Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2024, 15:44

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    5c87bc7b86c06bb8cd470891009473f0

  • SHA1

    5206f5d15901d89f85e8eaffb3c769c157b0718f

  • SHA256

    0bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363

  • SHA512

    c4d9f94f58f19c3cadfa0eff7651dcf0c6ef3278848b53a4bb4b5aee19c8442248f233d22256eaf5f1f5e107d635623f8eb5598f3e8bdd3c209b9b6f27d6365a

  • SSDEEP

    49152:uOYlNL4bhn1aqOU0y3xLYSFNo822Vy8cFGmrt0uU:8Nsbhn5OUh3xLYSD20y7B

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://founpiuer.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 3 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Users\Admin\AppData\Local\Temp\1004133001\f13b260116.exe
        "C:\Users\Admin\AppData\Local\Temp\1004133001\f13b260116.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2484
      • C:\Users\Admin\AppData\Local\Temp\1004134001\b9eb31a7d7.exe
        "C:\Users\Admin\AppData\Local\Temp\1004134001\b9eb31a7d7.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1924
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefaa29758,0x7fefaa29768,0x7fefaa29778
            5⤵
              PID:2592
            • C:\Windows\system32\ctfmon.exe
              ctfmon.exe
              5⤵
                PID:1816
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:2
                5⤵
                  PID:672
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:8
                  5⤵
                    PID:2456
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:8
                    5⤵
                      PID:752
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:2356
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:2896
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=976 --field-trial-handle=1268,i,10807321393205314410,15396512689814770081,131072 /prefetch:2
                      5⤵
                      • Drops file in Program Files directory
                      PID:2384
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 960
                    4⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:3228
                • C:\Users\Admin\AppData\Local\Temp\1004135001\30671e2514.exe
                  "C:\Users\Admin\AppData\Local\Temp\1004135001\30671e2514.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:344
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1768
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2792
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2064
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:552
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1020
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    4⤵
                      PID:940
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        5⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:756
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.0.70805275\1245743848" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {95f31364-d478-492b-be67-d195befe07ae} 756 "\\.\pipe\gecko-crash-server-pipe.756" 1304 46f3b58 gpu
                          6⤵
                            PID:1908
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.1.519233231\137627110" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {defbe69a-996c-4801-acfc-6ec1a34f3d04} 756 "\\.\pipe\gecko-crash-server-pipe.756" 1500 e74e58 socket
                            6⤵
                              PID:2344
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.2.1117121670\1249636014" -childID 1 -isForBrowser -prefsHandle 2084 -prefMapHandle 2080 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bb298c5-ea5b-4d8f-a876-756e2eafee68} 756 "\\.\pipe\gecko-crash-server-pipe.756" 2096 1a1c2358 tab
                              6⤵
                                PID:1896
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.3.2125585266\1241664868" -childID 2 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f10f1850-6165-43f8-b0f4-f461c4878392} 756 "\\.\pipe\gecko-crash-server-pipe.756" 2916 1b19a058 tab
                                6⤵
                                  PID:2124
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.4.107699797\372071087" -childID 3 -isForBrowser -prefsHandle 3628 -prefMapHandle 3648 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c41b3e9e-f31a-426b-9d0e-e2ff226f6149} 756 "\\.\pipe\gecko-crash-server-pipe.756" 3616 1f90fb58 tab
                                  6⤵
                                    PID:2276
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.5.1099073971\1239676362" -childID 4 -isForBrowser -prefsHandle 3808 -prefMapHandle 3812 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ee07942-6583-4ba5-a4d9-460f9986c2ac} 756 "\\.\pipe\gecko-crash-server-pipe.756" 3796 1f912258 tab
                                    6⤵
                                      PID:1116
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="756.6.1341650051\253360296" -childID 5 -isForBrowser -prefsHandle 3984 -prefMapHandle 3988 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5495b035-9dea-4a0b-99a4-00d85fe126fa} 756 "\\.\pipe\gecko-crash-server-pipe.756" 3972 1f912e58 tab
                                      6⤵
                                        PID:2616
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:2268

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                Filesize

                                16B

                                MD5

                                18e723571b00fb1694a3bad6c78e4054

                                SHA1

                                afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                SHA256

                                8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                SHA512

                                43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\activity-stream.discovery_stream.json.tmp

