26d-4406-b0d5-bc9307fc56c9} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 4896 2a83e6d2558 tab
                  3⤵
                    PID:4084
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2084.7.295269578\107223671" -childID 6 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8f14189-322d-4b29-9d2b-369ea68be786} 2084 "\\.\pipe\gecko-crash-server-pipe.2084" 5076 2a83e6d3a58 tab
                    3⤵
                      PID:984
                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                  1⤵
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:4308
                • C:\Windows\system32\browser_broker.exe
                  C:\Windows\system32\browser_broker.exe -Embedding
                  1⤵
                  • Modifies Internet Explorer settings
                  PID:4636
                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetWindowsHookEx
                  PID:3424
                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                  1⤵
                  • Drops file in Windows directory
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:3456
                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                  1⤵
                  • Drops file in Windows directory
                  • Modifies registry class
                  PID:4404
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                  1⤵
                    PID:2960
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                      2⤵
                      • Checks processor information in registry
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:1336
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.0.2056455681\927658121" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1700 -prefsLen 20747 -prefMapSize 233491 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30471c1e-cccf-4cec-9544-687c11967fd6} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 1828 22e601d1558 gpu
                        3⤵
                          PID:5116
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.1.1399323116\192534667" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 20828 -prefMapSize 233491 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d0950bc-4c39-43ed-87ed-52f8288a780d} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 2184 22e600f9858 socket
                          3⤵
                            PID:848
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.2.914094535\994729048" -childID 1 -isForBrowser -prefsHandle 2664 -prefMapHandle 2816 -prefsLen 20866 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4af23696-e2ee-4c7f-8062-ee9b69c75253} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 3180 22e6447ea58 tab
                            3⤵
                              PID:4664
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.3.882117377\1809008259" -childID 2 -isForBrowser -prefsHandle 3508 -prefMapHandle 3504 -prefsLen 26109 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fa996ac-1f8b-4965-ade4-4ec32b00d868} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 3520 22e62cabd58 tab
                              3⤵
                                PID:348
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.4.694516612\1260190645" -childID 3 -isForBrowser -prefsHandle 4312 -prefMapHandle 4308 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5218701b-98b0-44e2-80d0-fcb417154b4b} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4324 22e6664b858 tab
                                3⤵
                                  PID:4372
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.5.1840459296\2068041282" -childID 4 -isForBrowser -prefsHandle 4796 -prefMapHandle 4792 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92c27a02-e95a-4eaa-a82a-2c46900f5d1d} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4488 22e62761558 tab
                                  3⤵
                                    PID:1308
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.6.2034760639\1276001364" -childID 5 -isForBrowser -prefsHandle 4936 -prefMapHandle 4940 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1860b07-e6b3-4edb-9056-3d0ec311fe42} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4680 22e6664d358 tab
                                    3⤵
                                      PID:800
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.7.1787925672\6180982" -childID 6 -isForBrowser -prefsHandle 5108 -prefMapHandle 5112 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78366f5c-76f2-428d-ad4c-7ff108f86ea1} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4924 22e6664e858 tab
                                      3⤵
                                        PID:4200
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1336.8.1571327950\515811998" -childID 7 -isForBrowser -prefsHandle 3244 -prefMapHandle 4000 -prefsLen 26168 -prefMapSize 233491 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7044d9c6-f69c-4ac8-a8d4-44676054aa22} 1336 "\\.\pipe\gecko-crash-server-pipe.1336" 4464 22e63ec8c58 tab
                                        3⤵
                                          PID:4352

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

                                      Filesize

                                      9KB

                                      MD5

                                      f0d273d4d3e015c23f8e162f1495c98a

                                      SHA1

                                      32317b355d10ff7a7bc246f64b4f5618c55280f4

                                      SHA256

                                      c7e92660f49184323e7924195c1dfa53a27cd9d141a62eb0ad46a69fda488b16

                                      SHA512

                                      d569c804ddb74fc10bf82f40fb8df872fe5bf361249e869dabe81a28c23e3676e71190fd9c3fb3fa87a9fb820814e518be367b67babc33450f4b9b097cc5655a

