Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 06:10
Static task
static1
Behavioral task
behavioral1
Sample
de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe
Resource
win10v2004-20241007-en
General
-
Target
de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe
-
Size
578KB
-
MD5
2e1c27be8ad0c7cd5d617f4e65386eb4
-
SHA1
fb52e06e294053458025c3b4fb5c828c0d69eede
-
SHA256
de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a
-
SHA512
35dac0d3a5db35798495c4ff64abe5b7e7b6486db82efe1cfb7898a86e11d2ae6d6f4c800cac2ec5289982f737357e932ab3f77f1ec7d28e2fc3bcd34f3e19f0
-
SSDEEP
6144:tKld3FcfCElJk125U8SpVUagDsvb6mgmw4sFfTysVufBn597NX2U:tkVcfXlJkE5YVUjuOjysgfBnnl2U
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Revengerat family
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023ca9-6.dat revengerat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation ocs_v6z.exe -
Executes dropped EXE 1 IoCs
pid Process 5068 ocs_v6z.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5068 ocs_v6z.exe Token: SeDebugPrivilege 1312 firefox.exe Token: SeDebugPrivilege 1312 firefox.exe Token: SeDebugPrivilege 1312 firefox.exe Token: SeDebugPrivilege 1312 firefox.exe Token: SeDebugPrivilege 1312 firefox.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe 1312 firefox.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4808 de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe 5068 ocs_v6z.exe 5068 ocs_v6z.exe 1312 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 5068 4808 de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe 83 PID 4808 wrote to memory of 5068 4808 de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe 83 PID 5068 wrote to memory of 3496 5068 ocs_v6z.exe 88 PID 5068 wrote to memory of 3496 5068 ocs_v6z.exe 88 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 3496 wrote to memory of 1312 3496 firefox.exe 89 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 1740 1312 firefox.exe 90 PID 1312 wrote to memory of 2496 1312 firefox.exe 91 PID 1312 wrote to memory of 2496 1312 firefox.exe 91 PID 1312 wrote to memory of 2496 1312 firefox.exe 91 PID 1312 wrote to memory of 2496 1312 firefox.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe"C:\Users\Admin\AppData\Local\Temp\de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exeC:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe -install -555175 -dcude -6aa2c8fc392d4f159dd9827d875dc51d - -en -tiphgbsylgflfkpb2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=555175&appname=[APPNAME]&cbstate=&uid=84f0eae2-3649-4c63-ba93-aca732049796&sid=6aa2c8fc392d4f159dd9827d875dc51d&scid=&source=en&language=en-US&cdata=utyp-31.userid-373538386166383338366565616338323336306438336639.ua-66697265666f782e6578653⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=555175&appname=[APPNAME]&cbstate=&uid=84f0eae2-3649-4c63-ba93-aca732049796&sid=6aa2c8fc392d4f159dd9827d875dc51d&scid=&source=en&language=en-US&cdata=utyp-31.userid-373538386166383338366565616338323336306438336639.ua-66697265666f782e6578654⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4649c17d-fd22-4d05-bcd9-b9a6238ebd5f} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" gpu5⤵PID:1740
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e1756c2-c5cd-4721-a86c-c50900573171} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" socket5⤵PID:2496
