Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/07/2024, 16:24
240719-twjkmazclp 119/07/2024, 16:21
240719-ttzh3ataqa 619/07/2024, 16:18
240719-tseghatajh 6Analysis
-
max time kernel
136s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19/07/2024, 16:24
Static task
static1
Behavioral task
behavioral1
Sample
x1247 Crunchyroll.txt
Resource
win10-20240404-en
General
-
Target
x1247 Crunchyroll.txt
-
Size
45KB
-
MD5
73f8c3e2f25b303383bfdd5b37a2ccb4
-
SHA1
c80ecfc4ceaf8680fe6bef1c04aca4d63aaf38f0
-
SHA256
8e8d0639924618782a7e611cb06aba147d72afe9db12ebfd4b54556c12d0ca3c
-
SHA512
b887f85d18e68e8b4a34697183a6eb431e5e3711de53356edceda7202bfa4213d5b615d1c4418d8c4c5c65158f2b312c8e56d9d2059397db551016628022cd32
-
SSDEEP
768:jRdwObNCNamT79tSqOknR6icPkwLBeuUn2Qw7hKSYGCcrx9M9ywZba:9PbQNaI9BENQkZhKJGCc19M0wZW
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3384 firefox.exe Token: SeDebugPrivilege 3384 firefox.exe Token: SeDebugPrivilege 3384 firefox.exe Token: SeDebugPrivilege 3384 firefox.exe Token: SeDebugPrivilege 3384 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe -
Suspicious use of SetWindowsHookEx 61 IoCs
pid Process 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe 3384 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 4580 wrote to memory of 3384 4580 firefox.exe 75 PID 3384 wrote to memory of 5032 3384 firefox.exe 76 PID 3384 wrote to memory of 5032 3384 firefox.exe 76 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 4568 3384 firefox.exe 77 PID 3384 wrote to memory of 2204 3384 firefox.exe 78 PID 3384 wrote to memory of 2204 3384 firefox.exe 78 PID 3384 wrote to memory of 2204 3384 firefox.exe 78 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\x1247 Crunchyroll.txt"1⤵PID:1020
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.0.509003808\1225504384" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1632 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad028158-4920-4531-a1a7-236d3cc1001a} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 1780 1a6354a8e58 gpu3⤵PID:5032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.1.311850464\761970215" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {708eb8ec-23a7-4b8b-8839-4cae4d2144f2} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 2136 1a629172b58 socket3⤵PID:4568
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.2.684862407\1523517107" -childID 1 -isForBrowser -prefsHandle 2852 -prefMapHandle 2832 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e7cba60-e4ca-4bc6-9845-6bfc99b64397} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 2812 1a6382fdb58 tab3⤵PID:2204
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.3.1294587005\2086874587" -childID 2 -isForBrowser -prefsHandle 3420 -prefMapHandle 2936 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {553fb4ce-5424-4314-8f73-d4c1dcd1bf78} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 3492 1a6369c4858 tab3⤵PID:4140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.4.357575448\2069823876" -childID 3 -isForBrowser -prefsHandle 4248 -prefMapHandle 4244 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f37b3630-aa5a-4c2d-aab4-d59165bcdd7e} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4260 1a63a277158 tab3⤵PID:4148
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.5.473226490\1035238970" -childID 4 -isForBrowser -prefsHandle 4844 -prefMapHandle 4816 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d435350e-642e-46e8-8aaf-e3b75570a230} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4532 1a62912d558 tab3⤵PID:4084