                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

                                      Filesize

                                      7KB

                                      MD5

                                      3701a9aeb6a09e22e8fa423d1555866d

                                      SHA1

                                      63c0e865930c4c2e6b9909cf4bed4a383e8921c3

                                      SHA256

                                      e67721da273c499e60a27005a369ac08b9511864bcf76086fee2fe5dbfafe67e

                                      SHA512

                                      821d9bc8da000f6d7e336eeb9aef4356c7004ac68b0e6e0a83d49f80f33319eaa16f25f73b9efa8c2a033ad34ebf37fabbe8fb08e8e10773262fba75e4f7b40f

                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\startupCache\scriptCache.bin

                                      Filesize

                                      7.7MB

                                      MD5

                                      f0832224967733af8f5b9beb0daef776

                                      SHA1

                                      8efc7c92fb7bf2e0e33a718a8d6f2b34bc44f2ae

                                      SHA256

                                      ecd1224278eec0e3ae4faf1a03e01716c28891873057afdd840424ecee333677

                                      SHA512

                                      3460ccb889d72b7aac5f9904fe05f1616d482742ee3281eb6edf12af5f728a4c3b49ddea405bb5e845c5accd4b33980863380ed7db46d063057ad7dee0ff0108

                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\startupCache\urlCache.bin

                                      Filesize

                                      2KB

                                      MD5

                                      5a3e1cca06569a3abad215db82b0b76c

                                      SHA1

                                      18ecdf820ea13771e7b56bdb6ef306f0c0c13334

                                      SHA256

                                      503d2ae1b9e57f6b33593b6013152cc3a6b60b7697366416192d205673bf481f

                                      SHA512

                                      fd2b7fc449db397f5a8c23484a369a5ab7ebded5f2e21a594fe7a5faa314f185453c31650fd6bba83a66c4405a50f49748c1e79bde3a0bc69bceb6d069d2a8e7

                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFCB8BA4ECEBE6A493.TMP

                                      Filesize

                                      16KB

                                      MD5

                                      f6be7347c23af2b3f2c11de87b499b19

                                      SHA1

                                      47fee0cf76a4e8219126f2a1c6f30672fda58c19

                                      SHA256

                                      0b6158cb0ffcc8749dd7d9ebd07b5ad3f3658c11fe8d50ca22420c19fe7d7f80

                                      SHA512

                                      0c2b5b01b126bc21b7e55b4e06e67e93214b101e21a0c1ad504b5fa079bcdce634c08664e706b922c8201b39bf4897dd155c80f04c100c6e5b700220e554395a

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\AlternateServices.txt

                                      Filesize

                                      163B

                                      MD5

                                      c7fcf528fe6ebe3737c855f943de0712

                                      SHA1

                                      6f6b6a6ad77a8fd9b3c53a0ea0268ab48d0b9edb

                                      SHA256

                                      ac8379e21033b862f27a4de8e0aa723c5b71eee6e6a89d85b94fc02a21273951

                                      SHA512

                                      be1ba76be74079179ff45aab245f593b405ad803f722a09c59f4d23a2cd8b0afb7096abd677d3b8b8b9093a67bf7fc8b0d76faa7ca7bcdfb6b9e2d95c4d04c09

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\SiteSecurityServiceState.txt

                                      Filesize

                                      324B

                                      MD5

                                      281966321dc0cf0b74704a241a33bfa6

                                      SHA1

                                      e2b36b4e433b727e2ab03f17e1c9895be69a8f41

                                      SHA256

                                      260d7cb3bd8511c9cd9f4738da393d232ba75a0b2462bc50024ab058d4706ef4

                                      SHA512

                                      7fa593e54a3af44a2f0d05b401d60c6825a8e8dd568559c54e41e7d51d23cd0203a4e317625e03fb11be21e4a4edd98a065107aa29feaa2960f3ab02d404c8d3

