2205d416f69c7b85d925f38b98a2a1cc37b957367a05f2d8af641fb8966192a4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/08/2024, 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

excord.js
Size

93KB
MD5

c8a7c9b07c549b8101507953d7dfbc97
SHA1

25ad0cd00063771cd45c6131aa43997a6dec0f8d
SHA256

90be33d3da80b38f15055b3881ebadaf8559cd91902b92fc3ed07bb2a466da5f
SHA512

fb5b79cd208cf82b69e5fa0e7dee3632d6823a4474ce0b600eb6a85cf33815e7cfbc0bf01054a218c40c140dc61fe7a6b6f3e6f5b69fda61b3ec172c011049b6
SSDEEP

1536:vJSMqH+1+7FzaLiphqSXImzf58ytH9fJFZJn9HnRJK:vJSMqe8Bii7tzFdJNRA

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeDebugPrivilege	4956	firefox.exe
Token: SeDebugPrivilege	4956	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4204	wscript.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4956	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 1080 wrote to memory of 4956	1080	firefox.exe	75
PID 4956 wrote to memory of 3396	4956	firefox.exe	76
PID 4956 wrote to memory of 3396	4956	firefox.exe	76
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 1188	4956	firefox.exe	77
PID 4956 wrote to memory of 952	4956	firefox.exe	78
PID 4956 wrote to memory of 952	4956	firefox.exe	78
PID 4956 wrote to memory of 952	4956	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\excord.js
1⤵
- Suspicious use of FindShellTrayWindow
PID:4204

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.0.1717616244\1866019780" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37de8c36-6929-4579-a9f1-fc37fac697f7} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 1764 247b4ad4e58 gpu
    3⤵
    PID:3396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.1.1165317109\1856648767" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0861c40-e739-4059-b326-e0876b180aa0} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2120 247a9a72e58 socket
    3⤵
    PID:1188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.2.1200476089\797444348" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 2920 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8b261c4-9ae2-447b-b847-871e9bcca8cd} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2936 247b8db1e58 tab
    3⤵
    PID:952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.3.1714741484\282686105" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72fbfc19-4a76-468a-bcd9-308725b8952a} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 3524 247a9a61358 tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.4.334888171\333772213" -childID 3 -isForBrowser -prefsHandle 4220 -prefMapHandle 4196 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c3799e7-e045-45ba-89aa-fbdee31d4e2a} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4184 247ba36d258 tab
    3⤵
    PID:1400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.5.580776867\942222166" -childID 4 -isForBrowser -prefsHandle 4996 -prefMapHandle 5004 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {065c2195-d310-462d-a90d-8a86e131b559} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4992 247b7372258 tab
    3⤵
    PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.6.294070312\1101927301" -childID 5 -isForBrowser -prefsHandle 4908 -prefMapHandle 4900 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba813dc3-e92f-4a70-8af6-411795a42c3f} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4928 247bb329458 tab
    3⤵
    PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.7.1340093705\1877935334" -childID 6 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abaf9d80-918e-4dcf-8d2b-ff6993393c96} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5192 247bb32b558 tab
    3⤵
    PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.8.1004590715\467198264" -childID 7 -isForBrowser -prefsHandle 5600 -prefMapHandle 5596 -prefsLen 26514 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e14f0e02-ff16-4575-8c18-c585c3656ed4} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5612 247bb3b2d58 tab
    3⤵
    PID:5108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.9.122125769\1183636148" -childID 8 -isForBrowser -prefsHandle 5788 -prefMapHandle 5736 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {994f2850-03ef-4f66-8b92-e39b6d50d03e} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5920 247bca13158 tab
    3⤵
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.10.145151645\477246046" -childID 9 -isForBrowser -prefsHandle 5264 -prefMapHandle 5452 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2a420b5-8bd6-4656-92de-e901897dbb66} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5196 247bd3d3858 tab
    3⤵
    PID:648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.11.1536294318\1317316393" -childID 10 -isForBrowser -prefsHandle 5316 -prefMapHandle 5300 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec75a155-d569-4421-b2df-4d0167327ece} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5328 247bd498258 tab
    3⤵
    PID:4860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.12.1262531192\1055994456" -childID 11 -isForBrowser -prefsHandle 6448 -prefMapHandle 4384 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {437b1244-43ee-40be-99a5-bbc0e9eb374d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6156 247b8d73b58 tab
    3⤵
    PID:5404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.13.436020583\1702140156" -childID 12 -isForBrowser -prefsHandle 5932 -prefMapHandle 5944 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82fe915e-562a-408c-a5a1-219a2fa4df36} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6028 247bca0b258 tab
    3⤵
    PID:5596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.14.532131108\1893062510" -childID 13 -isForBrowser -prefsHandle 6424 -prefMapHandle 6420 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06f02520-f501-4bdd-a8a9-94e55cb13b4d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5412 247bc960358 tab
    3⤵
    PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.15.1845422189\1913478673" -childID 14 -isForBrowser -prefsHandle 3772 -prefMapHandle 3776 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {803ba5c2-82fc-4e33-8f9e-c4beaeb14b8e} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2728 247bc961258 tab
    3⤵
    PID:6024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\68BC2ADA259BF925235C7E6BF89FCA3B60EECD19

