Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 06:10

General

  • Target

    de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe

  • Size

    578KB

  • MD5

    2e1c27be8ad0c7cd5d617f4e65386eb4

  • SHA1

    fb52e06e294053458025c3b4fb5c828c0d69eede

  • SHA256

    de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a

  • SHA512

    35dac0d3a5db35798495c4ff64abe5b7e7b6486db82efe1cfb7898a86e11d2ae6d6f4c800cac2ec5289982f737357e932ab3f77f1ec7d28e2fc3bcd34f3e19f0

  • SSDEEP

    6144:tKld3FcfCElJk125U8SpVUagDsvb6mgmw4sFfTysVufBn597NX2U:tkVcfXlJkE5YVUjuOjysgfBnnl2U

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • RevengeRat Executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe
    "C:\Users\Admin\AppData\Local\Temp\de857504d0af2fb85045bc4f68ed7df380e2490186af314ca2a27cd1b7d13a6a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe
      C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe -install -555175 -dcude -6aa2c8fc392d4f159dd9827d875dc51d - -en -tiphgbsylgflfkpb
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=555175&appname=[APPNAME]&cbstate=&uid=84f0eae2-3649-4c63-ba93-aca732049796&sid=6aa2c8fc392d4f159dd9827d875dc51d&scid=&source=en&language=en-US&cdata=utyp-31.userid-373538386166383338366565616338323336306438336639.ua-66697265666f782e657865
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" http://www.download-sponsor.de/exitdownload/thankyou.php?pid=dcude&cid=555175&appname=[APPNAME]&cbstate=&uid=84f0eae2-3649-4c63-ba93-aca732049796&sid=6aa2c8fc392d4f159dd9827d875dc51d&scid=&source=en&language=en-US&cdata=utyp-31.userid-373538386166383338366565616338323336306438336639.ua-66697265666f782e657865
          4⤵
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1312
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4649c17d-fd22-4d05-bcd9-b9a6238ebd5f} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" gpu
            5⤵
              PID:1740
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2432 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e1756c2-c5cd-4721-a86c-c50900573171} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" socket
              5⤵
                PID:2496
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3004 -childID 1 -isForBrowser -prefsHandle 1364 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abd17f0e-252a-4c28-9f47-ee41bd7e28d8} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
                5⤵
                  PID:4620
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1040 -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 2596 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a94deb30-6464-473a-996f-cba140a66aa3} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
                  5⤵
                    PID:548
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4780 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e77c5c41-3afd-4610-a7b5-19dedf765246} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" utility
                    5⤵
                    • Checks processor information in registry
                    PID:4896
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -childID 3 -isForBrowser -prefsHandle 5136 -prefMapHandle 4792 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60fb3d34-7bee-4481-a4b9-5547324af005} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
                    5⤵
                      PID:3656
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 4 -isForBrowser -prefsHandle 5304 -prefMapHandle 5308 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79552a2e-e4e9-4338-b9a3-350df7f82126} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
                      5⤵
                        PID:2944
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 5 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {729f8cde-7852-4f47-913e-9b4abd88220b} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
                        5⤵
                          PID:3132
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -childID 6 -isForBrowser -prefsHandle 4504 -prefMapHandle 4732 -prefsLen 30948 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dabc1833-52e2-4917-b77c-befade6323dd} 1312 "\\.\pipe\gecko-crash-server-pipe.1312" tab
                          5⤵
                            PID:4572

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json

                    Filesize

                    31KB

                    MD5

                    705247067b20441e61acbdc78b532bee

                    SHA1

                    13e840695aca5e1b6d412fc6789fd1cbe65c2e24

                    SHA256

                    b476d29bc845eea29727a0ae11361380f38d89b265a32201bc8ae29423c4a445

                    SHA512

                    3e6bb99ec90ec31cebd41fb8fe8416e5d97ea5ce33a115892804f9a46e5dc35cf51da694caf1daf500466a8fbe7df6cadb1d3c9bd3bd73d17d311c95f26f6df1

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A

                    Filesize

                    13KB

                    MD5

                    ce950fd0062475f9ff3d0a4f70881550

                    SHA1

                    7b5f49c559e7c370c41f03b0b77ce7bd27162d19

                    SHA256

                    876ef062067cf825da9b20cf09d1cc5ebd32c6649a559bcdcfa52e630c1b040a

                    SHA512

                    acfd92bf940298e5eeccd1ae58ddc2f1980b13c11981954a8de30767835266b96747b21130ff3ece56f49897b3a0c1e29ffebbdd61820df4dc136075b3392f8f

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                    Filesize

