Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2024, 01:08

General

  • Target

    373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe

  • Size

    1.8MB

  • MD5

    3ca635061fa9685d799784f665850565

  • SHA1

    549bb2808560d826b7be8ea502b46e3cdc101ce3

  • SHA256

    373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb

  • SHA512

    7812edb799fc4ac60c856c61ecd793fb5499ffe433c9bf60e251d4e3e9d5bb4df8d8f2873bb643036ccbb5bc611cc339ad8e8789feec3b3c5834bb72ed887792

  • SSDEEP

    24576:9w/gXXZLf9FpuSVA83ZIaoOD8BR98BpLOKKxsGaC3x5MY0s9r3k7in9tFvGH:9kKpVu8pIO+D8rLOKHRQ5MYR3mV

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 10 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe
    "C:\Users\Admin\AppData\Local\Temp\373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Users\Admin\AppData\Local\Temp\1010832001\8b454a45af.exe
        "C:\Users\Admin\AppData\Local\Temp\1010832001\8b454a45af.exe"
        3⤵
        • Enumerates VirtualBox registry keys
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1972
      • C:\Users\Admin\AppData\Local\Temp\1010833001\3f3f5ea8aa.exe
        "C:\Users\Admin\AppData\Local\Temp\1010833001\3f3f5ea8aa.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2832
      • C:\Users\Admin\AppData\Local\Temp\1010834001\2704fd3c33.exe
        "C:\Users\Admin\AppData\Local\Temp\1010834001\2704fd3c33.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2784
      • C:\Users\Admin\AppData\Local\Temp\1010835001\8a9e2c7282.exe
        "C:\Users\Admin\AppData\Local\Temp\1010835001\8a9e2c7282.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:748
      • C:\Users\Admin\AppData\Local\Temp\1010836001\f85c115af8.exe
        "C:\Users\Admin\AppData\Local\Temp\1010836001\f85c115af8.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1832
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2636
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1196
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1388
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1932
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1712
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1912
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.0.1780278759\1875541443" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09d48e23-6895-4712-8b0f-5fe40cf2f9c0} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 1296 128e5058 gpu
              6⤵
                PID:2852
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.1.1224423619\1596953378" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cabdf1a6-9240-4bf8-8cce-c4115df14a48} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 1512 e71b58 socket
                6⤵
                  PID:756
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.2.90872897\778685358" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {19beef15-602b-4bf6-8cfa-75b66657856c} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 2108 1a7f3558 tab
                  6⤵
                    PID:2076
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.3.393596178\1003355182" -childID 2 -isForBrowser -prefsHandle 2596 -prefMapHandle 2592 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dec152fe-55ed-41bd-b7fd-e0ac37a737ae} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 2712 e64b58 tab
                    6⤵
                      PID:1412
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.4.943670386\960781120" -childID 3 -isForBrowser -prefsHandle 3412 -prefMapHandle 3692 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99caae62-1289-46fe-ae6b-0145c000be89} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 3724 20437c58 tab
                      6⤵
                        PID:324
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.5.1501857847\542134683" -childID 4 -isForBrowser -prefsHandle 3836 -prefMapHandle 3840 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {188d9456-500c-43ed-b15f-a597210d37be} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 3824 1bb4cc58 tab
                        6⤵
                          PID:1516
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1912.6.1744238979\820912223" -childID 5 -isForBrowser -prefsHandle 4040 -prefMapHandle 4044 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a3ae0d3-ff0a-409d-8da1-a7a01372baf9} 1912 "\\.\pipe\gecko-crash-server-pipe.1912" 4028 212b2558 tab
                          6⤵
                            PID:880
                    • C:\Users\Admin\AppData\Local\Temp\1010837001\2bb7ba6b04.exe
                      "C:\Users\Admin\AppData\Local\Temp\1010837001\2bb7ba6b04.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2568

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  26KB

                  MD5

                  b458301fe67c4c4ad33e10032fd963d2

                  SHA1

                  764ccb75da7eaf5bd08e230f882fa0e91105c2a8

                  SHA256

                  c1bd68efa7b3e2a0add214da7e7cd4a00b699b9083429cd87cab6802d8f207c2

                  SHA512

                  5aca8640730fe1dc0d24a5e708cf44228f54d88c5c447eaf211c6304bc8fa1c4f80a6ad24dcb85b8502827e928c41c5b44f1b6dabb16b61ed44a3e55bf0dcc26

