Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2023, 03:00

General

  • Target

    https://cutt.us/premium-user

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 1 IoCs
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://cutt.us/premium-user
    1⤵
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4416
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.0.684330395\2101804433" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1852 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8791513-128d-4741-bc5d-4d696baa4864} 456 "\\.\pipe\gecko-crash-server-pipe.456" 1932 1dfe29db058 gpu
        3⤵
          PID:2016
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.1.1759016001\717101873" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2308 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fad16895-2626-41a7-84b7-aff19196fb16} 456 "\\.\pipe\gecko-crash-server-pipe.456" 2332 1dfe290a558 socket
          3⤵
            PID:4320
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.2.996642875\1460465814" -childID 1 -isForBrowser -prefsHandle 3140 -prefMapHandle 3136 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88991f2e-081a-4a10-b2f3-3aa624080f94} 456 "\\.\pipe\gecko-crash-server-pipe.456" 3152 1dfe65b0a58 tab
            3⤵
              PID:2240
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.3.1870335850\601528466" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3500 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62051afb-bb52-4553-a805-f7d0306b2c2e} 456 "\\.\pipe\gecko-crash-server-pipe.456" 3516 1dfe50e6a58 tab
              3⤵
                PID:3032
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.4.2121119523\156046814" -childID 3 -isForBrowser -prefsHandle 4596 -prefMapHandle 4592 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15513866-b318-428f-ab7f-4a2740d2362e} 456 "\\.\pipe\gecko-crash-server-pipe.456" 4568 1dfe835b858 tab
                3⤵
                  PID:2940
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.5.48402341\1159702663" -childID 4 -isForBrowser -prefsHandle 4972 -prefMapHandle 4844 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cab3dd88-b76e-40e8-bff7-cf0b5e00d01f} 456 "\\.\pipe\gecko-crash-server-pipe.456" 4512 1dfe8baa858 tab
                  3⤵
                    PID:3608
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.6.262973053\1115177555" -childID 5 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecc5d0a3-ee32-4974-939f-65e49ee40b8b} 456 "\\.\pipe\gecko-crash-server-pipe.456" 5076 1dfe8bab158 tab
                    3⤵
                      PID:3612
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.7.310184227\867899819" -childID 6 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f9c1ee5-5695-4b67-bdfd-caa6b8f608d5} 456 "\\.\pipe\gecko-crash-server-pipe.456" 5260 1dfe8babd58 tab
                      3⤵
                        PID:4464
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.8.208999443\1845641478" -childID 7 -isForBrowser -prefsHandle 4248 -prefMapHandle 5844 -prefsLen 26921 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4c9bee8-1334-4135-af60-e3d9f9778c49} 456 "\\.\pipe\gecko-crash-server-pipe.456" 4240 1dfe2cba858 tab
                        3⤵
                          PID:1576
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.9.1013306469\1192626374" -childID 8 -isForBrowser -prefsHandle 6012 -prefMapHandle 5956 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48feb989-f0f5-42c1-b133-206fdf93beae} 456 "\\.\pipe\gecko-crash-server-pipe.456" 6084 1dfea093158 tab
                          3⤵
                            PID:3460
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.10.266559003\283075040" -childID 9 -isForBrowser -prefsHandle 6268 -prefMapHandle 6208 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {566b4850-144f-471c-87ae-be16f7400ca3} 456 "\\.\pipe\gecko-crash-server-pipe.456" 6184 1dfea092258 tab
                            3⤵
                              PID:1612
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="456.11.1542095297\1502151554" -childID 10 -isForBrowser -prefsHandle 5152 -prefMapHandle 4524 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1440 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53d6484b-3c5d-47d1-9807-da6854359aab} 456 "\\.\pipe\gecko-crash-server-pipe.456" 5236 1dfe2cb9358 tab
                              3⤵
                                PID:3228

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\qwzqiba\imagestore.dat

                            Filesize

                            97KB

                            MD5

                            04515078ab69dc53ed69a448e386021f

                            SHA1

                            49acbe1baf9856016b0178af35b854c14cfc0a05

                            SHA256

                            c7d52e7af4ddb6c180c917987505a99ae4147232cd7a2a5f493c516a23c012b4

                            SHA512

                            230127a1e4c52d5747729eaa9e3e1053d50d0d5dbc790d6fe4d816295a4c1a58510c76a2f0d619b2a1aab79ace88f4d3665c657266f68f7b7257d73d4fa78bd6

