Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/12/2024, 02:39

General

  • Target

    b66b9bbe43d16ba2ae2275aaad148809d9c5bce9726ac3f4b57333d355f9a85a.exe

  • Size

    1.8MB

  • MD5

    a541fa0eaf66c44faab3dbfd8229bb17

  • SHA1

    dd170660003d092e778e448d3f8fb6a6e7840262

  • SHA256

    b66b9bbe43d16ba2ae2275aaad148809d9c5bce9726ac3f4b57333d355f9a85a

  • SHA512

    c3f27bba03085836dde8f028db873052f61fb53ee74abea0f6a108399d400afddc144053975cde5a402f45d3a0d293dd9ec53b8994b7a97626b5cf8cd9c2a879

  • SSDEEP

    49152:UTB6KzbULmqL+SfMMq7DQN9GwPasbxUrxdC51Me/:UTcBKOJPhbSy51Mq

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 13 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b66b9bbe43d16ba2ae2275aaad148809d9c5bce9726ac3f4b57333d355f9a85a.exe
    "C:\Users\Admin\AppData\Local\Temp\b66b9bbe43d16ba2ae2275aaad148809d9c5bce9726ac3f4b57333d355f9a85a.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Users\Admin\AppData\Local\Temp\1011136001\c1b0c42c5a.exe
        "C:\Users\Admin\AppData\Local\Temp\1011136001\c1b0c42c5a.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1956
      • C:\Users\Admin\AppData\Local\Temp\1011137001\PhafoQj.exe
        "C:\Users\Admin\AppData\Local\Temp\1011137001\PhafoQj.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2376
      • C:\Users\Admin\AppData\Local\Temp\1011138001\e0ea6c0ac2.exe
        "C:\Users\Admin\AppData\Local\Temp\1011138001\e0ea6c0ac2.exe"
        3⤵
        • Enumerates VirtualBox registry keys
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4964
      • C:\Users\Admin\AppData\Local\Temp\1011139001\07c1ec5ad7.exe
        "C:\Users\Admin\AppData\Local\Temp\1011139001\07c1ec5ad7.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:6200
      • C:\Users\Admin\AppData\Local\Temp\1011140001\e85b1c7e73.exe
        "C:\Users\Admin\AppData\Local\Temp\1011140001\e85b1c7e73.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:6752
      • C:\Users\Admin\AppData\Local\Temp\1011141001\8f2ba77aac.exe
        "C:\Users\Admin\AppData\Local\Temp\1011141001\8f2ba77aac.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:7272
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:7236
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:7164
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:7836
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:7912
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:7988
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:8060
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:8076
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8076.0.235010622\335628007" -parentBuildID 20221007134813 -prefsHandle 1228 -prefMapHandle 1220 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77aa012e-a44c-45ec-8cb3-3e3f249ccade} 8076 "\\.\pipe\gecko-crash-server-pipe.8076" 1340 106efe58 gpu
              6⤵
                PID:8652
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8076.1.1813598021\717790846" -parentBuildID 20221007134813 -prefsHandle 1508 -prefMapHandle 1504 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {555633f2-abe6-4a45-a164-74167b695f1e} 8076 "\\.\pipe\gecko-crash-server-pipe.8076" 1520 f4ebb58 socket
                6⤵
                  PID:8764
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8076.2.1729192208\431178706" -childID 1 -isForBrowser -prefsHandle 2112 -prefMapHandle 2108 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5ddc755-aaff-407a-ac6e-176a7b508726} 8076 "\\.\pipe\gecko-crash-server-pipe.8076" 2124 1a4d8658 tab
                  6⤵
                    PID:9064
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8076.3.780209466\1966987807" -childID 2 -isForBrowser -prefsHandle 2940 -prefMapHandle 2936 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81978bf6-bd05-4abb-a6e3-15cdf89b9c02} 8076 "\\.\pipe\gecko-crash-server-pipe.8076" 2952 f64258 tab
                    6⤵
                      PID:9668
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8076.4.172124579\1989341326" -childID 3 -isForBrowser -prefsHandle 3604 -prefMapHandle 3572 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c850b1c5-49db-4996-95ae-9586940aa2a7} 8076 "\\.\pipe\gecko-crash-server-pipe.8076" 3616 1f1bf558 tab
                      6⤵
                        PID:7860
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8076.5.424033047\1232419130" -childID 4 -isForBrowser -prefsHandle 3744 -prefMapHandle 3748 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a662bbde-018a-49ee-bec7-df0ae0018d9a} 8076 "\\.\pipe\gecko-crash-server-pipe.8076" 3600 1f1bce58 tab
                        6⤵
                          PID:7996
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8076.6.1473882775\1692602045" -childID 5 -isForBrowser -prefsHandle 3792 -prefMapHandle 3788 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {868b2472-a826-4dd5-86ba-1eca18627cec} 8076 "\\.\pipe\gecko-crash-server-pipe.8076" 3804 1f1be658 tab
                          6⤵
                            PID:8584
                    • C:\Users\Admin\AppData\Local\Temp\1011142001\847aff0524.exe
                      "C:\Users\Admin\AppData\Local\Temp\1011142001\847aff0524.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:8196