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                  Filesize

                  13KB

                  MD5

                  f99b4984bd93547ff4ab09d35b9ed6d5

                  SHA1

                  73bf4d313cb094bb6ead04460da9547106794007

                  SHA256

                  402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

                  SHA512

                  cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

                • C:\Users\Admin\AppData\Local\Temp\1010832001\8b454a45af.exe

                  Filesize

                  4.2MB

                  MD5

                  c94feb7d4fe260f53cc227b9833c6b7e

                  SHA1

                  8d1f50a705256b9b8b688ed385799ed297ca0138

                  SHA256

                  9926ea0046fd1472946e4db23cd38e22ceecb5dd384ed91fc105a6c4d266ca1d

                  SHA512

                  fe606f2006ba996ca9afda8b42c89e297106541ced3b2cef15689c6e2a361b69cd2275fa21ba333031befc5321f7c463e935da0ee7a18b07d12ec4f24d191ce6

                • C:\Users\Admin\AppData\Local\Temp\1010833001\3f3f5ea8aa.exe

                  Filesize

                  4.3MB

                  MD5

                  a3b6fc75e9332e814f8068fc74937028

                  SHA1

                  aacf898df6cdc6b7da5d97b7a5728108a1551a18

                  SHA256

                  a28d11a71ff174f3f011ec4b94d0c67c6c07a367f165347ad02d7004dae27a26

                  SHA512

                  3d5db5aab7952acb8bcdf670a4eaa14b606b6518219ba15ab6bc5f2c9b5feb2d0acf3c5146751965d33f5cb93bd87048f2e5f4e3928aa3358143cc682ac0bc84

                • C:\Users\Admin\AppData\Local\Temp\1010834001\2704fd3c33.exe

                  Filesize

                  1.8MB

                  MD5

                  1d118d21b56a59293e64999be49fb8d1

                  SHA1

                  508580f5568eb0640792416745849846680ba6bd

                  SHA256

                  69400f595fba73b10cbe83c95fffce2cc33d4f5134d9a96c7c9b9e16c898f15a

                  SHA512

                  1a158c3469cf0f0f375f311960750885bd21557bce25bf53115e2514e7c945dd9e540ffcb760f99a1bcddc1ec0511448441301f24f302714a8489284f7f6ba87

                • C:\Users\Admin\AppData\Local\Temp\1010835001\8a9e2c7282.exe

                  Filesize

                  1.7MB

                  MD5

                  5851c6aa37bcc0a5b5b899cbc5f2518e

                  SHA1

                  1553c526dbf937284eb69d8005276daafd768f11

                  SHA256

                  eda726274201ab47f594adb46b80559f8a6d057d9feca660143642e3a475fcf5

                  SHA512

                  26a1ac576d0cfba9de3e769594d54d1b88299664614946e0de5f26bc6a00b68da1414497b31bc586463250f6b9bad69f3c552f45e1fcb2b48013195004986da1

                • C:\Users\Admin\AppData\Local\Temp\1010836001\f85c115af8.exe

                  Filesize

                  900KB

                  MD5

                  36945cc772da75aae26bd98962b20cf5

                  SHA1

                  644291aadfc10b8f25d403d53cb9d3cab93e7088

                  SHA256

                  74aebd1ac1cd8dad4f39dd7a8a041b874eb567d2996eaab01aa7e1770f844a06

                  SHA512

                  eaaa83aba45c84019b25b663834b422024d11c217211795cd7c487214821d26afb1014c878de2ee60d061319e4015bd232ad4d065bcf8604943ea73e28b388c2

                • C:\Users\Admin\AppData\Local\Temp\1010837001\2bb7ba6b04.exe

                  Filesize

                  2.7MB

                  MD5

                  944eb68b3615a8ec06e3dee7f5aacfc8

                  SHA1

                  d0b1a5caa37cb68232ae4f44febc69fcdcefc962

                  SHA256

                  2214f8f849171ce12a6761de39767107281f59f8b2ceb9b1e745b3f94f3db5ea

                  SHA512

                  139cf47d341f35030825c1f4d71d20afc94ec9cd2760507bce4b5fa95bfab0ac4bddcc71839e89f02f7bc4b0722b504c8124729e80770843038d216188ae44d3

                • C:\Users\Admin\AppData\Local\Temp\Cab144E.tmp

                  Filesize

                  70KB

                  MD5

                  49aebf8cbd62d92ac215b2923fb1b9f5

                  SHA1

                  1723be06719828dda65ad804298d0431f6aff976

                  SHA256

                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                  SHA512

                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                • C:\Users\Admin\AppData\Local\Temp\Tar1470.tmp

