Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    61s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 09:58

General

  • Target

    testestestestetw/triage - Copy (7).exe

  • Size

    1.2MB

  • MD5

    08b8eb8dd9681bfd0050fa7e547e1fd9

  • SHA1

    f810b716884668bbc554aae7914dd19f1c30c265

  • SHA256

    e8fec48d4400319a802dcc42081e768ef0bf8ec965e65d95ec4502ea3c35ac6b

  • SHA512

    d0fb222a0b356abce4f8489e953db9c9330e2446007eb002a7c7db3022f931fb22d5686da5749ea03504cffb241e21768512c9c6d20156fac32c81b0070c878f

  • SSDEEP

    24576:bdofGAmSIQ177wZ+A7MjiiRDXU/Sat5RgsLSmIOHsU5zMmX1xYwncqKvGqU/:bdofGbSIQ177wZvYjiiRDXASat5RgsLn

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (7).exe
    "C:\Users\Admin\AppData\Local\Temp\testestestestetw\triage - Copy (7).exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2884
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.0.2091679634\67787284" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52257c6e-0db7-4b3f-a38d-444480ce055d} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 1724 203c5605e58 gpu
        3⤵
          PID:4788
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.1.1249634147\988025208" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2356 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cee46b38-8b46-4b1e-be52-9d8fb749a2a0} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 2380 203c41fb158 socket
          3⤵
            PID:4940
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.2.928185914\2120903370" -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 3056 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60654761-e171-48d7-b759-203977a4a025} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 3124 203c849c458 tab
            3⤵
              PID:2548
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.3.1381018225\956737899" -childID 2 -isForBrowser -prefsHandle 3584 -prefMapHandle 3580 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8413b6d4-db96-475d-bd2a-c6105bd6019f} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 3596 203c9219e58 tab
              3⤵
                PID:4584
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.4.1912203752\1472541498" -childID 3 -isForBrowser -prefsHandle 4460 -prefMapHandle 4444 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27b8ae94-da99-44b1-96f1-c46a64204c28} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 4504 203ca09fd58 tab
                3⤵
                  PID:4468
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.5.345312697\256811932" -childID 4 -isForBrowser -prefsHandle 5180 -prefMapHandle 5176 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad4cc150-8890-4903-8a25-c930b7c3a5ea} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 5192 203caa3c558 tab
                  3⤵
                    PID:4144
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.6.1422836747\1995425612" -childID 5 -isForBrowser -prefsHandle 5348 -prefMapHandle 5352 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22366185-b461-4c1d-912f-c5f06211d722} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 5312 203ca5b9d58 tab
                    3⤵
                      PID:1688
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.7.1938572070\930908969" -childID 6 -isForBrowser -prefsHandle 5532 -prefMapHandle 5536 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15f94432-bef6-4aa9-b6da-b34c9c82a62d} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 5616 203caa3a758 tab
                      3⤵
                        PID:2612
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.8.2061482313\499127454" -parentBuildID 20221007134813 -prefsHandle 3536 -prefMapHandle 4192 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4194b54c-14ac-42e0-a0f6-ed443931e4bc} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 3544 203cbb23458 rdd
                        3⤵
                          PID:5496
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.9.2143383131\1716525319" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5888 -prefMapHandle 1644 -prefsLen 26206 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {577980c2-feb4-45ec-9113-49eea5cc1aae} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 5932 203cbb22b58 utility
                          3⤵
                            PID:5512
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.10.1994729174\1445813737" -childID 7 -isForBrowser -prefsHandle 6116 -prefMapHandle 6112 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf2a8e6b-8c1b-465b-ad0d-6451c33ec40e} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 2876 203cbcf0558 tab
                            3⤵
                              PID:5660
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.11.608427289\841384323" -childID 8 -isForBrowser -prefsHandle 10160 -prefMapHandle 10164 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01b45411-2288-4e1c-850a-d57450c08c76} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 10148 203ca5a7858 tab
                              3⤵
                                PID:5212
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3928.12.266861734\813408077" -childID 9 -isForBrowser -prefsHandle 10012 -prefMapHandle 10008 -prefsLen 26460 -prefMapSize 233444 -jsInitHandle 1388 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2393cc43-fd98-40bc-8ef5-3e922a5d902c} 3928 "\\.\pipe\gecko-crash-server-pipe.3928" 10020 203cbb88f58 tab
                                3⤵
                                  PID:3496