                                Filesize

                                22KB

                                MD5

                                6060ccb85c910cb99fed867468a5259d

                                SHA1

                                70d2e4cb6abc7567df6040a1a79e6d668ccc4639

                                SHA256

                                06ad676e1eada008f7d003c8ca6456a4120d429ed05a20c5402a98639a658bf0

                                SHA512

                                2c683734960536d293197d565831d07a95158ae5fe4b93f196cf6f6d112c17f1ed6518f8c368eb4b820b15ff60c3cf09ac67fb441ff79f160499f672e7ddfd7c

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n3lsnn48.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                Filesize

                                13KB

                                MD5

                                f99b4984bd93547ff4ab09d35b9ed6d5

                                SHA1

                                73bf4d313cb094bb6ead04460da9547106794007

                                SHA256

                                402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

                                SHA512

                                cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

                              • C:\Users\Admin\AppData\Local\Temp\1004133001\f13b260116.exe

                                Filesize

                                3.0MB

                                MD5

                                0d7b1ba6e967a55e6cff34069832498e

                                SHA1

                                be54bc4033d47cd14bc9648ce964c67b283fb6c6

                                SHA256

                                6ecb0aee684e895fbaede81d1ecacd3b2379301d7ab37ccd883de5ece7651988

                                SHA512

                                a4713d6a23b406c2bba2035d34c9e8a7da2b4af1fb27f3a26b9821c45f250766b7d171044b7f8a35bc51a49eae7f6541c483af0bb08f06040b9fc4be567c73e2

                              • C:\Users\Admin\AppData\Local\Temp\1004134001\b9eb31a7d7.exe

                                Filesize

                                2.1MB

                                MD5

                                d295038f6facf219e302c0444bffa7b0

                                SHA1

                                17a55b8e0872feb3476eb425758c7b8500e857fb

                                SHA256

                                a0cc678c942c6f391cb39e06f20cb9a8cdc2e319e41f52023c5e0e7b3985594d

                                SHA512

                                075691b3e30fd88fc59428f94c05858a0d625b371a1c44625d2d801efe337548bff94d7dc4facf14cbb88679a8186f23b053b9c7952120f40b50498693178e09

                              • C:\Users\Admin\AppData\Local\Temp\1004135001\30671e2514.exe

                                Filesize

                                898KB

                                MD5

                                8235b5d1589ab0fe6fbdbf7c63f574f7

                                SHA1

                                3d81dd57f1b105ce0e3648d35be7567e62715bf3

                                SHA256

                                22dc0e00649fa29f1296d0fa1a3873454548b100f49b96719eb5e53e3076d174

                                SHA512

                                8304ff6fc771e5973dc3b6a6da03bd9109dc7ef96f54b5a4876e9d1876b6cf97fa0279cee16c957dd87948682673b4f76471b58b1fdf4f33a0e4454cc9eaaaad

                              • C:\Users\Admin\AppData\Local\Temp\1004136001\0:8d23c08.exe

                                Filesize

                                2.7MB

                                MD5

                                018ab4002d0f1bfdc37b1c9fb9e9cffb

                                SHA1

                                fc9a3953eaf35b200bef857e3a30aa1557a5291f

                                SHA256

                                eef10ff2e1de516e49d2c3e257abfa550a733819375ca20d7fdc165879da1c11

                                SHA512

                                be3a705d025824c9c3f03936e6e3126d3a0fe864a9529a4dde199530e27240e896d4393e87e4b54547852a10e62457e6b63cc70bd26aae30fc6b98f7e2e32eeb

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                Filesize

                                442KB

                                MD5

                                85430baed3398695717b0263807cf97c

                                SHA1

                                fffbee923cea216f50fce5d54219a188a5100f41

                                SHA256

                                a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                SHA512

                                06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                Filesize

                                8.0MB

                                MD5

                                a01c5ecd6108350ae23d2cddf0e77c17

                                SHA1

                                c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                SHA256

                                345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                SHA512

                                b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\db\data.safe.bin

                                Filesize

                                2KB

                                MD5

                                064913bff9de30b86b9f2c5cc4bfd6c8

                                SHA1

                                58b4f0fdfc816be53d3613bec91cff732d01d521

                                SHA256

                                3bc595b237c58be92aec7525618268495dd06aeb8d2c42dd7d5d0a9a4fa6657a

                                SHA512

                                67c25459cb936dd0454fbf8af7ab817afcce05dea95f1eaf03cf0ad61c62260e963ec5fd8f6469b9fe366c274839b32b9ddc5480f649ecafb3c771bfee2d7000

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\56d941fb-4ef0-44c4-aff8-2c0e1fa2786e

