Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2024, 06:41

General

  • Target

    85815a1cb7eee10f958a02d58018a11fa37e8d204523df696a10da2a63531e10.exe

  • Size

    3.7MB

  • MD5

    36e2a5ae900dff67a64f81eb762a01de

  • SHA1

    97227f9f6c939f6d02c3b3cb8efd2eb81d246b12

  • SHA256

    85815a1cb7eee10f958a02d58018a11fa37e8d204523df696a10da2a63531e10

  • SHA512

    1e968dd2894d7e54435d48991e76ee554c6b667e45e205053ef9164e3e7870bc72904baea0e63478ebe07d17681f2355ef12179b56efff9ff4514605ca8fbd91

  • SSDEEP

    98304:EXIRvWaQUUKJ1c1XQIVa/yGbCq+siY9Om:E3aQUBJ2ZQIVqy3psiY9F

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\85815a1cb7eee10f958a02d58018a11fa37e8d204523df696a10da2a63531e10.exe
    "C:\Users\Admin\AppData\Local\Temp\85815a1cb7eee10f958a02d58018a11fa37e8d204523df696a10da2a63531e10.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1g67k4.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1g67k4.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Users\Admin\AppData\Local\Temp\1012887001\144dd9ccf0.exe
          "C:\Users\Admin\AppData\Local\Temp\1012887001\144dd9ccf0.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4452
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1576
            5⤵
            • Program crash
            PID:3544
        • C:\Users\Admin\AppData\Local\Temp\1012888001\520fa8b959.exe
          "C:\Users\Admin\AppData\Local\Temp\1012888001\520fa8b959.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2708
        • C:\Users\Admin\AppData\Local\Temp\1012889001\3d12610798.exe
          "C:\Users\Admin\AppData\Local\Temp\1012889001\3d12610798.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2984
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4664
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4364
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1852
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2112
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1644
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2552
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2072 -parentBuildID 20240401114208 -prefsHandle 1992 -prefMapHandle 1984 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73579812-2db2-43bb-8d5f-7fb7f938ca60} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" gpu
                7⤵
                  PID:4788
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2504 -parentBuildID 20240401114208 -prefsHandle 2480 -prefMapHandle 2476 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2aee60ec-5d37-4f80-a7dd-462db63fae64} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" socket
                  7⤵
                    PID:4484
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3308 -childID 1 -isForBrowser -prefsHandle 3360 -prefMapHandle 2832 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd2715fb-8002-437b-9f7a-fb8b844475ac} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" tab
                    7⤵
                      PID:4616
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4020 -childID 2 -isForBrowser -prefsHandle 3968 -prefMapHandle 1116 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77346125-1bad-4024-bb9f-03d871ab435c} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" tab
                      7⤵
                        PID:1108
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4668 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4616 -prefMapHandle 4644 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23b9266e-0119-4d0f-97bc-ba79e7dc666c} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" utility
                        7⤵
                        • Checks processor information in registry
                        PID:5516
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 3 -isForBrowser -prefsHandle 5520 -prefMapHandle 5492 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7388c292-fb1a-4cf6-8e4c-206e6f3bd201} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" tab
                        7⤵
                          PID:684
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 4 -isForBrowser -prefsHandle 5664 -prefMapHandle 5672 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4ae6e5a-246d-45d0-b706-ffa481ca9670} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" tab
                          7⤵
                            PID:1968
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5856 -childID 5 -isForBrowser -prefsHandle 5528 -prefMapHandle 5488 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23ad196a-765a-461e-b33c-88dc57a217df} 2552 "\\.\pipe\gecko-crash-server-pipe.2552" tab
                            7⤵
                              PID:2180
                      • C:\Users\Admin\AppData\Local\Temp\1012890001\38c472068a.exe
                        "C:\Users\Admin\AppData\Local\Temp\1012890001\38c472068a.exe"
                        4⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2140
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2W0050.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2W0050.exe
                    2⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4556
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1588
                      3⤵
                      • Program crash
                      PID:932
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1612
                      3⤵
                      • Program crash
                      PID:512
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4556 -ip 4556
                  1⤵
                    PID:1896
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4556 -ip 4556
                    1⤵
                      PID:2316
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4452 -ip 4452
                      1⤵
                        PID:2180
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5316
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5696