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.6.2000025799\1440353698" -childID 5 -isForBrowser -prefsHandle 4824 -prefMapHandle 4732 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59db7c4c-61e2-42e5-b114-9d896159db6b} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4964 1a6291e0a58 tab3⤵PID:1972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.7.167752558\1550763129" -childID 6 -isForBrowser -prefsHandle 4532 -prefMapHandle 5124 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {511a8e71-c12a-475a-9107-f3ada46254c8} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4944 1a6291e1958 tab3⤵PID:4864
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.8.562670300\1799820883" -childID 7 -isForBrowser -prefsHandle 5572 -prefMapHandle 5584 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df05793f-52c2-4c87-8c0b-252a855132ae} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 5608 1a63c472958 tab3⤵PID:4608
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.9.463684676\850335123" -childID 8 -isForBrowser -prefsHandle 4876 -prefMapHandle 4520 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b3c44e3-8d54-494a-b530-b76e29cb4898} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 1416 1a63b228658 tab3⤵PID:1728
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5e39c72b6a400ab15a89913492838ee80
SHA184ac55df016db31f07c7c992c93c0f213f116586
SHA256219137347a9b638fdafcc0e3aba36c5b84f81fba27cfdd18c915e634895a8593
SHA51223ef7c92b0017f13d7287defb553920a6a242aa980952f8a43486dbab92f27ace4e105df89e8bdcc6fdfc907e337ae97b3f9f63650ee1c0a239afad9b72dad83
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\1EDC3C65131272DBDEE715392B1DDE4DC2449180
Filesize421KB
MD57181c88280e7d49dc1c3dc9f28cf1218
SHA10fe186dc4e095bc5287b1b6f7848ba87d6fb9ef9
SHA256198b6aafcb10a3ff1fbc0fa0a44a085a7c6015c60bb110fa6406e4df96a16ba6
SHA51229885901782ff6c5710504a0ada9d3c45941dca5ee8c2aef06f50502768c99139765099cb863632a27b44d7eba0662b22d2a7904b34fd8c08614b61c4d41c82e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\39ACE9225AB29A17003E0F7A1A43808387BDB947
Filesize1.2MB
MD5fa7d7fc4cf16060f82702a43611c366c
SHA1f7c98a88a5ac774b8ab6ca15dedee925b22410ee
SHA256c7c8158d202e9f8ba25215fd1d99244f2035103279c7e4b8aa5fac465462c4cf
SHA5127b3c1823560b9b6b698632d5aefb27e40c8805084e93ec91f5fe799b173efca78d2f274772242f4927b388b078700505c63a972d581b4c85d7bb3aee68c4550b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\8B85AE92F6C8FEBB2A47D0788C71FD18108A2B0A
Filesize229KB
MD52250e17115c04c0a854551ef27e10300
SHA166a90e64eccd838788cae01e9420399f45f9951f
SHA2568a5cafce6a4cc93eb3e425d3830949ac0675d1840c8f2831670df0b71be5a821
SHA5120813823019bb6eaed8216e8bbbd0702c83ed21c02be2ffc056ed22cb656401635567999b95c3386aec186e51d9fb15618e65e36452399de2eefaa9a2e443f3f5
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5967ea355f02d78775ce202ad682cb471
SHA13f6217ea8a245dae05a5c50f5ea318f6ec8a30d9
SHA2567b4262bb4c58f832405b6916bd9b786365d788ede1abccb76590e7ef9e6dfc93
SHA512adbb909ba2f960cf97eb9a331b1351ea698b0d5a9255cf9dc6e091c1956b30a5b5ef7c32049dfee49163c602992df90b2673e20664422040ca9886d9d652a921
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\a391cfe0-1f19-42f9-be1b-c6dbabe3850f
Filesize9KB
MD5c11be32e5f3312d21afb772cbb590b30
SHA183f568db9be75b8264d98a4dced404d7544117ba
SHA2565351381db7b0436d82f3ce1d916f139c752971064a3125ecc2c10e9d01e78c26
SHA5123ae1b7110cd9e218913c3550fa079f2d05a36236a5a69a236895d713ebcaa7e93dc46b61759c8f356b69a1be387c970bb28d926b36c82cb2faa206c79e0f28aa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\dace4308-a09f-401a-aec6-6666419b5800
Filesize746B
MD55e0d83167967d66fe7a6d774978a01e0
SHA1465a71cddbff822f88cfd46e174c89d750f0ea6e
SHA256fc91775b53caebced6f451a9eeb2112b5e7e3731c362921f4b6ac52af29c7c86
SHA51296e6838b301b8195ef16b251129d8d51d84cd92af118bc6f860e5107dc32491f31beb75881af468ae3499a9b0949c845ebfacff71e1e7dbd569105f7e4b3efc6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5755a7d28754e4da3c80ee019675b26b5
SHA17b2ddf0ff9dde3d4544af756074e196410a3e774