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\cache2\doomed\22751

                              Filesize

                              8KB

                              MD5

                              479e21f470f47b385df8afdb1e2c71f9

                              SHA1

                              246fcfd16dbcc3aad5c0051ecb937309a63f51b9

                              SHA256

                              c2d7dba8011d5ea45f20d3454ae722e05fdbcf4d92b0812e5d8dfec6b96c5c1a

                              SHA512

                              3b6d76856d1cfeb890d7d7d46d54051370e32cbe75f97c9cbf88ba860e59b930795af8e9361c0013436c7b7583b6dd978cac172527e3dacdbac6588edb250ada

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\cache2\doomed\24120

                              Filesize

                              8KB

                              MD5

                              3fd489018a045d9424ce339d5a55a746

                              SHA1

                              f99df76da7e1a2b30a4cdc3b3e0aca10b2df3dc0

                              SHA256

                              a107557a9764385729f36ba9bc641706cf43c212fb3d63d420cf3e04dd174d52

                              SHA512

                              1f283e0e10e2c60aa73b87072b46ecafffe2e0ba93e3dd5f0678be2e3ea196e13f05d85a0c1214c50a96537e3b4f5ca9dc4c47bab4d2596bfe979c4ac9f89f0c

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\cache2\doomed\30303

                              Filesize

                              8KB

                              MD5

                              293518136d95a0813be7197d3ac3045c

                              SHA1

                              58a75001a11cb88b2f6b2efaf74ab04ffa05de7f

                              SHA256

                              77f560523e46083998d930e97dead544dbd0ef1156f605b43d8d24450198166f

                              SHA512

                              826ad3e4222dba412730826808f72903b101fa49907202916617f51b67ad459ee49c1580182c650c5b66c6abbd7378a512609c0f13c1429cc5d00cdbbbd0e121

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\cache2\doomed\31673

                              Filesize

                              8KB

                              MD5

                              a97fe78e4b95c53eedbeb362ceb9e133

                              SHA1

                              493f15290ee5d6eee3b0023ea57afa04971523ed

                              SHA256

                              bde49e54c7ddb3fa0c2d28f505796c70b9e17588b519d642c98176b4be8780ff

                              SHA512

                              864cd63c727953795119d9bec04fb0f55e6cdd0ae0772aa4b1bc7e4ade21adc06465f736fd4b800403cf2467ecb5b1c3f36bf80139cdaee3feef5867d190477f

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\cache2\doomed\5738

                              Filesize

                              9KB

                              MD5

                              8d330ed39e9738e1d0a5d20a20262730

                              SHA1

                              0b165895184f0c2514ee44a70d242cf73a85f0d5

                              SHA256

                              17189b87729cda70e1524d249be07b4b1b892670a8ccd1102dd16446b95df934

                              SHA512

                              cd0d9436adb871aeaa5600e5fe03db143dd92fb116cf5808057920599eb4367892204ff9487d58982525681a254cb54ce20b1d78439fc6dd8b6609d62fa0bcb5

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                              Filesize

                              442KB

                              MD5

                              85430baed3398695717b0263807cf97c

                              SHA1

                              fffbee923cea216f50fce5d54219a188a5100f41

                              SHA256

                              a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                              SHA512

                              06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                              Filesize

                              8.0MB

                              MD5

                              a01c5ecd6108350ae23d2cddf0e77c17

                              SHA1

                              c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                              SHA256