                                Filesize

                                745B

                                MD5

                                f8806daa0a4d6b2ede5979585d7a6eed

                                SHA1

                                0dd1c147bb7c5fdd18ce4c451a6840016130305e

                                SHA256

                                216df1694c7e3ffce949eaba846b6c07442615bdb999d36a69cdfefa15d72614

                                SHA512

                                d1a19d8945271cb032a06695893ae08aa2287250520268922dea70512b7dcbbe9975937b9df3bd6229058b616a30c0824c81a63d7ced52370fc46be15e5737d4

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\datareporting\glean\pending_pings\86ab1b60-12d6-49d6-ab80-5357eba4e45f

                                Filesize

                                11KB

                                MD5

                                1e712642cd84e5b916a18a9d930f904a

                                SHA1

                                d700717078a9d3fd3e34c0c6e3177116d5bdb4f8

                                SHA256

                                d9947dacf273bd719ad5a0c459d25d5cdb1b8a96257196942c4acb63a0148130

                                SHA512

                                998b61cf89ddf4ca028b62b1b03e308709e76b51d586af6eca04260af448b2183b16977ae388e6c997a58434fd49f1756e4d34f5130c087d205f36d899ca4dd2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                Filesize

                                997KB

                                MD5

                                fe3355639648c417e8307c6d051e3e37

                                SHA1

                                f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                SHA256

                                1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                SHA512

                                8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                Filesize

                                116B

                                MD5

                                3d33cdc0b3d281e67dd52e14435dd04f

                                SHA1

                                4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                SHA256

                                f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                SHA512

                                a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                Filesize

                                479B

                                MD5

                                49ddb419d96dceb9069018535fb2e2fc

                                SHA1

                                62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                SHA256

                                2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                SHA512

                                48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                Filesize

                                372B

                                MD5

                                8be33af717bb1b67fbd61c3f4b807e9e

                                SHA1

                                7cf17656d174d951957ff36810e874a134dd49e0

                                SHA256

                                e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                SHA512

                                6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                Filesize

                                11.8MB

                                MD5

                                33bf7b0439480effb9fb212efce87b13

                                SHA1

                                cee50f2745edc6dc291887b6075ca64d716f495a

                                SHA256

                                8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                SHA512

                                d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                Filesize

                                1KB

                                MD5

                                688bed3676d2104e7f17ae1cd2c59404

                                SHA1

                                952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                SHA256

                                33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                SHA512

                                7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                Filesize

                                1KB

                                MD5

                                937326fead5fd401f6cca9118bd9ade9

                                SHA1

                                4526a57d4ae14ed29b37632c72aef3c408189d91

                                SHA256

                                68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                SHA512

                                b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

                                Filesize

                                6KB

                                MD5

                                2c071f511835c9da235c933003d18812

                                SHA1

                                63990e0ea5a2ecf7d30f5335efca2855829a8f16

                                SHA256

                                ad4fc651f5c7bd21f49ce3a62f7cf87c98789d832fafc27a0cffeb1265a65ae8

                                SHA512

                                6bf7d3ea161e9349830f24beedf21549fc10d732f63aff213e6078f1ba70ef16f645f44e0a907ea051c930278f5c69a381304426fa3754c22fa244e2f727a736

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs-1.js

                                Filesize

                                7KB

                                MD5

                                31ee4a9c49fce600f34358a76c2991ad

                                SHA1

                                95d11a1fe5b77dbccffa462e98f2410724a88c52

                                SHA256

                                aed4d0bbc50ec266b0a756160303b365f6e51c8e14829919bf250df76f1f03da

                                SHA512

                                1f687b3258a99a935a00a9ba52c776b2e2f1d06543aaf76f954814c9185e2d984f0ccf96782df7839ce773ca52f3e941c7f91265c8de6454d447c75c4c8e5cf8

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\prefs.js

                                Filesize

                                6KB

                                MD5

                                4a0da6e1d335b5a06e3d1b1ed2b4b42a

                                SHA1

                                5c3ca0fc0c9e53322d21c7b104d60b833b81c463

                                SHA256

                                bacdedfb0c49cde5afd693a848973084e52a0dd320309c89ed4a170dcc5390d2

                                SHA512

                                0aa26e4d3a705d2ad02b929e5982ce71c0ed5830b01188300c80fea6f10dea7b958a237768649cd50b96de578ca6465270730bac1000318364f6340f8625a525

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\sessionstore-backups\recovery.jsonlz4