                    15KB

                    MD5

                    96c542dec016d9ec1ecc4dddfcbaac66

                    SHA1

                    6199f7648bb744efa58acf7b96fee85d938389e4

                    SHA256

                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                    SHA512

                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                  • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v6z.exe

                    Filesize

                    312KB

                    MD5

                    09f02c017e40a998537f26d0caee8d22

                    SHA1

                    7676d2f17068a9050bbbbe10908e75bc5d59b631

                    SHA256

                    fae6c9cfda16a9f4587b0041156a7284bf7cb1fc48e1e34f33b50ebc2d00e2d7

                    SHA512

                    0c7d4fad92bb7478e277f6c56e0e0dbd665171a7bea06a6668d9d0120c5f171cbcec37c60b6354a286192f2f0bbf104ccc5550159e863ee03cc2e23243eb93c7

                  • C:\Users\Admin\AppData\Local\Temp\OCS\tiphgbsylgflfkpb.dat

                    Filesize

                    91B

                    MD5

                    404a7679c5a70c38de354f87d537ca39

                    SHA1

                    5d33433a70b49f03a6fc448b778bbf7be41187b5

                    SHA256

                    96950de153a245f1aead7e2edcdc266236d7f0a6b5d0be4703565cef45f1f7df

                    SHA512

                    3502307cdc103755dab5dfc3f124e67323bde3b28bed6ca177eb8344030ace304329337a959eb4ada96d43a0482a7be7a99a0bb8aef322e0516c29e08d32aa0e

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    c161233b5071020b2d5ae409b3c044d0

                    SHA1

                    95a374fb72b3c5908d8079276d1c7023e67e25d0

                    SHA256

                    09b7de45a2c4e12fb6ca769f58225d6dd373d2e6b8b75b29638a539cc7c74905

                    SHA512

                    4fc13c242b0b105a961ba0cde85065057e92c9609585843354c56717734b2342968b5c7067a31c9512de7402181cf2c7c10d6deebce4d8acd25200d367eb726d

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

                    Filesize

                    6KB

                    MD5

                    694409d978e6a29d2a877b74818971fa

                    SHA1

                    8eca242fa2eb51ddf6c3c8066441764aee2c78e6

                    SHA256

                    a6f799d19f9f841dfbf9dfa13e030bd63b754b8a8ca567fb9d15449ec49fe8f5

                    SHA512

                    bc6e805e28ceefb0a0a3863ac3d7535f34f3b399cf987f25391cfc5067a592bfa235465cabb8e9c6b107adca61535d413486e5cafe8e100510af7722e8d0652b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    21d7bf502068360786cd5ca66a7085bd

                    SHA1

                    5cc2454bd9549b79a30f32f888418ad2b0eb051e

                    SHA256

                    199888de1e9362651de47d85fcc8d786146989cda732614ab500dc394af728ec

                    SHA512

                    37d759bb5045ef7a03add18cfce600172ce80a8f8c1a2bbaa3dabd3265b01cd12094e535632dc6e8b12670ff60c8716be5106e5c4819a4f48f2a405715366889

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    14KB

                    MD5

                    58aabf70b09e2b4e2966b6f6f9c1842b

                    SHA1

                    893fb4ccfde41f8332e859ee2883f27c20bd4a98

                    SHA256

                    5df92b933769aea51d10bd6077e11fbb7ee38ce1605825beefbb556c91e4c2db

                    SHA512

                    9fa07b3ddb981a5cf8a18f7da56fd17c39913db3bf5bebdc06c7171de046222ff91d94b51b9bd02be1db21a9b8e17f79b010bc3212730e9975dcd07ab5151162

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    14KB

                    MD5

                    4d3e7c071fe0da1c258af349ea2682ab

                    SHA1

                    41ef03c11acec0b85e29df5b8017745720e01353

                    SHA256

                    52327135a00b9e66344e18414196c791c9d7bf33e3ad7caa0bad8b817fb03b09

                    SHA512

                    8a808c23ee05bba67adf3a05774f3ce1c2dcf0aa20e37240c3b5f7a55cfb544c8e3817e79b7364c3195b1c14bc2d602c18b086dd29ff1232767a299c60fe1c96

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\6bf2f899-3042-44d6-96cf-6889d0779a8d

                    Filesize

                    671B

                    MD5

                    f520ccbf7b7c917430df47f7b048b20b

                    SHA1

                    84c4f181243984d53461c7dd14ff38103779d496

                    SHA256

                    82ed79535ba80246b5a66bad961c701ae416dd39060a041f5ee24a3251cc4d98

                    SHA512

                    613d6a3e22d68ecc870e5104a5b40cc3078c8a65363160aa0339d72288fecb3da567fceac3d54d071dc5442350076eacf0cc81ab170e38bcdc989c85782581fc

