Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    166s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/09/2023, 20:40

General

  • Target

    XMouseButtonControlSetup.2.20.5.exe

  • Size

    2.9MB

  • MD5

    2e9725bc1d71ad1b8006dfc5a2510f88

  • SHA1

    6e1f7d12881696944bf5e030a7d131b969de0c6c

  • SHA256

    2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

  • SHA512

    62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39

  • SSDEEP

    49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
    "C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
    1⤵
    • Loads dropped DLL
    PID:4556
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4856
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.0.446493690\681551977" -parentBuildID 20221007134813 -prefsHandle 1736 -prefMapHandle 1728 -prefsLen 20858 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {912d550e-24eb-414b-831e-58750bedfdac} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 1816 24512bd5158 gpu
          3⤵
            PID:432
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.1.460165966\1427141022" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2148 -prefsLen 20939 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6d4bcb4-94d3-43cc-b144-402a15e9e2e8} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 2172 24507b72b58 socket
            3⤵
              PID:4540
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.2.1524697333\1214660981" -childID 1 -isForBrowser -prefsHandle 2708 -prefMapHandle 2860 -prefsLen 21042 -prefMapSize 232645 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a46831a-1fdb-430f-92eb-6aa9ccd23ff2} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 2852 24516bda158 tab
              3⤵
                PID:4196
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.3.339218607\1494272511" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3420 -prefsLen 26402 -prefMapSize 232645 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5234f699-d3c5-4eb9-a42d-e9d7de4f89b2} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 3456 24507b61958 tab
                3⤵
                  PID:2068
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.4.1920061145\1928256783" -childID 3 -isForBrowser -prefsHandle 4232 -prefMapHandle 3968 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0417995b-845f-42d8-8c59-8e2835668929} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 4244 24518847158 tab
                  3⤵
                    PID:4560
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.5.1499410261\1634339146" -childID 4 -isForBrowser -prefsHandle 4664 -prefMapHandle 4684 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7eec95a-4ed7-48b4-9782-c101ae691eed} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 4712 24518cddf58 tab
                    3⤵
                      PID:3128
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.6.858118333\708231851" -childID 5 -isForBrowser -prefsHandle 4844 -prefMapHandle 4848 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc530367-6af5-4926-87b7-ca53dfb38129} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 4836 24518ef8158 tab
                      3⤵
                        PID:3692
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.7.2023943921\1835422196" -childID 6 -isForBrowser -prefsHandle 5036 -prefMapHandle 5040 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {484a725c-c15b-4367-bab9-b84b3ff53952} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 5028 24518ef9c58 tab
                        3⤵
                          PID:2876
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.8.1330429062\1391812855" -childID 7 -isForBrowser -prefsHandle 2608 -prefMapHandle 3040 -prefsLen 26964 -prefMapSize 232645 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2da2aa5e-e904-4170-b6ad-3ca64dbbb66d} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 4884 24515391a58 tab
                          3⤵
                            PID:520
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.9.897765979\1061227230" -parentBuildID 20221007134813 -prefsHandle 5784 -prefMapHandle 5780 -prefsLen 26964 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae53f07d-3a24-473c-9d35-bc9c63c96f36} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 5792 2451a78f658 rdd
                            3⤵
                              PID:3892
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.10.1574994128\304723894" -childID 8 -isForBrowser -prefsHandle 5928 -prefMapHandle 5904 -prefsLen 27139 -prefMapSize 232645 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7540830-3242-4b40-964f-de9ac180e7ba} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 5908 2451a78f058 tab
                              3⤵
                                PID:1892

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\activity-stream.discovery_stream.json.tmp

                            Filesize

                            21KB

                            MD5

                            3d1c32f7855b850bf931d8a8455d3e77

                            SHA1

                            01093db32011356b6d9722cc14124e0f42eba286

                            SHA256

                            5ef45153861fb3a7cd618f905b1ddc64f61a0211e3ca1ef218d88552a203a5ba

                            SHA512

                            1af93dadb81ddf252f70161e1326266107e75d6dc7ea81ad4aa84257203837fa2c501409b857789f6913ad3b780e7bff67653c0fbdf4ec37ab068204f63222cd

                          • C:\Users\Admin\AppData\Local\Temp\nshB141.tmp\InstallOptions.dll

                            Filesize

                            14KB

                            MD5

                            d753362649aecd60ff434adf171a4e7f

                            SHA1

                            3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

                            SHA256

                            8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

                            SHA512

                            41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

                          • C:\Users\Admin\AppData\Local\Temp\nshB141.tmp\System.dll

                            Filesize

                            10KB

                            MD5

                            56a321bd011112ec5d8a32b2f6fd3231

                            SHA1

                            df20e3a35a1636de64df5290ae5e4e7572447f78

                            SHA256

                            bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

                            SHA512

                            5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

                          • C:\Users\Admin\AppData\Local\Temp\nshB141.tmp\ioSpecial.ini

                            Filesize

                            765B

                            MD5

                            580f3b4fc7e60b61f2c7b83dc3fd69dd

                            SHA1

                            afd0106f9f55933261bfa2a86797129de814980f

                            SHA256

                            6e04d459e9219a5ff65e8d7a4ca700158fa790e9e53f6e23090a6ddc7e00a902

                            SHA512

                            37cbfe21cda918c5f7aa5f8abb0761b7a179c6829016bbe0fe12782320f965a88c61f45e84eabde08e60e3c71e5d9c1e157afa16c73de1a0570f62239523c499

