amadey | deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
Size

1.8MB
MD5

9e221be6b28a24ec318e27c499da8c8f
SHA1

58b34ce63400ad6a54c0ee96886486f2c1dafebb
SHA256

deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90
SHA512

615c796734448621aa1692bd4e61f7b4b14772efe50c157e8505030699b0299fa7c34de2191e202f7678d96ec385eb82628c3cb91d4210542f2199177aaee2b7
SSDEEP

49152:40CdISVh6geEuk+SMPW212P6TH5MNopmxJnXaHe:4xISV0/raWrUNopkZKHe

Score

10^/10

amadey lumma stealc 9c9aa5 drum discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

drum

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	1d295340ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	0b6fa2c2aa.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0b6fa2c2aa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d8d0f64673.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e244d978cd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1d295340ad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	40e71d0003.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d8d0f64673.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e244d978cd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	40e71d0003.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e244d978cd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1d295340ad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0b6fa2c2aa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1d295340ad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	40e71d0003.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0b6fa2c2aa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d8d0f64673.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Executes dropped EXE 7 IoCs

pid	Process
2840	skotes.exe
2864	1d295340ad.exe
2192	40e71d0003.exe
588	0b6fa2c2aa.exe
2392	d8d0f64673.exe
2620	e244d978cd.exe
2084	e684d8c9f4.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	1d295340ad.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	40e71d0003.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	0b6fa2c2aa.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	d8d0f64673.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Wine	e244d978cd.exe

