Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2024, 10:22

General

  • Target

    a6181d18d9ce25c3c2e3dad8227fbe1d56a4c0dbf38e7245ec63388d16527319N.exe

  • Size

    3.6MB

  • MD5

    ee8159256e50319eca83f757a5bbe470

  • SHA1

    83e4b618a175fa632e4be77b4f89295d038373ee

  • SHA256

    a6181d18d9ce25c3c2e3dad8227fbe1d56a4c0dbf38e7245ec63388d16527319

  • SHA512

    00064265a9e73b5c4a64e0718eed13a71bff4f1f4bb604439c104e14bc995167ff81387af76b1d880d6baa5192dcafb5e3730d5ae5a87ef4b9b803961f839233

  • SSDEEP

    98304:FnunKrpJ8JpbuIxjIjhSgxHnxGc6KIdUp92R9:FubBxEHxJWUp9w9

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6181d18d9ce25c3c2e3dad8227fbe1d56a4c0dbf38e7245ec63388d16527319N.exe
    "C:\Users\Admin\AppData\Local\Temp\a6181d18d9ce25c3c2e3dad8227fbe1d56a4c0dbf38e7245ec63388d16527319N.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1O23T7.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1O23T7.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1416
        • C:\Users\Admin\AppData\Local\Temp\1012911001\JoYUT4N.exe
          "C:\Users\Admin\AppData\Local\Temp\1012911001\JoYUT4N.exe"
          4⤵
          • Executes dropped EXE
          PID:4440
        • C:\Users\Admin\AppData\Local\Temp\1012925001\14802906c9.exe
          "C:\Users\Admin\AppData\Local\Temp\1012925001\14802906c9.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1504
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1584
            5⤵
            • Program crash
            PID:4628
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1564
            5⤵
            • Program crash
            PID:2548
        • C:\Users\Admin\AppData\Local\Temp\1012926001\0318ec5fac.exe
          "C:\Users\Admin\AppData\Local\Temp\1012926001\0318ec5fac.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1560
        • C:\Users\Admin\AppData\Local\Temp\1012927001\e358c26441.exe
          "C:\Users\Admin\AppData\Local\Temp\1012927001\e358c26441.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1032
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1448
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4272
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3200
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2512
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1148
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3740
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              6⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4584
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2076 -parentBuildID 20240401114208 -prefsHandle 1996 -prefMapHandle 1988 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49d4fb6c-fef5-46ed-b6d3-034bec2c640c} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" gpu
                7⤵
                  PID:4376
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2504 -parentBuildID 20240401114208 -prefsHandle 2484 -prefMapHandle 2480 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6bfc991-c7b1-492d-aac0-3871c2c3992a} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" socket
                  7⤵
                    PID:2932
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3164 -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3028 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb7cee0a-4745-4674-8e6d-02adf3c0513a} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
                    7⤵
                      PID:2492
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1692 -childID 2 -isForBrowser -prefsHandle 1280 -prefMapHandle 2656 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84c30fdb-8af1-426e-895f-405da4dc614a} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
                      7⤵
                        PID:4536
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19f7e6a5-c67b-43d2-aa0b-6a21217fe6ae} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" utility
                        7⤵
                        • Checks processor information in registry
                        PID:6084
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5364 -prefMapHandle 5360 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d392a361-5d98-4f54-ae30-90cdd9bd4149} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
                        7⤵
                          PID:4576
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 4 -isForBrowser -prefsHandle 5512 -prefMapHandle 5520 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c668aea9-68e7-43a3-b94f-d35d40c07d1a} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
                          7⤵
                            PID:2812
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 5 -isForBrowser -prefsHandle 5784 -prefMapHandle 5780 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d366c3e-7726-46c5-8d48-edce45e9d13d} 4584 "\\.\pipe\gecko-crash-server-pipe.4584" tab
                            7⤵
                              PID:4596
                      • C:\Users\Admin\AppData\Local\Temp\1012928001\4b7991b093.exe
                        "C:\Users\Admin\AppData\Local\Temp\1012928001\4b7991b093.exe"
                        4⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7036
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2k8223.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2k8223.exe
                    2⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:468
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 1604
                      3⤵
                      • Program crash
                      PID:1536
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 1592
                      3⤵
                      • Program crash
                      PID:1172
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 468 -ip 468
                  1⤵
                    PID:1216
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 468 -ip 468
                    1⤵
                      PID:5072
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1504 -ip 1504
                      1⤵
                        PID:2280
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1504 -ip 1504
                        1⤵
                          PID:2804
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4604
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1044