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3004 -childID 1 -isForBrowser -prefsHandle 1364 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abd17f0e-252a-4c28-9f47-ee41bd7e28d8} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab5⤵PID:4620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1040 -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 2596 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a94deb30-6464-473a-996f-cba140a66aa3} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab5⤵PID:548
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4780 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e77c5c41-3afd-4610-a7b5-19dedf765246} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" utility5⤵
- Checks processor information in registry
PID:4896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -childID 3 -isForBrowser -prefsHandle 5136 -prefMapHandle 4792 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60fb3d34-7bee-4481-a4b9-5547324af005} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab5⤵PID:3656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 4 -isForBrowser -prefsHandle 5304 -prefMapHandle 5308 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79552a2e-e4e9-4338-b9a3-350df7f82126} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab5⤵PID:2944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 5 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {729f8cde-7852-4f47-913e-9b4abd88220b} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab5⤵PID:3132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -childID 6 -isForBrowser -prefsHandle 4504 -prefMapHandle 4732 -prefsLen 30948 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dabc1833-52e2-4917-b77c-befade6323dd} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab5⤵PID:4572
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
Filesize31KB
MD5705247067b20441e61acbdc78b532bee
SHA113e840695aca5e1b6d412fc6789fd1cbe65c2e24
SHA256b476d29bc845eea29727a0ae11361380f38d89b265a32201bc8ae29423c4a445
SHA5123e6bb99ec90ec31cebd41fb8fe8416e5d97ea5ce33a115892804f9a46e5dc35cf51da694caf1daf500466a8fbe7df6cadb1d3c9bd3bd73d17d311c95f26f6df1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A
Filesize13KB
MD5ce950fd0062475f9ff3d0a4f70881550
SHA17b5f49c559e7c370c41f03b0b77ce7bd27162d19
SHA256876ef062067cf825da9b20cf09d1cc5ebd32c6649a559bcdcfa52e630c1b040a
SHA512acfd92bf940298e5eeccd1ae58ddc2f1980b13c11981954a8de30767835266b96747b21130ff3ece56f49897b3a0c1e29ffebbdd61820df4dc136075b3392f8f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
312KB
MD509f02c017e40a998537f26d0caee8d22
SHA17676d2f17068a9050bbbbe10908e75bc5d59b631
SHA256fae6c9cfda16a9f4587b0041156a7284bf7cb1fc48e1e34f33b50ebc2d00e2d7
SHA5120c7d4fad92bb7478e277f6c56e0e0dbd665171a7bea06a6668d9d0120c5f171cbcec37c60b6354a286192f2f0bbf104ccc5550159e863ee03cc2e23243eb93c7
-
Filesize
91B
MD5404a7679c5a70c38de354f87d537ca39
SHA15d33433a70b49f03a6fc448b778bbf7be41187b5
SHA25696950de153a245f1aead7e2edcdc266236d7f0a6b5d0be4703565cef45f1f7df
SHA5123502307cdc103755dab5dfc3f124e67323bde3b28bed6ca177eb8344030ace304329337a959eb4ada96d43a0482a7be7a99a0bb8aef322e0516c29e08d32aa0e
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
Filesize6KB
MD5c161233b5071020b2d5ae409b3c044d0
SHA195a374fb72b3c5908d8079276d1c7023e67e25d0
SHA25609b7de45a2c4e12fb6ca769f58225d6dd373d2e6b8b75b29638a539cc7c74905
SHA5124fc13c242b0b105a961ba0cde85065057e92c9609585843354c56717734b2342968b5c7067a31c9512de7402181cf2c7c10d6deebce4d8acd25200d367eb726d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
Filesize6KB
MD5694409d978e6a29d2a877b74818971fa
SHA18eca242fa2eb51ddf6c3c8066441764aee2c78e6
SHA256a6f799d19f9f841dfbf9dfa13e030bd63b754b8a8ca567fb9d15449ec49fe8f5
