Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2023, 10:10

General

  • Target

    ©Contract_Agreement_Koerber-supplychain_6CMOSK71.htm

  • Size

    655B

  • MD5

    839cd7b10ca755e709b36bf885e8d449

  • SHA1

    0af8c1a4634d13220e3774d12ef19a3225eafc84

  • SHA256

    c1918edb8d2bf99eb71a219e53741cc028561230a1b8d1e1d28ab729f0f64f64

  • SHA512

    ac7b8582d166f7ea726b2db1ed782d80643352aa2720639f05fa25aa072942fd520f524779f04b00e9851f6913753d259288844b7854bf0569fde83e721d2f18

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\©Contract_Agreement_Koerber-supplychain_6CMOSK71.htm
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3768 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:704
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.0.2031574917\1763239089" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1840 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec285a8f-ab82-4c28-a8ee-cbb5a09a96a9} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 1932 1b6252fbc58 gpu
        3⤵
          PID:3556
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.1.1506961772\23851391" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7844d8a7-197d-40a6-8d69-5d2236ffbdb5} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 2332 1b618372b58 socket
          3⤵
            PID:1456
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.2.1366421191\1467720077" -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 2912 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea8da15c-e2b0-4ada-b511-b981794c1f97} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 3020 1b628ee8d58 tab
            3⤵
              PID:4224
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.3.1771927867\1998413497" -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 1304 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ee2623e-1e0d-49fd-923f-e6b900efae70} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 3892 1b618371f58 tab
              3⤵
                PID:1968
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.4.2035771138\384303409" -childID 3 -isForBrowser -prefsHandle 4024 -prefMapHandle 3900 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {417b0853-6749-43dd-883a-cc3fa42b6b1c} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 4044 1b62862ae58 tab
                3⤵
                  PID:4984
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.5.1739421822\41902771" -childID 4 -isForBrowser -prefsHandle 4956 -prefMapHandle 4968 -prefsLen 26738 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d854860c-bc49-458d-945f-414f1793c6bd} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5000 1b62b6dce58 tab
                  3⤵
                    PID:5560
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.6.1681392840\2081905642" -childID 5 -isForBrowser -prefsHandle 5220 -prefMapHandle 5180 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c69b3fea-e3e3-421d-b9ca-f449b49e4c28} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5204 1b62c614058 tab
                    3⤵
                      PID:5788
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.7.1692212846\813007262" -childID 6 -isForBrowser -prefsHandle 5332 -prefMapHandle 5336 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3f9ed82-7dbc-44aa-a52a-b72b4bace946} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5324 1b62c614358 tab
                      3⤵
                        PID:5796
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.8.1680592394\1382105652" -childID 7 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 26913 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a2f780-89be-43c5-b2c1-38f64f15a2f3} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5512 1b62c614658 tab
                        3⤵
                          PID:5812
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3380.9.734588361\159171033" -childID 8 -isForBrowser -prefsHandle 5772 -prefMapHandle 4056 -prefsLen 26930 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13a628fb-e7cb-4b96-94e4-fc842047a99c} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" 5116 1b618366e58 tab
                          3⤵
                            PID:5308

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\suggestions[1].en-US

                        Filesize

                        17KB

                        MD5

                        5a34cb996293fde2cb7a4ac89587393a

                        SHA1

                        3c96c993500690d1a77873cd62bc639b3a10653f

                        SHA256

                        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                        SHA512

                        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\activity-stream.discovery_stream.json.tmp

                        Filesize

                        146KB

                        MD5

                        b7ec0f6c1f2d860c7cf1954d5b7e9fd6

                        SHA1

                        cb250a453f73911c829710aba3e5366cd0fde231

                        SHA256

                        eedf7bbe0460498f9fdaa0de55303472d273bd222fa870e517f975cba4fece07

                        SHA512

                        2afcb87c8ee679c9878ec6ffcabec13ff54df522f1acfda2b28561934fc20623d44a055949ffa2e0120d9420f1b5005c051fb08ccde20da263ae617e73b80853

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\184C843EA0B8CD10730CA2564A233632E40FEF45