                              345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                              SHA512

                              b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\db\data.safe.bin

                              Filesize

                              2KB

                              MD5

                              0328613dbf975abaa48d7ff2418cb792

                              SHA1

                              c1b72af59d44c2b6d29f93ddf53ba2769b735f72

                              SHA256

                              7b047fdadddde55de2f182f021e54ba59a1671563e00998835f880e4385224be

                              SHA512

                              faa9fac55156425389a71dec217a55a930cc97f0df862a29f3fd5da9ac775eea799ff2997c6dab0280b5a4c424e2cd65db7ffe49e2ce9cdd2f06ca344f534539

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\pending_pings\1627c24f-7514-4ee1-aabf-74d7ec4549b2

                              Filesize

                              746B

                              MD5

                              48e8c2d9d0b452ebebd20b56fb777aff

                              SHA1

                              b5b0c8914fcd60a69420312428fc4348b09ac7ca

                              SHA256

                              d5bf08fbd3f085496b85ece5c2080a050d0be4604e4b69723cef0533c22be719

                              SHA512

                              014a65359797ff72ec7e2f168aa96d4b86c7663b39f96c527fb011e15d4e3a2f3cd2e404f116186f0379258f63b7c4a3c116113de3f0f770f0652c4b0c770dbb

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\pending_pings\7a22b2fa-16f9-4a14-a30a-ebb1b1b5250e

                              Filesize

                              10KB

                              MD5

                              0d3fc6b9fb934c4c54e09e8806c5ac03

                              SHA1

                              f6f74d8ffdb3d4f1ef664a8d7b28a0b45bb29ad3

                              SHA256

                              d1bad13e9d57436edb9ba79c3122823e25acb98c6b59308c872cc5df254e220d

                              SHA512

                              15b6f591b2cc4c2dd613a4f1b3488f12f0fffcb8514855d8bf210ed31afbf8545ff13da150f3e766c79e961d6ec82d8b1a5c6fff314ec3c6737bfbb7c59318ba

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                              Filesize

                              997KB

                              MD5

                              fe3355639648c417e8307c6d051e3e37

                              SHA1

                              f54602d4b4778da21bc97c7238fc66aa68c8ee34

                              SHA256

                              1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                              SHA512

                              8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                              Filesize

                              116B

                              MD5

                              3d33cdc0b3d281e67dd52e14435dd04f

                              SHA1

                              4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                              SHA256

                              f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                              SHA512

                              a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                              Filesize

                              479B

                              MD5

                              49ddb419d96dceb9069018535fb2e2fc

                              SHA1

                              62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                              SHA256

                              2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                              SHA512

                              48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                              Filesize

                              372B

                              MD5

                              8be33af717bb1b67fbd61c3f4b807e9e

                              SHA1

                              7cf17656d174d951957ff36810e874a134dd49e0

                              SHA256

                              e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                              SHA512

                              6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                              Filesize

                              11.8MB

                              MD5

                              33bf7b0439480effb9fb212efce87b13

                              SHA1

                              cee50f2745edc6dc291887b6075ca64d716f495a

                              SHA256

                              8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                              SHA512

                              d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                              Filesize

                              1KB

                              MD5

                              688bed3676d2104e7f17ae1cd2c59404

                              SHA1

                              952b2cdf783ac72fcb98338723e9afd38d47ad8e

                              SHA256

                              33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                              SHA512

                              7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                              Filesize

                              1KB

                              MD5

                              937326fead5fd401f6cca9118bd9ade9

                              SHA1

                              4526a57d4ae14ed29b37632c72aef3c408189d91

                              SHA256

                              68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                              SHA512

