Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
23/07/2024, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
image_2024-07-23_204848213.png
Resource
win10-20240404-en
General
-
Target
image_2024-07-23_204848213.png
-
Size
40KB
-
MD5
f742671bb7f80427a677862d3f72f483
-
SHA1
e06edb3197478a7794d86d2a06d96954715d800a
-
SHA256
9700c7f7ff2176ef68f788803bdaf06e0c3195ce4f77c11351ca8f6d93c0a79b
-
SHA512
30dd59372e0d95e915e7421f2380994b8ff4e795ce61aed358359ca36ff0224de86f95007cb1359d927a3000095e30ef4e265363392cdd6afee6110d5a39b025
-
SSDEEP
768:Ctg1utJmCCaeajfJ5iH24KVpCctyzm5kKPklmABgXU:C5VfHiHhsp5tp5nG/gXU
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5048 firefox.exe Token: SeDebugPrivilege 5048 firefox.exe Token: SeDebugPrivilege 5048 firefox.exe Token: SeDebugPrivilege 5048 firefox.exe Token: SeDebugPrivilege 5048 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5048 firefox.exe 5048 firefox.exe 5048 firefox.exe 5048 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 5048 firefox.exe 5048 firefox.exe 5048 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5048 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 3724 wrote to memory of 5048 3724 firefox.exe 75 PID 5048 wrote to memory of 3116 5048 firefox.exe 76 PID 5048 wrote to memory of 3116 5048 firefox.exe 76 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 508 5048 firefox.exe 77 PID 5048 wrote to memory of 2852 5048 firefox.exe 78 PID 5048 wrote to memory of 2852 5048 firefox.exe 78 PID 5048 wrote to memory of 2852 5048 firefox.exe 78 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\image_2024-07-23_204848213.png1⤵PID:4872
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.0.1462471685\1859552012" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eeea86e4-3147-44f7-929e-17e7f5a43e69} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 1796 18b291d8458 gpu3⤵PID:3116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.1.706922507\1604663383" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e90f431-5ddf-4de1-b9ad-2dd4755650fc} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 2152 18b2910a258 socket3⤵PID:508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.2.137386647\1836759192" -childID 1 -isForBrowser -prefsHandle 2660 -prefMapHandle 2896 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fe4a3fa-b7ce-428f-b5f7-e76aa286a784} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 2908 18b2d59de58 tab3⤵PID:2852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.3.1765756450\422879083" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3420 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f374e060-55e9-46d3-a140-86cca2fa3815} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 3360 18b16e62558 tab3⤵PID:3100
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.4.222170598\619181282" -childID 3 -isForBrowser -prefsHandle 4272 -prefMapHandle 4276 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c303f378-f0fd-48ab-a6e6-cd635519137e} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 4312 18b2ebe4458 tab3⤵PID:2084
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.5.586924882\72098426" -childID 4 -isForBrowser -prefsHandle 4904 -prefMapHandle 1592 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {395e98fa-80c8-43c4-8d6f-da679da988a9} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 4864 18b2f4ec558 tab3⤵PID:2884
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.6.487278088\1667881103" -childID 5 -isForBrowser -prefsHandle 5116 -prefMapHandle 4892 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1816016-06aa-4942-8937-99e75ca5136d} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 5108 18b2f7b7658 tab3⤵PID:1448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.7.444277975\36746256" -childID 6 -isForBrowser -prefsHandle 5224 -prefMapHandle 5228 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3550a815-b0c4-49cf-9a69-cd92654fe815} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 5216 18b3002fb58 tab3⤵PID:2304