                  Filesize

                  181KB

                  MD5

                  4ea6026cf93ec6338144661bf1202cd1

                  SHA1

                  a1dec9044f750ad887935a01430bf49322fbdcb7

                  SHA256

                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                  SHA512

                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  442KB

                  MD5

                  85430baed3398695717b0263807cf97c

                  SHA1

                  fffbee923cea216f50fce5d54219a188a5100f41

                  SHA256

                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                  SHA512

                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  8.0MB

                  MD5

                  a01c5ecd6108350ae23d2cddf0e77c17

                  SHA1

                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                  SHA256

                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                  SHA512

                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin

                  Filesize

                  9KB

                  MD5

                  66bb5fc6b672ad6329a6c0003f9e1e98

                  SHA1

                  7e8a54d524a57b355fadd4b7c5eaecab76b51302

                  SHA256

                  943d51a88ef831251d3bf7a91f1ea2e4125299b1e58f8c3a15f69e22540c9ea0

                  SHA512

                  1ed52f26eae88f49fc91c78d4e512f90af579b9e046c3b06fe61ec0108de015a22355bbc6e64c3a036957c61bb7b9d1076fd2f1472b4aa3daba0420bf146b3a9

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\e2b04aa4-93b2-4c7a-b5bf-7892f5a67bd5

                  Filesize

                  733B

                  MD5

                  63270712cef600468a463a8ade5cc477

                  SHA1

                  459534aff47e9d5e27ca18c559505b41b1ff2d84

                  SHA256

                  306f2ebc7601411e65a42155a3381313c841e0d36a7590efaa2850e32fb6846a

                  SHA512

                  655f7096fcc038c1a366aaac0ffd5a2ed4da9e83ba1a1b6b51832863e3975c44b9570a920c1ff2b55fb0b347e4cff40748a675435a661b37005d79e923bfc637

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                  Filesize

                  997KB

                  MD5

                  fe3355639648c417e8307c6d051e3e37

                  SHA1

                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                  SHA256

                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                  SHA512

                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  3d33cdc0b3d281e67dd52e14435dd04f

                  SHA1

                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                  SHA256

                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                  SHA512

                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                  Filesize

                  479B

                  MD5

                  49ddb419d96dceb9069018535fb2e2fc

                  SHA1

                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                  SHA256

                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                  SHA512

                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                  Filesize

                  372B

                  MD5

                  8be33af717bb1b67fbd61c3f4b807e9e

                  SHA1

                  7cf17656d174d951957ff36810e874a134dd49e0

                  SHA256

                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                  SHA512

                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                  Filesize

                  11.8MB

                  MD5

                  33bf7b0439480effb9fb212efce87b13

                  SHA1

                  cee50f2745edc6dc291887b6075ca64d716f495a

                  SHA256

                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                  SHA512

                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                  Filesize

                  1KB

                  MD5

                  688bed3676d2104e7f17ae1cd2c59404

                  SHA1

                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                  SHA256

                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                  SHA512

                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                  Filesize

                  1KB

                  MD5

                  937326fead5fd401f6cca9118bd9ade9

                  SHA1

                  4526a57d4ae14ed29b37632c72aef3c408189d91

                  SHA256

                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                  SHA512

                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

                  Filesize

                  6KB

                  MD5

                  40a0c2995a5181fd7ab3b1fd7e99d374

                  SHA1

                  8375c98d37f0aa8850cdb075bd96c9e105edd20e

                  SHA256

                  1a11684a28d13ee52ce3148246693f5cd2f6621c41fb2e0a54a293f848750496

                  SHA512

                  b079d75024bdf26e008d60b833405d5baebbe378b57b6364fbd8ac0a1dd98c8bfea4d29ca7b0455eb2bb0ecce59fd3c67ca7a8f37b7af093ead9bbc03daf5769

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

                  Filesize

                  7KB

                  MD5

                  09ab4a6ba52cb1adbdd236808dacafbd

                  SHA1

                  a7852d5d8cbcb16b28fc8ddf07ea5e44efafc8fb

                  SHA256

                  1162cce3ac21aa40ad79f97e4e0cc405fb16a8821d2c94f005776ab4d925f0e2

                  SHA512

                  3844532279d24821faf89b8999398809500a13ac8cfa8f51b44b01825dfbbcbc6b21938b96c99609fc0e79c3063a480b0c278d3afeadd1df7b88c2f07247cabb

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

                  Filesize

                  7KB

                  MD5

                  f3b481bb3d34caeda496b1407150d6e4

                  SHA1

                  159516210c18611dad3a4b23a82a8ce27a092181

                  SHA256

                  a3ea27150a0db6c4efdb96f91d3cd7a9b2977d8541ce214ce2c93c2efbbc2076

                  SHA512

                  57fdaf336aa453bdc13cafefae31c75f346b4c8a0b153880027172ce469deac10cef53ec112713c826644ff567125b48d6ea5c2ed8b8e91024284e486b9657f5

