Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    325s
  • max time network
    328s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/03/2024, 14:37

General

  • Target

    8vwuYJ8J.exe

  • Size

    299KB

  • MD5

    1c2193793f2665bdb25f7a34fd25c313

  • SHA1

    9e7d803142fd446012c1e89f5b182c785026ae4c

  • SHA256

    35ef512b8db22c573878616dfa185e3d104acb0c36f4387630979188bc80c3ac

  • SHA512

    9deee44ce328d4dec36b6baf11484ee999b09df6c19cf057bd7e3df5d8e7bdf382f7a08c6164da1722bda503f6460a3a2918a2fd233a72131d1bb1328692c74e

  • SSDEEP

    6144:QFHQ2zFCn3u1ZVTc0/YxuQOPLnrU1ZE2pkLPVQW13fe0I2028fOTMK+epwMgIOEg:gHQRmZVTc0/YxvOPLnrU1ZE2pkLPVQW8

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8vwuYJ8J.exe
    "C:\Users\Admin\AppData\Local\Temp\8vwuYJ8J.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2336
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1268
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Modifies registry class
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4192
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.0.1441807276\1877017134" -parentBuildID 20221007134813 -prefsHandle 1780 -prefMapHandle 1772 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8138f755-7e5a-4b99-9c96-88abe305c3b6} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 1872 202364e6b58 gpu
          3⤵
            PID:3536
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.1.974716120\1588350028" -parentBuildID 20221007134813 -prefsHandle 2236 -prefMapHandle 2224 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54b67c07-a5a8-4c8f-8c9f-71149fb49145} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 2248 2022a472858 socket
            3⤵
              PID:2604
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.2.998505242\500618800" -childID 1 -isForBrowser -prefsHandle 2820 -prefMapHandle 3060 -prefsLen 20886 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4127ebb0-da4a-4b18-abfb-8ace682c2b52} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 2828 2023b7bb358 tab
              3⤵
                PID:2032
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.3.1452792073\889096176" -childID 2 -isForBrowser -prefsHandle 3480 -prefMapHandle 3476 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {752007ea-f977-4a85-9567-a8c270007c78} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 3492 2023c5d5458 tab
                3⤵
                  PID:2892
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.4.1049305266\1405717657" -childID 3 -isForBrowser -prefsHandle 4424 -prefMapHandle 4388 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0532ec67-7c22-4e66-a771-122c81327bd5} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 4436 2023d5d3858 tab
                  3⤵
                    PID:2276
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.5.1870718024\238974343" -childID 4 -isForBrowser -prefsHandle 4988 -prefMapHandle 4396 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7331dad7-8287-459a-af02-0c1b21dcb54d} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 4972 2023d986758 tab
                    3⤵
                      PID:1364
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.6.452443788\1242162320" -childID 5 -isForBrowser -prefsHandle 5124 -prefMapHandle 5128 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9dd5354-a9c3-47af-8783-c51da51321fd} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 5020 2023d9f3f58 tab
                      3⤵
                        PID:2944
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.7.117339632\616363525" -childID 6 -isForBrowser -prefsHandle 5316 -prefMapHandle 5320 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4ed80bd-7f47-4687-99dd-e824e7092c7e} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 5308 2023d9f4858 tab
                        3⤵
                          PID:412
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.8.131090712\898935350" -childID 7 -isForBrowser -prefsHandle 3460 -prefMapHandle 3892 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a74fdb0-37e8-45b2-b1f3-4a24a1a6bf1f} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 2680 202367c2058 tab
                          3⤵
                            PID:3940
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4192.9.289653517\1692781195" -childID 8 -isForBrowser -prefsHandle 6112 -prefMapHandle 6124 -prefsLen 26723 -prefMapSize 233444 -jsInitHandle 1348 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {464bf70e-c4b0-4414-a3c9-49f5330a001b} 4192 "\\.\pipe\gecko-crash-server-pipe.4192" 6104 2023e0c0058 tab
                            3⤵
                              PID:3584
                        • C:\Users\Admin\Desktop\R3nzSkin_Injector.exe
                          "C:\Users\Admin\Desktop\R3nzSkin_Injector.exe"
                          1⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4492
                        • C:\Users\Admin\Desktop\GBkwXv8u.exe
                          "C:\Users\Admin\Desktop\GBkwXv8u.exe"
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2452

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ri34bmyn.default-release\cache2\doomed\14189

