Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 07:43
Behavioral task
behavioral1
Sample
svc_host.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
300 seconds
General
-
Target
svc_host.exe
-
Size
78KB
-
MD5
eb821d20efb0c32d0bd3614a5e3b6262
-
SHA1
8a718eb6acde2e7c8a38903d104ddd13d8259476
-
SHA256
c1e6b4a0fbc8a4847fb5d8407153a88ab855de8b3ce5ae90d9b4fa3b5d357df9
-
SHA512
19121eebfbf91ae214451c86135cb988a2dc1d66f078c8c1d6bd4d1517862e0bd7fe09af5affc6fb0ea804f5247c67d38ac3c1bcbdb6dba9742fa51fa7021493
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gPIC:5Zv5PDwbjNrmAE+EIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIxNzg3OTI5NjU4MDkxNTMzMA.Gun2Gk.3qQXjIgklnHhehF2Rahn_w8VgV15V483p13AWM
-
server_id
1217879157267234846
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4872 svc_host.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 1340 firefox.exe Token: SeDebugPrivilege 2012 taskmgr.exe Token: SeSystemProfilePrivilege 2012 taskmgr.exe Token: SeCreateGlobalPrivilege 2012 taskmgr.exe Token: SeDebugPrivilege 5168 svc_host.exe Token: 33 2012 taskmgr.exe Token: SeIncBasePriorityPrivilege 2012 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1340 firefox.exe 1340 firefox.exe 1340 firefox.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1340 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 4436 wrote to memory of 1340 4436 firefox.exe 108 PID 1340 wrote to memory of 1784 1340 firefox.exe 109 PID 1340 wrote to memory of 1784 1340 firefox.exe 109 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 692 1340 firefox.exe 110 PID 1340 wrote to memory of 1948 1340 firefox.exe 111 PID 1340 wrote to memory of 1948 1340 firefox.exe 111 PID 1340 wrote to memory of 1948 1340 firefox.exe 111 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\svc_host.exe"C:\Users\Admin\AppData\Local\Temp\svc_host.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2220
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1340.0.844200615\1265675642" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07485867-a8db-4a62-b396-6db09f778ac2} 1340 "\\.\pipe\gecko-crash-server-pipe.1340" 1976 1d3aafdc158 gpu3⤵PID:1784
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1340.1.1410095613\1963065234" -parentBuildID 20221007134813 -prefsHandle 2364 -prefMapHandle 2352 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ee25852-c13b-4a15-8817-e0f5437fc247} 1340 "\\.\pipe\gecko-crash-server-pipe.1340" 2376 1d3aaefa558 socket3⤵
- Checks processor information in registry
PID:692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1340.2.1430170016\2104520590" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3100 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d3c1f7f-624f-41dc-aa42-1f3ce971ecb0} 1340 "\\.\pipe\gecko-crash-server-pipe.1340" 3116 1d3aaf61158 tab3⤵PID:1948
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1340.3.1792211377\695340028" -childID 2 -isForBrowser -prefsHandle 1028 -prefMapHandle 1104 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {976b810b-1952-4c9c-ba28-780c759f110e} 1340 "\\.\pipe\gecko-crash-server-pipe.1340" 3616 1d39e761f58 tab3⤵PID:5192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1340.4.2034656483\875799243" -childID 3 -isForBrowser -prefsHandle 4316 -prefMapHandle 4340 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {903648f3-1917-4732-a002-55657629de4d} 1340 "\\.\pipe\gecko-crash-server-pipe.1340" 4256 1d3b02dc758 tab3⤵PID:5524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1340.5.915622085\1105427084" -childID 4 -isForBrowser -prefsHandle 5168 -prefMapHandle 5176 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c55c0a0e-4644-404f-bb3e-6ec7954a8c8d} 1340 "\\.\pipe\gecko-crash-server-pipe.1340" 5200 1d39e72e458 tab3⤵PID:5976