                                Filesize

                                4KB

                                MD5

                                bf3229d294e946762332ff676ce25e3c

                                SHA1

                                fddf1cda5e00342dafc82fa2c4644aa0769acdc3

                                SHA256

                                d5280abf44342287fc98cf762ae01f31891a48aab265f1c046dbf86b3e566879

                                SHA512

                                a7e46ec89adad83efa1a178a19b61d2d1cb6313c9fb1e31ce74054938ad534ca865864d761bd3f35ef5b9ad89bf45d638ff493b4344e122667f936ac621dbc0a

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                Filesize

                                184KB

                                MD5

                                bece0acf9d7f19d01c7943c54d2ad372

                                SHA1

                                aef59ca4b0fe97f32db128e103bfb98aee3b5e29

                                SHA256

                                ce40f79585195148ac86928d18da80b963cc98d6feb83c1c2e75e8b6d6ef39f8

                                SHA512

                                105fb01521fca054766d1d1e46cf3bf177b8bab44800f7bbad9a84f388af32e745474b3cc4f70c1fd779b4e7bcf0912502860092e1824f7ba4b52c612ba5a70b

                              • \ProgramData\chrome.dll

                                Filesize

                                676KB

                                MD5

                                eda18948a989176f4eebb175ce806255

                                SHA1

                                ff22a3d5f5fb705137f233c36622c79eab995897

                                SHA256

                                81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                                SHA512

                                160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                              • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                Filesize

                                3.1MB

                                MD5

                                5c87bc7b86c06bb8cd470891009473f0

                                SHA1

                                5206f5d15901d89f85e8eaffb3c769c157b0718f

                                SHA256

                                0bc54a76b0a63d8f0022caf8804a3fbb9ce0d497aedc7274ab7c9bc988b17363

                                SHA512

                                c4d9f94f58f19c3cadfa0eff7651dcf0c6ef3278848b53a4bb4b5aee19c8442248f233d22256eaf5f1f5e107d635623f8eb5598f3e8bdd3c209b9b6f27d6365a

                              • memory/1380-325-0x0000000000870000-0x0000000000FAC000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/1380-67-0x0000000000870000-0x0000000000FAC000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/1380-311-0x0000000000870000-0x0000000000FAC000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/1380-69-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                Filesize

                                972KB

                              • memory/2464-1-0x00000000773F0000-0x00000000773F2000-memory.dmp

                                Filesize

                                8KB

                              • memory/2464-18-0x00000000067C0000-0x0000000006ADB000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2464-19-0x0000000001311000-0x0000000001379000-memory.dmp

                                Filesize

                                416KB

                              • memory/2464-0-0x0000000001310000-0x000000000162B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2464-14-0x0000000001310000-0x000000000162B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2464-2-0x0000000001311000-0x0000000001379000-memory.dmp

                                Filesize

                                416KB

                              • memory/2464-5-0x0000000001310000-0x000000000162B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2464-16-0x0000000001310000-0x000000000162B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2464-3-0x0000000001310000-0x000000000162B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2484-47-0x0000000000010000-0x0000000000319000-memory.dmp

                                Filesize

                                3.0MB

                              • memory/2484-45-0x0000000000010000-0x0000000000319000-memory.dmp

                                Filesize

                                3.0MB

                              • memory/2872-44-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-23-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-305-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-59-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-20-0x0000000000BF1000-0x0000000000C59000-memory.dmp

                                Filesize

                                416KB

                              • memory/2872-332-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-64-0x0000000006A20000-0x000000000715C000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/2872-342-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-264-0x0000000006A20000-0x000000000715C000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/2872-68-0x00000000063C0000-0x00000000066C9000-memory.dmp

                                Filesize

                                3.0MB

                              • memory/2872-17-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-146-0x0000000006A20000-0x000000000715C000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/2872-387-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-66-0x0000000006A20000-0x000000000715C000-memory.dmp

                                Filesize

                                7.2MB

                              • memory/2872-41-0x00000000063C0000-0x00000000066C9000-memory.dmp

                                Filesize

                                3.0MB

                              • memory/2872-43-0x0000000000BF1000-0x0000000000C59000-memory.dmp

                                Filesize

                                416KB

                              • memory/2872-40-0x00000000063C0000-0x00000000066C9000-memory.dmp

                                Filesize

                                3.0MB

                              • memory/2872-21-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-24-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-425-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-426-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-437-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-438-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-439-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-440-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-441-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-442-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB

                              • memory/2872-448-0x0000000000BF0000-0x0000000000F0B000-memory.dmp

                                Filesize

                                3.1MB