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json

                        Filesize

                        27KB

                        MD5

                        b7a0476d98eee05ffbbec2367daadf32

                        SHA1

                        9a24e08354fc05484152767025ac1e185a50a9f7

                        SHA256

                        c668735f31b7d658b791abea6ecd975403604e0d788fd6e0191e2e93df94cc4a

                        SHA512

                        02503a1775d6e80f37f330d011d0e14c4261e3c42b0e1c1b1aec6ae1b9ac4f1118481c39f6c5b6e29d791f3d819672787bf54613189c0c7b07f8fe60f7c22b5d

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

                        Filesize

                        13KB

                        MD5

                        c625996c147058f9bb592dbbabe304b3

                        SHA1

                        a79d2f1e9565d49261cf640314051b606a81f87f

                        SHA256

                        e604a30037f6aa454d60dec937759f8c08c3902127c37d0de19fde46489fe264

                        SHA512

                        308f60c2ff80a5b6c5bb6612254d9962a5f88e890ed9c0fdaf1c811b764161bc54fc2d1ae4cb8d88cdd2b7bc9530a201d5907b77ec26a871f9e455b7ebf2956e

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                      • C:\Users\Admin\AppData\Local\Temp\1012887001\144dd9ccf0.exe

                        Filesize

                        1.8MB

                        MD5

                        ae8111f11c7a5611770e4c4b8510eb4b

                        SHA1

                        99974bcb92a9106045cd4391902d6fc9680c42fd

                        SHA256

                        d84d3e12220e17275fcd6b90d7f2baa6e47bc91d06efa9d47e685d6353a8b2e0

                        SHA512

                        c98c4bce8332f496865cb11ef63b842fffc53416745e4269da1306e4a5a549780eb8b426122d456db585ebc2f583c2928e3b0565081e623f24e26278c9afa667

                      • C:\Users\Admin\AppData\Local\Temp\1012888001\520fa8b959.exe

                        Filesize

                        4.9MB

                        MD5

                        a2728561b7680aab4204863cd307df3d

                        SHA1

                        ed90cd719cd34e45cb5ba0147fe16a1241497dea

                        SHA256

                        8a00b650affb26d6fd996043a56922c8f2caf4d3a73ad0400ff6958adbae265b

                        SHA512

                        60f595125cd94f3664fe356868d644fdb39aa2513085c2f90fa878b5362bd610bd0879122a7b2345e3889ef46bea682cefbb1e1730413801655c5cb52197bb64

                      • C:\Users\Admin\AppData\Local\Temp\1012889001\3d12610798.exe

                        Filesize

                        947KB

                        MD5

                        6da1d1729f73ca6cc3aec6e26c0a5bfe

                        SHA1

                        d07c102097d332249fcb0bacf485eeb307962ac4

                        SHA256

                        6c9f50764263e318da51169a2f82bb5965977b5c71bae55b30f6d768e41a834c

                        SHA512

                        ef163cb37bf8345dc3d030d76510b0d9f1c48af45dd1c030bd0ebe8be58b47651594747c5ccfe9468aa09f40a0f99410d2b45e5c8b3e77d1e41e739abbd35868

                      • C:\Users\Admin\AppData\Local\Temp\1012890001\38c472068a.exe

                        Filesize

                        2.7MB

                        MD5

                        b556e5001a590d13c69c25a0e62c48fb

                        SHA1

                        544c70f1595ab12f6d264a48887b9cefaa636882

                        SHA256

                        b11e93125194bedd6d119310e02a7f1f2571d8be5e126d8a760b40e412d59be6

                        SHA512

                        ccd13233b478a7c5aec7b64b1b0abd2f6dc537ab26728a516f91a52a3a3f596261581812a394ae51b62929f7b4cd2fbed24307d1ef8ce9c05bfa9063306e6cbd

