Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/03/2023, 23:10

230328-257yksfe3y 7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2023, 23:10

General

  • Target

    SKlauncher 3.0.exe

  • Size

    1.2MB

  • MD5

    32c7e3347f8e532e675d154eb07f4ccf

  • SHA1

    5ca004745e2cdab497a7d6ef29c7efb25dc4046d

  • SHA256

    107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b

  • SHA512

    c82f3a01719f30cbb876a1395fda713ddba07b570bc188515b1b705e54e15a7cca5f71f741d51763f63aa5f40e00df06f63b341ed4db6b1be87b3ee59460dbe2

  • SSDEEP

    24576:Dh199z42ojP6a7HJlF9eu5XFQZSIZeNGdmEE8H17UBcegl:R9zbgH3euNFQZr/oEE892cfl

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.exe
    "C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:468
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.0.1917857808\1977446600" -parentBuildID 20221007134813 -prefsHandle 1180 -prefMapHandle 1172 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b28e6f8b-490d-4c2e-8d03-1349e079d027} 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 1256 f3ae558 gpu
        3⤵
          PID:1932
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.1.160795016\531829017" -parentBuildID 20221007134813 -prefsHandle 1452 -prefMapHandle 1448 -prefsLen 20971 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78e0611e-a909-4a2c-9302-4a0cccf0c6cb} 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 1464 d70d58 socket
          3⤵
            PID:1704
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.2.1773705190\717806821" -childID 1 -isForBrowser -prefsHandle 1888 -prefMapHandle 1832 -prefsLen 21054 -prefMapSize 232675 -jsInitHandle 780 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57f2f723-345c-48e7-8b83-c18ab0cb4229} 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 2016 1abdeb58 tab
            3⤵
              PID:1964
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.3.17529888\245328313" -childID 2 -isForBrowser -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 780 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {daeabae1-4ce1-40f6-bc01-b5bd827159da} 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 1624 d67e58 tab
              3⤵
                PID:1852
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.4.601911996\1102832636" -childID 3 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 780 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b97b934e-90db-47ae-8e09-6a9cfcb2b447} 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 2908 d62b58 tab
                3⤵
                  PID:1076
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.5.1617466388\571070002" -childID 4 -isForBrowser -prefsHandle 3576 -prefMapHandle 3012 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 780 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {871e4ded-f103-4bd1-a559-f92be8cf4673} 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 3520 185bf858 tab
                  3⤵
                    PID:2376
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.6.1689851156\744214613" -childID 5 -isForBrowser -prefsHandle 3724 -prefMapHandle 3728 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 780 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b40ff536-cfe6-46b7-ab7b-00e7a5389ff2} 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 3576 18524958 tab
                    3⤵
                      PID:2508
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.7.646613720\1615785666" -childID 6 -isForBrowser -prefsHandle 3760 -prefMapHandle 3756 -prefsLen 26704 -prefMapSize 232675 -jsInitHandle 780 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9710f9cb-d2b7-4c09-8b8b-d1230d105783} 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 3784 185be058 tab
                      3⤵
                        PID:2520

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                    Filesize

                    61KB

                    MD5

                    e71c8443ae0bc2e282c73faead0a6dd3

                    SHA1

                    0c110c1b01e68edfacaeae64781a37b1995fa94b

                    SHA256

                    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

                    SHA512

                    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                    Filesize

                    61KB

                    MD5

                    e71c8443ae0bc2e282c73faead0a6dd3

                    SHA1

                    0c110c1b01e68edfacaeae64781a37b1995fa94b

                    SHA256

                    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

                    SHA512

                    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    e2b905f1893f09e9a8f54ee4a17f55e2

                    SHA1

                    73dfdf0897ee2d8961450759a1eb3d5380589642

                    SHA256

                    df7e7a522e0a81153cac386a3a6e40409930610a3ef25d2383a683a1edc00cff

                    SHA512

                    fff1e13b986cb2ccfb6229e4f0431d49f7d5d7c550a957709c635d4c52a49483ebd840c8d37672e8e7c35b23fadc0fbee62875ef9011e927984fa158a1357c5f

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    e2b905f1893f09e9a8f54ee4a17f55e2

                    SHA1

                    73dfdf0897ee2d8961450759a1eb3d5380589642

                    SHA256

                    df7e7a522e0a81153cac386a3a6e40409930610a3ef25d2383a683a1edc00cff

                    SHA512

                    fff1e13b986cb2ccfb6229e4f0431d49f7d5d7c550a957709c635d4c52a49483ebd840c8d37672e8e7c35b23fadc0fbee62875ef9011e927984fa158a1357c5f

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    f8ff1e2614bf984c604e786adf772432

                    SHA1

                    890953c36534f106eefa280ca6e085ad14ada5a5

                    SHA256

                    28f9176ab2907b260fdeaf9563c4cb6136ae55b78736ba0a21bc6a07002eab84

                    SHA512

                    410c8518373f38b65085d1ad1e4b32903a57f554ed2df057b71b28d6073f21d685a271e7393d0bc36e6afc85eee726d500103afaab12b25ced542468f1ddeabb