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\cert9.db

                                      Filesize

                                      224KB

                                      MD5

                                      67bd6f220bc212b26e287a270674fa0b

                                      SHA1

                                      064d74b1102ad6378a3c9989091ce3429c37814f

                                      SHA256

                                      61663c7e22cec45a26dd929c80516e34eba70745d41ed80448755294f10e5d78

                                      SHA512

                                      7dc2a99812caa4cac849e2513494fd5621f64af54a7be8aed8361764e69fc1cba788c7b57b9371434979eb7c196a9c5a81cb2e0bb8ef1fcee74da2590121d09c

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

                                      Filesize

                                      2KB

                                      MD5

                                      3bc1d3d94586ad9c11c4f92d8b4bd7d3

                                      SHA1

                                      bf8d156bed3a868d8368a2087a4ed540f30c61c4

                                      SHA256

                                      bf6e34127caeec207d09c77ab5d89a686db5a1e3ed10e3153d53ee4a4825fa21

                                      SHA512

                                      28e377c1796d4a4a94d2c9db92a93b5318966494506a54fb7fa93e207408deb18d293b61a335895378f1d9b0ed31699d3448ddcba0594655bd0ae8afb2d42d92

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

                                      Filesize

                                      4KB

                                      MD5

                                      aeb902fa5fa4e8b33a28ae97f65245e4

                                      SHA1

                                      58b67ca0f0146c89cacd8dd7cfdd4692f69f7ed9

                                      SHA256

                                      e0d3b1d598a0b3eb352fad74c5e89d5913cf66cd05a5e814e120b24b6dda5324

                                      SHA512

                                      5d2a77088a05a3731882097477d63114dd2032e7559df3b5fa26f08de34a1386f28fb41eca0a2c0c5e832cfd2077d68f0d42dbf2bb3fccaf88438e0b7ba11fbc

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\806a8fc6-2b38-48d8-9b38-89789738b57c

                                      Filesize

                                      657B

                                      MD5

                                      c2028ac5eaf6eef394320acbc0c55f41

                                      SHA1

                                      f15f67f4ccfff686feface95f6df7de5062760bd

                                      SHA256

                                      0b70d4a66820cf61b4ec11ceacc010ecd2dbc957a7c582ba3eac6a73d4023db0

                                      SHA512

                                      b8e5f47344eea721afb0732c37d99eb04a9ff5b00fa2d664ac3dced88836bc588df4f732e8fd6d9307dff941404e31ad83972443b31c6378b05937bd354b6007

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\98e5a667-e17c-4f6b-ac82-2e2c143f321c

                                      Filesize

                                      9KB

                                      MD5

                                      29f225e14ffd9b2c8250b21e8e1d5556

                                      SHA1

                                      70185f89c0d4d6434043438c18afa1a5a500e583

                                      SHA256

                                      4c3e62e8774ae36cbdd0c0cd009fca550b77a042ee6a25d3580e4516872a5a58

                                      SHA512

                                      3b487ed7561718c2254f2fee5bed504a0e01f9e1a3e2e0ad5696f1163ce84f1f5464fdf159674a8ea5545770915a66e85018f9cae68f11c0531743cb239e949f

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\b60db904-5b5c-498d-a5b0-815c84e73ab0

                                      Filesize

                                      746B

                                      MD5

                                      fd19d01c6cca389f915ed44fc10a725f

                                      SHA1

                                      9e86f05c0cf48627fd18dc755c509793ababf137

                                      SHA256

                                      195d834b47075afffcff9a98a1384c6ff115fe2dfa17936e9cbc1e55e640f4a3

                                      SHA512

                                      81b6a3361a6d67015b2c5c099c4edb29cb7b84cafc7ab2ee5f6cfbb75b1a34d2767161e526533c83cf397bdb94cae9734f7e82913d1a98704788b2f74770250c