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1g67k4.exe

                        Filesize

                        1.8MB

                        MD5

                        f25ddb78a2cc3b6442c52a3c4a2aa843

                        SHA1

                        52ba6df84b158bf917044fee22625d2a12202382

                        SHA256

                        ca2d328cf8d3bb990c47a4ea62d67eff34f06a00b7a3a7bf5189120da96d8bc4

                        SHA512

                        74c7900f42e3d9b5d490e4848c7d12832f14b245065e04baa96604f2ca91ea5e46318ea71e081ee266fc770a94413edc298516abf23ed9f6c7cd6e7a70b72f14

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2W0050.exe

                        Filesize

                        1.8MB

                        MD5

                        a996397cd4d1502f1eed95cd693d5752

                        SHA1

                        e66aed1fe77966fe2d9eebc5ba8e44f873485589

                        SHA256

                        81a3a8a0412d519ebc63f7020adff204ea2ea0c117fd0ad8d7828615895ea648

                        SHA512

                        160d03ee92fcc883ba168824d54404ea579b4e4ddebc8fb2ada4e9c0330658f3962b9cdbf894ea31453c27eff3ef04adbd2218eaa1330a8578464049a925d9ce

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

                        Filesize

                        18KB

                        MD5

                        7927a05d2c247236a6b05e8c3b99fa3d

                        SHA1

                        c274b308925b02a4ec658a4629eb63b1405ce788

                        SHA256

                        0407d2d34953143bcd8d9d6aa7eeb29253a26b1f68f3e127ee0612c302c94426

                        SHA512

                        8df1071f22e44c6594427425100db41ba06ee43959a614a1f946ed577c1c53b387d2855b6e78862798423c7078f152732f746d5e90b82ac3423153d1c18120d8

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

                        Filesize

                        10KB

                        MD5

                        a86cb6894f17696f49795a18947b54d4

                        SHA1

                        4156e40b4b37804e9479f009559b2a7e4b58251a

                        SHA256

                        fb3e3bbb75532056a8f660b332948515bad1da3e5cb9a74d7d04f483bf9eba1c

                        SHA512

                        45e9257afcea420eb9fb66ad53d8cbc00b6a5da735f3c0d0ab82f787936b915537016a65de58e877b7de500d0ee3bf2bbf896d06cf694686d2937d450348fe3d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

                        Filesize

                        22KB

                        MD5

                        c1e401132032fdab9915eed528041679

                        SHA1

                        5dcaead8ef4e38b32fcd658ad066088a53067eb5

                        SHA256

                        6faa49da45c20925ca383c69acdfb393c4ac989fe50961c8c224c7a6f4c94f58

                        SHA512

                        2250b2ef7e930d33517666a43efad53986b5afba8c05bba70d15ae172a7b7ab57b5975de3eb2b62001dd19dc6d9f729a64303cfc5143ac193b9660904f2d909a

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

                        Filesize

                        15KB

                        MD5

                        d3d1967aedc9f849305fe2771d318db9

                        SHA1

                        c0b919216ee812f5ab7870c82c70911ead7e46f6

                        SHA256

                        5917e8d23db29635a0f21a2cc449812a11def0eb185b22e058bb208984eef5fb

                        SHA512

                        23d4d2f12a380a89c186e02da2f4846403d466bbc6d3725ac4ed43a8bca26adea9050f9dfcb55855c1a122a805777c7feaa32d83b4280bcb0018a68799157daf

