Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 15:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamtickets100.com/s/KQRA
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
https://steamtickets100.com/s/KQRA
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral3
Sample
https://steamtickets100.com/s/KQRA
Resource
debian12-armhf-20240221-en
Malware Config
Signatures
-
flow pid Process 76 3464 firefox.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3464 firefox.exe Token: SeDebugPrivilege 3464 firefox.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe 3464 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3464 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 2220 wrote to memory of 3464 2220 firefox.exe 85 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 4984 3464 firefox.exe 86 PID 3464 wrote to memory of 3792 3464 firefox.exe 87 PID 3464 wrote to memory of 3792 3464 firefox.exe 87 PID 3464 wrote to memory of 3792 3464 firefox.exe 87 PID 3464 wrote to memory of 3792 3464 firefox.exe 87 PID 3464 wrote to memory of 3792 3464 firefox.exe 87 PID 3464 wrote to memory of 3792 3464 firefox.exe 87 PID 3464 wrote to memory of 3792 3464 firefox.exe 87 PID 3464 wrote to memory of 3792 3464 firefox.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://steamtickets100.com/s/KQRA"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://steamtickets100.com/s/KQRA2⤵
- Detected potential entity reuse from brand STEAM.
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99a969b5-f30e-4d8f-a90d-6ed1a49b37e9} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" gpu3⤵PID:4984
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e0c859f-8102-4fd7-9cdc-965b948c5bc3} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" socket3⤵PID:3792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2976 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2956 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bd12435-1864-4637-b328-3bc4ea907e2e} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab3⤵PID:3960
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4048 -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 4008 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ba24d1a-eb67-4c45-86c8-5d4e1c07aa29} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab3⤵PID:4744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4728 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4664 -prefMapHandle 4736 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3fee766-85ae-4c73-9082-3e36ba86587f} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" utility3⤵
- Checks processor information in registry
PID:4728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 3 -isForBrowser -prefsHandle 5292 -prefMapHandle 5288 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2ad5fd9-e05f-44a4-b8eb-7c5b9dc5af65} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab3⤵PID:2684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4668 -childID 4 -isForBrowser -prefsHandle 5548 -prefMapHandle 5500 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {387f6485-79fd-407d-b4b6-7aa8286493bf} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab3⤵PID:4792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 5 -isForBrowser -prefsHandle 5636 -prefMapHandle 5736 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0f19e19-df33-4a5c-beaa-011e986d8d7c} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab3⤵PID:4292
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6012 -childID 6 -isForBrowser -prefsHandle 5932 -prefMapHandle 5940 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 972 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e81d1810-f4b5-468c-aac4-481406295dc6} 3464 "\\.\pipe\gecko-crash-server-pipe.3464" tab3⤵PID:4768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
Filesize21KB
MD55ecf1edf5c6d1f8d0403b9a08a5e16ed
SHA13180d33b152405dbf9a34dff0d6b96ac35751077
SHA256b76c21c3ad9405344a053090976e032ecaf71b82b637a88da89190e3e73df1bb
SHA512dc3304d12c016aed8745e68779121de8f55be9d75a5eeb7d67d1987d7b3ef2b053afda9cec54b539d6f64064fddc14d5e1b56ea14d41ee123a73d1277452c965
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\86254BE5C4605A6368B6E91A664F0C6BB10599B0
Filesize118KB
MD5d715210fbf89b33ff01758297b95d3e5
SHA14fe011adbba412b5771ea80ccd1ee6bd873743b5
SHA256e50e65a5eef9dfc06e31f9c814f98ee563671936c2f65c81601d85570235589e
SHA512f47609c68f0282b0dc50e732c3f63287b39b0c336910ee732042676f591403ebf118924c76e983589ba0ec790880bd8ace4671d0c7327b8bce537499170fe3ef
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\BDBFAF694C30FC9FD0B5D03F0456B4CA5FF7B159
Filesize34KB
MD501ee11616d231adcaa47482515ce4a9c
SHA1cca5dbe9897d061954ef0abc2db0ffadcf0cbf6b
SHA256a16c1d79dda071aee6bbd757584108ecf93d1ff4110239fc66c8a9e1309812e8