                              b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\prefs-1.js

                              Filesize

                              6KB

                              MD5

                              dfaa7922a491a56f2a633f48dfaeee5b

                              SHA1

                              f9f4dfba73da12a417961a6d0e8fb006b7dd8e12

                              SHA256

                              c6d997d4dbbec38dd66521c4e397c810dbdf5228030c3ae5bb052d3aa00aeeb9

                              SHA512

                              4d11046f2faf061f0220343cce9881d1006bf86f6882ea27299a8538815681cb3413d3ec59bbe4c48e7628917b7ade29011fc3a454e1ac73f5ddf22e47337a1f

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\prefs-1.js

                              Filesize

                              7KB

                              MD5

                              1ccf528ffe7a55c38e532eded53aa972

                              SHA1

                              9cf3ba66ff288a5b56a5346c7c6c5735bba2bc38

                              SHA256

                              951790e9efe022801ec9b21adb0d39095ce4f2721eef8decd6108d7649dd1b68

                              SHA512

                              f4723d0cea18ea7401cf03c5d3bb28ba816ae8c1c7fe3c03bad75f63483f86a54b752eb7a692713f36fa7166394266f087737cad7f1567bf06b68490a7339f1d

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\prefs-1.js

                              Filesize

                              7KB

                              MD5

                              9e6d2937e3deaf0082450679f33f4102

                              SHA1

                              39fdae6ade6da5b4ef32e8b2d04d4386bae14a4f

                              SHA256

                              ca648d300df7041ec113b17ef4519c7f139b01d65aa33406d3f1877bc148d07e

                              SHA512

                              27a74b9794d0308d6399cb43ed4cc80d5214618d8791900b6947f0df30870d192911c160f84a57fd14a41e3404a5c9fede1b5a3f12ad71852f2ab0c00a0ff05c

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\prefs-1.js

                              Filesize

                              6KB

                              MD5

                              d47bdd022f9c9588c9330fe524115d8a

                              SHA1

                              9e8581829cbdef523a8f94e6606ee7df79a2623f

                              SHA256

                              96b27e410fdc018ebc3f40bddc2b0b50679a33cd2e182d4a7492c5e0583fa498

                              SHA512

                              e5d4863b0144703332ac751ad48e0cab32737f448728110314c8c09502903dc2126dfff3aaf019b775411534144562d6f40c15e33a4a4caa10826937c367e98f

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4

                              Filesize

                              2KB

                              MD5

                              500abb22261b739cd5492563b65f418d

                              SHA1

                              d5035c241814b70985aef53ed3d6ab8694b26d87

                              SHA256

                              adfc07d978e5830c052052df7f719689efe8525a49638e54423cfeee0a5ebd84

                              SHA512

                              b7c0d9376e696beb70e360b22e58528da2c0806a4db62bc57faebbc92dcb9408f91be5d2cdfd8f06dbe69b1f802d5dd37f2291626ec4766b0cdd02fb86c0ed65

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4

                              Filesize

                              9KB

                              MD5

                              43620c1e11db034173539815e4a6142b

                              SHA1

                              91542b5a8b38e691b1eedd89391c023283f57ce8

                              SHA256

                              72f337acdea7f657611d137863c5407cad3f1573ee7bc4caa4014da2782e73a0

                              SHA512

                              455cd45a05796ea9f1572610abc4d6ef690398e6b2ae727b8a131344f3e73423e298dd440c437e5fc6d3a37d3d93c3ff1fd54f9255e52368626b99c6adc55cc5

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore-backups\recovery.jsonlz4

                              Filesize

                              9KB

                              MD5

                              cd4b05b451f1e059e4be5cb8428fc496

                              SHA1

                              ae1b43c7f29047ec4d7343897def3afe1fbf7e59

                              SHA256

                              55163592206f0f03598c09f11a49eae147786636a34167ac3b7661bd10052ee0

                              SHA512

                              485c631fb2084b39e75f1523a789d34385fe6a0f62937f14df1c8d249a203ee529294dd29fec4eaa792bbb872f854b43bfed5491409731968d5159856d9a5d0f