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    d1780b4e2c9d173599eee2eafeb80f4b

                    SHA1

                    be00e31dbc2fcb987f01016a65127a2b54dcb557

                    SHA256

                    581f0618170b4bcc4c8f90264e4dce5de2b52c79d93153b5b0d9e9f581d61f71

                    SHA512

                    3e668ef3128a6ea7c16a963e112b308d836d79e37ff8239ecf0dea01cb947264dfb78dec3d24a72240be991aba795cedf5d168de1573d0c81e34fef803de6e37

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    9689559a74ac0863f76cd9a73ef4f3a0

                    SHA1

                    5a4c8996b5bea051d3d1d5e84b7c6faa0de42727

                    SHA256

                    20c827d2e5a83bd0989e16866dae3b4d65e5453aab09740b5dcfbae93a1f04ea

                    SHA512

                    023ec6f39d441fe22e7e62d4e2466604f42e4e6ed43ecf466c12a5141479e4ee1ac032afd1eec841034257186a43137ac9876b48ec38aeef56500927e15271ff

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    bb87a3b280c76e17070b3f88cc6ce5bd

                    SHA1

                    9a542dc71d234601e3dbdc46c05b2134d0417c27

                    SHA256

                    caaeaae9f746c260b22702e0a193468156d3a53ed06dcec3bff9c29108c3362b

                    SHA512

                    03a3f6c1e995341ba6f6f16484f548e70966594e2081e9ac70ef8e8714a57e6dbe2b869d992049cc4f1b43d973e8682f1bf16a4188c985a85cc0c1d0a1f554b3

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    278d794ea3e57175c3c692c185d1404b

                    SHA1

                    44b5d2eb0136fe305a04e0fc81fbd7c02579507b

                    SHA256

                    a9786724d4aae24bbca5c2658838fac9a51c93f77ce16494590e706e6d0b5639

                    SHA512

                    696408ae9279bcd75935608871065fcc23550cda082530f0248e15281e90faee0679b7fe470902a3d65a2e4687f0b64a64137a26214b6736bf09eb2a930ca409

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    c33d8088c29935349829165617f1fab2

                    SHA1

                    fc3cf6fed406f7ce2f60428f67760a094b3849c6

                    SHA256

                    85f6a8b081a7a67e12146e8ee84791103d8aa0cee50b15dc295f87d3ac0fb596

                    SHA512

                    0e1e5b7475ab9b64e6aa308e6298cf82f7887976730922def50d34289dadcda5d010ce1296b065c46410f96e89631b0e6591c1f5ee75d80ec617c7a20fc4640b

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    c8bb4b8b28a736e286b7e2ad92443986

                    SHA1

                    a6f70abd9b870ccc31e875ee11787f7d67fb6662

                    SHA256

                    775cc4b5e00b63de89edbb059e9c809df0860c5404d2f06c8cb3687f9a446df4

                    SHA512

                    6a528d97fc0983d12940ce0943bfa3d47069dd44515415d8972c6e1c3f79a86a8f87c9e7471326dd8b3f9e8a396aca732d810196f5082309e6b884b87eedf5d0

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    e9a7c99950d3116c267652f141893f47

                    SHA1

                    72785b3bd8eb3bfed09312a4f9392a6584321560

                    SHA256

                    17737fdacdce42213586d06d28939ef72a5cc1bf9fd9d02b429089c7f58d0d39

                    SHA512

                    8ba3b72b25e4f95030785f9750b09738d7ed320c3f4311faaa57dfff597a49fb25d402872821279c2538ff17120e8770168909170172491810b3e1dd0c084b0d

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    e6929774d9867e2bcac92572a06579a0

                    SHA1

                    74c98466c229c41378ca56f5f5b487c2c600a42b

                    SHA256

                    2986bff82c7a76706f13c107651568364852647df022f38369a777f403a8a1f2

                    SHA512

                    3dbe2a01345722906298dda33f817e8803ae0b6731a2b17b624b53b2ad5220b78b273807c38b955d23c2b6ae15b7149ee10dbc5da3bc8df5d1c6ca396767b465

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    c6509101a8132a045be246f111a4cfc1

                    SHA1

                    47ba971aa9df37f38eb85c0cf5611dd5f99f7c04

                    SHA256

                    aa3d992944861e88c7f64da3aac3892bc909c9184bfbc547e44c36fd591f3e3e

                    SHA512

                    6bb0cbf40086cc851ef504c0acb904effb5882af5cc7936067ace4ae1b75190b3bd358a75061348a9d993e9b7f222998f4fe00e9caea839a2192ab21c4f61358

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    21e34436d1887e38dc65216611eb5631

                    SHA1

                    a0b3c4493cb1e41bd8976db2f69b129f1c15f6a5

                    SHA256

                    7619afc13f245f46060ac259e6d8567285a2a11276238d463a157e97cde35dc5

                    SHA512

                    02860686041f6347beb23da4ac89d77d9ed9c7405743332b48a3978dc9ccad5e20e8aa5607cdef9017ac80357fbb7913ee691897f5f1af7c986f6d1aff6eb0b5

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                    Filesize