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        15KB

                        MD5

                        a7830c2fd890f9c44aaa21ae2512aaca

                        SHA1

                        9373e112f04661ec515bb20ca4d63121950fb974

                        SHA256

                        9b41a63dde56e5006796a7e914b8dd0a5335c6e9b391af09636ed551f1dc0dee

                        SHA512

                        9fa0d20ea543c37d81eb6146cb9eb3ed5037a077af8c968ce007cac934c8f3677b7d0b6c215d0eb40981c00602f56a659d74a78515e7cf0629af3750a9e119ad

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        15KB

                        MD5

                        f8846938a716d4a2d7b61c664e4001e7

                        SHA1

                        51cea4a60168d575b127f4769e5411a68d63d0eb

                        SHA256

                        29b851650d419eea22233a55929e75b6d6a9485e2dc489c24d09754d5ee7295f

                        SHA512

                        0f4e1ce82a7c2875f9688440680fd65053bd3183fdebea11dc95fa8503be35ab48186a40f59350afb3a2175a55c16167a80d59349b92d9c0198c2f5a80ecee27

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                        Filesize

                        5KB

                        MD5

                        aed10293b95f5c2561ee74aebb77271b

                        SHA1

                        4ba4eb4f50db135e8d5b1c0a9619d268513dc837

                        SHA256

                        2ab00ab490b360183fc02dca050e6f3855efc02609929ba979f04dc0bbc2805b

                        SHA512

                        b4a0d94772b07585789d18839cc48332ee746f54e6ba0231a2fd4bade5402801c3a0c2b0c518b8f97102fcd4ec5b194426eb980c0ff7c0ba8811d6a287f0a725

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\137051ce-7fe9-4759-bc5d-2fd6b31a4bd2

                        Filesize

                        671B

                        MD5

                        b835383b6470eba8489c4d3a37b93ab6

                        SHA1

                        5e553fb3a306f75147a69be6b98ec2febaf2abd3

                        SHA256

                        3403b221c3727dbce83fe0505fd3f584806845d621a7dae7e31d921495311423

                        SHA512

                        35a8cef4271b6b585bd866e33d61b96590d026c1f97a331de263acc62081cb91653a9e808a03274d9e5cc8ab2225c0a8b7a26e1efeb79ad752fe3ef19fe59aa1

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\1cb5dea6-9896-44ce-b35d-835af377e50e

                        Filesize

                        982B

                        MD5

                        bd137e81dea4f385b8d6a935187349d8

                        SHA1

                        252d996d6e561aee625702d1d292e9e30a16c1d2

                        SHA256

                        171f19dfdc57bdc3dcb669d287176777f459d7d822bb69cddf63ae63b6786d22

                        SHA512

                        2156d516e37810ad8b7c67036d84bf29f712dbe84639291ccbe1d27f5cdc443f6d0c8173455d8ffbccd40a26ad66606c0aaac845baa5d7cdf12118fb20013e93

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\f21b520a-03d1-4490-a3a6-a2664175fc80

                        Filesize

                        25KB

                        MD5

                        15248af3abbe6cafefd39e7d998e751c

                        SHA1

                        da3807f20bb5585751063bfbf0b81146186073c4

                        SHA256

                        720d2667f7f6a5a88d581a40b253917e3005b716beff57853b1a0d22a2825e3b

                        SHA512

                        9779c0457b431aa47811a387ea4601682bd30f3c667e3111f60b4c2c2bd175e3d03c7a8e0e85a732f08c493ea19645a9c1523d9eb32b2ccbb4ea03fc89a6cf2d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

                        Filesize

                        10KB

                        MD5

                        fc8414547dff57788f3625e4f3af53f7

                        SHA1

                        4f7c35d0ab59c8f3802f1d1f836851d32cdb00bb

                        SHA256

                        ccd1e84c2a6e3c68349506319f7687521ef0a458d0712caa6611a9d3cb6fd423

                        SHA512

                        d8ccfe38e8c305218cecbc0be252e2010b7efda247d1f71aa04332ef11ab79ff33871d6f2e935a242814b2acee8b703c2974ca4c999e2eb384d719dba5e95150