                          Filesize

                          14KB

                          MD5

                          0a565022631ca5157ef84475ceabda6c

                          SHA1

                          ad143d0a0c7583ba2c419f8357c1e12105c02f81

                          SHA256

                          75b1d7aea68419f51d525e86337dedc019e772f3bef6684a33cdd8077ba11a00

                          SHA512

                          20c0302056e59c73350b86d721965466c275e140a56fcc7a91b311115501e2835e9e98893f062c03dd56346da3237a5336a9661fd2d3827479e144bfaad9bbe0

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ri34bmyn.default-release\cache2\doomed\15509

                          Filesize

                          15KB

                          MD5

                          8ccf12debecac3dec889637b3f051a6b

                          SHA1

                          98594f44f5fa7c5f5408465fc22a70d1b9a5d4f7

                          SHA256

                          2ec34749d5aeefa4af9160c59bf5104fc16cecc834ca67ac4b7bb8954eff6fc6

                          SHA512

                          d420ae119ba2bdee657f66869b5dd1488186fc1cada4b535ca7dba4015078513bbc9c5336de656381129c3f1d8aef18f65ee2f838c297d673beb339b7ed13290

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ri34bmyn.default-release\cache2\doomed\31463

                          Filesize

                          10KB

                          MD5

                          9941111ff93265982059d71d15d27982

                          SHA1

                          0afe5199de69e9b4301b3736188a88b1edff9bdc

                          SHA256

                          37f008eb977806fe91c663326fde43ad3783e7a3660494b875af518bddb0a20b

                          SHA512

                          0fb4b321d320945071ee1f31965d552eb13ebc9caa69488a649a703d43e1b5ce9ae6b7abff9bb8a9d00f225ecee30e36ba30ca1c272ab5a9bec485145fca251b

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ri34bmyn.default-release\cache2\entries\75618D4814E59EE271AAA434B222669E870291B3

                          Filesize

                          59KB

                          MD5

                          5f58b449263f63868e89120b9f47c8f1

                          SHA1

                          6bc279faa650fd50f8e40c54234f1d5dac385b6f

                          SHA256

                          0a6bc440bf5c91ef55aab9224abf31dd4ae6b9922224f5ab65930cdb1b47dd27

                          SHA512

                          de75e74170361b6c0e669aebb745322d0f7656f7a4f8d631b32da3e06a9e2f3736f7d0d5b403e485b262fa333908a0b6cb17f1b982d16909b5c10fb0481368c9

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ri34bmyn.default-release\cache2\entries\8BAD8B912F2D6C94A71545B207FE04358A4C90F6

                          Filesize

                          205KB

                          MD5

                          530a72ea0058c12283c9893b93540eb2

                          SHA1

                          d430cb2d2375175c37d46c4414768e87b959a6f1

                          SHA256

                          a2bbccc2af334e60c442ccf9591c7cf27df8f114ef22505fa4c58d2c7d93571b

                          SHA512

                          c2103547e701ff43d74b0f6e24945c90daa85f5694f6adabb1fe696166d4b2d0a0285a285e328d43202b223f98fecab9b54d04ae6cf06062758da36d5872b06b

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\db\data.safe.bin

                          Filesize

                          2KB

                          MD5

                          636ba9e43d69b82decf6e741d1d7de05

                          SHA1

                          14e421cc989f2e50ce29c4bcebac661646033dd3

                          SHA256

                          c82ed2c62f74e6ccd9507fab8d3068c8a0cc791b49d1e7151c1a1ff5db84970c

                          SHA512

                          d61ae2183a6823475313fccf5a12fba97ac300f9cc9aa966aca5553c3cb28ddd2ff11be99fe06a2ea6b616eff282e22448b549a03f617d4a20c6413cca3a1333

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\pending_pings\40fabf59-fac9-4f38-af33-e792f272bec9

                          Filesize

                          856B

                          MD5

                          b88486af0c644114fc26b029930d6a4b

                          SHA1

                          6a8a957a74c584185e8f3bf8c1b2fbf451e6f890

                          SHA256

                          b590ad61e8b9c45dedfb24e9289ef6e744f34e57b1f722cd89d2495347b5674f

                          SHA512

                          b9c54e2fb36a86dc0cae8dc007635d9eaac3cf3fe28c26c44504939e9d23ce4c8c12a1ccd589473bc88955a8fca225d311d0b808cbed2c695fe11f71cddda05a

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\pending_pings\b7fd8273-d8b7-446c-b973-7aea82c7c288

                          Filesize

                          1KB

                          MD5

                          f0b81c8ee349765234d22b7724eb5e79

                          SHA1

                          fe883d8a3f1890af4792a676bd92fde9dcfcf1d6

                          SHA256

                          35833848f7ba4faf39c187376929e5a23c937c409088808178b2a7c5cd91903b

                          SHA512

                          01780d18718fe701f6906babcc123bb35d2f6cc51d26d7e1bc34faa8505c027c1a1e9b001e6b6cfb43c17eabbb4b327c7754b1188640b9bdc7009a48b7560b03