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json

                          Filesize

                          19KB

                          MD5

                          faf6d94d35326d596d59131869bc946b

                          SHA1

                          0365a038cf59250140ceaf74128c4a5c169c43c3

                          SHA256

                          54f9943a19d933d82b95f2a99ffa37365868f8bb55a7ab1c74b370996ede70ab

                          SHA512

                          df226b2659659202f59f5bbded5bb01bd744b271a90b7e7140e4a0aa92a2d5be5d439b21afb609a7cc214879e645c61271c56409ddcb3493bda99c8c044adf33

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

                          Filesize

                          13KB

                          MD5

                          6b67e7473f21076c0b63dea3e1bd927e

                          SHA1

                          b4eb2e6288edbf28263a6f1cecd9a820d2df3d4d

                          SHA256

                          7bf13c1e420b28467dd74b6ef725c38fe450a7fa4c15cd451ffe0960a7069bcf

                          SHA512

                          be80f6c9d32f8d04288d8accdb7825695f9a3819973c84ef762bbefe360aac5f38ddc7ad79b3db7844abea68943e226b15371cf5b833cc287952994cc00b0242

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        • C:\Users\Admin\AppData\Local\Temp\1012911001\JoYUT4N.exe

                          Filesize

                          491KB

                          MD5

                          0141baf82bb318d465d2207be71876ef

                          SHA1

                          842c96e333bc63b130763369edb5048dc3ca8241

                          SHA256

                          f90cae22e1c93ab14789f1a8c238312bfdb1885a90058f696f7f446e1c922c48

                          SHA512

                          560202c3668921b0c8c6e25ba59231feb55d61178e2337f0f70cd2a2cfcd2dceabe2df87bfe46b391fc8694bfd64fb34c645fe9997e43af9026935b67db6a569

                        • C:\Users\Admin\AppData\Local\Temp\1012924001\e24a59ed40f6bec09ae4ce87e928f207.exe

                          Filesize

                          1KB

                          MD5

                          558ff77f562cdacc269e8eb3af5e60c2

                          SHA1

                          88aaad33d5c4525df22f396dd0199ac97984c1d8

                          SHA256

                          4fa207bb8a326740884a36e1bac2e1f3d3bee6a199a94807cc2477e20a24c86c

                          SHA512

                          935f2461e3e95902506420b23cddf26e0406adbd13b526e35422a00e24c2f5f3207e9bbe43a66306b96845d3b4ad65f778ef84e2438901534d764ad1a71bd0c9

                        • C:\Users\Admin\AppData\Local\Temp\1012925001\14802906c9.exe

                          Filesize

                          1.8MB

                          MD5

                          e0933ae8e72f7faa74c26e20098c6279

                          SHA1

                          61edd92c5d8a5416a556b6a822bb7e7cef73068a

                          SHA256

                          8c60e2eb2504988a8b4d55b0b5d9b430896e04c8b40547efd5e5930b168a7beb

                          SHA512

                          05ad0f15d4b78581bb7b2f2df4f9c8e38cf83825fdc963d9d8bf633030418bbd01e2330eb411d2c42f78acf3ffe7e9cf6f492cc68316630763fccf811bf8fb3b