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\download[1].htm

                  Filesize

                  1B

                  MD5

                  cfcd208495d565ef66e7dff9f98764da

                  SHA1

                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                  SHA256

                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                  SHA512

                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\activity-stream.discovery_stream.json.tmp

                  Filesize

                  32KB

                  MD5

                  fdba55c68d5ab45e34af6a20b0ff2e37

                  SHA1

                  3de5b73187987f974bbaada915e726a12fe5da9e

                  SHA256

                  03e2b28e4b5f3dbff16c5421c31dca31af20acda9583e6c1c38886c01d8c3d41

                  SHA512

                  19e16822a6471cc09c9ae6bec656a7f70624b1faa0ab94bd92fbad36d6ac46ca25ea8de2df950e88a9b073a84ba4690b2379e4fc04812b76ae2252db2d0bfa52

                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                  Filesize

                  13KB

                  MD5

                  f99b4984bd93547ff4ab09d35b9ed6d5

                  SHA1

                  73bf4d313cb094bb6ead04460da9547106794007

                  SHA256

                  402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

                  SHA512

                  cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

                • C:\Users\Admin\AppData\Local\Temp\1011136001\c1b0c42c5a.exe

                  Filesize

                  1.9MB

                  MD5

                  870c92cf89253baeaf80574aaad15adc

                  SHA1

                  feefb55fa434ceb4aa10997bedfccd5597852078

                  SHA256

                  65238eee07b00d608d030a601ebe0878656466084e1f55e9e41258bec1370b59

                  SHA512

                  fe1cf7efa897c4c4fada01ba67ef38e7491d96870ab32354b0acbf2bb0cfa32faf914d05037d6e813fcc9b1241466acdaa178adeacc2451ea371f1189e7923c6

                • C:\Users\Admin\AppData\Local\Temp\1011137001\PhafoQj.exe

                  Filesize

                  1.4MB

                  MD5

                  03757138d540ad9e87a345bf3b63aebf

                  SHA1

                  83a0b3ce46a7178456763e5356bf4940efa41cd1

                  SHA256

                  659ef7c3fd01df95231975c36e8e45444f6329da33a70e58690f2ee75c7a722f

                  SHA512

                  0f08c40ff45829c608a42a6d0d12c1b2a726d315c28f0b4330320a7585506474f72eca550a90b042eece41911174859e95d4b5056c77999a1acf14d43e5279ca

                • C:\Users\Admin\AppData\Local\Temp\1011138001\e0ea6c0ac2.exe

                  Filesize

                  4.2MB

                  MD5

                  bd6d6662b11f947d8480c6e9815c3ef3

                  SHA1

                  b5ecc2be2f54b7849b8c948bbd91cef25028ce41

                  SHA256

                  7191093754402a6cc5ee460bafef859de07ac2bbf91ce56c6b56a91d3020c2e2

                  SHA512

                  242a995d3c3a123401d7776b1b5b373d7d117566a897e3e8ed2fe07faaff3dfda01daca76cc60012a6480412f6118b5185926677bb61678bdb3cca336a36e8fa

