Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 02:43

General

  • Target

    8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe

  • Size

    1.8MB

  • MD5

    be131b7bc8cd4eb30eb81ccceeaaea4d

  • SHA1

    d3370bc98065a5b0d11b06a089f9280e184325b1

  • SHA256

    8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60

  • SHA512

    d3923b754ad3199815d154b996f6fc620ef2a4752e337268ebf46263271d434a35cb94ce0f48c54250a0f3e5284fa263ce00b518df577b76d3ee03b3635a5c9c

  • SSDEEP

    49152:x1C65bDvLzDByacb4n+rK7oXKjdPSoj+:xMGbbQai4nMSpSo

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe
    "C:\Users\Admin\AppData\Local\Temp\8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Users\Admin\AppData\Local\Temp\1008081001\1e33794c6b.exe
        "C:\Users\Admin\AppData\Local\Temp\1008081001\1e33794c6b.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3228
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffced41cc40,0x7ffced41cc4c,0x7ffced41cc58
            5⤵
              PID:3244
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2052,i,12087313980633843934,12698166183273456058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2040 /prefetch:2
              5⤵
                PID:2176
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1920,i,12087313980633843934,12698166183273456058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2500 /prefetch:3
                5⤵
                  PID:876
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2164,i,12087313980633843934,12698166183273456058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2624 /prefetch:8
                  5⤵
                    PID:3268
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,12087313980633843934,12698166183273456058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:696
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,12087313980633843934,12698166183273456058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3480 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:4924
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4484,i,12087313980633843934,12698166183273456058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:3240
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:3284
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:3992
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1788
                  4⤵
                  • Program crash
                  PID:2368
              • C:\Users\Admin\AppData\Local\Temp\1008086001\30c40469c2.exe
                "C:\Users\Admin\AppData\Local\Temp\1008086001\30c40469c2.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1016
              • C:\Users\Admin\AppData\Local\Temp\1008087001\d995d724bd.exe
                "C:\Users\Admin\AppData\Local\Temp\1008087001\d995d724bd.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1148
              • C:\Users\Admin\AppData\Local\Temp\1008088001\6e06b71496.exe
                "C:\Users\Admin\AppData\Local\Temp\1008088001\6e06b71496.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3208
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4408
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4612
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4472
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2152
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3064
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                    PID:4516
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      5⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:2672
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b337fe3-80b1-4bae-8c18-5c0045bb2c4a} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" gpu
                        6⤵
                          PID:4280
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2416 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fbf237d-5628-4a28-a934-c94a6a85fd75} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" socket
                          6⤵
                            PID:1876
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1332 -childID 1 -isForBrowser -prefsHandle 3080 -prefMapHandle 2860 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab946e56-7f3b-4025-b4b9-c0e1166a8681} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" tab
                            6⤵
                              PID:4804
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 2 -isForBrowser -prefsHandle 3664 -prefMapHandle 3660 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a36d95d-7bea-4746-86b2-eca45908ecde} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" tab
                              6⤵
                                PID:4560
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4556 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4484 -prefMapHandle 4532 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfd30cda-def2-4811-bcc5-0a5a7e113f10} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" utility
                                6⤵
                                • Checks processor information in registry
                                PID:5160
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 3 -isForBrowser -prefsHandle 4800 -prefMapHandle 5304 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c9e1491-f87d-4957-b84d-7144d244bbc1} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" tab
                                6⤵
                                  PID:5736
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5568 -childID 4 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afa53e9d-6557-4c0d-82e0-0120bdad12c7} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" tab
                                  6⤵
                                    PID:5748
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 5 -isForBrowser -prefsHandle 5788 -prefMapHandle 5796 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68b7ee99-0f4a-4be7-aaeb-6adec6a7dd59} 2672 "\\.\pipe\gecko-crash-server-pipe.2672" tab
                                    6⤵
                                      PID:5760
                              • C:\Users\Admin\AppData\Local\Temp\1008089001\ba99ae2978.exe
                                "C:\Users\Admin\AppData\Local\Temp\1008089001\ba99ae2978.exe"
                                3⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4840
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:2280
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5260
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3228 -ip 3228
                              1⤵
                                PID:1436
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6128
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1124

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\activity-stream.discovery_stream.json

                                Filesize

                                27KB

                                MD5

                                b5e7725e4f8f1be36b459f993bfce2d6

                                SHA1

                                234d13f9a05a1a28efbb11994bee1c14cf98ab8d

                                SHA256

                                30d7aff3169e805c1fe02c6d40263da224d5cde1ade864bcf2dd41a79a70a3e2

                                SHA512

                                35dd336125e24c9cc0769dbdb86d5f73bbcbfc4c095f3e1b11652d419b6e0f592caad2a8c230b6222f7655cef3452e555f6a5dbb5db2203acf85ec2609f990f3

