Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06/08/2024, 13:11
Behavioral task
behavioral1
Sample
excord.js
Resource
win10-20240404-en
General
-
Target
excord.js
-
Size
93KB
-
MD5
c8a7c9b07c549b8101507953d7dfbc97
-
SHA1
25ad0cd00063771cd45c6131aa43997a6dec0f8d
-
SHA256
90be33d3da80b38f15055b3881ebadaf8559cd91902b92fc3ed07bb2a466da5f
-
SHA512
fb5b79cd208cf82b69e5fa0e7dee3632d6823a4474ce0b600eb6a85cf33815e7cfbc0bf01054a218c40c140dc61fe7a6b6f3e6f5b69fda61b3ec172c011049b6
-
SSDEEP
1536:vJSMqH+1+7FzaLiphqSXImzf58ytH9fJFZJn9HnRJK:vJSMqe8Bii7tzFdJNRA
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4956 firefox.exe Token: SeDebugPrivilege 4956 firefox.exe Token: SeDebugPrivilege 4956 firefox.exe Token: SeDebugPrivilege 4956 firefox.exe Token: SeDebugPrivilege 4956 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4204 wscript.exe 4956 firefox.exe 4956 firefox.exe 4956 firefox.exe 4956 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4956 firefox.exe 4956 firefox.exe 4956 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4956 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 1080 wrote to memory of 4956 1080 firefox.exe 75 PID 4956 wrote to memory of 3396 4956 firefox.exe 76 PID 4956 wrote to memory of 3396 4956 firefox.exe 76 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 1188 4956 firefox.exe 77 PID 4956 wrote to memory of 952 4956 firefox.exe 78 PID 4956 wrote to memory of 952 4956 firefox.exe 78 PID 4956 wrote to memory of 952 4956 firefox.exe 78 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\excord.js1⤵
- Suspicious use of FindShellTrayWindow
PID:4204
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.0.1717616244\1866019780" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1676 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37de8c36-6929-4579-a9f1-fc37fac697f7} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 1764 247b4ad4e58 gpu3⤵PID:3396
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.1.1165317109\1856648767" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0861c40-e739-4059-b326-e0876b180aa0} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2120 247a9a72e58 socket3⤵PID:1188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.2.1200476089\797444348" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 2920 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8b261c4-9ae2-447b-b847-871e9bcca8cd} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2936 247b8db1e58 tab3⤵PID:952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.3.1714741484\282686105" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72fbfc19-4a76-468a-bcd9-308725b8952a} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 3524 247a9a61358 tab3⤵PID:4924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.4.334888171\333772213" -childID 3 -isForBrowser -prefsHandle 4220 -prefMapHandle 4196 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c3799e7-e045-45ba-89aa-fbdee31d4e2a} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4184 247ba36d258 tab3⤵PID:1400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.5.580776867\942222166" -childID 4 -isForBrowser -prefsHandle 4996 -prefMapHandle 5004 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {065c2195-d310-462d-a90d-8a86e131b559} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4992 247b7372258 tab3⤵PID:2648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.6.294070312\1101927301" -childID 5 -isForBrowser -prefsHandle 4908 -prefMapHandle 4900 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba813dc3-e92f-4a70-8af6-411795a42c3f} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 4928 247bb329458 tab3⤵PID:1544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.7.1340093705\1877935334" -childID 6 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abaf9d80-918e-4dcf-8d2b-ff6993393c96} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5192 247bb32b558 tab3⤵PID:3332