                        • C:\Users\Admin\AppData\Local\Temp\1012926001\0318ec5fac.exe

                          Filesize

                          4.9MB

                          MD5

                          443c778fc72c59824a828ece66b8e82a

                          SHA1

                          91fb9df41bba19b6d6612bbafd6d35dc81dc01d6

                          SHA256

                          a43029c07921865be726ccc99e368b445715a3e55279c7faaaae5cad38eb4276

                          SHA512

                          b7d2ea13089446be522b2e69f8a326ff218180aa1a341cd251b13df85ef0f3c68afeb7bb0e2fee57624c9c8a17d7407f75aaf17147186d285d5799b42da00c91

                        • C:\Users\Admin\AppData\Local\Temp\1012927001\e358c26441.exe

                          Filesize

                          947KB

                          MD5

                          af37fe81c11b366a272710684c1c3aad

                          SHA1

                          db9237e149092c166908deac48bc21fff19e5552

                          SHA256

                          0faddfc4413703b1d9798592d5902dca7e7bfa737b4df44e92cc3d75b3fa21d8

                          SHA512

                          b7bcbc21eb7848acac7e193889fd04061937c58660b36cb76340b6a19d92d7f36657709b8bd4593f8c2443796c7b249b807c5212849306f9b44ad0540bcef05d

                        • C:\Users\Admin\AppData\Local\Temp\1012928001\4b7991b093.exe

                          Filesize

                          2.7MB

                          MD5

                          5fd8503c7d22ef556ff89841f26fe03e

                          SHA1

                          aa6cea0d0b8be5fba6e1cda19d485c65eaf8f534

                          SHA256

                          3db166ad30011af27341fe917b0e53fef80ab8051c6a64edd0c76841c6fcfabc

                          SHA512

                          54c00e445a7e2b97a96350a17a14027dd0910b9db33afaa5ee8a518573b33b5b74bf33038155b69c1b9371cad32d3d98337863a5888b56342d429d72adec8543

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1O23T7.exe

                          Filesize

                          1.8MB

                          MD5

                          05cb9fab7f63090af8daf42b731aa11c

                          SHA1

                          d03cb29fa974a9754ab4e44c7339d95633039857

                          SHA256

                          33202814f6f3ede944bff5d417d7125f8f07bce8d099b4ccd29d8cd774d0e148

                          SHA512

                          025248950624f59c54a9bca741132472f5c7a0cf2060587c533f54c707894d4929fdbb82116004f34f42f0f5f05351cb0f3a14ab2a18acf2bd0c64874ad79215

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2k8223.exe

                          Filesize

                          1.7MB

                          MD5

                          17cc76520a0027d6de469a4ac441c76c

                          SHA1

                          162746e63bea82f47a1680638148eacef0723da3

                          SHA256

                          fae41c9cd3c7b33f4a46f5a5bcc54f0cb464c7a41bd11e59a9f47a806da2ba64

                          SHA512

                          afa887ba5f5e26be05720c074d7ab2265a789f6fb573c25524dc8059a5684c85c03546e1b3e0c8a4fb49c428721bfc0615db1e9b17a32a631431b6ba43fe22d4

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                          Filesize

                          479KB

                          MD5

                          09372174e83dbbf696ee732fd2e875bb

                          SHA1

                          ba360186ba650a769f9303f48b7200fb5eaccee1

                          SHA256

                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                          SHA512

                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                          Filesize

                          13.8MB

                          MD5

                          0a8747a2ac9ac08ae9508f36c6d75692

                          SHA1

                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                          SHA256

                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                          SHA512

                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

                          Filesize

                          8KB

                          MD5

                          3d082bf14a174bf0d282ff8cf2c44e7c

                          SHA1

                          c413d1d8f176ea1874220da82c2182c2763d5ec9

                          SHA256

                          7ae2119746739a0946a33d89c8246c66c9dcc2c81d6ec2edb9a8c8d33b89ab2a

                          SHA512

                          8b8255b0a4f1c182562a2138151e6f37525950f9744e6146d9f750ffe94b63cdc4d710815d9500a4ab461e30687446529ce9a09875045b090edb8148b11434a0