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

                                      Filesize

                                      6KB

                                      MD5

                                      eb675138b09cdf220e02c9c39787103e

                                      SHA1

                                      6c841b9dda34ab2ca7f65a35e1bd1cdbcf9c24a5

                                      SHA256

                                      ac6bd3fb18dab1e013ac6eba371607393a1a022269806d9d1ac94db9c02576fc

                                      SHA512

                                      41287ea28e95183681ab0947ca20750919ef81865fc2a2942297fe82777583735da7cf3353293d8fbbd895b94dfd75d3d271d63de3375a3685a6aaed05e3753f

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

                                      Filesize

                                      6KB

                                      MD5

                                      fb186f9834b99970cbe3b846a14b42f1

                                      SHA1

                                      e55e417d1f33e071a2a0856220de84cd027e64f0

                                      SHA256

                                      0163d7e8a99a62e9f450c4f80a695fda911fa1974e7ec1214353f56a00c7f704

                                      SHA512

                                      d816facba053e377189fe00af2b51841a21c6274b32f3daf424987be9931a736d7d9d2a9088df4df62c5559e2b6a177a8f0b1753d27b43cb9d3efbacabaf5e74

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

                                      Filesize

                                      6KB

                                      MD5

                                      5d5fe25d74abd5ed970cdb2c1d287127

                                      SHA1

                                      da8c99e4d43044e0e874cf7dc6f312829e75d8b6

                                      SHA256

                                      d79627955799bf25731bac233ae6ada1143bbb176136816fbe718321800040a1

                                      SHA512

                                      eb8a13fd0ab4767c2e74e71c0cef806369c84d9d2d8dd05e8bea128d96a6a3b6e4a8cfcf3fffd50c80bfa4d13a3aab7a3b658076734df5daee04c9edab8654df

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js

                                      Filesize

                                      6KB

                                      MD5

                                      fa8bf577de360865034f41b980ed394b

                                      SHA1

                                      49a6ad36ab6d66cc15852f398fdf4ee25171ef1b

                                      SHA256

                                      338177eb53c29a111facb65209d9b4fd66aca62fb505a9a3b017a1fb2272baa1

                                      SHA512

                                      869243c0cd03d73cc49f0c934cc7a0cc348798af83975dc17d3beae231d97900eb2b8692632e7166327b034c0dae1cedb642eadd3da0e8b17628d5ee9f9b3fe5

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\protections.sqlite

                                      Filesize

                                      64KB

                                      MD5

                                      49397db0486dc59d607907a086f40c9b

                                      SHA1

                                      08742ce9db9569062def08e99eea8470702feb7d

                                      SHA256

                                      890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4

                                      SHA512

                                      fc8dad1ae2215cd96c41bb3e683670bb9138467677da46c19d1e58972775842a995b70123c22ea1efb659d043f5116d0c9dca422035a6646b35f81033c9f5f53

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json

                                      Filesize

                                      288B

                                      MD5

                                      362985746d24dbb2b166089f30cd1bb7

                                      SHA1

                                      6520fc33381879a120165ede6a0f8aadf9013d3b

                                      SHA256

                                      b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

                                      SHA512

                                      0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json.tmp

                                      Filesize

                                      53B

                                      MD5

                                      ea8b62857dfdbd3d0be7d7e4a954ec9a

                                      SHA1

                                      b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

                                      SHA256

                                      792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

                                      SHA512

                                      076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionCheckpoints.json.tmp

                                      Filesize

                                      90B

                                      MD5

                                      c4ab2ee59ca41b6d6a6ea911f35bdc00

                                      SHA1

                                      5942cd6505fc8a9daba403b082067e1cdefdfbc4

                                      SHA256

                                      00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                                      SHA512