                          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\qwzqiba\imagestore.dat

                            Filesize

                            97KB

                            MD5

                            04515078ab69dc53ed69a448e386021f

                            SHA1

                            49acbe1baf9856016b0178af35b854c14cfc0a05

                            SHA256

                            c7d52e7af4ddb6c180c917987505a99ae4147232cd7a2a5f493c516a23c012b4

                            SHA512

                            230127a1e4c52d5747729eaa9e3e1053d50d0d5dbc790d6fe4d816295a4c1a58510c76a2f0d619b2a1aab79ace88f4d3665c657266f68f7b7257d73d4fa78bd6

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SUUB7YB2\favicon[1].ico

                            Filesize

                            97KB

                            MD5

                            63089da99dde81f229bbdeba46b9ea7b

                            SHA1

                            19c816ce673b8686fa56d6d82d30b6a28c09e1e3

                            SHA256

                            c282cc66744e30f7fdd3b47986f1fac99bd7ea81385e9d1ed6579277de9616eb

                            SHA512

                            0a21893d3e561cbf72eb87204eeb17c36c1c3977cf4a6bd699dcae9d40c2a9fc1a004f32901fce2adb70359f77c0ba0774c3136e789feaefbdb236faa3f5ce5b

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vjiou3c0.default-release\activity-stream.discovery_stream.json.tmp

                            Filesize

                            147KB

                            MD5

                            41e301a108536c32a800943e2da49008

                            SHA1

                            78ae73739d31903216aa889c7c306aac80942047

                            SHA256

                            d4f9ebac40502098754d7eb886873be500a52754c80e4784afa29db435b11e8c

                            SHA512

                            30decddf10a2c86a79265a39e1616aec3080ba09f7b4045a88d6c2f19654150762fb5513fb3dcfe251f398fd00e72a98571036ff8a88a04aaa595560e0fda608

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vjiou3c0.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0

                            Filesize

                            14KB

                            MD5

                            d90085479a6fd7099769ce4e0a1febfd

                            SHA1

                            34328d4994e4601eab84793469928b01ba4ca4ad

                            SHA256

                            7b56587f6f119db7602959368a19385a55a1662b72c84a82b7f71899c044b96e

                            SHA512

                            1fab625f1ea8a4bf555243bd75404edb39de7da5fbf25c63d336787030677d360a9d03bd5562f378876237bbde7f5a193cc0841d87153d764e8a4ca7d53d00da

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                            Filesize

                            442KB

                            MD5

                            85430baed3398695717b0263807cf97c

                            SHA1

                            fffbee923cea216f50fce5d54219a188a5100f41

                            SHA256

                            a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                            SHA512

                            06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                            Filesize

                            8.0MB

                            MD5

                            a01c5ecd6108350ae23d2cddf0e77c17

                            SHA1

                            c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                            SHA256

                            345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                            SHA512

                            b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                          • C:\Users\Admin\AppData\Local\Temp\~DF3CEE48A503E5754E.TMP

                            Filesize

                            16KB

                            MD5

                            32e6a463b4cb7c6c3237c4a766b67217

                            SHA1

                            cb75dbc5c1b0cd2c6e6017a0270eae4052aaaad3

                            SHA256

                            3b6ce752278360edcc4d26692e9bdf776964713f3ffcc281a33cf11c00746b24

                            SHA512

                            ec80c4877602fad50c781da4d274a509204cb4da3dfba51497ee34dd30c8eaf60ba07e0f908d6e0e24681ee389adfd53e3f7a5417cbab0527967a7074ee206af

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                            Filesize

                            997KB

                            MD5

                            fe3355639648c417e8307c6d051e3e37

                            SHA1

                            f54602d4b4778da21bc97c7238fc66aa68c8ee34

                            SHA256

                            1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                            SHA512

                            8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                            Filesize

                            116B

                            MD5

                            3d33cdc0b3d281e67dd52e14435dd04f

                            SHA1

                            4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                            SHA256

                            f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                            SHA512

                            a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                            Filesize

                            479B

                            MD5

                            49ddb419d96dceb9069018535fb2e2fc

                            SHA1

                            62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                            SHA256

                            2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                            SHA512

                            48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                            Filesize

                            372B

                            MD5

                            8be33af717bb1b67fbd61c3f4b807e9e

                            SHA1

                            7cf17656d174d951957ff36810e874a134dd49e0

                            SHA256

                            e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                            SHA512

                            6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                            Filesize

                            11.8MB

                            MD5

                            33bf7b0439480effb9fb212efce87b13

                            SHA1

                            cee50f2745edc6dc291887b6075ca64d716f495a

                            SHA256

                            8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                            SHA512