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5048.8.261166635\1961635947" -childID 7 -isForBrowser -prefsHandle 5596 -prefMapHandle 5592 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd68fb8f-1e94-4e04-9aea-28e7c26b11fd} 5048 "\\.\pipe\gecko-crash-server-pipe.5048" 5608 18b31598958 tab3⤵PID:1384
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD53a6a6f4ba32c81353c3ece3a80f3eac5
SHA1d3dd925f1b5401869232480446d583962db161b8
SHA256f60b4f17c67ff4183a1ace1dc37063f2b2182f1d4eb44eedb80fff63c188b272
SHA512ef77ae0fd17127c73bd3412c7dc3741f347e21e3d6b982ba86c5205ee31bf284c79b8cd0f78304804d10d2ce4633749bdb5e69a39d9378709ef36e92d3b666ce
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\84702131-eb15-4384-a169-b3aa1f61eb65
Filesize746B
MD52ebdc2734b2b06beebfb2742c38ef2b2
SHA1b4766383726a4bb6f041454fe2821d1f477e58f5
SHA25679a92a994bd4277b249f03848d7f8087f2b49974b67244af33fcd17a76afab19
SHA512121c557b87be684d2c657b89c199322856db0fe472d70c3539c87fc946dc7bc5e37f7de558b17d6a3ab6581ff0d20b5c233b9b4b786b2501a7a99764ddd431e3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\f52dbcff-12ad-4753-8928-ea0846dbc765
Filesize9KB
MD5385a9744fa9373e6b0c4fa507463b230
SHA1b2708c3b2ca72559ef6f9e9afd96a1b784f5d65a
SHA2568f4c0fddb7a7f9480cae534b0666c2709959f30a06514addf8347bcc52c2a546
SHA5124755363991434d948c07cb52524106fdac4807d28d5e9016403b51c24e5062c421224e36f7cabfe7d62a87ab3952e4c50eb31570ede8913ef55b7f3a46ed4709
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
6KB
MD5dd705e04632a9e909c2dff57288e4c19
SHA1ed0ee26059a28d72b9a2249f2a7631344388cae4
SHA256dfaede46a5b2b81e82f88848e552ba0036642fc01b9c47bb92c14cbb95222010
SHA5120412dbd99e486bc92d996b636359fe832ded4b750276aa9572929be9529acd35a79eaa823798522e73cbbd202ec869591e2a4b3aa05672569b8c8e575ef477df
-
Filesize
6KB
MD59b3be0d6cbd63ac2a7acc636cdb43016
SHA11980b85ba19b5d1dcacadcd909c29669ca3c3051
SHA256a2561a653c28cc58959a645e3ce08fa5c8666dda227977623d75d357df6dc60e
SHA5120199dafe0275fa83940682780039ae96de90c8d87e89d4e8b6c0215650abd6d33fec00f9f374ff53d7652051aac65a55e719448f246c4b68a1e7b97c2541b9ab
-
Filesize
6KB
MD5e21895082198e9dad2d10cb5e243c4a2
SHA14c7cdc533db34d224c017747f88ca923545e51ed
SHA2569f4e67d516b119ccdfd2c052816baa31058ba25a0369f4ece2f835944c62ce73
SHA51228bed6b9eebb87135e93dc0b11aee2f0e3e21ec43d28735f5b71e4749f310ff5eb688f27ee0f3e0beebf2a60b7a69c967600a86e7ef905da01b1ccda00a07085
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD552474dfcba1087505fdd4f057e7d8457
SHA171a0270c693d19011426c8833bdf035656bfd681
SHA256a418d114d8bd893c70181b2362bde582f74fabf50bfe079a69991306b058397b
SHA51248aa8b0c3eea8df0d14185f0cbb9220016462b888cfef9b9bdb4bb1e9adbc78836716eabaa0a8a4fcf9e41a10542cb527d1fb517cabb48e530b1ffdc313b6f98
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5280ea04cdeea7a3621715057b15c7d90
SHA1d3ef7a4abb5b88b07b745e492e1cd4699b58bea7
SHA25639efb7b9e96d302e941ea08c2b27c0e48b3504f436648a83dbdaa0b3ea44f9e3
SHA5123e284ff885bd8a8b342843e84f68bd097590787e981f252afab2f33f9c0c8e91ac4610bcfde17b1ad4f4768f2fbac3b4f25697c8a55cc7542924a3bedfae325f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD594b10d771188cb684e023182b2df17c6
SHA18a50549d21e127c164321e29b1b43dbbc4571705
SHA256869edb623828c26df9bf6255b1d152d93db07be71527fd28fdf108f913e485aa
SHA51217d0ffb8de34bbbaf1a01755a43a260fe542ea0ae04a2070ac0052fee24ba753bdf21f328e099535e3c63285095ceef9dfcd6a393b3e0d40dbe57511929c2481
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD558ad2d8941b6ffd6e7fa17f6a52d3cea
SHA1bd25a87a49b92f9e8dd41bd0441b448f196d047e
SHA256a3eb6095d244cf2c537b38877576b339cde9c311f6e7b7ee618aca1a617de2ca
SHA512b5062df45c25fdb5d7a19a14e5a6c252d9d305e895b0c1f63ca0e167cbc8f7debcf213603163c7f1ccb626a404675abb0ffd15e2731b5db54e81abb4b3a2a5c0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD566d0ec2b9d9876b4c63edab68aee8c84
SHA1f70074307024e1fa1505b8e7cec39967e7ba66e9
SHA2560c56c809c7b109cf9cb55c073372c9b48ea73e6a5d139ba7cd8886ebd4ef445e
SHA512428ea61c410813b6c2bc45843c956f8c387502f47e7a99a62aa0d423165b5448f19e3d1bce153f95dad9d920c47d4103eb57e2e65fd7ce450a5827f9975e09e2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD57f868e557b098795d645df9ea302427f
SHA1001f3306144559b4049a8ab139b4139f51e59c0e
SHA256b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5
SHA51256fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a