                        Filesize

                        14KB

                        MD5

                        3e2348be4e006bed2236efb7fb2daf64

                        SHA1

                        e30894bff4757f7d5b0f7fabe1c2e6a16943c3a9

                        SHA256

                        d4a597ad6c4e2596a0efa5d8883c4de210f0df09faa1ac234cfef82b0a1f647a

                        SHA512

                        d47f54a7e83a4c126559b61736e3c9dd1b9c1100f9d3318ea2120b55698ff848878ee95eeed15b839a3d496070e96b01fe0341b6c29612254d1482c4cd6185f1

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85w5cth6.default-release\cache2\entries\D5594A2648EECD01993B5C42919BA64ADBF56052

                        Filesize

                        14KB

                        MD5

                        2b131c9fc683f312a567c416e23fd843

                        SHA1

                        22eb91a5fbb0abe0a4f97b4eea434ca8f81e8f81

                        SHA256

                        5eb9f039b65aa7d3e9ad074dcf5929898198b4c489e177cb89512991927d34ac

                        SHA512

                        949f738600f3c9b2d68b5df0d8229ef790c717e348f237ec48a4eacc19c4eff8090cd1e657947f7bcbd62a659e1839de9168d8b72477d3285613f931664fe425

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        442KB

                        MD5

                        85430baed3398695717b0263807cf97c

                        SHA1

                        fffbee923cea216f50fce5d54219a188a5100f41

                        SHA256

                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                        SHA512

                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        8.0MB

                        MD5

                        a01c5ecd6108350ae23d2cddf0e77c17

                        SHA1

                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                        SHA256

                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                        SHA512

                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                        Filesize

                        997KB

                        MD5

                        fe3355639648c417e8307c6d051e3e37

                        SHA1

                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                        SHA256

                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                        SHA512

                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        3d33cdc0b3d281e67dd52e14435dd04f

                        SHA1

                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                        SHA256

                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                        SHA512

                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                        Filesize

                        479B

                        MD5

                        49ddb419d96dceb9069018535fb2e2fc

                        SHA1

                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                        SHA256

                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                        SHA512

                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                        Filesize

                        372B

                        MD5

                        8be33af717bb1b67fbd61c3f4b807e9e

                        SHA1

                        7cf17656d174d951957ff36810e874a134dd49e0

                        SHA256

                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                        SHA512

                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                        Filesize

                        11.8MB

                        MD5

                        33bf7b0439480effb9fb212efce87b13

                        SHA1

                        cee50f2745edc6dc291887b6075ca64d716f495a

                        SHA256

                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                        SHA512

                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                        Filesize

                        1KB

                        MD5

                        688bed3676d2104e7f17ae1cd2c59404

                        SHA1

                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                        SHA256

                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                        SHA512

                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                        Filesize

                        1KB

                        MD5

                        937326fead5fd401f6cca9118bd9ade9

                        SHA1

                        4526a57d4ae14ed29b37632c72aef3c408189d91

                        SHA256

                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                        SHA512

                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        edb1472a4c9d7280fcfd08b6af096eb5

                        SHA1

                        3cc6a7f0a8182a8f5e37d1241147d555b05f1eb6

                        SHA256

                        ba1be9a98259f82fbf67263e47445047c7160f2c1f51065cdcc2456eba42e59d

                        SHA512

                        fe750bb2ab34426c1d688ccb6c9a2fa73c191db75db8e4878f705408561590010b2212e48ebb5c8b0e4d250c1ffe6d5cd91edc49c7e0fe976a6e5ae6102945ad

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        5c8460a5ac1158aeccf6a31b52b3cf5f

                        SHA1

                        5fffb176e9b7d9e5d0368bde52300076d9fe3d3d

                        SHA256

                        4428276f87d0de655702c5d1a592ca0275dfbdac93f63cd66c72b11ab9d6d802

                        SHA512

                        68deca24193a9070f34b291926ce80de7dfaf58340f1f4a36982fc7f3048d43201d088ad3b2272fffc86207aeead8a036422157ffd1dc192a4d850be538fbd16

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        9eed0f5f5f2a8c9e69d1b7360dd0e166

                        SHA1

                        e26802f846adad0d3fd4780c229bd44a57241364

                        SHA256

                        3c87a4fc456e02b0ac5be204cc15cde4058c64499ad77f535bcae087e1a4ed6e

                        SHA512

                        9b0eb8ef2c684a237fc68b3841d262ce88f772b8eb3ea7a16c4462a09efbf9aa4c1b87288f5825df06ad3fc61038c3fd752257215d0ebb3f7f564260640e8cff

