Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    29s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 19:54

General

  • Target

    rama.exe

  • Size

    1.8MB

  • MD5

    6e5042ff1ec6df9aee18f4eea7864524

  • SHA1

    19e4eaaec31c8512b191138a439b6c4c7ba73d18

  • SHA256

    420a1ba2737e39704e52e1ea0c2494d8c232f10e2b40971923959da4708b3b0c

  • SHA512

    ac5c8537bfd0a509ab49911cdf180778e9e47f9f9fb600933b2ba03f939f9bc9834db5a106840382ee648b289cddaf69b55cf969f51b9f89c49c678f1edc202c

  • SSDEEP

    49152:2M3rvEOaXgE3YC8ZtDYYuyVcBUpxOePEEmeweNX9:24E9QiYC2DYscuEEmdu

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\rama.exe
    "C:\Users\Admin\AppData\Local\Temp\rama.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
      "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Users\Admin\AppData\Local\Temp\1000008001\a96907737a.exe
        "C:\Users\Admin\AppData\Local\Temp\1000008001\a96907737a.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2332
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E560.tmp\E561.tmp\E562.bat C:\Users\Admin\AppData\Local\Temp\1000008001\a96907737a.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1672
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password"
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2104
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7219758,0x7fef7219768,0x7fef7219778
              6⤵
                PID:1712
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:2
                6⤵
                  PID:2452
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:8
                  6⤵
                    PID:2052
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1480 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:8
                    6⤵
                      PID:3044
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:1
                      6⤵
                        PID:1612
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:1
                        6⤵
                          PID:2356
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2092 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:2
                          6⤵
                            PID:3508
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3468 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:1
                            6⤵
                              PID:3680
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3432 --field-trial-handle=1368,i,13793652152911531255,11638423389261553988,131072 /prefetch:8
                              6⤵
                                PID:4016
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password"
                              5⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2396
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                                6⤵
                                • Checks processor information in registry
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:1760
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.0.232382003\694153471" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30d52747-dfe0-4ca7-ab28-bca4999a797d} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 1308 45d6258 gpu
                                  7⤵
                                    PID:2996
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.1.133539589\280012840" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98ec20c6-da15-4c89-bd0a-52830773ff77} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 1516 e72458 socket
                                    7⤵
                                      PID:1496
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.2.2103892038\375904984" -childID 1 -isForBrowser -prefsHandle 1980 -prefMapHandle 2000 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6f51a1c-557e-4caa-ace4-c2a2ccbcf8c2} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 2120 19ec2258 tab
                                      7⤵
                                        PID:2056
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.3.1733338217\1841646821" -childID 2 -isForBrowser -prefsHandle 2700 -prefMapHandle 2696 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99bc1cb8-8387-4e08-8ffc-609bc45e130d} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 2720 e64558 tab
                                        7⤵
                                          PID:832
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.4.1416664302\455355594" -childID 3 -isForBrowser -prefsHandle 3812 -prefMapHandle 3796 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b83790e3-d1c1-4cc0-9514-0b25e4857308} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 3824 e30158 tab
                                          7⤵
                                            PID:3652
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.5.364760197\1930996262" -childID 4 -isForBrowser -prefsHandle 3940 -prefMapHandle 3944 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5d6b4b1-ca7c-4cda-a0e7-4a8fc2e1c26b} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 3928 2121fc58 tab
                                            7⤵
                                              PID:3664
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.6.1485311932\1115290780" -childID 5 -isForBrowser -prefsHandle 4120 -prefMapHandle 4124 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6af0cb2-2419-4663-a925-6e552580899c} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 4108 2127bc58 tab
                                              7⤵
                                                PID:3732
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1760.7.1997410984\972613396" -childID 6 -isForBrowser -prefsHandle 4380 -prefMapHandle 4376 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a56b2457-2ee0-48e0-a6ef-ee5fcfff3cc7} 1760 "\\.\pipe\gecko-crash-server-pipe.1760" 4392 232dc158 tab
                                                7⤵
                                                  PID:3312
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:2620

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                        Filesize

                                        264KB

                                        MD5

                                        f50f89a0a91564d0b8a211f8921aa7de

                                        SHA1

                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                        SHA256

                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                        SHA512