                                      71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

                                      Filesize

                                      3KB

                                      MD5

                                      f203ce0d097b3d865709d96dffdf62f7

                                      SHA1

                                      887c29f8ae1ab5b0ccf8eb0d60027020c7c74425

                                      SHA256

                                      d9ad74c3b113ab24234ceba6c6b1bec339827f56ec32b00aa5721c49a18e1c6a

                                      SHA512

                                      19b4e54b2f0df09a7001df8bbadc9afb044f39bcd285944fe9bff76477d9fd31e27fa354d8bc24ef50adbcb94e6dd36767ebade7ae3ad676a08f0b4e9160ef19

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

                                      Filesize

                                      4KB

                                      MD5

                                      a685d8d289d702c113fe783e2d52df30

                                      SHA1

                                      2a581ef4f21270b872f5a826d56621b9c4ae4b5d

                                      SHA256

                                      265605d16964482395c20f99a99f32b894c9588fef4831daa1a06f7e5b5d1883

                                      SHA512

                                      b5fdc8166e959c282e757e1cf39c66897f9da7d0c7c50339391fda8592a905a7845c1c1f98f87fade3eade2cb991ce6e80c5ef2837450e6ec640c35f15e8bddc

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore.jsonlz4

                                      Filesize

                                      880B

                                      MD5

                                      50fabd5b20597a5eb32e59d50b546487

                                      SHA1

                                      ef2f8e4ee71655eabf770abdbff458d05c0d74aa

                                      SHA256

                                      2fa9f5b17e1f4eeef4ef2cd253dc1eeb94c2435bff401597b87605193a9b3627

                                      SHA512

                                      5696c741ade45c67f1bbe640be29e0244a7cafc348deeaad39d6c38b4acae223f8db76f4794cc996b3f866dc0afe48c419f4cb034eee298ea08c9b88ca28a1bc

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

                                      Filesize

                                      48KB

                                      MD5

                                      9ca4ba8b4c3cab6422782bd1563d4bf7

                                      SHA1

                                      361f1228ab07211a0824b85642010f9af1c34633

                                      SHA256

                                      4427adcb116ea07c3c68e6fcd84b5b574607defc389b94f2acee838725aee83f

                                      SHA512

                                      ed9a10bc908a267cf79a9174cb17ac6e9b8eba41354a9b400784d8baef39910256a51f58cd7319756be792def0e1285d7193cec8a38625bdf0868950a3e53ca8

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                      Filesize

                                      184KB

                                      MD5

                                      f72c2c8a738f1bdd4a5e24326ff248df

                                      SHA1

                                      d60277881f6b36509d709948fcf7ed3ec3da74a6

                                      SHA256

                                      06575a0a693c9e0f265fcf03ee5b6ced4dd922ac999f5d767a9a7d92fb199082

                                      SHA512

                                      7fa2cc3e4f6e6f9c77fc12e188a0ef4e5dfd9079e1ddd2d689669513bd2e512136ac4485b34aa0ed8587c8cd519572d31eb2496b4091e229b6c339bf25c27d6a

                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\xulstore.json

                                      Filesize

                                      120B

                                      MD5

                                      05e1ddb4298be4c948c3ae839859c3e9

                                      SHA1

                                      ea9195602eeed8d06644026809e07b3ad29335e5

                                      SHA256

                                      1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be

                                      SHA512

                                      3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e

                                    • memory/3456-199-0x000002281C600000-0x000002281C700000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/3456-200-0x000002281C600000-0x000002281C700000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/4308-190-0x0000021B58020000-0x0000021B58022000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/4308-256-0x0000021B58010000-0x0000021B58011000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4308-252-0x0000021B5D020000-0x0000021B5D021000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4308-249-0x0000021B5D170000-0x0000021B5D172000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/4308-171-0x0000021B58F20000-0x0000021B58F30000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/4308-155-0x0000021B58E20000-0x0000021B58E30000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/4404-219-0x000001BDA8170000-0x000001BDA8172000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/4404-221-0x000001BDA8190000-0x000001BDA8192000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/4404-223-0x000001BDA81B0000-0x000001BDA81B2000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/4404-216-0x000001BDA8140000-0x000001BDA8142000-memory.dmp

                                      Filesize

                                      8KB