                            d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                            Filesize

                            1KB

                            MD5

                            688bed3676d2104e7f17ae1cd2c59404

                            SHA1

                            952b2cdf783ac72fcb98338723e9afd38d47ad8e

                            SHA256

                            33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                            SHA512

                            7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                            Filesize

                            1KB

                            MD5

                            937326fead5fd401f6cca9118bd9ade9

                            SHA1

                            4526a57d4ae14ed29b37632c72aef3c408189d91

                            SHA256

                            68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                            SHA512

                            b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\prefs-1.js

                            Filesize

                            7KB

                            MD5

                            8b8d45142121d18ac534cd09aa54dcac

                            SHA1

                            0b57b7a5973a6fd839413190aeb4b93d31e84fab

                            SHA256

                            54b720160a550b9a6b5d19ce279bd506f3f22cca84bf7a1d3b45f51c354d7bf7

                            SHA512

                            d488f3fb573962d1ac6a18661ba5ab50ba92140f77e2d0c86d34d4248887895e58d0055800832583d0843127b0ccd295fdc6d6b057eefacce338cefa340e1b99

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\prefs-1.js

                            Filesize

                            8KB

                            MD5

                            b96a71680d563a86f55ba79bf14906ef

                            SHA1

                            6ffe03bfaba27618d9117f2a0bc7858f26451dc4

                            SHA256

                            06dd8e6c0970e593fc184bd76405c478aa287155de5ea54b7fc7350d2cfeaff1

                            SHA512

                            9b1e8d544c2866a0a9cc6e30184b7c162f57a44492d0ec481c1fb3516be4937347d4c49e06aec3104f46f291b39b1f2620948e4c9067748f9d8e0908d2fbf0ba

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\prefs-1.js

                            Filesize

                            6KB

                            MD5

                            741142ff3cec7ad2603e87ecad03255c

                            SHA1

                            2182e7ac18ea44487f2c94055e700986ff062015

                            SHA256

                            bede1b1bf96d0e026832531e45ba7b78ffa5e90efe2a439c52dece5a00c7bf51

                            SHA512

                            b90525962bbadfbf188ecb620c6f2bfebbeff4a606079047e207dcd72d29afa9c34e247a551fc345a36ac3a2de9614e52ccdcde6f1c0b1d67b8387bfe62b0bcc

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\prefs.js

                            Filesize

                            6KB

                            MD5

                            b449f2fd545724cf80b5ff33fde99181

                            SHA1

                            270afcad8a4b4287dd4ea976ef0b8510259eb867

                            SHA256

                            b7f4c6e3347fa14dfc09ea65320acfe6bc0ece256420ad2515a3a4e4fd941e86

                            SHA512

                            659e94fc6aa77613df0f5fa63bb5c574fd2916851f32b950d346205a96a0853372aa87da835bc92aef0029d2e834f0afbe556437b95e6b921e3f1db92e8f7430

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            1KB

                            MD5

                            8235aa0a75bbd1892ca1a469d1d56886

                            SHA1

                            7c4774654a4d8b2bf92cd312e37a25868b91e7aa

                            SHA256

                            75a77135ac4d86d6d040ef0f19bac402d20141ffd6b598b8f4b749efe8f47491

                            SHA512

                            ced627224ea10481c54f04cf3beaf8f92c572cd0becd50996e182d6347c2dd47cb6e43a45e3e6b1f36b6e844cf9936d2bb65e73021357383ffd979672f626b7a

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            1KB

                            MD5

                            7202b5d79439695c917ae32b5530cc4d

                            SHA1

                            e2b0f9c9af4a8bca8ac621fa658f776df04bf445

                            SHA256

                            705df299859954acf35d2158166aad8ed6f26911bef3244efafda9fe364189f8

                            SHA512

                            111f53782b05e90f6f8a5e77657fec8c1e7fcbb7231e9ac196fba211c951dbd283eefb1b53b56d78b47dd37ffd8e1755c42128583d5078bc4bf89c4397d98954

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vjiou3c0.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            1KB

                            MD5

                            cb9afd6818c8bd4adc3bfedf2f7991b4

                            SHA1

                            e88c535f0c8b88347d0f8e1a0e27f4a7719a0c81

                            SHA256

                            2c8c9684b119dd8970373a7e48b621a98a23b35e929b64937ce597898ba0a097

                            SHA512

                            e0e6cf516a1fa8512f301470402849dc85dc7bd248515f4c6a00e8d20af0010352cade1021bbe649f2d31c2f536c3a6588bdf8c12d820a9e71676026f62d53d1