                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        1KB

                                        MD5

                                        af8cded2352b22dd6326cb0be5f6b39a

                                        SHA1

                                        da39026671ffd6f81002ed8c6b0dcb6378cbfa7b

                                        SHA256

                                        c2c0e8b539ba05668bc0243135564a54733319dea8387c2e22a743c879d2a823

                                        SHA512

                                        05beb6fdfbe7bd5a4bdf44084586d71d63607af69a046ffc7e0d1019461985bd889d39f2c00590772e91cc1426a13a2a02df1b798f4c9e488d436eff30199cb7

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        bd7df784128a5c9478661a3089ef177a

                                        SHA1

                                        f70a0392bff75eda862aa15282b5754b51251662

                                        SHA256

                                        cca377ce089e7db5d4cf92acaf14e7a7b9e53c6952ec45ad25de96a36b5be180

                                        SHA512

                                        a60b09c384872e870ce3c95bdbbcb0282faa1c5d784b4956cf57db530338ab44a99440c5d7493101ec9054b6731b0d2e620028e096c1e10516af82085cf466e1

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        fea1d8c068e76f1a28af3a750dbf7cce

                                        SHA1

                                        6f33e3559312cb1aac71dbe70cdbe209fd377e06

                                        SHA256

                                        ef04c215a29ee64b6f9e2c5c38a5339fdc01d34544d1a9e5486d66c6951d1a6b

                                        SHA512

                                        51c1f84770e4306ffa7bdada8ab5d9c4aaa8d6422917108b2d4dba65ab01bd1f65367467b3fe917d3f9af5e954155cdead5358a53317059af9c021f092e65bc3

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                        Filesize

                                        16B

                                        MD5

                                        18e723571b00fb1694a3bad6c78e4054

                                        SHA1

                                        afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                        SHA256

                                        8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                        SHA512

                                        43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nndpnsl0.default-release\activity-stream.discovery_stream.json.tmp

                                        Filesize

                                        38KB

                                        MD5

                                        0fc4637fec756c8ddf881bd4a7dd3fa4

                                        SHA1

                                        453cf3da2a544ab546fdc88248c09708ad7040c8

                                        SHA256

                                        68b06d4c1ce9eb0b0ce51f197c0732574bcaa174ee8d3f888608c6eb41326b59

                                        SHA512

                                        18e401c7b9acefa9fa1e6f9c1a40e46c7084121a58165a33b57f6c2039563dc17afdf23bc5028d76f41858df16f202381e1413a5ddd582cc7609455e7b9657fb

                                      • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        6e5042ff1ec6df9aee18f4eea7864524

                                        SHA1

                                        19e4eaaec31c8512b191138a439b6c4c7ba73d18

                                        SHA256

                                        420a1ba2737e39704e52e1ea0c2494d8c232f10e2b40971923959da4708b3b0c

                                        SHA512

                                        ac5c8537bfd0a509ab49911cdf180778e9e47f9f9fb600933b2ba03f939f9bc9834db5a106840382ee648b289cddaf69b55cf969f51b9f89c49c678f1edc202c

                                      • C:\Users\Admin\AppData\Local\Temp\1000008001\a96907737a.exe

                                        Filesize

                                        89KB

                                        MD5

                                        cc86773e8d2f2c3ade17e0b062aecddb

                                        SHA1

                                        5e7790ca0b918b8e74e4e85af0c08f81cb4ade0f

                                        SHA256

                                        51f4ab5d835ea80224cd5ceec0fcd7cbae80ffc1216b3da35c498cf4b01224cd

                                        SHA512

                                        9f5bc37e717063dd0758bbcd77789038aed67b191a0ff23ee6f408a08c9b9992f298643108ed148eacbaaf9322b65acc82f3737e3da664f7a44b96796a1b4350

                                      • C:\Users\Admin\AppData\Local\Temp\E560.tmp\E561.tmp\E562.bat

                                        Filesize

                                        2KB

                                        MD5

                                        4ac6a9d9e192f54598f8b67cf299ea5e

                                        SHA1

                                        c3c63fc731603f581ab71bab7651a4d5112b04e6

                                        SHA256

                                        f1179bc15a8c644c353af64d6c6c3f13fd2d48eed2fb0b709a167185d2ed806e

                                        SHA512

                                        3ff1226c147403aa5afdc515f260849196dec92166273206256ce8437a98dc1dd3b2cf913861e7537ccf36d6bc53537bd49b600e9adb1671f4bdb3d6e3da23a5

                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                        Filesize

                                        442KB

                                        MD5

                                        85430baed3398695717b0263807cf97c

                                        SHA1

                                        fffbee923cea216f50fce5d54219a188a5100f41

                                        SHA256

                                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                        SHA512