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

                        Filesize

                        7KB

                        MD5

                        64ed6ac8b6b798aa64c8f97697d44b24

                        SHA1

                        5df04b8b42115da6ee1a2ae569db02459c8fa53e

                        SHA256

                        01ee6749d67cfead66d41f74a829bdd391b5af0e07e4f53db25cfd44e895ad8d

                        SHA512

                        14c04ffaa4fe2b3d41d987eaafe700d6d3d98f3aeba538b1bfa87597b154fc8d614fbb5d360c1bee767f23202f5e9fe063c2ab6cedc8342e09d1d22ec77ea4af

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

                        Filesize

                        8KB

                        MD5

                        1a07ce7b2be645d625eda03f0093cdf3

                        SHA1

                        f9e6976cb312bd0af0780743a389227f1a4bc69b

                        SHA256

                        75099304c52c9b369da53879e56772c21c109d98c365db2d559534d56e265734

                        SHA512

                        50a823a1c63c919450d39dd996fcb305751beda1c143958ade5b93eb0328f3f2b4bdc1f48902e7e415cb962fb76617e4ad35e0eda1ca75d79f94b3dfd699565d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs-1.js

                        Filesize

                        10KB

                        MD5

                        0147becdfeb61fcf83686b353012b5b0

                        SHA1

                        077b7d08d209423822da5682d4362f223b373283

                        SHA256

                        2b5b0260648610ab46ff2f3ffb9ce40f5c89b8ee629d5319f101c94dad735a29

                        SHA512

                        4c4a1a3e64a05f7f4f7444630608b57dd8e280f6e1e6ccd1f64248e616f82b515d40fd2a369f410e2c7a989d8c89558fe2af7849f79ec91468fc67b73dc160c0

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\prefs.js

                        Filesize

                        6KB

                        MD5

                        f73e52d124620d05267ba934f3b312d3

                        SHA1

                        34121aa291d9f88b3e8e3a2fa37cb1c06cac2d30

                        SHA256

                        fc898a91ae8ce9d241c586f5dee2e60450dcdc5a31f1a7015d6dc2f4fefe4ac7

                        SHA512

                        4ef67626a2ba584817d707c71ddf7e7ce75a780921c3fcdfa8a03de0de9303c4b548ce3c3b493f1c4876d511271978bcd3cdbc2d1003b23c2459847180045d46

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        2KB

                        MD5

                        718e3cd583ea22471c383e08b7525378

                        SHA1

                        be63e9ace4559c7c2309a0e7ce749b0d89d43814

                        SHA256

                        36a87cbfaf46203a1848294a05e4de4eceda9e7af58e3dcf1926834a969a99af

                        SHA512

                        a11b401a6f86d4f748858c359c746ab41382a21fee0cf3a9c2a56017526cf555db3090bb36d5638075f31870e95199003d4b7c1cef3343f46b0c35497595dea3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        1KB

                        MD5

                        22c0430ed4af11a1967256d8e9a38556

                        SHA1

                        f2a23341f73084c0df315457d8153f3278620bc9

                        SHA256

                        5f09b45194da337ec7871aaecf123e499e822ee49026bc270768975291bab267

                        SHA512

                        5befe1bf18ecd8606e16c10eaf3ea95243147188ea8a1b560ec9fc5575d7351460c2ed22c055439fa0bfb52108b04d8142ba2acc987dbadc1d66e261578efa01

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85w5cth6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                        Filesize

                        1.4MB

                        MD5

                        259f812aa753c120f2c643661b3edfee

                        SHA1

                        9af86fa48de1f63a1337e12478deb6a9dd4b3af4

                        SHA256

                        612cd440ec3a0f3bab99f5cb30e0442f15ac0a5ecd968bcf9cf099f7b0380137

                        SHA512

                        a10428c7c9d96ad89853b57e7e26e01c09e57b094cd5d26eaea3e4d118f4e62d11bf709eb7ff000f27dae1d9dffe75cb2e0c83b475e2b46810ed0e274dfbc6c4