Loads dropped DLL 11 IoCs

pid	Process
2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
2840	skotes.exe
2840	skotes.exe
2840	skotes.exe
2840	skotes.exe
2840	skotes.exe
2840	skotes.exe
2840	skotes.exe
2840	skotes.exe
2192	40e71d0003.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\e244d978cd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010510001\\e244d978cd.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\e684d8c9f4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010511001\\e684d8c9f4.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\d8d0f64673.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1010509001\\d8d0f64673.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0008000000018792-178.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
2840	skotes.exe
2864	1d295340ad.exe
2192	40e71d0003.exe
588	0b6fa2c2aa.exe
2392	d8d0f64673.exe
2620	e244d978cd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b6fa2c2aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e244d978cd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d295340ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40e71d0003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8d0f64673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e684d8c9f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2848	taskkill.exe
848	taskkill.exe
2028	taskkill.exe
2172	taskkill.exe
2892	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	d8d0f64673.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	d8d0f64673.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	d8d0f64673.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
2840	skotes.exe
2864	1d295340ad.exe
2864	1d295340ad.exe
2864	1d295340ad.exe
2864	1d295340ad.exe
2864	1d295340ad.exe
2864	1d295340ad.exe
2192	40e71d0003.exe
588	0b6fa2c2aa.exe
588	0b6fa2c2aa.exe
588	0b6fa2c2aa.exe
588	0b6fa2c2aa.exe
588	0b6fa2c2aa.exe
588	0b6fa2c2aa.exe
2392	d8d0f64673.exe
2620	e244d978cd.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	2848	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	1640	firefox.exe
Token: SeDebugPrivilege	1640	firefox.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
1640	firefox.exe
1640	firefox.exe
1640	firefox.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe
2084	e684d8c9f4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2840	2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe	30
PID 2216 wrote to memory of 2840	2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe	30
PID 2216 wrote to memory of 2840	2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe	30
PID 2216 wrote to memory of 2840	2216	deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe	30
PID 2840 wrote to memory of 2864	2840	skotes.exe	32
PID 2840 wrote to memory of 2864	2840	skotes.exe	32
PID 2840 wrote to memory of 2864	2840	skotes.exe	32
PID 2840 wrote to memory of 2864	2840	skotes.exe	32
PID 2840 wrote to memory of 2192	2840	skotes.exe	33
PID 2840 wrote to memory of 2192	2840	skotes.exe	33
PID 2840 wrote to memory of 2192	2840	skotes.exe	33
PID 2840 wrote to memory of 2192	2840	skotes.exe	33
PID 2840 wrote to memory of 588	2840	skotes.exe	35
PID 2840 wrote to memory of 588	2840	skotes.exe	35
PID 2840 wrote to memory of 588	2840	skotes.exe	35
PID 2840 wrote to memory of 588	2840	skotes.exe	35
PID 2840 wrote to memory of 2392	2840	skotes.exe	36
PID 2840 wrote to memory of 2392	2840	skotes.exe	36
PID 2840 wrote to memory of 2392	2840	skotes.exe	36
PID 2840 wrote to memory of 2392	2840	skotes.exe	36
PID 2840 wrote to memory of 2620	2840	skotes.exe	37
PID 2840 wrote to memory of 2620	2840	skotes.exe	37
PID 2840 wrote to memory of 2620	2840	skotes.exe	37
PID 2840 wrote to memory of 2620	2840	skotes.exe	37
PID 2840 wrote to memory of 2084	2840	skotes.exe	39
PID 2840 wrote to memory of 2084	2840	skotes.exe	39
PID 2840 wrote to memory of 2084	2840	skotes.exe	39
PID 2840 wrote to memory of 2084	2840	skotes.exe	39
PID 2084 wrote to memory of 2172	2084	e684d8c9f4.exe	40
PID 2084 wrote to memory of 2172	2084	e684d8c9f4.exe	40
PID 2084 wrote to memory of 2172	2084	e684d8c9f4.exe	40
PID 2084 wrote to memory of 2172	2084	e684d8c9f4.exe	40
PID 2084 wrote to memory of 2892	2084	e684d8c9f4.exe	42
PID 2084 wrote to memory of 2892	2084	e684d8c9f4.exe	42
PID 2084 wrote to memory of 2892	2084	e684d8c9f4.exe	42
PID 2084 wrote to memory of 2892	2084	e684d8c9f4.exe	42
PID 2084 wrote to memory of 2848	2084	e684d8c9f4.exe	44
PID 2084 wrote to memory of 2848	2084	e684d8c9f4.exe	44
PID 2084 wrote to memory of 2848	2084	e684d8c9f4.exe	44
PID 2084 wrote to memory of 2848	2084	e684d8c9f4.exe	44
PID 2084 wrote to memory of 848	2084	e684d8c9f4.exe	46
PID 2084 wrote to memory of 848	2084	e684d8c9f4.exe	46
PID 2084 wrote to memory of 848	2084	e684d8c9f4.exe	46
PID 2084 wrote to memory of 848	2084	e684d8c9f4.exe	46
PID 2084 wrote to memory of 2028	2084	e684d8c9f4.exe	48
PID 2084 wrote to memory of 2028	2084	e684d8c9f4.exe	48
PID 2084 wrote to memory of 2028	2084	e684d8c9f4.exe	48
PID 2084 wrote to memory of 2028	2084	e684d8c9f4.exe	48
PID 2084 wrote to memory of 2396	2084	e684d8c9f4.exe	50
PID 2084 wrote to memory of 2396	2084	e684d8c9f4.exe	50
PID 2084 wrote to memory of 2396	2084	e684d8c9f4.exe	50
PID 2084 wrote to memory of 2396	2084	e684d8c9f4.exe	50
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51
PID 2396 wrote to memory of 1640	2396	firefox.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe
"C:\Users\Admin\AppData\Local\Temp\deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\1010506001\1d295340ad.exe
    "C:\Users\Admin\AppData\Local\Temp\1010506001\1d295340ad.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\1010507001\40e71d0003.exe
    "C:\Users\Admin\AppData\Local\Temp\1010507001\40e71d0003.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\1010508001\0b6fa2c2aa.exe
    "C:\Users\Admin\AppData\Local\Temp\1010508001\0b6fa2c2aa.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\1010509001\d8d0f64673.exe
    "C:\Users\Admin\AppData\Local\Temp\1010509001\d8d0f64673.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\1010510001\e244d978cd.exe
    "C:\Users\Admin\AppData\Local\Temp\1010510001\e244d978cd.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\1010511001\e684d8c9f4.exe
    "C:\Users\Admin\AppData\Local\Temp\1010511001\e684d8c9f4.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2172
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1640
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.0.147776990\1992880010" -parentBuildID 20221007134813 -prefsHandle 1168 -prefMapHandle 1092 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9d25754-fda0-464e-afe3-e7cf4f712d7c} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 1244 101ef458 gpu
        6⤵
        
        PID:2280
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.1.2115563062\305619065" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1528 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6912d830-27d3-4e04-9c42-862909bcfc38} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 1556 44eb858 socket
        6⤵
        
        PID:1972
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.2.196686330\1088719727" -childID 1 -isForBrowser -prefsHandle 2040 -prefMapHandle 2036 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d330ac9c-6735-4627-aef6-e3be607769df} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 2056 18850e58 tab
        6⤵
        
        PID:2764
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.3.1663738281\1068386353" -childID 2 -isForBrowser -prefsHandle 2676 -prefMapHandle 2672 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9403c781-ea9f-4790-9fea-59dc6e2d0916} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 2696 e60558 tab
        6⤵
        