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\pending_pings\c4843856-fcad-4526-98a9-ed95af116ea7

                          Filesize

                          11KB

                          MD5

                          69586cff809f262555b178cd8909aa63

                          SHA1

                          c443d529ed5ba6e3ab79fa7256f3ba737f385a4f

                          SHA256

                          ccdb8889c71db839009a10d8dd0e9eb597cedc159ea0ed429a5bbb12e380dee4

                          SHA512

                          1cd85051b1f51ecff86df4f84bf1e944f8ff9bf97d1a8bb88fb5580a2528dfc2318c54edeb087ef675b2193cfebbda7107f1b33d7c698a4ab3234de181316dda

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\pending_pings\c789be77-40b1-49fd-bfae-e8197eb5de8d

                          Filesize

                          746B

                          MD5

                          5f984490bc2e34366cad2bbf58ba28b1

                          SHA1

                          7ea8e70f804da25a15555282ba608b44b5273ddc

                          SHA256

                          790e4ca201f92e245ea2a38b79356a9348c45ec3159f43fa63abbf6c41a29e88

                          SHA512

                          27caf0153430cb3400b98560d2f9b38a40725a2aa7713309d7afb7246b0ac4d91ba8de3bcb53327e128a01d9b6b6c2890a28435a078266545def7780eedca318

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\prefs-1.js

                          Filesize

                          6KB

                          MD5

                          2b3564de16db5857d4f18f2d7fbf5150

                          SHA1

                          254eb6a56eb87c9c5fcceb6e18a5edf68dcf78bf

                          SHA256

                          895f26579741ea8f1dab8c80b2b4230bae75fa680fd185ce6602d2d4c7e13424

                          SHA512

                          a358f9edf757fbee7ec84d628712ff5f734e4fa950a5f4d8842c0700f7a5831ab4d2f6e21e8546f764462fbc2c0b4ceca3635325fa0bb78de91503cd87191677

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\prefs-1.js

                          Filesize

                          6KB

                          MD5

                          42cee4c6f10ebd7cb7747c9ad1936e1a

                          SHA1

                          87d4ab0240efd16486c736bc0d04cda6543a49b9

                          SHA256

                          89300eb4ac0b3f14bf5cd1678ce854532174b13e76dd1e037d26794a48d301c1

                          SHA512

                          427c31f7503f5ac7117903db2ca40fd71ffa1fc865df5f99a3f87c5d32c9b6621d8b6c80934d6d31fa90374d2e320714f92151f46522ee93e4fddaf3f46bc461

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          4KB

                          MD5

                          4f80714d5a19ab6c187f9d02ac32f68d

                          SHA1

                          304a1fd14922ccbaba4290f78230c9eb1eaa0c67

                          SHA256

                          492ab35d901f10c9a1b7c03eca6baa6016f65d9700e3655c7a10c45c2b10adef

                          SHA512

                          d876411170153c7422f58f64b06767b7a134321976804e453de03ac616d22ddb748cbbf130b5c84fdca38151290058595cfed1daafc64d37b983e7ddf2f5d889

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          5KB

                          MD5

                          3a0f774eb8f5f3683c53068a1748e042

                          SHA1

                          4315f6b3dc335ce3f9636c98af96c3b508f2722d

                          SHA256

                          b875f78a9a6130159744ff0a8103d1a4288e1ee154ce68a8cf0c5e8857b82306

                          SHA512

                          cccfb53ba22cbb9530ffa452cb133e5aebd6df7202ea36e5f7ac3df0b91db0efc3454c93126d003832180a539aef3fd706673fe1acc72faad07c9dc43820a67d

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          5KB

                          MD5

                          7c34c99d089766efb7fdbb52b2642612

                          SHA1

                          785f701926a5aec13f7e9617dd8371cd00f23947

                          SHA256

                          ef0b0200fffcb00ba184b616e394e4f84117c7a502e575560a9d58fa72f91c5c

                          SHA512

                          291fd23673fa6f2e14e064b303490843c9224c48f16bba09639fde7b2422ba6ff6322ef3c2e907cedd2299362b8a75d0f922545b0ed48e5e490d16b24d54abde

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          6KB

                          MD5

                          364503c14103947415b072cca24c1656

                          SHA1

                          687b383e61dca77ba9c7efe5cecccc3f95034d18

                          SHA256

                          dae9e667d92f582c022cbb92d7e255ec25c02f37d5fd059504fe88ec61a59f19

                          SHA512

                          26d371a59e61ee4484f443cc016b19732b019d5e35e0db97b9bf0283dc36e8c69d12b7ef013098062f12f09b697a58e9b5263c07b1046c8a4d7a73764aedbaf3