SHA512bc6e805e28ceefb0a0a3863ac3d7535f34f3b399cf987f25391cfc5067a592bfa235465cabb8e9c6b107adca61535d413486e5cafe8e100510af7722e8d0652b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD521d7bf502068360786cd5ca66a7085bd
SHA15cc2454bd9549b79a30f32f888418ad2b0eb051e
SHA256199888de1e9362651de47d85fcc8d786146989cda732614ab500dc394af728ec
SHA51237d759bb5045ef7a03add18cfce600172ce80a8f8c1a2bbaa3dabd3265b01cd12094e535632dc6e8b12670ff60c8716be5106e5c4819a4f48f2a405715366889
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Filesize14KB
MD558aabf70b09e2b4e2966b6f6f9c1842b
SHA1893fb4ccfde41f8332e859ee2883f27c20bd4a98
SHA2565df92b933769aea51d10bd6077e11fbb7ee38ce1605825beefbb556c91e4c2db
SHA5129fa07b3ddb981a5cf8a18f7da56fd17c39913db3bf5bebdc06c7171de046222ff91d94b51b9bd02be1db21a9b8e17f79b010bc3212730e9975dcd07ab5151162
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Filesize14KB
MD54d3e7c071fe0da1c258af349ea2682ab
SHA141ef03c11acec0b85e29df5b8017745720e01353
SHA25652327135a00b9e66344e18414196c791c9d7bf33e3ad7caa0bad8b817fb03b09
SHA5128a808c23ee05bba67adf3a05774f3ce1c2dcf0aa20e37240c3b5f7a55cfb544c8e3817e79b7364c3195b1c14bc2d602c18b086dd29ff1232767a299c60fe1c96
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\6bf2f899-3042-44d6-96cf-6889d0779a8d
Filesize671B
MD5f520ccbf7b7c917430df47f7b048b20b
SHA184c4f181243984d53461c7dd14ff38103779d496
SHA25682ed79535ba80246b5a66bad961c701ae416dd39060a041f5ee24a3251cc4d98
SHA512613d6a3e22d68ecc870e5104a5b40cc3078c8a65363160aa0339d72288fecb3da567fceac3d54d071dc5442350076eacf0cc81ab170e38bcdc989c85782581fc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\7a1dccdc-3e1f-4571-86ee-efdc7249075a
Filesize26KB
MD5643550bfe0eb62f21cce109e0cdbb51c
SHA11e19813c8b2acf52b693f821743b17b59d846fab
SHA256dc06418cb411bb757da94b19f521fd1b7adbf6764f26fe264a5387cab8272b98
SHA512af7b636a25632815e2152a773b6014d07fdac0aa7a518923f1d0ee2fd22f4983db0c2b53daac36c5d05083f8ffdc5dbec0ad18d6cf67005c344dccca34fc8f32
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\910f8865-40ee-4a5f-87e0-f1fd1d238b25
Filesize982B
MD57cbefb6563d0933a7bd6bb8935849844
SHA13456526f25e6dbc8010f457a692fb36313d19a46
SHA2563523c8a836644528612ef244502ef742c8a97e58f545720656f71f4b6d06b672
SHA512a3ab1ed796b3979da7db5ee626ee6f57eae07ef0169408d1bf7ff747859956bd9f92a3417462eea7b507a2eda5a8acd28fdce2bfe2164200b23b64098aaf81e7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD583b8ed3d2377de377cc9d7740c4620d7
SHA1c87466e69d8471f6de004ad7b5a606b22ad351d3
SHA256f13097433112b7bb769a79abd56196b40c2ea04c80caf9a8d92efae330f1371b
SHA51277d8ebe17fbeac9dee3d0f37d9bd4eda2a4b106077ffd859e6d3237dcc70d414ce5b122647bd803e6da8f04383327e04903f6e768943d88a18547f0029b758df
-
Filesize
14KB
MD5d77509cd2f8b90b3c18b50a35d1ff2e0
SHA1b2a0a57ee54766710731b8b8e3a1df6286e46d70
SHA256bf5386530a066b78425c18c9c3dc1e457c4f45d876ef6654ef963bcdab6b7c58
SHA512eac64b0a2f69f4f3f5b9fc509b10e52dcb7905afd1b0a86218d6438598dd2b3b6f9246b3d14d214b5258c3cfa963743c8c835055d7095a65f43406d59a9691b3
-
Filesize
10KB
MD53fe101bababa0853c2766b9fd5b2a39a
SHA1745b1f8e55b3ecf2c7af59be9259085c8fb92ce9
SHA256580d75500d30058f9560067d91185f2cfab9746b877fe86a1a762b66b3e5b0e4
SHA512d1dfcf16b891a7606faced8e57e5e7b3effcb7d70a28283ebe1d0520bf0c36685d154909304943c2c3c81bc192b2faac760466c33fb3de1f484c27e563a10210
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\sessionstore-backups\recovery.baklz4
Filesize1KB
MD5a5a96da9dcca063e270e447362159c9d
SHA1f8954864852652e9da6c30aa97f255927b1e4524
SHA256fbb9bcc03c64c73b401b673196caacb2247d0ac46287ff35d23da7df290934dd
SHA512d997589da81aa9f7e4a88a23b7a4bfd21e445c71359c56b0ac1c98517c3d92891a3225df44987420babfb0cc6dc9c4bdc13e1fb791a88574fc517fb2e79108f3