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

                  Filesize

                  6KB

                  MD5

                  3ee11d9d8702542283b443acf52f6322

                  SHA1

                  9332c7e3d4f0d8f28f6d64f58c3e853a6ec17115

                  SHA256

                  133ed00219ed2ed8f5eadeebbad0e34cefdb547975d2eed139240c262905efd9

                  SHA512

                  750957637f2be7b20efd154bcdc5e577f342321d28d960abb365ef2dd44f5b7179578fe67288b35a3a91913d8080ebdfdfe9a7ca7789aa3d693a2a0c57ab08b8

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  4KB

                  MD5

                  c25324135a33d39d3b635b7d00637ba8

                  SHA1

                  e4de51ecb1d111e54e2b12e5938988ac6c441c24

                  SHA256

                  5bd45d89bd08826a9fbb8b2358e0b104ad6514b9c99615afc6c4c18c96e51812

                  SHA512

                  4185ec6b72f4c5994b103ab13be7f42534824e3121c30aebd4c8fd76181570fe30c9a1c59516a140c8678c12c354b049f3fdb450226756b6c0fb6f69b0f3f326

                • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                  Filesize

                  1.8MB

                  MD5

                  3ca635061fa9685d799784f665850565

                  SHA1

                  549bb2808560d826b7be8ea502b46e3cdc101ce3

                  SHA256

                  373ffb138b7376264a307837ef5bd51bd02380376f9fdd27350cf1b65a28bcbb

                  SHA512

                  7812edb799fc4ac60c856c61ecd793fb5499ffe433c9bf60e251d4e3e9d5bb4df8d8f2873bb643036ccbb5bc611cc339ad8e8789feec3b3c5834bb72ed887792

                • memory/748-107-0x0000000000320000-0x00000000009AF000-memory.dmp

                  Filesize

                  6.6MB

                • memory/1972-66-0x0000000000ED0000-0x0000000001B5A000-memory.dmp

                  Filesize

                  12.5MB

                • memory/1972-46-0x0000000000ED0000-0x0000000001B5A000-memory.dmp

                  Filesize

                  12.5MB

                • memory/1988-20-0x0000000007210000-0x00000000076B9000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1988-3-0x0000000000070000-0x0000000000519000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1988-4-0x0000000000070000-0x0000000000519000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1988-5-0x0000000000070000-0x0000000000519000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1988-2-0x0000000000071000-0x000000000009F000-memory.dmp

                  Filesize

                  184KB

                • memory/1988-19-0x0000000007210000-0x00000000076B9000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1988-18-0x0000000000070000-0x0000000000519000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1988-0-0x0000000000070000-0x0000000000519000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1988-1-0x0000000077400000-0x0000000077402000-memory.dmp

                  Filesize

                  8KB

                • memory/2568-288-0x00000000001E0000-0x00000000004A8000-memory.dmp

                  Filesize

                  2.8MB

                • memory/2568-287-0x00000000001E0000-0x00000000004A8000-memory.dmp

                  Filesize

                  2.8MB

                • memory/2696-47-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-22-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-446-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-61-0x0000000006E10000-0x0000000007AAD000-memory.dmp

                  Filesize

                  12.6MB

                • memory/2696-45-0x0000000006E10000-0x0000000007A9A000-memory.dmp

                  Filesize

                  12.5MB

                • memory/2696-43-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-41-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-29-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-28-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-445-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-104-0x0000000006E10000-0x0000000007AAD000-memory.dmp

                  Filesize

                  12.6MB

                • memory/2696-306-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-26-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-312-0x0000000006E10000-0x000000000749F000-memory.dmp

                  Filesize

                  6.6MB

                • memory/2696-335-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-27-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-344-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-24-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-23-0x0000000000F91000-0x0000000000FBF000-memory.dmp

                  Filesize

                  184KB

                • memory/2696-156-0x0000000006E10000-0x00000000072AC000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2696-106-0x0000000006E10000-0x000000000749F000-memory.dmp

                  Filesize

                  6.6MB

                • memory/2696-105-0x0000000006E10000-0x000000000749F000-memory.dmp

                  Filesize

                  6.6MB

                • memory/2696-444-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-87-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-85-0x0000000006E10000-0x00000000072AC000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2696-83-0x0000000006E10000-0x00000000072AC000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2696-443-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-64-0x0000000006E10000-0x0000000007A9A000-memory.dmp

                  Filesize

                  12.5MB

                • memory/2696-427-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-429-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-430-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-441-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2696-442-0x0000000000F90000-0x0000000001439000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2784-84-0x0000000000F80000-0x000000000141C000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2784-157-0x0000000000F80000-0x000000000141C000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2832-63-0x0000000000100000-0x0000000000D9D000-memory.dmp

                  Filesize

                  12.6MB

                • memory/2832-62-0x0000000000100000-0x0000000000D9D000-memory.dmp

                  Filesize

                  12.6MB