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1340.6.604236659\171800177" -childID 5 -isForBrowser -prefsHandle 5216 -prefMapHandle 5316 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f442374b-1519-4bfd-b41c-0d23cdf1f96d} 1340 "\\.\pipe\gecko-crash-server-pipe.1340" 5152 1d3b13c4458 tab3⤵PID:5984
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1340.7.1170322613\1286592457" -childID 6 -isForBrowser -prefsHandle 5504 -prefMapHandle 5508 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1288 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {279b6e3f-4b80-4028-9e9e-f105968ae9be} 1340 "\\.\pipe\gecko-crash-server-pipe.1340" 5588 1d3b13c5f58 tab3⤵PID:5992
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012
-
C:\Users\Admin\AppData\Local\Temp\svc_host.exe"C:\Users\Admin\AppData\Local\Temp\svc_host.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD594960e47357987e2387d2586316e60c7
SHA12c99d55a0cbfb73f2081800421eb4aa48d7483a0
SHA256569be2ab63cc7279580ed02a7e09a12d11bf8b8076ef6053d7b0a45bac925ab1
SHA5129e40501a932b63ef70768dd9060994f84a622695bf8c9afa79c5d04ef6ee76cd000f5d64cf836c87e2f0101b7f8d3f055da1b31b98a9c45fb395bffa66448a52
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\pending_pings\351e179a-84ee-487e-9dc2-3f6c03f98f9c
Filesize11KB
MD5364b05b4de9124939f2ae56bb19e4021
SHA14d75ab8f051806a55be48138f35b280fe40a02aa
SHA256abedc63d1fa9c2efe6b6775e4d2cc5e99e7cb8ce7a6e2fbe5b2ae19d84bc0ad7
SHA5121ef6e55a10eb61271adfcf622dee18a65fefc134e15f23528c7303b8dc04cd43805355d0093b7bb2a88806cfc436f36bf2b64ae2795f9a80ff06919be193d657
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\datareporting\glean\pending_pings\e8064f9d-5533-4fed-b0da-745ca8b48d11
Filesize746B
MD51b4990ac929e5bf1aa952e30fa367bc3
SHA17fc6ce32d47646b04e15947d00dc4cc1d7980ddf
SHA256944121b5a070328a50038361c8993190b832609b23bf87e7ccb60c4e477d6191
SHA51252a55aa80dbafed53c345b0d7e135bce2a9d26b8ff0f7c05a0659500546d1093b12e1efee6b6d7a318350c32d08da7ce8df6ae1f6076858e5df24fc8b58e2207
-
Filesize
6KB
MD5373a869ebbc88dafb527739fbadc9930
SHA18680487b85ee810366b6f2bd9491ab1181d93669
SHA256068cf3131aa8e707b1e614663e3b6bc8fe67b37a1a6ba96739aaa5c32b12add4
SHA51299e5c963f6bbe9c6822c1491b4de223ce8aef5f7f18d355227ddff4d5c2e4631d094ba10dfb5f1e28eed01c4e80b94f3d77c1037d8ec908e29273d839764ca5e
-
Filesize
6KB
MD5f6e39e5f8ed82524bdfac8a3b3d3dea4
SHA1eed8315e00c678d3583c0cde8677b72a88d1ec12
SHA256cafd914e07ddbbdccd40cec4d0bbde87e75f9c913b5f885a69af493ba5c8dd0b
SHA512d763e31d5715146c1edeade3ee00a470596b6f1d1d8cea8b42d90b925a0b8d90385733414a0f56498ffae9cbc9c4efcb484db06dc3fb18cca8b3631dcc8e8d13
-
Filesize
6KB
MD54214b6a3945e6084590f58c3530cf308
SHA18f0c397f4c027658af2f54e9985b412c780dbf72
SHA256567cbc51ee36f21cc5650b3df061b1011a73ef055bf42e93cbc47fd9356faf2c
SHA512738d4ff994810764c49cf054e8b56cd0ac3e2477865607b529ca3cbce48ae0151b5f74937fd794bca52f0e3a2ba645ed46c2845591cfc05d036baeb7b6978dad
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xh4b7nwe.default-release\sessionstore.jsonlz4
Filesize879B
MD5fad6ba70afa5a1c7a60249acc56aba87
SHA1ea9ab4daa0d5e17a573c9b05d87532c74a36a488
SHA2564d8b3708606fdfa4a3ec42920117930debbb6e36e3ca71e1605e2033c3fe0177
SHA5127b537c4481a383ad8f5607c3d1071b31932814cd436397e1f44fc7de1b6055fe3b8d31c61e77ba33ae8081b3a2ca0f1ae0173f30b231d04ae891968796cb8517