Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 04:59
Static task
static1
Behavioral task
behavioral1
Sample
Install.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Install.bat
Resource
win10v2004-20240226-en
General
-
Target
Install.bat
-
Size
21B
-
MD5
d5f0fc9e8f9a3ee577d2eb161e8f1cc6
-
SHA1
96bae652bc27c60712888a48247c683a4bc93e28
-
SHA256
a426cb7764d384f490700bdfa7304c427bd2c9e5677d3e684eefe5ce587ee3e5
-
SHA512
4e6ddf9be6413e54b5e5b3e9962b982a07513ecdb3ad75cce5415cc033dc953f4070ccdce4114709027212b82900a4052b443fa5931058a6d705b3691835e916
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini solitaire.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft Games\Solitaire\desktop.ini solitaire.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MenuExt Groove.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" Groove.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" Groove.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" Groove.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" Groove.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar Groove.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" Groove.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote Groove.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel Groove.exe -
Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF} solitaire.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software solitaire.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft solitaire.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows solitaire.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX solitaire.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats solitaire.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}\LastPlayed = "0" solitaire.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\UserSpecificDataForAllUserGames explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\UserSpecificDataForAllUserGames\{00D8862B-6453-4957-A821-3D98D74C76BE}\LastRunTime = "133536564499266000" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings solitaire.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\UserSpecificDataForAllUserGames\{00D8862B-6453-4957-A821-3D98D74C76BE} explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2236 Groove.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1656 explorer.exe 1212 solitaire.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 1656 explorer.exe 1656 explorer.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 2772 firefox.exe 2772 firefox.exe 2772 firefox.exe 1656 explorer.exe 1656 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2852 2532 cmd.exe 28 PID 2532 wrote to memory of 2852 2532 cmd.exe 28 PID 2532 wrote to memory of 2852 2532 cmd.exe 28 PID 2236 wrote to memory of 1952 2236 Groove.exe 34 PID 2236 wrote to memory of 1952 2236 Groove.exe 34 PID 2236 wrote to memory of 1952 2236 Groove.exe 34 PID 2236 wrote to memory of 1952 2236 Groove.exe 34 PID 2236 wrote to memory of 1952 2236 Groove.exe 34 PID 2236 wrote to memory of 1952 2236 Groove.exe 34 PID 2236 wrote to memory of 1952 2236 Groove.exe 34 PID 1952 wrote to memory of 1964 1952 DW20.EXE 35 PID 1952 wrote to memory of 1964 1952 DW20.EXE 35 PID 1952 wrote to memory of 1964 1952 DW20.EXE 35 PID 1952 wrote to memory of 1964 1952 DW20.EXE 35 PID 1656 wrote to memory of 1212 1656 explorer.exe 38 PID 1656 wrote to memory of 1212 1656 explorer.exe 38 PID 1656 wrote to memory of 1212 1656 explorer.exe 38 PID 1656 wrote to memory of 2188 1656 explorer.exe 39 PID 1656 wrote to memory of 2188 1656 explorer.exe 39 PID 1656 wrote to memory of 2188 1656 explorer.exe 39 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2188 wrote to memory of 2772 2188 firefox.exe 40 PID 2772 wrote to memory of 1676 2772 firefox.exe 41 PID 2772 wrote to memory of 1676 2772 firefox.exe 41 PID 2772 wrote to memory of 1676 2772 firefox.exe 41 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 PID 2772 wrote to memory of 2868 2772 firefox.exe 42 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Install.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\system32\PnPutil.exepnputil -i -a *.inf2⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove.exe"C:\Program Files (x86)\Microsoft Office\Office14\Groove.exe" /TrayOnly /NoLogon1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 13322⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 13323⤵PID:1964