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.8.1004590715\467198264" -childID 7 -isForBrowser -prefsHandle 5600 -prefMapHandle 5596 -prefsLen 26514 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e14f0e02-ff16-4575-8c18-c585c3656ed4} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5612 247bb3b2d58 tab3⤵PID:5108
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.9.122125769\1183636148" -childID 8 -isForBrowser -prefsHandle 5788 -prefMapHandle 5736 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {994f2850-03ef-4f66-8b92-e39b6d50d03e} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5920 247bca13158 tab3⤵PID:5000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.10.145151645\477246046" -childID 9 -isForBrowser -prefsHandle 5264 -prefMapHandle 5452 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2a420b5-8bd6-4656-92de-e901897dbb66} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5196 247bd3d3858 tab3⤵PID:648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.11.1536294318\1317316393" -childID 10 -isForBrowser -prefsHandle 5316 -prefMapHandle 5300 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec75a155-d569-4421-b2df-4d0167327ece} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5328 247bd498258 tab3⤵PID:4860
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.12.1262531192\1055994456" -childID 11 -isForBrowser -prefsHandle 6448 -prefMapHandle 4384 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {437b1244-43ee-40be-99a5-bbc0e9eb374d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6156 247b8d73b58 tab3⤵PID:5404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.13.436020583\1702140156" -childID 12 -isForBrowser -prefsHandle 5932 -prefMapHandle 5944 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82fe915e-562a-408c-a5a1-219a2fa4df36} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 6028 247bca0b258 tab3⤵PID:5596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.14.532131108\1893062510" -childID 13 -isForBrowser -prefsHandle 6424 -prefMapHandle 6420 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06f02520-f501-4bdd-a8a9-94e55cb13b4d} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 5412 247bc960358 tab3⤵PID:6016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4956.15.1845422189\1913478673" -childID 14 -isForBrowser -prefsHandle 3772 -prefMapHandle 3776 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {803ba5c2-82fc-4e33-8f9e-c4beaeb14b8e} 4956 "\\.\pipe\gecko-crash-server-pipe.4956" 2728 247bc961258 tab3⤵PID:6024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\68BC2ADA259BF925235C7E6BF89FCA3B60EECD19
Filesize60KB
MD554c40c9cd190a0118fb02e0c3fba701e
SHA1624076d806b12f8c72c6a21a7403da8881debacd
SHA2560d4eaaa4a827fdb0b9e5bee9764512f23f4da1b614b4f45f0b3f6e7546161d36
SHA512e03f70157dd9954d18ec75779918b5e801dd76fd36080743f122a7b436f87bd5016ea696bf1fe0cd0617fc1903590e6c5232566e315b87ab5afcefb95622eb59
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\9357B92D7A82DC731CBB46EBC4F197AB314C7C11
Filesize218KB
MD5e2ed23d94778f5f3044caf19f810c14f
SHA1a097a130ef5c9eb886c1387418ef82507ffee5f2
SHA256b4762244ce232c2d1477db827d2e97d5245bdc0119f8a31766259fac7cbf0f7f
SHA5123213c865d5091cfc5700632bfdc67f4ab779a3bb8a84717fd5f46e34935070deb026fc1e1315eadd31483e8b9d16db8905bfec856c117b41945b4df6e40befb9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD51f87e88e2c832c5f8c47227572e90743
SHA1829ad1294759246e81a3ad816f46f16fd70eb7f0
SHA256c83d9f2c588521721563052d019fe347ee7b22763e3d32b33fd21dd934bd3394
SHA5121f037f79dce5468b15a3f529df74346ef9deb24f7b9a2ebea8c4f781d66fb4dd172e14d7208e418ef0d47aab9d0365c8cc148968a970a6634fde2e423518ac79