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

                        Filesize

                        11KB

                        MD5

                        c594e20b0b849a99b3e554c91e7febc3

                        SHA1

                        a6f055ffee259e8979aeac821b89157d0f2db2e9

                        SHA256

                        166d4b8d3cffa578f6eec5cd65eb815980b786ea801e467a5d1bb0d60d9df728

                        SHA512

                        7a1d84b26c6d3649bd09f83624725deb0b35d8cf805b93f4e3a44879a584eaff2c8415e4a3d0cbaf549c9a11da8376255cafa72c6600bfbd300bc7fff41fb215

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

                        Filesize

                        15KB

                        MD5

                        1df4f9818e18ce22b6b3cab96d04cc54

                        SHA1

                        ec20dc6ee2a1673a0823af67b405d396938472bc

                        SHA256

                        bed4049848794776613814dd7f5a9470e6aa9d54be90cbf7c473bd646f63c2aa

                        SHA512

                        82c24a160dd50bf593bf9267d1b6814dfbae4cab81de5f425926cde3e6a51cb75485d6118e1c011a8fc588b2867091e28ad931d4a6d6fb6d9c0b2841843163a2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js

                        Filesize

                        10KB

                        MD5

                        964e5b61def45195d5b530425f0782c9

                        SHA1

                        7225615117adaa38eb26a1ad48d9f661fca9ac72

                        SHA256

                        4ca9f179a9d446c0afdffe898ffe8fb52a739a3fcf356a36c15b46cd2a3e381d

                        SHA512

                        6ff357a4c2b7ac77adc7698adb728a0139e1880c75441fee98b9577630f401ee77a2e6c9a81e1e36dbc8d312563e0e6d0f9dd4011c042a5bde9079c5a187160d

                      • memory/2140-111-0x0000000000AA0000-0x0000000000D68000-memory.dmp

                        Filesize

                        2.8MB

                      • memory/2140-643-0x0000000000AA0000-0x0000000000D68000-memory.dmp

                        Filesize

                        2.8MB

                      • memory/2140-644-0x0000000000AA0000-0x0000000000D68000-memory.dmp

                        Filesize

                        2.8MB

                      • memory/2140-855-0x0000000000AA0000-0x0000000000D68000-memory.dmp

                        Filesize

                        2.8MB

                      • memory/2140-845-0x0000000000AA0000-0x0000000000D68000-memory.dmp

                        Filesize

                        2.8MB

                      • memory/2268-2276-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-4183-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-4192-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-4191-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-846-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-4190-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-4177-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-4008-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-886-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-25-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-638-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-50-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2268-49-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/2708-66-0x0000000000090000-0x0000000000570000-memory.dmp

                        Filesize

                        4.9MB

                      • memory/2708-67-0x0000000000090000-0x0000000000570000-memory.dmp

                        Filesize

                        4.9MB

                      • memory/4452-47-0x0000000000F90000-0x0000000001426000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/4452-48-0x0000000000F90000-0x0000000001426000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/4556-31-0x0000000000360000-0x00000000007F7000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/4556-29-0x0000000000360000-0x00000000007F7000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/5000-24-0x00000000008C0000-0x0000000000D6F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/5000-11-0x00000000008C0000-0x0000000000D6F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/5000-10-0x00000000008C0000-0x0000000000D6F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/5000-7-0x00000000008C0000-0x0000000000D6F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/5000-8-0x0000000077D74000-0x0000000077D76000-memory.dmp

                        Filesize

                        8KB

                      • memory/5000-9-0x00000000008C1000-0x00000000008EF000-memory.dmp

                        Filesize

                        184KB

                      • memory/5316-826-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/5316-828-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/5696-4186-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB

                      • memory/5696-4187-0x0000000000680000-0x0000000000B2F000-memory.dmp

                        Filesize

                        4.7MB