        PID:1680
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.4.1489363126\2133112549" -childID 3 -isForBrowser -prefsHandle 3752 -prefMapHandle 3732 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2359c1e6-9a1d-4120-a4c7-f6012e3b2334} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 3764 1dfd3b58 tab
        6⤵
        
        PID:2220
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.5.1178066813\146992411" -childID 4 -isForBrowser -prefsHandle 3872 -prefMapHandle 3876 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fc97b59-b2e9-4a10-afde-052f77744622} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 3860 1ea65858 tab
        6⤵
        
        PID:536
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.6.1230648616\838362958" -childID 5 -isForBrowser -prefsHandle 4040 -prefMapHandle 4044 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d41d48ee-646a-4b1a-81d7-d58bd1f09f83} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 4028 1ea65b58 tab
        6⤵
        
        PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
337b97f6448088f456ca623d654a41c2

SHA1
730ffd2148716b20be16e6a598771243f771fd7a

SHA256
817810313673bf3b5e1db4fcb893a70069d0d40c16aadc48f52403c49ce359f9

SHA512
705ee883837d52538244b7e6a186171a3b2d61f6ca8f88e6727e4ce24b0e96f765bc8089189156d6bf744cd81f0080ea7c888bcfad556a997006023a61cfa63b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
13KB

MD5
f99b4984bd93547ff4ab09d35b9ed6d5

SHA1
73bf4d313cb094bb6ead04460da9547106794007

SHA256
402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

SHA512
cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010506001\1d295340ad.exe

Filesize
4.3MB

MD5
08f54694fcdf9433d8f3aa581903c4ca

SHA1
08d738cc1c80c55c2835b23e24e8e211b4fb437c

SHA256
3c87e8c4b46af6850934553b22a5bd2d0d1b648938fec52cd2f3b664b1dceb68

SHA512
ff582e5e8a6e1f711a8b0f2a108acf49965cae3bcdbf68ecbfce0f90590673b961ad1325b5cdbfb4295db820a8093031279e841a9ebad67dea5585421a281ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010507001\40e71d0003.exe

Filesize
1.9MB

MD5
9d2eed099096486e2ae388b2b220497c

SHA1
c84457bca7db83641fd56925c6496b4c9a8c6c5b

SHA256
5d5a9d7c44e0dbd125b577319dcad5274121c38b6cde03658eb83c49e316d307

SHA512
c289c2e38dc49ef5495baf8873f02866c53ce398f991a246148b29db81870e41dba5353691d9b73b071720ad98dfca438b5f5143eb65979e25220971c167dd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010508001\0b6fa2c2aa.exe

Filesize
4.3MB

MD5
245042b39f7fe432daf72c046d5000d3

SHA1
f3ae48a9bd52536b83b76ed988558e5681009e96

SHA256
1c4b207bb8d58a6068ed2be0eb27653a7245dfe8fee548c4720d14510453c27c

SHA512
fedb81cb96239c8e2456872914155d54d2cb9c5c98b2a59554113de6b8987df01d2e4dd7bdadc26c8749020cf59d74fd4d2229806882bcf62b5b4083bc98622c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010509001\d8d0f64673.exe

Filesize
1.8MB

MD5
3d834c7d2af18d01157fd54cb394567a

SHA1
f74649292365953e787be057e615f20d2cf6349f

SHA256
d17d5943bce6e643f8c75fa9d7ce4dfb0869ef8c701b9122eaed7251aa5626ab

SHA512
9c1830acbc896b013e0629f719b452b51a340ea36c8c1be005c0254f42ebd13c88b8ef7bc8e983d9280d4f699508bc8ddfcf1325843f0b705d38a40b715f5b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010510001\e244d978cd.exe

Filesize
1.7MB

MD5
3a8e4485dffff1de900b30449b33e56a

SHA1
b932de6fd713fcdc1f97c8b5f5144ef654f77ac3

SHA256
624a02ea536c673b4939e19f0509d585afebc7a8d73177d466f1b2b58aa5a901

SHA512
b16b4dba6b82c5982731dfa44989e14910363c619baa39bcb70b2b64d52adeb8ddb23fc0fc367ef48b0c1f19db365ea8998c199744950d5c81aada5345ebc00b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1010511001\e684d8c9f4.exe

Filesize
900KB

MD5
a9e989ef5eb79aeeb328a104849f4a85

SHA1
2350a9ecc6c9012f34a1206487d96f9912b6b2a9

SHA256
b5c318e6f3e8af90f8d3bcd87bfd270195d238dba7ab2fe277c0bf9d57e6fdd0

SHA512
f8b7685846b3efdb253b1c3ef5e45b308a240f9ee56f2f30b07777628b573247291b654b43d8029bada68896b456aeba3c98865914d9f96b3eb8db3cdb1e8ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95CC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar960D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
1.8MB