Filesize
60KB

MD5
54c40c9cd190a0118fb02e0c3fba701e

SHA1
624076d806b12f8c72c6a21a7403da8881debacd

SHA256
0d4eaaa4a827fdb0b9e5bee9764512f23f4da1b614b4f45f0b3f6e7546161d36

SHA512
e03f70157dd9954d18ec75779918b5e801dd76fd36080743f122a7b436f87bd5016ea696bf1fe0cd0617fc1903590e6c5232566e315b87ab5afcefb95622eb59

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9357B92D7A82DC731CBB46EBC4F197AB314C7C11

Filesize
218KB

MD5
e2ed23d94778f5f3044caf19f810c14f

SHA1
a097a130ef5c9eb886c1387418ef82507ffee5f2

SHA256
b4762244ce232c2d1477db827d2e97d5245bdc0119f8a31766259fac7cbf0f7f

SHA512
3213c865d5091cfc5700632bfdc67f4ab779a3bb8a84717fd5f46e34935070deb026fc1e1315eadd31483e8b9d16db8905bfec856c117b41945b4df6e40befb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
1f87e88e2c832c5f8c47227572e90743

SHA1
829ad1294759246e81a3ad816f46f16fd70eb7f0

SHA256
c83d9f2c588521721563052d019fe347ee7b22763e3d32b33fd21dd934bd3394

SHA512
1f037f79dce5468b15a3f529df74346ef9deb24f7b9a2ebea8c4f781d66fb4dd172e14d7208e418ef0d47aab9d0365c8cc148968a970a6634fde2e423518ac79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\931c4bbd-19d0-4100-81a2-820c8d037b8f

Filesize
10KB

MD5
89be44b0c429f77702504b0363404a07

SHA1
d5b3d9e30e761d2cbde752095d8add8f1c1bf401

SHA256
ee9688343dda7ef07412389da846b2ed1103e12f96b54e48955f19607bca0a6e

SHA512
51935ffc8cf8409ecb91691e22a9ead20d5683e43261e3c71551ba6eb4541757ed73328c22ee57a6926465a02242fc3304d6f5eaed55dafc872dfe13bcb3afbc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\b588b78a-0082-41bb-b726-985216335edd

Filesize
746B

MD5
dba365c75cc02d5190fe7b029c1a0c8d

SHA1
c188bbe866d51e6fb6b39d89fa8700dcac325b4c

SHA256
2bd7a25058660e467aea6db641aebc419dcc7bbcd03119de5f86305cfaba1f1f

SHA512
4cda3b55be8a26dd3b305c410580146a59598e957b854bd276e424e6e930bd10742aa247515fce4328140fcd5a86a125bd2351bc81f49e1e7560bc2589c29915