                                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                        Filesize

                                        8.0MB

                                        MD5

                                        a01c5ecd6108350ae23d2cddf0e77c17

                                        SHA1

                                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                        SHA256

                                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                        SHA512

                                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\db\data.safe.bin

                                        Filesize

                                        2KB

                                        MD5

                                        bd154da8f8b68fb93d7151152926da5c

                                        SHA1

                                        8e05d3e684c8d9101b5364c84f840a2ff87007c7

                                        SHA256

                                        10acff73c70673d87b3eefc4f6f79b56112ae2b87e1f2b7534579c43a7be8e0d

                                        SHA512

                                        7464afa1ffe45431a143e3ad217885240fa8e6647ee48d1c2c268a9ad87805c10c3bf6f1643a73271c4b963f895cc7fa5f7f828acb3e7859eb4bc0fddb295fa7

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\162cc495-b3a0-457a-a4da-f1bd8b1713c7

                                        Filesize

                                        745B

                                        MD5

                                        135e7778e893000a749026e84cca8060

                                        SHA1

                                        3d34cc6c40cc2575a80d369c4e928730de17abb0

                                        SHA256

                                        47167974b7a34c17caf0c696ae639a03408ac2d653c280a13c2e501564465517

                                        SHA512

                                        41eee69b7ac661241d9f84cd4da850e3d2fe18ef10c344e2ed46d264d354268eb4a310e8e8e26d1e9d0e765d55c0f0f17f7548b8d88cba3a9684623fb8e9640b

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\datareporting\glean\pending_pings\e4b2ff55-694e-4cad-8b57-bac5325f43e0

                                        Filesize

                                        10KB

                                        MD5

                                        e84660e88979fb22550b88a1cf3711db

                                        SHA1

                                        066c421f349cb0628934b9b88c14c983a92fb916

                                        SHA256

                                        b6a46d44b339f54f16d4f9ab45f70e57adc62b62b5949277fa190fd2a071f27e

                                        SHA512

                                        cdd6364c0213afaa2ee23d4ef9edb4e7ad3431f7ace17b6575a368f814953d3d3af8c6cda82353c6b73b628e5b3cdfdd45bcc35bcce2d5fc205d3c703503ec92

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                        Filesize

                                        997KB

                                        MD5

                                        fe3355639648c417e8307c6d051e3e37

                                        SHA1

                                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                        SHA256

                                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                        SHA512

                                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                        Filesize

                                        116B

                                        MD5

                                        3d33cdc0b3d281e67dd52e14435dd04f

                                        SHA1

                                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                        SHA256

                                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                        SHA512

                                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                        Filesize

                                        479B

                                        MD5

                                        49ddb419d96dceb9069018535fb2e2fc

                                        SHA1

                                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                        SHA256

                                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                        SHA512

                                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                        Filesize

                                        372B

                                        MD5

                                        8be33af717bb1b67fbd61c3f4b807e9e

                                        SHA1

                                        7cf17656d174d951957ff36810e874a134dd49e0

                                        SHA256

                                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                        SHA512

                                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                        Filesize

                                        11.8MB

                                        MD5

                                        33bf7b0439480effb9fb212efce87b13

                                        SHA1

                                        cee50f2745edc6dc291887b6075ca64d716f495a

                                        SHA256

                                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                        SHA512

                                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                        Filesize

                                        1KB

                                        MD5

                                        688bed3676d2104e7f17ae1cd2c59404

                                        SHA1

                                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                        SHA256

                                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                        SHA512

                                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                        Filesize

                                        1KB

                                        MD5

                                        937326fead5fd401f6cca9118bd9ade9

                                        SHA1

                                        4526a57d4ae14ed29b37632c72aef3c408189d91

                                        SHA256

                                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                        SHA512

                                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

                                        Filesize

                                        6KB

                                        MD5

                                        72098c6cb4fa721a2c262a364b0e4426

                                        SHA1

                                        fd94f24823c3ed49f9371cc9d55406c15a274a54

                                        SHA256

                                        5f46ee321c39200645722dd7d5de738ab6d69e022132aaa955423c82d69323da

                                        SHA512

                                        61c5d889abe84f98025d78eca0a7bb17bba46ff9770cf3b18c176e256de9a90c7e79df50d49b93f8a462fd3c7c6ab7c8c9314dc2e2d8455e332ad0486bae089b