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n4zftpal.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

                                Filesize

                                13KB

                                MD5

                                d7cdd0e1f6b14363af211e7c9a364c83

                                SHA1

                                4029b5183735d1c5ac5b68ea786c5121cfacbdc7

                                SHA256

                                b224d15f0dda454119fbf45a055ee8f7346481050567be8e365c77b37c6b933a

                                SHA512

                                b72c65ff8fc523859bf04b81e9c9c5a8180f711abbc82e82b8453ee3ff393105c7f3219292a2edff7d2b4164854573b010c5037a0347a2dcf64464660b83c888

                              • C:\Users\Admin\AppData\Local\Temp\1008081001\1e33794c6b.exe

                                Filesize

                                4.2MB

                                MD5

                                402af0c244e89244c6e899931f5a23b9

                                SHA1

                                4413e4e963830f4631a64830b8dc8bf3e427d53a

                                SHA256

                                e4f2dd198edb21635f20639dc65bcae2b2cf6a66b9f8a37b7253dd7b353c3ef9

                                SHA512

                                fdcce9f496704336b45ec255095f7dd76fa0af26cf8ab784a283d55d5b05bd94ef3d3e61bee5b9f7e20251dfaaef9834373e6ff39e21fc689551a4ae5a27f1da

                              • C:\Users\Admin\AppData\Local\Temp\1008086001\30c40469c2.exe

                                Filesize

                                1.8MB

                                MD5

                                c29c30bfb75bf498848c908638625e45

                                SHA1

                                9879e768d895a6f4fa69bbff4c4d7193321dcc9f

                                SHA256

                                06a34982b9154716e14297712ecb8efb2bc9bcce381e6e4305cf2e1579bfdcd4

                                SHA512

                                ada1d2345e2a0bbb3aef2916cc001094524638a38f431817eb80207215c9eb935e2f7dfee50870b90dc43af4d39a72b4640d12aaaa51c839da0c7ef076167205

                              • C:\Users\Admin\AppData\Local\Temp\1008087001\d995d724bd.exe

                                Filesize

                                1.8MB

                                MD5

                                e5a48f23e7b32f452f9bf2e6bf42094c

                                SHA1

                                4f95895d7a641793c3e603847c06ffd51fb29940

                                SHA256

                                90a76e28f761c3a0580ec1b56eb241b57001091cac3d63378dec4368279103dd

                                SHA512

                                3ad71818ffa0544e8c7e302c49a51b7e58b42543a0640a588e448d4d1ebb9e4b880e1869a634b7e66a2d11849eb2c68672b575f7b6386393bc02ff052293ded4

                              • C:\Users\Admin\AppData\Local\Temp\1008088001\6e06b71496.exe

                                Filesize

                                901KB

                                MD5

                                6e6af329feb47e6d6dec9389429cfd07

                                SHA1

                                dfd44cfcabd9d5ae746ad4221e55302b89002b0a

                                SHA256

                                f6dc47d57da7bec7190d32e4140b861714fefc6ceac91faf1ae3d65eae141d5d

                                SHA512

                                da9e894874433ae748912ad95dc0e92a9e9cb44f95755d2ba929355abd9de631fa9b4fddebd1647d655ca8c62cc7284c97a1d4de174ce47b3cd6ec5c51a5e157

                              • C:\Users\Admin\AppData\Local\Temp\1008089001\ba99ae2978.exe

                                Filesize

                                2.6MB

                                MD5

                                737f95c4ab6db790a94058de0ae65785

                                SHA1

                                27e0429b7426a619bfdfe0c71e4f5c995eb82dad

                                SHA256

                                b15c5a342a7300a91373426ca437580d1dc969403e9a855cf89c4876aaa3f3eb

                                SHA512

                                cc57f79bc6ed4884d174ff37cc5dd64b71946c0114b5fdb1df8aac9248db9425afcd93444bfa1a925801d82caac18eec91ad6ce6eb0d2aacc5c3f77ca693d1f7

                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                Filesize

                                1.8MB

                                MD5

                                be131b7bc8cd4eb30eb81ccceeaaea4d

                                SHA1

                                d3370bc98065a5b0d11b06a089f9280e184325b1

                                SHA256

                                8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60

                                SHA512

                                d3923b754ad3199815d154b996f6fc620ef2a4752e337268ebf46263271d434a35cb94ce0f48c54250a0f3e5284fa263ce00b518df577b76d3ee03b3635a5c9c