                • C:\Users\Admin\AppData\Local\Temp\1011139001\07c1ec5ad7.exe

                  Filesize

                  1.8MB

                  MD5

                  2426e5ac8ee0bbb03e63d7467cba1df2

                  SHA1

                  6cfd84d6f98b4a9d1b9d5bd724ec59cd4e8533c3

                  SHA256

                  4b6f652aa6df9d8078f869655c18ac854262d94c3b3a547488a2ece1b184a7b5

                  SHA512

                  5697de737cf9ee10433c57a1f0d214b0d8344ad33306b243624542ead2375e6c3a4ca5a8d4e3b806cb5bbad17b1612881b1f1064d03b18da01c5f96c57e9751c

                • C:\Users\Admin\AppData\Local\Temp\1011140001\e85b1c7e73.exe

                  Filesize

                  1.7MB

                  MD5

                  66bcb6e17b5fb8da5c8791b5fd6cadec

                  SHA1

                  a7ef8cd29018bce43618425c1f211ab4d7d3c88e

                  SHA256

                  cc9109ffeede3b8f3117ccb1bae82347c4506e08e2a06c3bffd15608dad16cfd

                  SHA512

                  76708812f23247c7ab921adb69f1fe3c79e3bef5f2fd374021ab120644a7c4e9768b202c3283edcfb9b7b42647e86f880021eb340594b0cbc0b07938408a8aed

                • C:\Users\Admin\AppData\Local\Temp\1011141001\8f2ba77aac.exe

                  Filesize

                  947KB

                  MD5

                  4932e7c10bb027cec9de8696ecf6901d

                  SHA1

                  aef2197b802633e3453dd7c221bbd889b99a5b90

                  SHA256

                  6bbbe9d1fa289f9bcdfa962f16c09f8035064becce76871a60c9db490bc6df9c

                  SHA512

                  9253a415c4f826b09ab01f2afb7f0b2c35534aa093209e72223ab23392822b50d3edc1949c66d1f39aa59198e9275a1b7729df6a9fb39008e9bb28c6f245c8b3

                • C:\Users\Admin\AppData\Local\Temp\1011142001\847aff0524.exe

                  Filesize

                  2.7MB

                  MD5

                  3834ead0f530e99a0d9810e6866e893a

                  SHA1

                  a051a6bc8dcd18dcc71af7861c8031f0bfade6c1

                  SHA256

                  c7c57fb214ae177ef2cf143775c2131cbdcd8965bf55540a3422ebd03494d436

                  SHA512

                  e2e0b2907f28016ec5a22976dd211a73d0ee9aeee1859740e31ca073a17a79f4624415a216939f80b4746e731b98c1066c5e854307950d8c73c4dfc67854b24c

                • C:\Users\Admin\AppData\Local\Temp\CabCDBD.tmp

                  Filesize

                  70KB

                  MD5

                  49aebf8cbd62d92ac215b2923fb1b9f5

                  SHA1

                  1723be06719828dda65ad804298d0431f6aff976

                  SHA256

                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                  SHA512

                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                • C:\Users\Admin\AppData\Local\Temp\TarCDDF.tmp