                          • C:\Users\Admin\AppData\Local\Temp\nshB141.tmp\ioSpecial.ini

                            Filesize

                            765B

                            MD5

                            580f3b4fc7e60b61f2c7b83dc3fd69dd

                            SHA1

                            afd0106f9f55933261bfa2a86797129de814980f

                            SHA256

                            6e04d459e9219a5ff65e8d7a4ca700158fa790e9e53f6e23090a6ddc7e00a902

                            SHA512

                            37cbfe21cda918c5f7aa5f8abb0761b7a179c6829016bbe0fe12782320f965a88c61f45e84eabde08e60e3c71e5d9c1e157afa16c73de1a0570f62239523c499

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                            Filesize

                            442KB

                            MD5

                            85430baed3398695717b0263807cf97c

                            SHA1

                            fffbee923cea216f50fce5d54219a188a5100f41

                            SHA256

                            a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                            SHA512

                            06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                            Filesize

                            8.0MB

                            MD5

                            a01c5ecd6108350ae23d2cddf0e77c17

                            SHA1

                            c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                            SHA256

                            345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                            SHA512

                            b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                            Filesize

                            997KB

                            MD5

                            fe3355639648c417e8307c6d051e3e37

                            SHA1

                            f54602d4b4778da21bc97c7238fc66aa68c8ee34

                            SHA256

                            1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                            SHA512

                            8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                            Filesize

                            116B

                            MD5

                            3d33cdc0b3d281e67dd52e14435dd04f

                            SHA1

                            4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                            SHA256

                            f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                            SHA512

                            a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                            Filesize

                            479B

                            MD5

                            49ddb419d96dceb9069018535fb2e2fc

                            SHA1

                            62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                            SHA256

                            2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                            SHA512

                            48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                            Filesize

                            372B

                            MD5

                            8be33af717bb1b67fbd61c3f4b807e9e

                            SHA1

                            7cf17656d174d951957ff36810e874a134dd49e0

                            SHA256

                            e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                            SHA512

                            6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                            Filesize

                            11.8MB

                            MD5

                            33bf7b0439480effb9fb212efce87b13

                            SHA1

                            cee50f2745edc6dc291887b6075ca64d716f495a

                            SHA256

                            8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                            SHA512

                            d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                            Filesize

                            1KB

                            MD5

                            688bed3676d2104e7f17ae1cd2c59404

                            SHA1

                            952b2cdf783ac72fcb98338723e9afd38d47ad8e

                            SHA256

                            33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                            SHA512

                            7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                            Filesize

                            1KB

                            MD5

                            937326fead5fd401f6cca9118bd9ade9

                            SHA1

                            4526a57d4ae14ed29b37632c72aef3c408189d91

                            SHA256

                            68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                            SHA512

                            b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\prefs-1.js

                            Filesize

                            6KB

                            MD5

                            c6408d4d025821be0462c3749179fd48

                            SHA1

                            1ebe3e65d688702536920063cc88748d1528de91

                            SHA256

                            96c4145c276239194d4999787c95fe4dd25799c3be8ebf4535bb263c6ce45f17

                            SHA512

                            f6b6bd652849437d0e69c3fb36633f303d407199b3359d740c17e011a3b073f390a27733efb78fdc2eb4c3cf52fac906cf4e7850886a1b30fd5524d6c58fb9c6

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\prefs-1.js

                            Filesize

                            7KB

                            MD5

                            d87cad1a3da045980d247e6adaf568cd

                            SHA1

                            394092eb45b59ea01548085dae750b33b4861faf

                            SHA256

                            47542f3078bb925623f231b691ba545c122888e1d99af32b9f9bb3e99a7b7cba

                            SHA512

                            9a059155fafd3982fd436c37b87c1998dd3ae9a5b83b1ecfc314cc0f08b6110304c7891fd9bdb7d893e1cb4a8ac3091ca0269b452bc5440e1b0087658490491b

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\prefs-1.js

                            Filesize

                            6KB

                            MD5

                            10df1f14d687994e03259edb1270f45b

                            SHA1

                            3a8ae697f5456e7c0fa9a36620b6382c3202cc9b

                            SHA256

                            41208de9dde3f03802467e825bf5e1fe12a5f011999606f17e94ba0d1344b130

                            SHA512

                            5fd6cf93c8d5a330c166c2a5dee61d895c0b9df8020e0a4817660c0e5c88c2f9e09df130c65721fb307e061e126dc4c1465a4127710b1d48707b111e05c9c6b2