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js

Filesize
6KB

MD5
ac49a7f883c6fc15366ed5ab49bedb26

SHA1
d4377d0c10ee2de944d07d8151db1b817a4e3b67

SHA256
6914726563410dace4994e43fa520894e1d7ae144a8069027486a73a1f534434

SHA512
a17db6e0311587624bf2a0f82f9c9432e331b9a3f007e807229a55a05752b83b5f5e80753a7ee30413a024ef531051e47c46dbf859cccb4ee2700239640f3111

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
af5dee26f139c714cb195f7426a79e05

SHA1
5ce0ee1ce91abd015fa9249d449963ac416e721f

SHA256
c367b28e0c1195fb2c9094404aa1fe7f3dcf77e44325791f79c6ca080da28770

SHA512
31d91d03b0c674d92b7fccaf9df6d67d6015c8d53e5b215ce072e3c413ad6a6684e79fa692933d2b90b4554f37183cd2062c39a2ba069aadeb513b033ed0710a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

Filesize
6KB

MD5
8272154d06438d863537716fa68423ea

SHA1
5354d7f4917cb8b2fbd27a812057049467da68ba

SHA256
e6c6b4596b9123ca4a1378ba633fa13d700876e220b4ef4f10ad591e945cca82

SHA512
dcc6a4fdde0aae8c197c3cf05521445575da2a666b8ac4ab68c3df3cacd5d5680288c26f286a8eb1c90276ccc58b6ea2d4e71815b2ab56132a7303b86fe4f3ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
50KB

MD5
0cf5768cefb706f8227eb7f2f7745a79

SHA1
83989483274569232dc24f5695fa5e852f7b3ea7

SHA256
93f696072ea9b1eb02eca92551fc4552b3ce675e73b307f985b92909c60d769f

SHA512
e7d1ffe0924c8a2508f548be6a3d57c71aabeec330189a597f90354a588511096389d4b00ee7b0c2fa23c6a3d3c00d36b040190b128eb49b916c2f71a80b985e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
60KB

MD5
b821914747127adb28d79e14468511c3

SHA1
2b1f86cd6d288d29dc64227ffc279516e4802b91

SHA256
6eb5c317f5eb9d1f96a60d58e926e20d8abc48af15ff708cc4081b556d99df0c

SHA512
9e10932e949f35858dedbaf8857a1dc18c5bd83d44e9c82d086d58a6d6af446e6c8f2450be62648c4f026e8db60a2a2b940a0e84adc7293e40a7a41acb6f1bb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
bb14f0dd1b5b40c94076c10b8df35aa3

SHA1
9d1d7263d7fb870b1c86397a4e73cd5cc7fd1eb0

SHA256
843d7401fc94080c20a2091c05d44cbcac71feb4c08289dc60387ae5029471e6

SHA512
6bcfc2c45b387d8d3b5551bf041560150ff2d99d91a485e27b3f6deee5a28a20af794fb58ba109b7b27f047cc8f7cf2bc9ad2789953c913d5e6654681fc6472e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
54KB

MD5
dd2da5455e426c4553cea206de7bae21

SHA1
24b472b78c29b31070758abf6a8e242279dd350d

SHA256
58e5ef5fd6ddb51129c4b5f8d5b7cf368a47c7f6cd0e4e80acea20d03b1a8ea1

SHA512
8d44f56fc7f79fb4ef1a870543d7d9b89713106fad48449c68b4c15836e9a1ed33e97541da17f18a5da2999010eb73e6a3751ee663a76d95d7d1cca8e3acdc1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
60KB

MD5
478eb2201b3a0fbb2b078774b32514dd

SHA1
823fb5c82335283ae17b54352169e2b77ab2f7d0

SHA256
0d04252ccafbe6c0bdab6ca8960f4e2d3fb4cf6e4b9e21112961968e13ac7995

SHA512
d91233c25ce55529afbbd81d95a7fce73ae2e193de5851fed64e86bf597302321c3b05159a439367f94d0d01d2d0aa6567dc5b5cb21fe8ea898908b02107cb30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
7f868e557b098795d645df9ea302427f

SHA1
001f3306144559b4049a8ab139b4139f51e59c0e

SHA256
b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5

SHA512
56fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a

Download Submit