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files\Microsoft Games\solitaire\solitaire.exe"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"2⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.0.1840483029\1937750389" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {828fa51f-92e3-4c63-a41c-501fbf84d18b} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 1308 44d9758 gpu4⤵PID:1676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.1.1537843068\356880676" -parentBuildID 20221007134813 -prefsHandle 1472 -prefMapHandle 1468 -prefsLen 20830 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64cdd4f9-4daa-47c6-861f-b343169ea6c5} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 1484 d70a58 socket4⤵PID:2868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.2.283052998\1485832936" -childID 1 -isForBrowser -prefsHandle 2016 -prefMapHandle 2012 -prefsLen 20868 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9815e83-a2a9-422f-a649-ce8b1b0d0006} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 2064 1a051358 tab4⤵PID:1976
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.3.1114332734\534193265" -childID 2 -isForBrowser -prefsHandle 1076 -prefMapHandle 1080 -prefsLen 26046 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3659a2de-3d29-46ab-8e2c-7c069ac3503c} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 2436 43fb958 tab4⤵PID:2024
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2772.4.75529781\1126327385" -childID 3 -isForBrowser -prefsHandle 2556 -prefMapHandle 2484 -prefsLen 26046 -prefMapSize 233444 -jsInitHandle 868 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {864453cd-759b-401b-85bb-4c9af0932022} 2772 "\\.\pipe\gecko-crash-server-pipe.2772" 2568 d62b58 tab4⤵PID:2328
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{2BEF7857-0BAE-480D-BE49-4F3F3BE80C1E}.FSD
Filesize128KB
MD5fdd63c63fba0b4d85d58c059429efa75
SHA1fea7edda522beb25560f82af938d9390fdf7f825
SHA256372fcfdc5435a50b36ec3cee692e4f029c387282e40151d17a13abb70ebb0fd2
SHA5128e849446c00ece98f8bb28212fe8a8d1ad223749d573d0c5dca0f6b44ef42cf5f1cd74e127a88090e9237e78f8d9947110171fcbf3212ce2f03ab1ee6fa57891
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Filesize128KB
MD53d208a48bcba4e37806c1a8bd2916c1a
SHA1263ddf6479d090c8324346a0be42f7ea55f7d962
SHA256b4ea9c40e4ab86b6de55b7f4651222179ce683433084ecb08c11354077d8ba3d
SHA512ffeb93034a28751f144231446a439c54ce79af93acc6aa64b87ee6870d869461e104211274fd3bb69219d4b27ab18c0cb924d2c7f5eacefbea2acf81a3b5cc46
-
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{0648D01C-8FB3-4085-8E35-4F6101EC5B90}.FSD
Filesize128KB
MD5c9c559b0d9fff52d7aa0346da3ce151d
SHA146040685117c52212a33b965d425abe42f22fc27
SHA25692d5505a2605afbe553d00a0f38acb11b5b938fa8eae1c4950df2d88d5fbf01e
SHA512bd2ac66e5d9e4c1c50f7ef421877f79b150b90abbc8a63db32a21afb6a9c3b138b85fbee90f187e2009ac275e2113a636dea023e05f9c0b72a8d77c43b497c22
-
Filesize
560B
MD5cf0f31fa02ec7115aba882f1ebe4bce6
SHA1232f9b4b171e9a0a0ddb7900ac6ebe6f7889c3c7
SHA256e322cb41cd5d9f28184988f5400d831bb520e0c03adc3be283893ec26415492a
SHA5126b2beae2de1e9a1f28b4e881802790b6f05d09bdde8067a620aa34ae1598c8727ad162c5ef13b27905729d17b5ae149932a7aa97d9f1b8d0811ffb34baee7c77
-
Filesize
128KB
MD5f9f6fc433197c6857f7ad9b2ff2d333b
SHA1283f83a0f3c5daabb2ed2a9e2232697b6045a9d3
SHA256a05505a1e5e8feb46b1292da14b6cb7866fde6b43608b358fa0a7690e5d6470f
SHA512c689d844ed6334286357b2f0286e20b7b17cf1f6a2c3bd5f6fb0e8b097dfc460983f556efdd3c3d480d55d31b2f00503f5659d540f3b8d37ec75af0261831ff3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m9nu9nej.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD59b47fb0f4dba5a8bc1473d35c78352f7
SHA12e8cc39dcd8ad43b42e89928c868a085dd8854b5
SHA2568e022d9431b64dd7279eb3b9c790cddfbf4e126ddfe98408ee0cf4dbd478864e
SHA512ad7d04566257b42d4b9c7c14abef35dc56e4bb26351f7821bf871c486e43fff064bca182a59cf1a9da78f6f2647ea8e5d2279df9be465b8a4ca0dac77f69dc03
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m9nu9nej.default-release\datareporting\glean\pending_pings\5c30038a-1e15-4b7c-95c0-60afc38d182a
Filesize11KB
MD55e3b54bce78d82e4b9419bc979f651f4
SHA179c8813c36cda8fc6327f2e278e6e1ab4e462206
SHA256807e01285855164d92ff8ef690a1f0259554ec212d8972001213407874afe834
SHA512a6a14738cb748b5b03aeffccfcd396bdf55ee25d88b241455bb6599bc1b0c79a63c7ac4438752693a85bf87f225f00ab86f659a764813cb1f5dc1f6bd57da5ee
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m9nu9nej.default-release\datareporting\glean\pending_pings\7d44e463-b595-4fe0-82e4-11f1c3886549
Filesize745B
MD56b3d7b3c7f34d826c5a3e0677cac90c9
SHA1d1d2e30be277f4e0b23d901ed41cfadb67586073
SHA256d40f1716d5fa50be60b96fd0fe6f2ef84012f41b86768782b57755bfeab423f6
SHA5125209ba2fccd5a3d39f816ac4dd6e85e1d2b6bd1145a43448e762b0bd9ba2ea276131292b89910327286d24540ba85d402fa6449dbb929828d7c60c35adf4b063
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m9nu9nej.default-release\sessionstore.jsonlz4
Filesize832B
MD540f7d02536ff9d73290a6c56b57660d5
SHA18198d22986720141860c9dad14306505efe9e6a2
SHA256055cd88bf664d90fe8b96fffbea1ae4a0a2e5e3fe057c556f98789e8151db541
SHA512b1300dc1a3fcf23e600149e24d31f40e40bee76e1e298dc650dc7b5a526f20fa24c4177d7f873f5983c2a3f258a6a457664127fb61f412c7cce13e14b8b947cf