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          3KB

                          MD5

                          ec6c58fd692d606e1691a73c5a44f8f5

                          SHA1

                          f098707b0451379d016a795abbc8b6020fd144e9

                          SHA256

                          915c1fffc0b4c7abf0971fc5aa6c8a7eb6abbf0493ccab3389097ab6062a6557

                          SHA512

                          41798b88d537710b9b600508531a0d4067b6ac05fc31fd94414ca64ae84272a37f772b7595a3bae462c8e87182a0b5c95e9faf16c76105abf767b33decca64c4

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          4KB

                          MD5

                          25bf10923d8143bd79f461ce0bdda8c1

                          SHA1

                          55f872afd38bb90fb5a9bda942344983501438f3

                          SHA256

                          7f629ab10e706d9a9363ea15e547f3930e252cd413a7bed85e4dc1fb4d48df45

                          SHA512

                          141627e953efbe7405ccec2d6cfed21e45ec941b30d32c7059e74c51c0cb894984ca5d6309ba8756bc82747aff331f292f4baa883803d35577e1da8cce89a799

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          5KB

                          MD5

                          6017f5b5d844a0507a207e16110fcd65

                          SHA1

                          7552fe1600e939c63045b3406cc7efaa2d435a28

                          SHA256

                          05f5628ae26b7dc4eaf74e181ec8d06dbebe6ee44e4fa676d2e7cc707bbe07a2

                          SHA512

                          735ab44d6e25d5d93863531410d22ed258b351cd9426cbedb34a6e339be3ab5cc76c71be62a9b71e64f4870dbfc59b8a975b1859883429b91f30c3d8d42cc7bb

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore-backups\recovery.jsonlz4

                          Filesize

                          6KB

                          MD5

                          af371489126b55ae520c828ce5d0f998

                          SHA1

                          601e536560199773325130fc8c3174e81c5426fe

                          SHA256

                          81aee9a32cafc89c5d79b7d25c85c39febdbcffde3aa7d121680965892ad1427

                          SHA512

                          997e813b38ac00eb9b2e796c5b7bac1128db97a6e355012337292fef881a6b0b109d3d4650fd0d9e22ef63d3d3b615717ae37cee2c8ad1f88aea22fa83af91bd

                        • C:\Users\Admin\Downloads\R3nzSkin.y1pej58q.zip.part

                          Filesize

                          518KB

                          MD5

                          04b36128ecd418b74310a6a4c4486afe

                          SHA1

                          db492f02eb2825dd9579486b2b1dcec7ee276939

                          SHA256

                          2f227995eeda1f67a87295c6eecf4bc5bb135a68f99ddebaa07384c4de0308df

                          SHA512

                          172671fe25cf55538e8f061d0e62c2a46aec088310bae2c5237f378292504c4cf79740add24eda1ed411b23d783d04d2d8cd7a1ef0f04b9e11fb24a6c260b8ad

                        • memory/2336-0-0x00007FF6DBF50000-0x00007FF6DBFA0000-memory.dmp

                          Filesize

                          320KB

                        • memory/2336-5-0x00007FF938950000-0x00007FF939412000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/2336-3-0x000001BAA0C80000-0x000001BAA0C90000-memory.dmp

                          Filesize

                          64KB

                        • memory/2336-2-0x00007FF938950000-0x00007FF939412000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/2336-1-0x000001BA88050000-0x000001BA8805A000-memory.dmp

                          Filesize

                          40KB

                        • memory/2452-642-0x00007FF63CE50000-0x00007FF63CEA0000-memory.dmp

                          Filesize

                          320KB

                        • memory/2452-643-0x00007FF937180000-0x00007FF937C42000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/2452-644-0x000002834A7C0000-0x000002834A7D0000-memory.dmp

                          Filesize

                          64KB

                        • memory/2452-645-0x000002834A7C0000-0x000002834A7D0000-memory.dmp

                          Filesize

                          64KB

                        • memory/2452-647-0x00007FF937180000-0x00007FF937C42000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/4492-631-0x00007FF9370D0000-0x00007FF937B92000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/4492-632-0x000001C39D3D0000-0x000001C39D3E0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4492-633-0x000001C39D3D0000-0x000001C39D3E0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4492-641-0x00007FF9370D0000-0x00007FF937B92000-memory.dmp

                          Filesize

                          10.8MB

                        • memory/4492-630-0x00007FF63CE50000-0x00007FF63CEA0000-memory.dmp

                          Filesize

                          320KB