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\prefs.js

                            Filesize

                            7KB

                            MD5

                            3c8be05b81e32518516d887df247524f

                            SHA1

                            4017200bcab8117b8cd7906f006dfd2eb047e35f

                            SHA256

                            ace381afedef63c82bfe49ea59def49baeab8e02d3ea6f196dc1c45d54dd860c

                            SHA512

                            d765bff0f87b441945b7053f504c217321daccc17a2ad82607b2bcb29b749936a396c350938f7c6de5e8fd037b783998702f01d5e62e71df46e8a655a62ae989

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            3KB

                            MD5

                            3f3002402b7a3d8ea78dc8afd6d058f2

                            SHA1

                            616e5e46198b8a7f7deedb8edf47dca638b90663

                            SHA256

                            7f670cedcb32f76e3567cd887958d7caf718441f88f52b02a53da86edbb6a497

                            SHA512

                            8028ef18764c987f4c7176f79369f8c496d0c0c122f94ee68db03e022b4ba6ed3ffb1cd5712eb28ab14ce67374c703fb779395b4cc9ab31a3218da5dad466752

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            4KB

                            MD5

                            a7eab625f85167ae01d37142dfc39e7f

                            SHA1

                            a736da9c1f7809e0265b857381e28f9954eaa1bd

                            SHA256

                            503dc90ec582498b1f89301ffa4cdf6654cd1412ce4fbdbeea57f3569f759d21

                            SHA512

                            94c9561c9d05845b01974a9b8d456cb1eb140d201e2f182786355290e7517ef9ec23f4ce19157fbe14325baf401fa0dd957ea4a8c7c08788851192b065a86579

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            4KB

                            MD5

                            f0918debd5acd25929b5d6b7dbbd7069

                            SHA1

                            ab28a7acbe28036a44f01abdd296650334e73c6b

                            SHA256

                            1881ef9183499e18018d4de036b3c350c2806effc1a905757e8f05c4bbae56d9

                            SHA512

                            a8ac28622e4d3335181a14e13a102bf5714ae4188df873bf7cac7ac9f643f441a5d5ac6de4f75533b81260bd6bed25aecaa56d277f108f1a3d9372d10814eb87

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            1KB

                            MD5

                            ef8045bff7229c47d3faaa7722034f50

                            SHA1

                            b3eb26f9b6b9f87802c4c42d99f7813d998cd27c

                            SHA256

                            267ad3303ed0d69507dff7dcf9c30be0699dd79a0baf1ba69e603a97b50b1981

                            SHA512

                            edab152c61545ebb9b193af594d71ca9ea5d79f2e409e1c6d99e588605b8920a85af6dc02c10b2b398c4d64755d5e816467f4afd7c224cfd6aa2967495ca9e57

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            4KB

                            MD5

                            cd8eecead20444bb922e111a114865bc

                            SHA1

                            0b5469182de212cbb34c8b8be11318807f85c777

                            SHA256

                            479e8fe0cc6eb29457c79570eb22106d5f8952efdddc693916b16770014339c8

                            SHA512

                            2ab4fda17e8d0b08f4deb06132370dce2c4f9b9b2f92b4f5aa8688fc965df3a0a66f0e2c9103973b44206b9701da55b77cc33811eccafcb1bce51dbb4f148356

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k1y5d1fh.default-release\sessionstore-backups\recovery.jsonlz4

                            Filesize

                            4KB

                            MD5

                            482708df2de67b752b8f7f0ffc4affbd

                            SHA1

                            5c107dba0011fa98097b29058a31eace2a728ceb

                            SHA256

                            59e3a28d0c2a53f95ed8f4c53ee46c3868a7c71f42b975ddcf30755372945796

                            SHA512

                            d59afd1afee729404ad9c80c57740bfa71c2c3088b17d2b79deb17c6ac71cb75e75720ebf8e23d8a9fcdf9bcfd29e7d96462472103d7b91240f333bb6936fd2a

                          • \Users\Admin\AppData\Local\Temp\nshB141.tmp\InstallOptions.dll

                            Filesize

                            14KB

                            MD5

                            d753362649aecd60ff434adf171a4e7f

                            SHA1

                            3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

                            SHA256

                            8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

                            SHA512

                            41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

                          • \Users\Admin\AppData\Local\Temp\nshB141.tmp\InstallOptions.dll

                            Filesize

                            14KB

                            MD5

                            d753362649aecd60ff434adf171a4e7f

                            SHA1

                            3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

                            SHA256

                            8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

                            SHA512

                            41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

                          • \Users\Admin\AppData\Local\Temp\nshB141.tmp\System.dll

                            Filesize

                            10KB

                            MD5

                            56a321bd011112ec5d8a32b2f6fd3231

                            SHA1

                            df20e3a35a1636de64df5290ae5e4e7572447f78

                            SHA256

                            bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

                            SHA512

                            5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

                          • \Users\Admin\AppData\Local\Temp\nshB141.tmp\System.dll

                            Filesize

                            10KB

                            MD5

                            56a321bd011112ec5d8a32b2f6fd3231

                            SHA1

                            df20e3a35a1636de64df5290ae5e4e7572447f78

                            SHA256

                            bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

                            SHA512

                            5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3