SHA25611f0d06c06f89f6668baa1756e07e47d301897b59b4422618205a1e880b0068d
SHA5122aaa4ff73c51ab0c02563b944af1a14b60ec942bcf0e3f98f654ff2523e8d2894ffef34d39fd3a07682fc8d79a5b39dfc2f755eb5448136fb0223d8ace8e8038
-
Filesize
7KB
MD5ce3e7a55b6784bb400c202daeb18551b
SHA1003e75f52d439b5fbb1be9ce4b4d9ae366a0e200
SHA256bad77ad2f9dcb15466d7f675f95feef61e050c91ff49febbc99ad5ca0c070908
SHA5122942a8c76963f142465577abad73cc4c47f8af099463c0cca530dfcc6bccf8f67281fdbffa5134b03f29caa586f438620275a3a1202587ad4589c3f283039230
-
Filesize
6KB
MD5594f26b4ec78a91302495cf2bff3c5e8
SHA1d6a99a4e3c7b66d796fb604c8d059096818aec02
SHA256dc9cc58825a1a734652d7d82bbe8e12199cf4f63c9d2ef0dac7621450a90f28a
SHA5127ad00054d99ca7a66954e6d7b2960998e14be52e452a22dc516da1fd0836b896f4f167a112787e05c6e1091dc75ab97c6a285d87f0fb23beeeb7ede1a1a755fd
-
Filesize
6KB
MD597f54db01153d253f5291ecdc56f2d70
SHA1c1a696309a118de9c83856730e6c7a95f3d27246
SHA25698d289ca6771ec98aee9f44785616537e4b7cb10e37ae92ab463c60d50b57e26
SHA5128262ef2e0d4d50f12609e793a24be6576c430787f4f7ed722496e94e7e55f1fd95cdf9aaccc0392bee11758fa39f421813b1262bceb46dedca1dfaf7240638f6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5cd12547d31b0c21e469e864569aec431
SHA1858578cdc548428af2d710a76c9f97d57df05727
SHA256f57e219b9e08ff3cdde5231980e0eec0554b268eeb73ff387b0e9392a1ecf8f3
SHA5127c40c957b904caa7230f55c798c8fc5a94a93e4b554f7efe3fdeb93740f274b0ba434937cce0d798e32a31ac535688d00d74b0d1cdf650936a3c15b046cd8255
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize31KB
MD5df39fdc32fc7afcfa2811095b208c6ce
SHA1938c9e17d5261048be2248fdfdc6f5ab4da6c9c2
SHA256fd61f90103ad61d91e61519d2e3010499c38705cc6f7fc7c7e1059342ae9f433
SHA512e0a858ddae63914d2f1c6c228c9502d533ba0650ea678867921610c635834ec70647412531b25bb87b387ef8f2e02314f2cd86fd7e9e4310614cef83f7a5b739
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize31KB
MD591ca377a6a52dba82ff8400724049496
SHA13e5851a903018d4937437101ec780f85378c876b
SHA256ece5538c47f801b3d657019183db6b87faf717ec71195913485129184e9ace1c
SHA51294b60b66b55b28db5d5ee3967daa9fbc0cc986861057ed1fa8436142de933b88c095f3c28d812ac301eeb667dc64ff9179533fe73a0223912811cdf3aef1064a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD519c852a2baf5bf8651a19f6de1a36a68
SHA1d8e5842efd28381134ee22047adde15585b63d8c
SHA2561f56fbe2b9fdc28740eb90d743e7e8224d62c7471af8ffd555c9b10223a6c9f1
SHA5122352b516b7c6ad31da6b6eb50ad391d7cf4211a110ec3d85bbb5dbc3a552446bdeb22e1ccb6632fe684979f45065949b6f2721651a1f3a2905436726a5b9b69e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD5fb9a703d5e49cf61fb76276e8b6fce70
SHA1616fb2dea80c45fca4e96616d7e32b833ebcbcbe
SHA256c425d4a7c5376555325e3f721522dc6769f6771179ee37f3eb470a621c7a6e4d
SHA5128beb6621dc949c67b32b8b1ee8017e3b7ce0e175e39b3b221486fe7d228896a37d480147306c90eae02998e5c1f5394b2a220bf5b1a62ce10d0d65f7dffa543c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD54c448dd1804969c420acf37b83cc67d2
SHA12b1c22efc2a683121c08edee0a490f5ba357da3f
SHA2561d5e0240540409de50575b931d34b1654701e469eae954ac20aa7399b94deab8
SHA512ef282843eb89541c9abc83ca03adcc286a97600db9e58fbb8469eba4d73987dc6dfb982f84257f75076b1ddef0532592dac7de2524b91b520146bd4755fa3f81
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD5a08e57219c534a99f98b4e6f2ee0fc5b
SHA1ab46c66e23438eb29b1123255d8fb1b39d1eb104
SHA256dc15f6a437563795b9ccef150aa44d41e6004d2d24c949470aa64baf01973e4a
SHA51296c7f64dfd26550350783a66b500ed4e05de5a1703794ba0ebc1fbc2bd99834a2bcf5f4273eec64c76e1b807051d456da658ba18a6623ca5255c67d101cb2bfa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD51a357d639bbe77680b066f3df75cde17
SHA18b92528488c9d3f59b2d10b5840881e152277f69
SHA256ec0afd310fdbed4bc9b7542557aa471facb2a9779df0250e47aa73ea2a89e071
SHA5125cdb34a09bfa5e02daf4bca65eb3eb9145f9dbc58a6f57131e0eb3c3a4986f3c6fcf3b519772156ba74a3b2839c558137ea3b9aedf9abbb4d50802265f67a5a9