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

                                Filesize

                                6KB

                                MD5

                                f7dfc4e10ab9cef043c5e39f0f0b3a42

                                SHA1

                                4ac827b76bbeaa70b1c662792be00f7328042c8e

                                SHA256

                                89f6d354ccea94ced6d8f79e9c5a10513501822e42a7aded859535c5e9995db0

                                SHA512

                                d52dc22f1374be8b461d256e474601d4c51e4bf9691c70b99614e82cf4eb6a9da13b899306b631fbe97f7b30c5f7215f8d2c46fb5fb6230408e298b678140625

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

                                Filesize

                                8KB

                                MD5

                                455fa2cf8e4fd1f6dd959d15a7d640b1

                                SHA1

                                1405e295858dbbd1dcbe6b31a9ac99619dd2f81e

                                SHA256

                                6775599a1d8dfd9255f8cdc6d942e274663a6729d8b27ff4aaaede528f58ed60

                                SHA512

                                093833c75ccd6b8a9c49361281b1205d3b23fd7055fd60e74257c86ffa85094ba1831ee2dd9d3fd5a069c91625d3b387418a8f4389387bcccdac6e422ec50800

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

                                Filesize

                                12KB

                                MD5

                                67c83b8a7e8f6d2de27ef16c3b981024

                                SHA1

                                dafde7db513a19822e2eb19e571f30eb4c46a656

                                SHA256

                                5300bb33164a57a4ec234a5cb8326e6ca9d058ed85bd64d49ac296169f185af4

                                SHA512

                                e1a39d0e1131fabd47fb854dbc27117c480d1275a35c2b730690eb8556957df8c389a0b51293860f1929301df6912e0c8d11876a82c5fb9041ff58d688c09398

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                21KB

                                MD5

                                6bce9511db665ecb0889b132931f67e6

                                SHA1

                                4c78063f76e32b508414a2e94fdd5b7564771325

                                SHA256

                                b5227cf28671fb8dd788d51a793762289c517b33ad35737ca2730c0c37aba055

                                SHA512

                                6c52adb9307407261537adf8b241fb80d0597e76646724dad2d35e764831ebd7ed6d449213f6d33b85f726396de58835d62360c50a86c85d127778df28287f0b

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                25KB

                                MD5

                                0a5ecedb08d87bbfdf69603e310b6cba

                                SHA1

                                4bf7037a7671365b68e443a362e07162cf4672f8

                                SHA256

                                a2f8a8e82db178f2ac759822298d3d7e55af7b381e2a23601ef79bfce15cf2c7

                                SHA512

                                31289176eea56356ff0bb0e06a7478a3911e52dfb1c6b0af121ba76bfd222734271610750893e1bebbd3455766fc7a5de38135223c3aed579aabe488bb728dc3

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                25KB

                                MD5

                                0422667f3633c203c3caef0966a0e15f

                                SHA1

                                b4fca0713f3393ec2d28b49f4041895727223396

                                SHA256

                                dd248a8b4ed8cc80879635f41a3f23219320f9ece4c2ee1020d30d5232492175

                                SHA512

                                701b737b77264ed8cbd518b7429db52b752a87d077605983fcb5c115158b094183ee83b93cf96d4c1e25c3d375a6382d0da1d349eb2009cf0d2bd2e63c84255c

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                22KB

                                MD5

                                8258ba2578d760ae1609a158291a56e6

                                SHA1

                                a35636b61fd6151d7d2b6833778f952ae44a7b1e

                                SHA256

                                6cafa6239c06073781783d8786abb2be9bcbf3470f2bc78300ad5a0fb38c4e5c

                                SHA512

                                f63442141365d29d9070bff2ec9570cc607830ae8b909cb4f7dac956a7e367634bf429cccf356c3ee04a7d416cb69a2da0bdb10105bade904ae113441e0dff37

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\5a38d931-5c06-40dd-8ce8-e3a0ca495fd0

                                Filesize

                                982B

                                MD5

                                d9882d3bd2aecc64d741a5ea7bb4d043

                                SHA1

                                76a454a945b88b1cd152268aa36da5d8a2c7479a

                                SHA256

                                42f8d9a219dcfbc775949396349ca1d52e32ed43fe702b97446d7fba136e5e1f

                                SHA512

                                66ca93b16d913ff73189353280ed7bed5796cff9767ed9a7404f43c616382c48d136c235b9fdfa62ad7b30d2b30dfc766c6e3f5537f7713d50d23c6ae27eee23