SHA512cdab8b5dfaaf7e17ba96bad3b6d67e56cac000bdb451281db5655dee0d6b478da583324c4b32fbf42544c5f2de599fb4a9d719d2680a06a647fa5eb7b8158077
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A
Filesize13KB
MD568d058d97aea80c6d09426bf8dcc7f00
SHA1d86826c27c842f5045aa7b113b457598631357f7
SHA2566884c6e19cf9f20a99b0200b1944b2fb5d3f2cbae62ddd0c1e2e5a7f458c25f1
SHA512abe252dbf0beaa7ec92b599812b2cb7aeed745e7c8aaa95d18f9b69292078a249c9b65d9e37b0bf0660dc046c29dd9acfe7a04cd52d5bc7b3c4e7aa41ff3d9d4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize15KB
MD596c542dec016d9ec1ecc4dddfcbaac66
SHA16199f7648bb744efa58acf7b96fee85d938389e4
SHA2567f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
Filesize6KB
MD517389126997c36641fbd183050f1cf44
SHA1e613e747bb4486242a28aceb28a3b0514f131295
SHA2560551955b7a78860389459975754c0507700c1edacc2209e93a8ea4c226831335
SHA512c494e4e94132b9cec3e005ac52ec6f16d61738807fd82f7e5ec1c356ec9481db9f3f90a16787a9f682580774980b6cb1af7712206063cad5775ce71b48cf6d53
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
Filesize8KB
MD5b4d15a604f111c41801c77ea6434c47b
SHA16a7eeded41d35d855e8133715344a30e66f06a23
SHA2569f9cfe28dcea173e29000bbb4686bb86b5db9f2504c99b6e20ce32937566ccb5
SHA5121f029c403791f2454057d9ed8a003b3031a65838a6132323743c6ebd66009b3aa19b5d873a7d2b0ec4563bbd4e7fc62bcd008431d5753ef5e2ad7ba1396abd35
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD5ae770ad509a60394139d1f937cc83abd
SHA186c610646f55c20a8d9145de4000cd2d511c84f1
SHA25645959ad9c379eedb77c5af6eb63f28cb1b44c09d0cd3516e1adf1f90eec94e03
SHA512fc38f149c597c7866ccb026300ea04b58f7aca4e3d31774809d148c899283d2c886bbede2960b516a2c41016c5e834811042efa91668db04a7ca822452ad8c89
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD54edccc399b1323aa381ed31ccbb25930
SHA1e6786681d1ac0aa4e43c0ddd2b6d5cb8e8f6f177
SHA256654fa0f6df30fe9112e93438e4681407abf340f38a36afcdd3bc5308df9e5d33
SHA512f22e7aff06cc82cf9fdb860d58f8b99ff35d298c133dcdfc637d990878bf766535423ad311c490dc660c98285508339d0b905fc5975b2dad3aa5b2a4009c0a9a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\58c6f5bd-07b9-4eb3-b717-90da5aba689a
Filesize982B
MD5fe2c9a1c061c94f5574a61b947bf722d
SHA19fe7094a0e4efbbea6a1281b82eebc516b538e57
SHA256b0b4bb9d633a69f51bc26472aab98634f9c0ce1e2d7261017f2f9ab823ed8e25
SHA5122e6082a5911681bfa80bf9345ee8f46f81ea9f117cc92442700b45f3d890aa2f2229b40badbad41c2b8614e58bcdc5c0919d99113b828a4945da7bb5018ddc35
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\90706441-c2e8-4e87-b4f3-ef0795fd5d26
Filesize26KB
MD539c9446a07be36589f5a91effb1ecc5e
SHA1416952d75ed02363fb3440cf5fbe4f4701192ebb
SHA256994b8961faa6901517873d35ef617d55dec97985465c55e658728d187f137dff
SHA5127803dbd5fcd8f7aa67602aecd7487c699beabcf8f083604d53ec36d8c1fe6607d9b23377ce300e7e53b9328056c8f621cb77b17f50c05141110651d9e4b9cc1b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\d55b3037-1830-4d65-86b3-788b4802fd09
Filesize671B
MD5324a28c4f2c0169d21b7e559b52d383e
SHA131d6d08d4a0f22739c61dc4a38d6df32e377f162
SHA25691a987344004602474e3f606dcb4f9340160ec7d17a779f3b123629b128d1fcb
SHA512dbbe1fa2f7f211ed3854842c785998dea35be5c13ec99a9611b821b47142a715ec46fb0f35dc02020999422a3d150556c3765bb0649d01fdcea21540ebc70e68
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD5bb8ea65dd410eb00bac1531bf318d1e4
SHA1aa11b1337c1bcb25334afc36e957002dff96fbe9
SHA25668f58898cc960f8327ade850183075fcc372cbed3891a15c1e832e95ce955aa3
SHA512264c95370d16a40539f062e2950b9eec6636ab770657534b4c20a602b9127ba9b7ded46b46c292587626405128c815edffa1c9d64f4ad9135e4e97f0ef9b9c34
-
Filesize
14KB
MD5e9baf37985503e2f23fa1b1e3ad27f52
SHA10d4e3b5a2052002c9ca84cba4797d7095ab65eb1
SHA25609435d06b232506bf504dab69144fa25e3c5dede943cb06ee8b2e069915be164
SHA5128ac936068cc704ffa67af97b230bd59f577f7f11aa253f0f36d98617bcc23e2efa8d08c8e63cac19370edf015966de0322baa507a543b4428401f0adb3b94a91
-
Filesize
11KB
MD540c2357278d1e4613532b2da21a84704
SHA1177a9aa6bf3e213be223936e52474363ebaec196
SHA256b54e80b4b75eb012daaa292e565eb2ca2f8d517a27b73d85f9bc1331ec8ca8c4
SHA512e0f132f49849f1e1fc61da772fa824b8e27a166e702d3ea3ac451fe26ba7c456a516d0718d5d4a70cab7632982be8022ccb5b28e6737a37a8e22d6b7732c2c6c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\sessionstore-backups\recovery.baklz4
Filesize40KB
MD5c9a52752f1f138088fd6228c8e3be266
SHA1a626a088189d76f08487beb1d8215f258d4b095c
SHA256408a9dc6ac96bc5a769c26437227f189f1f70f9f1e03845a1dad897fd319cbde
SHA512c105e454c97b2aa5292fa932c991b31421ef5b7a2b2923517e672f3a6a5f6c4e1d00b26aae81d8e723104aa6eb98ec92364e3257bc0c048a9ffc5f4ad207f55b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\default\https+++stor-steampowered.com\ls\usage
Filesize12B
MD5cdd578b59a5e7d64e1d6bf0b98b3e81d
SHA1280b1d7aae0947a448c68e6ec22d9b68a0a005c0
SHA256043cc32ecdbb208c7481c554e8165c85d89eb1385f5541929dadd5ef6bcc3486
SHA512b6f04959ec6eff93b6adc9b610aed13926d0e2c767bf335c2e3da2ab5bb6901ce1bfe7be3ca619c6a8f86e4b301cc9b39511ab959d0b388d38dd87bbe066327b