MD5
9e221be6b28a24ec318e27c499da8c8f

SHA1
58b34ce63400ad6a54c0ee96886486f2c1dafebb

SHA256
deb8b42416072a6be8c2a0d957db28f5c4a67ac707c4f5f20da46efe23d85d90

SHA512
615c796734448621aa1692bd4e61f7b4b14772efe50c157e8505030699b0299fa7c34de2191e202f7678d96ec385eb82628c3cb91d4210542f2199177aaee2b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b01d96b5a8dddc36f522feacce4e38e5

SHA1
28070de07c0a09d15db2b3ef1663a5c35e75e251

SHA256
0576fbac72d13ef79c96cef54fdd29e268c38e7b270484740b16ce8619b9f69f

SHA512
b3732278419f89dfcb81af2058a21137d3d689b03c00868ec368016f289672411e0d93a0f3a77733f7a44830035d07e93e453c59ddc643ed17b1c8354672412e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\84135a55-7552-4ad1-b1c6-af345a07e78c

Filesize
10KB

MD5
03d6d0b31e75a2828e3c0c7d74f0a1eb

SHA1
ea614b20e965e65a7c099c42a060851df8c96f58

SHA256
8cb75607f0eb0ff3922f38f1653ca61c11fe2eb39368a14d1866b5a754d5229a

SHA512
629781dae0a757936fa86ee0411c2e9f2df740e7d5cde9f675770f6c85a11a0f335842626f367f49fa45993279f3cd7f3bf92375468982f9b1cb6f13ad7e79d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\912155ba-6770-481b-8b0e-4f29965a9bce

Filesize
745B

MD5
373dd3ea3d3962c6b0897318a1496cfe

SHA1
8b37807ba8154b8badb94ae06758b860cc07dba4

SHA256
082aed58760cceb4b005464aef8e59e3e4913953d6d0ceb23d04298fa5a0599a

SHA512
15ec1f73e7e9d7808f55bd8ed48890c6aa047ca6375c73f39e92daa680180cd60b2c98ffbbacc74f8986c150fe1d70c3fba6273b5a5998a3888ed48106ef7775

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js

Filesize
6KB

MD5
432ed3e9b10e9ac956321881736e9700

SHA1
3ef77ffaa53a4b5e080d030fdfc5e68130a4e934

SHA256
614f32fdd3717de6b68e762bb927162725366ec50ae84d3b37d69f1ff6066f8a

SHA512
230f95c753012253db8791ab60039d61cdf623b01dce7611b5c036f328842ffc0d41df4056826b0d6a17dd2cf33fb23772c2b918702d83de9885d3bd704dcb2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js

Filesize
7KB

MD5
c2a3227ec37012a833cdb62785fb0f83

SHA1
69f1a664aa82ea7c185e5ca266dcae1845e802e2

SHA256
5c7c8bedafeb3d46c1601fe94f099c8c346050556af865bc11d956e4f48479c0

SHA512
45379194cf29f5958fad5492b9eeb98fee422f42eeae113938cc007837ec17cddb948e6ed9acf113089d274493e2ac4e86494f54f4e658e32f56b9bf4b734173

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js

Filesize
7KB

MD5
fa2d11a73407c335503e4f95ec6473cb

SHA1
b213ebe5620d200f1c1592921f7a075242f6b31a

SHA256
541a007b1697061d82efc56587441c6b48a848bbc8e3554bbae8bb51586ada17

SHA512
57b4b1b09d98c08bf6b20841311aede4e234a65c2d2a9d0b14000eef087d2b451c81bc540595f77bb9359777146064c9b86ffa9924a2c92cd62c94455bae0414

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs.js

Filesize
6KB

MD5
7a9de45391839d9b2e67885e9d45e125

SHA1
d28f4bca88eb38db734450780cb3e0635a677b20

SHA256
647c5d6e54904afee5ce61121e0756c49571e9417e78d433b865dde471fc1047

SHA512
3f7a78c8d3504cd53003e022f1bfc86502050ea453cc6077c4a991fce071b73ca5891f354cf5530277194359269bc2f44a5083d58673f21861cf83eeb9a2ed71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
403b433078d5b85cd96961f2bf13e0e9

SHA1
fc582932c0bcce987bbcc480f36bb84174960780

SHA256
f2611359f7a89220edfef8d0f0d9de45733291bc786d11ba90ac075e542ec4d9

SHA512
13f475628db8de2ff5de8ef93f7a915e4129e4fad7ecceada74dea8820b4af0bf476649b4a789787686a46ff13600ed604b9a44d373d8f1b0c2a91264faab9c2