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\f92a2fcd-1a52-4933-bd62-9fa13faf53fe

                                Filesize

                                659B

                                MD5

                                87a28ba159332bd012ef02f0b196bb65

                                SHA1

                                44eea0e0fa5a8fb41b4f2af7ac374fea7b6d2c33

                                SHA256

                                cf340c1a7e961f458fcc7b40b90953718ce7446ff794b459fe4e782facfbb735

                                SHA512

                                3ce25ec987ada4377f7f39e45766c22da9b29b0508c452c5d653f2ee7db00a81587d5a93113eb7a82604580fef4f5d9e1391ae7f23be60078c3a97f3cdf8d8ce

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs-1.js

                                Filesize

                                11KB

                                MD5

                                1a92b671cb46598f7d424ea35c2f3868

                                SHA1

                                2633cdcc90960b006a01042a4bdb70a748ed487c

                                SHA256

                                9322402256bad1c3b97cbf80a4e7e6f08b8cf3997d7c3d93382e754f5d430648

                                SHA512

                                c5ffb5f7bfb818d971095084c3332c76d115907ae204210f4841ae411e5426e86d771f871b3200506ffc8ea9376fbc3b93598163fe1600aec3d987e38f9c774c

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

                                Filesize

                                10KB

                                MD5

                                61f2fbf7f90e52ce617766db11941700

                                SHA1

                                ab0df6fac65b0ede03f3281514495758744d56d2

                                SHA256

                                b077945e07f395378d1b9c5958aaa86fcc8a631a66f27c6a9b73dc87c8d92a1f

                                SHA512

                                c2d8b150ee6a7e153a84f6aeab85fc4548b8c62bfd5cccad5b92b948531ebf7ace8ac6c5dc73f72358dc5c8cb0e2a77d27ac4fde7556a52e99c7d1cdd7e4a3f7

                              • memory/1016-57-0x00000000008F0000-0x0000000000DA8000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/1016-60-0x00000000008F0000-0x0000000000DA8000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/1124-2957-0x00000000005B0000-0x00000000005C2000-memory.dmp

                                Filesize

                                72KB

                              • memory/1148-86-0x0000000000490000-0x0000000000B3E000-memory.dmp

                                Filesize

                                6.7MB

                              • memory/1148-87-0x0000000000490000-0x0000000000B3E000-memory.dmp

                                Filesize

                                6.7MB

                              • memory/2396-1913-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-18-0x00000000008A1000-0x00000000008CF000-memory.dmp

                                Filesize

                                184KB

                              • memory/2396-41-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-2967-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-39-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-2964-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-37-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-21-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-108-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-20-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-2961-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-19-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-2958-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-2949-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-2940-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-507-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-2741-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-61-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-828-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-16-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/2396-522-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/3228-59-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-38-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-58-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-474-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-514-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-2468-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-688-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-2443-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-62-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                Filesize

                                10.4MB

                              • memory/3228-88-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-1695-0x0000000000A90000-0x00000000016D0000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3228-40-0x0000000000A91000-0x0000000000D09000-memory.dmp

                                Filesize

                                2.5MB

                              • memory/3284-2938-0x00000000005B0000-0x00000000005C2000-memory.dmp

                                Filesize

                                72KB

                              • memory/3284-2939-0x0000000072E50000-0x0000000072F84000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/4420-1-0x0000000077584000-0x0000000077586000-memory.dmp

                                Filesize

                                8KB

                              • memory/4420-0-0x0000000000150000-0x00000000005F2000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/4420-3-0x0000000000150000-0x00000000005F2000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/4420-2-0x0000000000151000-0x000000000017F000-memory.dmp

                                Filesize

                                184KB

                              • memory/4420-5-0x0000000000150000-0x00000000005F2000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/4420-15-0x0000000000150000-0x00000000005F2000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/4840-516-0x0000000000010000-0x00000000002BA000-memory.dmp

                                Filesize

                                2.7MB

                              • memory/4840-494-0x0000000000010000-0x00000000002BA000-memory.dmp

                                Filesize

                                2.7MB

                              • memory/4840-493-0x0000000000010000-0x00000000002BA000-memory.dmp

                                Filesize

                                2.7MB

                              • memory/4840-495-0x0000000000010000-0x00000000002BA000-memory.dmp

                                Filesize

                                2.7MB

                              • memory/4840-520-0x0000000000010000-0x00000000002BA000-memory.dmp

                                Filesize

                                2.7MB

                              • memory/5260-521-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB

                              • memory/6128-2954-0x00000000008A0000-0x0000000000D42000-memory.dmp

                                Filesize

                                4.6MB