                    342B

                    MD5

                    9dda49a8ae3327af8f7b5a1aa830128b

                    SHA1

                    c3c9602d062a2f11f99278e29020fe1c65b42305

                    SHA256

                    a90fa4dc2226da7201118663c8ff3714d19c20e79bedc5f6d24af80bf2595dd5

                    SHA512

                    cd0be5aa96bf3ce2f9b07580f316d61a0163d589f8af0cd88c6665d59d55aabd698d0b18de611ad26cbc0e60394d781c256bc02e65ffb987785f69c3f753ec74

                  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jo5ozfo\imagestore.dat

                    Filesize

                    7KB

                    MD5

                    dca08b52bf69f6f63df16bc99572fd4d

                    SHA1

                    c79009dd661b7873dd8ace706f4dc5d5fb12f2d2

                    SHA256

                    7d88e9612e09921ab8ad2125b32fa18bf2408336d88257fc53ad58b33f4ab2b4

                    SHA512

                    fc1b3e36002a0aeeec6f45549df553c8e4326ffdb90b33aa439daaf3db2ad34368dd350e5951358950b9011755a811dfb50d8ae559ad3f5af2fa3dd206cd96be

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYXN1WWD\favicon-32x32[1].png

                    Filesize

                    2KB

                    MD5

                    dfb98b35bec083cddf7e575ccbc12efc

                    SHA1

                    f77c5e6f37aec582c5977a76691f992e3ebc3a05

                    SHA256

                    f053cec8f37df661ce13646ff5ecad7050bd50c4afb4f7ad12cd252577207e66

                    SHA512

                    17d2d675bc677f126fabab826b4fc79a05eece52cf586a97b7d8093dc402d0160f273fbf9d38978f01befc9f85a979208c2355cc0a4c129a2232ffa4554961ef

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\841yyxv3.default-release\activity-stream.discovery_stream.json.tmp

                    Filesize

                    139KB

                    MD5

                    bdd57eaf8d038b09242bc81cfdff183e

                    SHA1

                    822337868268f80e5490e6d0118d94ae4c72a533

                    SHA256

                    9ec2caaf4d42e8585de48e376115867ca4c858192dbccbd74f6f7754e9fde6fb

                    SHA512

                    360c3353d3341c120245b96ba71a1d1d4e316bfb0c9b1725a004ebb79f659566367c6df0d025c28773bcc7108e846c8bf5550c81361901948fa6db48fa8e3f38

                  • C:\Users\Admin\AppData\Local\Temp\Cab41F3.tmp

                    Filesize

                    61KB

                    MD5

                    fc4666cbca561e864e7fdf883a9e6661

                    SHA1

                    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

                    SHA256

                    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

                    SHA512

                    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

                  • C:\Users\Admin\AppData\Local\Temp\Tar43BE.tmp

                    Filesize

                    161KB

                    MD5

                    be2bec6e8c5653136d3e72fe53c98aa3

                    SHA1

                    a8182d6db17c14671c3d5766c72e58d87c0810de

                    SHA256

                    1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

                    SHA512

                    0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

                  • C:\Users\Admin\AppData\Local\Temp\~DFEBA33C9DFBD62FF7.TMP

                    Filesize

                    16KB

                    MD5

                    accfc41ab2ec436d15e3149995da4748

                    SHA1

                    12107e42ac6ad2cb5ae5bd3bd39fe5c60a43a87d

                    SHA256

                    089879e24538a605e486cce82b4eae55ef5aa8c22efea3080763f5cb7ff6fdce

                    SHA512

                    93b801d1921ef862c4742c79e035ec49f2ea6d2a9ca0201ec62c1527a599311048c72a828e8c178cdc56730bf85e1d0da6230ef2625e145200833c992b5a5a0a

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\841yyxv3.default-release\prefs.js

                    Filesize

                    6KB

                    MD5

                    af5e0d0f83969aaeb4fa6e78d6f95a24

                    SHA1

                    2bd8d80e93e21ac00bcd76ace582b012c30a7e66

                    SHA256

                    ea920c40489f3fe7fc1e02d86070da051c38ac5ef6950a15955116f7bf2e0891

                    SHA512

                    7124e5e077ff990e53c23f8b4c87ccb485ea2f7e28b1e465846aa2f1b4190fc1ccd905a8a2d10b7c7373f0bb5e4a4f0b37da769e5fb877099b61201fbed50b52

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\841yyxv3.default-release\sessionstore-backups\recovery.jsonlz4

                    Filesize

                    1KB

                    MD5

                    1d18f147b0688709ba29e0da89d622a6

                    SHA1

                    121a9fb59d905eb6c4bb0ae3bebfa9927eada938

                    SHA256

                    a9bb528c0f2c6692548d817eb254f213dafe7f5c923afa1a45c7181d45b16c3c

                    SHA512

                    3f4d8f5fefc785f0aaa1df9603794a758b71db7ee7e5ded3d4c4c379c2965362652105f5b36510a0d7c15ce6613b1df241f785a3965e1a8910c84030a72ff107

                  • memory/2012-54-0x0000000000400000-0x0000000000435000-memory.dmp

                    Filesize

                    212KB