                  Filesize

                  181KB

                  MD5

                  4ea6026cf93ec6338144661bf1202cd1

                  SHA1

                  a1dec9044f750ad887935a01430bf49322fbdcb7

                  SHA256

                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                  SHA512

                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                  Filesize

                  442KB

                  MD5

                  85430baed3398695717b0263807cf97c

                  SHA1

                  fffbee923cea216f50fce5d54219a188a5100f41

                  SHA256

                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                  SHA512

                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                  Filesize

                  8.0MB

                  MD5

                  a01c5ecd6108350ae23d2cddf0e77c17

                  SHA1

                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                  SHA256

                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                  SHA512

                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\db\data.safe.bin

                  Filesize

                  9KB

                  MD5

                  000415c13f7e5abe696fb4a188b7291e

                  SHA1

                  db26d94019b664f6407dc9da87e2e9d81e34d846

                  SHA256

                  040b519124ce52d7707c7bbe0681006cbcd810e50d26e079ff8f335eb0b66db5

                  SHA512

                  a2803e179c9fe96e893483cb6d275a8b754f1e0e4c4ff236ac5513043f75372175569de4ffdeeffae13667765cbab5b558e6b0723bd4fcf733b78faa086d61d4

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\datareporting\glean\pending_pings\b81df1d9-91ab-4698-ab4e-1cfda5a8a658

                  Filesize

                  733B

                  MD5

                  07f7a626f27ef9b56cb206a98ae99181

                  SHA1

                  1ab83cd3115845b56b716d21530e15a4a4b7cbed

                  SHA256

                  8332122ed71a8001eadefa1f300d5483fbc462c2936308dd67653cd56997057a

                  SHA512

                  6fdb330b9d3e4cfcd7cd18b2f4446f7e7238bb3db232e772196a635be88d37e327339dea6bf62e498cc3b19c449fa413dc6a1d3701de7bc9bf5c037213531645

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                  Filesize

                  997KB

                  MD5

                  fe3355639648c417e8307c6d051e3e37

                  SHA1

                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                  SHA256

                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                  SHA512

                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                  Filesize

                  116B

                  MD5

                  3d33cdc0b3d281e67dd52e14435dd04f

                  SHA1

                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                  SHA256

                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                  SHA512

                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                  Filesize

                  479B

                  MD5

                  49ddb419d96dceb9069018535fb2e2fc

                  SHA1

                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                  SHA256

                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                  SHA512

                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                  Filesize

                  372B

                  MD5

                  8be33af717bb1b67fbd61c3f4b807e9e

                  SHA1

                  7cf17656d174d951957ff36810e874a134dd49e0

                  SHA256

                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                  SHA512

                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                  Filesize

                  11.8MB

                  MD5

                  33bf7b0439480effb9fb212efce87b13

                  SHA1

                  cee50f2745edc6dc291887b6075ca64d716f495a

                  SHA256

                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                  SHA512

                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                  Filesize

                  1KB

                  MD5

                  688bed3676d2104e7f17ae1cd2c59404

                  SHA1

                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                  SHA256

                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                  SHA512

                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                  Filesize

                  1KB

                  MD5

                  937326fead5fd401f6cca9118bd9ade9

                  SHA1

                  4526a57d4ae14ed29b37632c72aef3c408189d91

                  SHA256

                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                  SHA512

                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\prefs-1.js

                  Filesize

                  6KB

                  MD5

                  a47419c3f0b5a23f6c0d1bb7c36b4393

                  SHA1

                  bebeac1c63834777d01dc3d215f8616d8ed7e7b4

                  SHA256

                  3b22f539f8a681bca6627fcdb67a0c34ce11443c6e9f3303f4a4063ea2794932

                  SHA512

                  db530ba4c189213e80d3cbce66aecbd79c918eddcc7545690096410e88476ac1fd650a61e187b9c2578dcd8e25c57da60cb5d2979c2a887fe00d47c926eb1247

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\prefs-1.js

                  Filesize

                  7KB

                  MD5

                  2ba4da4d1169fadc798a00fb43d08367

                  SHA1

                  c0db8c627b595dfda91eda7f5a7306a990de514d

                  SHA256

                  8e544a6aa82fd58fda4ec4852dea7613882109db8b0324c1d51a7db672cd32e1

                  SHA512

                  68b2a56d5e2fbda8040f202d1c3cbd67a9a046df57848b71fd8e87d6039324fa1f0dcb41635361535bf586af585346fdfaad3abac865d10a9ab6b5415b29d091