Download Submit
\Users\Admin\AppData\Local\Temp\dw3weZ93fwwzeSw\Y-Cleaner.exe

Filesize
1.4MB

MD5
a8cf5621811f7fac55cfe8cb3fa6b9f6

SHA1
121356839e8138a03141f5f5856936a85bd2a474

SHA256
614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

SHA512
4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

Download Submit
memory/588-93-0x00000000011E0000-0x0000000001E64000-memory.dmp

Filesize
12.5MB

Download
memory/588-116-0x00000000011E0000-0x0000000001E64000-memory.dmp

Filesize
12.5MB

Download
memory/2192-358-0x0000000000400000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/2192-365-0x0000000000400000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/2192-65-0x0000000000400000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/2192-95-0x0000000000400000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/2192-195-0x0000000000400000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/2192-97-0x0000000000400000-0x00000000008AA000-memory.dmp

Filesize
4.7MB

Download
memory/2192-72-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2216-3-0x0000000000350000-0x000000000080D000-memory.dmp

Filesize
4.7MB

Download
memory/2216-5-0x0000000000350000-0x000000000080D000-memory.dmp

Filesize
4.7MB

Download
memory/2216-19-0x0000000006F10000-0x00000000073CD000-memory.dmp

Filesize
4.7MB

Download
memory/2216-18-0x0000000000350000-0x000000000080D000-memory.dmp

Filesize
4.7MB

Download
memory/2216-17-0x0000000000350000-0x000000000080D000-memory.dmp

Filesize
4.7MB

Download
memory/2216-2-0x0000000000351000-0x000000000037F000-memory.dmp

Filesize
184KB

Download
memory/2216-27-0x0000000006F10000-0x00000000073CD000-memory.dmp

Filesize
4.7MB

Download
memory/2216-0-0x0000000000350000-0x000000000080D000-memory.dmp

Filesize
4.7MB

Download
memory/2216-1-0x0000000077120000-0x0000000077122000-memory.dmp

Filesize
8KB

Download
memory/2392-112-0x00000000000F0000-0x0000000000594000-memory.dmp

Filesize
4.6MB

Download
memory/2392-173-0x00000000000F0000-0x0000000000594000-memory.dmp

Filesize
4.6MB

Download
memory/2620-153-0x0000000001370000-0x00000000019F6000-memory.dmp

Filesize
6.5MB

Download
memory/2840-28-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-23-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-62-0x00000000067A0000-0x0000000006C4A000-memory.dmp

Filesize
4.7MB

Download
memory/2840-480-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-46-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-44-0x0000000006F20000-0x0000000007BDE000-memory.dmp

Filesize
12.7MB

Download
memory/2840-30-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-29-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-92-0x0000000006F20000-0x0000000007BA4000-memory.dmp

Filesize
12.5MB

Download
memory/2840-343-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-344-0x0000000006F20000-0x00000000075A6000-memory.dmp

Filesize
6.5MB

Download
memory/2840-64-0x00000000067A0000-0x0000000006C4A000-memory.dmp

Filesize
4.7MB

Download
memory/2840-66-0x0000000006F20000-0x0000000007BDE000-memory.dmp

Filesize
12.7MB

Download
memory/2840-136-0x0000000006F20000-0x00000000075A6000-memory.dmp

Filesize
6.5MB

Download
memory/2840-375-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-26-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-25-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-189-0x00000000067A0000-0x0000000006C44000-memory.dmp

Filesize
4.6MB

Download
memory/2840-22-0x00000000003E1000-0x000000000040F000-memory.dmp

Filesize
184KB

Download
memory/2840-135-0x0000000006F20000-0x0000000007BA4000-memory.dmp

Filesize
12.5MB

Download
memory/2840-411-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-134-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-21-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-479-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-478-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-111-0x00000000067A0000-0x0000000006C44000-memory.dmp

Filesize
4.6MB

Download
memory/2840-76-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-91-0x00000000067A0000-0x0000000006C4A000-memory.dmp

Filesize
4.7MB

Download
memory/2840-463-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-464-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-465-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-476-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2840-477-0x00000000003E0000-0x000000000089D000-memory.dmp

Filesize
4.7MB

Download
memory/2864-70-0x0000000000D00000-0x00000000019BE000-memory.dmp

Filesize
12.7MB

Download
memory/2864-67-0x0000000000D00000-0x00000000019BE000-memory.dmp

Filesize
12.7MB

Download
memory/2864-45-0x0000000000D00000-0x00000000019BE000-memory.dmp

Filesize
12.7MB

Download