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\931c4bbd-19d0-4100-81a2-820c8d037b8f
Filesize10KB
MD589be44b0c429f77702504b0363404a07
SHA1d5b3d9e30e761d2cbde752095d8add8f1c1bf401
SHA256ee9688343dda7ef07412389da846b2ed1103e12f96b54e48955f19607bca0a6e
SHA51251935ffc8cf8409ecb91691e22a9ead20d5683e43261e3c71551ba6eb4541757ed73328c22ee57a6926465a02242fc3304d6f5eaed55dafc872dfe13bcb3afbc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\b588b78a-0082-41bb-b726-985216335edd
Filesize746B
MD5dba365c75cc02d5190fe7b029c1a0c8d
SHA1c188bbe866d51e6fb6b39d89fa8700dcac325b4c
SHA2562bd7a25058660e467aea6db641aebc419dcc7bbcd03119de5f86305cfaba1f1f
SHA5124cda3b55be8a26dd3b305c410580146a59598e957b854bd276e424e6e930bd10742aa247515fce4328140fcd5a86a125bd2351bc81f49e1e7560bc2589c29915
-
Filesize
6KB
MD5ac49a7f883c6fc15366ed5ab49bedb26
SHA1d4377d0c10ee2de944d07d8151db1b817a4e3b67
SHA2566914726563410dace4994e43fa520894e1d7ae144a8069027486a73a1f534434
SHA512a17db6e0311587624bf2a0f82f9c9432e331b9a3f007e807229a55a05752b83b5f5e80753a7ee30413a024ef531051e47c46dbf859cccb4ee2700239640f3111
-
Filesize
6KB
MD5af5dee26f139c714cb195f7426a79e05
SHA15ce0ee1ce91abd015fa9249d449963ac416e721f
SHA256c367b28e0c1195fb2c9094404aa1fe7f3dcf77e44325791f79c6ca080da28770
SHA51231d91d03b0c674d92b7fccaf9df6d67d6015c8d53e5b215ce072e3c413ad6a6684e79fa692933d2b90b4554f37183cd2062c39a2ba069aadeb513b033ed0710a
-
Filesize
6KB
MD58272154d06438d863537716fa68423ea
SHA15354d7f4917cb8b2fbd27a812057049467da68ba
SHA256e6c6b4596b9123ca4a1378ba633fa13d700876e220b4ef4f10ad591e945cca82
SHA512dcc6a4fdde0aae8c197c3cf05521445575da2a666b8ac4ab68c3df3cacd5d5680288c26f286a8eb1c90276ccc58b6ea2d4e71815b2ab56132a7303b86fe4f3ec
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize50KB
MD50cf5768cefb706f8227eb7f2f7745a79
SHA183989483274569232dc24f5695fa5e852f7b3ea7
SHA25693f696072ea9b1eb02eca92551fc4552b3ce675e73b307f985b92909c60d769f
SHA512e7d1ffe0924c8a2508f548be6a3d57c71aabeec330189a597f90354a588511096389d4b00ee7b0c2fa23c6a3d3c00d36b040190b128eb49b916c2f71a80b985e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize60KB
MD5b821914747127adb28d79e14468511c3
SHA12b1f86cd6d288d29dc64227ffc279516e4802b91
SHA2566eb5c317f5eb9d1f96a60d58e926e20d8abc48af15ff708cc4081b556d99df0c
SHA5129e10932e949f35858dedbaf8857a1dc18c5bd83d44e9c82d086d58a6d6af446e6c8f2450be62648c4f026e8db60a2a2b940a0e84adc7293e40a7a41acb6f1bb8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5bb14f0dd1b5b40c94076c10b8df35aa3
SHA19d1d7263d7fb870b1c86397a4e73cd5cc7fd1eb0
SHA256843d7401fc94080c20a2091c05d44cbcac71feb4c08289dc60387ae5029471e6
SHA5126bcfc2c45b387d8d3b5551bf041560150ff2d99d91a485e27b3f6deee5a28a20af794fb58ba109b7b27f047cc8f7cf2bc9ad2789953c913d5e6654681fc6472e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize54KB
MD5dd2da5455e426c4553cea206de7bae21
SHA124b472b78c29b31070758abf6a8e242279dd350d
SHA25658e5ef5fd6ddb51129c4b5f8d5b7cf368a47c7f6cd0e4e80acea20d03b1a8ea1
SHA5128d44f56fc7f79fb4ef1a870543d7d9b89713106fad48449c68b4c15836e9a1ed33e97541da17f18a5da2999010eb73e6a3751ee663a76d95d7d1cca8e3acdc1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
Filesize60KB
MD5478eb2201b3a0fbb2b078774b32514dd
SHA1823fb5c82335283ae17b54352169e2b77ab2f7d0
SHA2560d04252ccafbe6c0bdab6ca8960f4e2d3fb4cf6e4b9e21112961968e13ac7995
SHA512d91233c25ce55529afbbd81d95a7fce73ae2e193de5851fed64e86bf597302321c3b05159a439367f94d0d01d2d0aa6567dc5b5cb21fe8ea898908b02107cb30
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD57f868e557b098795d645df9ea302427f
SHA1001f3306144559b4049a8ab139b4139f51e59c0e
SHA256b228e23ecfb7965e3badefcbb031de0b4bb887634bccb34a826ac8ac89124ac5
SHA51256fd8aa514cc25db5a2c9191d665eaffe90182cc5e4f15317e0cfbc9adf7336d9ad937d20384b0504f784e5939b76b4c4b0020cb06e4a472c650355cc6c4c89a