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\prefs-1.js

                  Filesize

                  7KB

                  MD5

                  7d8556463d3a17372421cd2312f1510a

                  SHA1

                  23e919f9469bfc64c3b0dc99e74f077bdf4365d2

                  SHA256

                  a8a8f8929d0808508770bd0d1f6a65307a1375f07103a33712ef20506deaa87f

                  SHA512

                  2c4bf7bb99fc1e2723020be1d918d0ab1f2502b7240420b1e7ac75d8ddb896ef364591c385aefa0fc0f99b7724e10c7dd4ab6e7cae85bc29612d01a27aaea999

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\prefs.js

                  Filesize

                  6KB

                  MD5

                  fed469ed89ecf5ce5899617993b5a955

                  SHA1

                  82d3d7822ed2a048e85575cadaabe37eddcc2899

                  SHA256

                  9f8988b6ed636a5c1d75bffc58b0742be77dd9c167566885ee0636302a65d8c3

                  SHA512

                  db5495480b72fa1bf94e7a196cc6d3edd7187b749483f7e95d75d93f94a75facc572c52361df88a63f1b34aaeb78f914123230b067f9689c6e39e76ee6908563

                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\sessionstore-backups\recovery.jsonlz4

                  Filesize

                  4KB

                  MD5

                  af35de214decc065aedefa887d8ad8d0

                  SHA1

                  a7c466132f092a3204072d61ffc6153e1d8f1a4a

                  SHA256

                  9815d2193c5b4f147ea97c351b49be56b29901fec5497226dca8faa30164dca3

                  SHA512

                  ea4e4ac52cd6a077dca8451248c17c7cf8e213bb687713ad980eaf34b9e89ca6165e80188165860ba50db6593fb2337821214a759736f18ba4ad67329f1f0e29

                • \Users\Admin\AppData\Local\Temp\6AdCfwsr43v0ww\Y-Cleaner.exe

                  Filesize

                  1.4MB

                  MD5

                  a8cf5621811f7fac55cfe8cb3fa6b9f6

                  SHA1

                  121356839e8138a03141f5f5856936a85bd2a474

                  SHA256

                  614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

                  SHA512

                  4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

                • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                  Filesize

                  1.8MB

                  MD5

                  a541fa0eaf66c44faab3dbfd8229bb17

                  SHA1

                  dd170660003d092e778e448d3f8fb6a6e7840262

                  SHA256

                  b66b9bbe43d16ba2ae2275aaad148809d9c5bce9726ac3f4b57333d355f9a85a

                  SHA512

                  c3f27bba03085836dde8f028db873052f61fb53ee74abea0f6a108399d400afddc144053975cde5a402f45d3a0d293dd9ec53b8994b7a97626b5cf8cd9c2a879

                • memory/1900-18-0x00000000000B0000-0x0000000000564000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1900-19-0x00000000070C0000-0x0000000007574000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1900-0-0x00000000000B0000-0x0000000000564000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1900-5-0x00000000000B0000-0x0000000000564000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1900-3-0x00000000000B0000-0x0000000000564000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1900-2-0x00000000000B1000-0x00000000000DF000-memory.dmp

                  Filesize

                  184KB

                • memory/1900-1-0x0000000077720000-0x0000000077722000-memory.dmp

                  Filesize

                  8KB

                • memory/1956-44-0x0000000000400000-0x0000000000C6C000-memory.dmp

                  Filesize

                  8.4MB

                • memory/1956-8774-0x0000000000400000-0x0000000000C6C000-memory.dmp

                  Filesize

                  8.4MB

                • memory/1956-3336-0x0000000000400000-0x0000000000C6C000-memory.dmp

                  Filesize

                  8.4MB

                • memory/2376-107-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-1266-0x0000000004350000-0x000000000439C000-memory.dmp

                  Filesize

                  304KB

                • memory/2376-73-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-71-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-69-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-67-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-125-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-123-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-121-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-117-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-115-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-113-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-111-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-109-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-62-0x0000000000360000-0x00000000004CA000-memory.dmp