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

                                        Filesize

                                        6KB

                                        MD5

                                        bbeb32be9c05f01134665a9329dbf49f

                                        SHA1

                                        f35961666c6bd3801ddf87c7b225b4c161b824dc

                                        SHA256

                                        b7740ae02e43157d314575d1c6777ab3ccf07f22464aedc1d171d700d7c17124

                                        SHA512

                                        4a314e2320cede3cf8ccd01204399598318fcfd443acfab0378e432f135bc2f4e69ef6b77a4eb3708090c555f10b290544e3623ef5338ce65f7117034b21e118

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs-1.js

                                        Filesize

                                        7KB

                                        MD5

                                        d98170fea5f7bbe00e65379d31e439d5

                                        SHA1

                                        049b78dd697239b71a21270deb2c97d6ef490baa

                                        SHA256

                                        02a3aac06e6952dafaf5c48488bda3346bec4f6785994ff5973d224b0be7a8fd

                                        SHA512

                                        42e825d2474b03d8d0c4801cfcea4fdec06b6ebd755b31290eeccafb12ca18e2993e31c06debfc0d1cd4128973eafa04d94b0a36af293ebe783bcf2a6d3b33e8

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\prefs.js

                                        Filesize

                                        6KB

                                        MD5

                                        80186056555106a0722c8731e7b08d64

                                        SHA1

                                        507be64f64b7739fb91df41d23d0df47d9e9ca9f

                                        SHA256

                                        c02370e823b9ac6ddbccf4685e84f04bade54d90baa110c6994e7d77ed08d2e6

                                        SHA512

                                        f6fb0cabe210b40bafaa0d6a9bcfd24485be26c8527393ea3efb61739376b301b5be79306ffbcd6d2ca6fa8ec9e4fdfcde08b00ab8133e36a749c5cf98016a95

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

                                        Filesize

                                        4KB

                                        MD5

                                        6bfbe10ef3feccbcbea782c77352e3f7

                                        SHA1

                                        5d3c69fce4b59422fc9651c45a054cf94e9f66a2

                                        SHA256

                                        1ba1a6f281e17e55a37117518b0d730aa895b032d3ae0e9cf652e578640913b6

                                        SHA512

                                        787c65c7ddd10d51d4f4a7ef5f4983f1c471ccb7a777ffabd268b598e29d9fa8d291032f31b47cae5cb5efde7cbb03f5322ba185bbd9cdee5f0d181b0ee7ac5c

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\sessionstore-backups\recovery.jsonlz4

                                        Filesize

                                        4KB

                                        MD5

                                        b73411a9e764dafb0d4643f8fd26c42f

                                        SHA1

                                        d1f3901e6a264407b424fa79f7582fa5e06626bb

                                        SHA256

                                        b550226f75cc2cc0a57f78cb4fcee0185eb427a68d23f311f88e98e26594480c

                                        SHA512

                                        05acb35590038bc56fe78dd6efa792a1b5b97d0cda843f155d22be176076ed34d7af2122c5bca86f412b49558538173a082b71987281e326bf4b100f8376d874

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nndpnsl0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                        Filesize

                                        184KB

                                        MD5

                                        b35168e22d4587ca37d0174f4eb27c8c

                                        SHA1

                                        a07075038391d0b93092e1618497a7799dcb5e18

                                        SHA256

                                        83cde2e7574cc3209d39b0db964fcfcc28f52e077021ab0604b3f52710f8ccc1

                                        SHA512

                                        277cd4696f5a1db9a14ee880b423932a0c00a1f7f9944560942dcc8a6ea930e84e0bb42962ef3c7b27c192e041ba86eebc945ea32dded85a34dcf5a57358a79e

                                      • memory/1320-15-0x0000000000D70000-0x000000000122F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1320-1-0x0000000077B90000-0x0000000077B92000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1320-2-0x0000000000D71000-0x0000000000D9F000-memory.dmp

                                        Filesize

                                        184KB

                                      • memory/1320-3-0x0000000000D70000-0x000000000122F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1320-0-0x0000000000D70000-0x000000000122F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1320-5-0x0000000000D70000-0x000000000122F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1320-10-0x0000000000D70000-0x000000000122F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-330-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-417-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-17-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-19-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-21-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-89-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-306-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-268-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-408-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-253-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-416-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-18-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-430-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-248-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-443-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-444-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-445-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-446-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-447-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-453-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-454-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB

                                      • memory/1820-214-0x0000000000B50000-0x000000000100F000-memory.dmp

                                        Filesize

                                        4.7MB