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\7a1dccdc-3e1f-4571-86ee-efdc7249075a

                    Filesize

                    26KB

                    MD5

                    643550bfe0eb62f21cce109e0cdbb51c

                    SHA1

                    1e19813c8b2acf52b693f821743b17b59d846fab

                    SHA256

                    dc06418cb411bb757da94b19f521fd1b7adbf6764f26fe264a5387cab8272b98

                    SHA512

                    af7b636a25632815e2152a773b6014d07fdac0aa7a518923f1d0ee2fd22f4983db0c2b53daac36c5d05083f8ffdc5dbec0ad18d6cf67005c344dccca34fc8f32

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\910f8865-40ee-4a5f-87e0-f1fd1d238b25

                    Filesize

                    982B

                    MD5

                    7cbefb6563d0933a7bd6bb8935849844

                    SHA1

                    3456526f25e6dbc8010f457a692fb36313d19a46

                    SHA256

                    3523c8a836644528612ef244502ef742c8a97e58f545720656f71f4b6d06b672

                    SHA512

                    a3ab1ed796b3979da7db5ee626ee6f57eae07ef0169408d1bf7ff747859956bd9f92a3417462eea7b507a2eda5a8acd28fdce2bfe2164200b23b64098aaf81e7

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

                    Filesize

                    10KB

                    MD5

                    83b8ed3d2377de377cc9d7740c4620d7

                    SHA1

                    c87466e69d8471f6de004ad7b5a606b22ad351d3

                    SHA256

                    f13097433112b7bb769a79abd56196b40c2ea04c80caf9a8d92efae330f1371b

                    SHA512

                    77d8ebe17fbeac9dee3d0f37d9bd4eda2a4b106077ffd859e6d3237dcc70d414ce5b122647bd803e6da8f04383327e04903f6e768943d88a18547f0029b758df

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

                    Filesize

                    14KB

                    MD5

                    d77509cd2f8b90b3c18b50a35d1ff2e0

                    SHA1

                    b2a0a57ee54766710731b8b8e3a1df6286e46d70

                    SHA256

                    bf5386530a066b78425c18c9c3dc1e457c4f45d876ef6654ef963bcdab6b7c58

                    SHA512

                    eac64b0a2f69f4f3f5b9fc509b10e52dcb7905afd1b0a86218d6438598dd2b3b6f9246b3d14d214b5258c3cfa963743c8c835055d7095a65f43406d59a9691b3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

                    Filesize

                    10KB

                    MD5

                    3fe101bababa0853c2766b9fd5b2a39a

                    SHA1

                    745b1f8e55b3ecf2c7af59be9259085c8fb92ce9

                    SHA256

                    580d75500d30058f9560067d91185f2cfab9746b877fe86a1a762b66b3e5b0e4

                    SHA512

                    d1dfcf16b891a7606faced8e57e5e7b3effcb7d70a28283ebe1d0520bf0c36685d154909304943c2c3c81bc192b2faac760466c33fb3de1f484c27e563a10210

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\sessionstore-backups\recovery.baklz4

                    Filesize

                    1KB

                    MD5

                    a5a96da9dcca063e270e447362159c9d

                    SHA1

                    f8954864852652e9da6c30aa97f255927b1e4524

                    SHA256

                    fbb9bcc03c64c73b401b673196caacb2247d0ac46287ff35d23da7df290934dd

                    SHA512

                    d997589da81aa9f7e4a88a23b7a4bfd21e445c71359c56b0ac1c98517c3d92891a3225df44987420babfb0cc6dc9c4bdc13e1fb791a88574fc517fb2e79108f3

                  • memory/5068-24-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-23-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-13-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-27-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-12-0x000000001C6A0000-0x000000001C73C000-memory.dmp

                    Filesize

                    624KB

                  • memory/5068-11-0x000000001C550000-0x000000001C5F6000-memory.dmp

                    Filesize

                    664KB

                  • memory/5068-25-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-10-0x000000001C080000-0x000000001C54E000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/5068-16-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-14-0x00000000016C0000-0x00000000016C8000-memory.dmp

                    Filesize

                    32KB

                  • memory/5068-22-0x00007FFBBDA55000-0x00007FFBBDA56000-memory.dmp

                    Filesize

                    4KB

                  • memory/5068-9-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-8-0x00007FFBBDA55000-0x00007FFBBDA56000-memory.dmp

                    Filesize

                    4KB

                  • memory/5068-21-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-20-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-19-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-18-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/5068-17-0x00007FFBBD7A0000-0x00007FFBBE141000-memory.dmp

                    Filesize

                    9.6MB