                  Filesize

                  1.4MB

                • memory/2376-79-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-77-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-63-0x0000000004890000-0x00000000049D4000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2376-1264-0x0000000004D10000-0x0000000004DC6000-memory.dmp

                  Filesize

                  728KB

                • memory/2376-97-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-1267-0x00000000051D0000-0x0000000005224000-memory.dmp

                  Filesize

                  336KB

                • memory/2376-1268-0x0000000005220000-0x000000000528E000-memory.dmp

                  Filesize

                  440KB

                • memory/2376-1269-0x0000000005480000-0x0000000005518000-memory.dmp

                  Filesize

                  608KB

                • memory/2376-64-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-81-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-3338-0x0000000005F00000-0x0000000005FF2000-memory.dmp

                  Filesize

                  968KB

                • memory/2376-85-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-87-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-65-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-75-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-83-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-105-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-103-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-89-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-119-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-101-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-91-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-93-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-95-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2376-99-0x0000000004890000-0x00000000049CE000-memory.dmp

                  Filesize

                  1.2MB

                • memory/2580-1262-0x0000000006BD0000-0x0000000007841000-memory.dmp

                  Filesize

                  12.4MB

                • memory/2580-45-0x0000000000300000-0x00000000007B4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2580-20-0x0000000000300000-0x00000000007B4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2580-8473-0x0000000006BD0000-0x000000000706F000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2580-21-0x0000000000301000-0x000000000032F000-memory.dmp

                  Filesize

                  184KB

                • memory/2580-8487-0x0000000006BD0000-0x0000000007251000-memory.dmp

                  Filesize

                  6.5MB

                • memory/2580-22-0x0000000000300000-0x00000000007B4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2580-8401-0x0000000006BD0000-0x0000000007251000-memory.dmp

                  Filesize

                  6.5MB

                • memory/2580-8403-0x0000000006BD0000-0x0000000007251000-memory.dmp

                  Filesize

                  6.5MB

                • memory/2580-24-0x0000000000300000-0x00000000007B4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2580-40-0x0000000000300000-0x00000000007B4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2580-8381-0x0000000006BD0000-0x000000000706F000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2580-8379-0x0000000006BD0000-0x000000000706F000-memory.dmp

                  Filesize

                  4.6MB

                • memory/2580-43-0x0000000006BD0000-0x000000000743C000-memory.dmp

                  Filesize

                  8.4MB

                • memory/2580-8373-0x0000000006BD0000-0x0000000007841000-memory.dmp

                  Filesize

                  12.4MB

                • memory/2580-1671-0x0000000006BD0000-0x000000000743C000-memory.dmp

                  Filesize

                  8.4MB

                • memory/2580-41-0x0000000006BD0000-0x000000000743C000-memory.dmp

                  Filesize

                  8.4MB

                • memory/2580-298-0x0000000000300000-0x00000000007B4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2580-55-0x0000000000300000-0x00000000007B4000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2580-8457-0x0000000006BD0000-0x000000000706F000-memory.dmp

                  Filesize

                  4.6MB

                • memory/4964-1263-0x0000000001280000-0x0000000001EF1000-memory.dmp

                  Filesize

                  12.4MB

                • memory/4964-8659-0x0000000001280000-0x0000000001EF1000-memory.dmp

                  Filesize

                  12.4MB

                • memory/4964-8383-0x0000000001280000-0x0000000001EF1000-memory.dmp

                  Filesize

                  12.4MB

                • memory/6200-8380-0x0000000000DE0000-0x000000000127F000-memory.dmp

                  Filesize

                  4.6MB

                • memory/6200-8455-0x0000000000DE0000-0x000000000127F000-memory.dmp

                  Filesize

                  4.6MB

                • memory/8196-8472-0x0000000000EA0000-0x000000000115C000-memory.dmp

                  Filesize

                  2.7MB

                • memory/8196-8471-0x0000000000EA0000-0x000000000115C000-memory.dmp

                  Filesize

                  2.7MB