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

                          Filesize

                          23KB

                          MD5

                          7a9d260d886ee1dd560c713c9914e21f

                          SHA1

                          c0c95c72f03a667ae8efc2070d7c683c284d5a33

                          SHA256

                          61a60674fef4ac90db4e5bf475892597fe6f71125305336866ffed24d1e883f8

                          SHA512

                          0092adf4bfcc55cb4cf73e28c2bdfa2d01cf141e60bf12007b9833a3797c207fbb6d7e5fb0348ce830d8c612ee0c0241069e09235e8035afe5531df9c6d2bc9c

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

                          Filesize

                          14KB

                          MD5

                          66516db40ac90631df9f6569f8b2b0ab

                          SHA1

                          8ca2a0f9064478d6e8e562d5cc3781c589be6e99

                          SHA256

                          a2c8bacacb114d8a3208ae09a610acf281d44ded488aa544761b160add8e1eb7

                          SHA512

                          859ed1b4be2ec7592f7a67bbdca83ae529e74b9f3cf714beb3e536594c6da1dcc45107478ce3452248d1b3b9207601a8db1996ef766fa72cdf6ab7ea2e545620

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

                          Filesize

                          6KB

                          MD5

                          e842ac784a34d5909874d6c77c89fe88

                          SHA1

                          7ecc7f789d9b9fe54ab99795733c2d1c5d3ec4b9

                          SHA256

                          a62facfeae8906d871e88c6ba8b2e210c773a57f0a9b8582bc53cff626c1b1ca

                          SHA512

                          7466ba323b6cb94f14fe29f5f2b6e08e159f0f601abbfe4de5d11a213c62e064b2b0340d00b24c11614762d1d89acd3fb171f1eab4c46346f6a97b24dff0c237

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

                          Filesize

                          15KB

                          MD5

                          c31aa7afe0629542e9603b5e9c884ae7

                          SHA1

                          1c592c8dd344bd2efda0f219f41d1cc0be35ee12

                          SHA256

                          1cbb71db753f88ef8c0ac3028da8da3275821f9c33e3483bae2d70b96ad45be0

                          SHA512

                          a79ba13fedeceb6c7ce425e405f5ca2b2bd0a8180cbc3c6eab17ddb22e47e40b4aeff2a5037a67f7cb21dd7eaec3b5779bab6e864029761945ab1073b8ca8583

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin

                          Filesize

                          5KB

                          MD5

                          6de643ac266931375a90537948a07d49

                          SHA1

                          f0ac659e36ed726debd379d5cd52ea568cfd9248

                          SHA256

                          5280fd2d17e677e8944e9cab1891467aae339d1ae88766a7340206be9d2f8eab

                          SHA512

                          a6caf9bfb5d1b8c351790bcf8a2faf5a8ceee920f257459369ec0a1eec156cbd38ee75cbed2661dcd447f0fd2d5458b7761271f13cbb564321d19fa6cde37050

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          6KB

                          MD5

                          0c1160e316455b3f2d28bee97ff68cfe

                          SHA1

                          9f79f78013c10e5907464d2bf8bd8c96c44bd10c

                          SHA256

                          546ae6194d9644f637fcd41277b1fba313a6ec51cd6df045cf5578ee258fadd5

                          SHA512

                          b0fa6d5657007da0d39b8497cda18e3106faac0f651f4654da4627004d378cd7f0a5c2f681b1d4284e0b455887745ec4bb784df5dc400488fed1e47687b70e95

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          6KB

                          MD5

                          44b5d121b3d245a1422234a22bc75ab4

                          SHA1

                          93dfe7a4d8a8e72035f17a867c39ff428d0c927d

                          SHA256

                          8619520c280d7f8d574f0b25c6e7f1711b6b0fcdf6af9ac6278bf0b77f6b11ca

                          SHA512

                          48c85615a3c7e868f0c3baa988ed5a6bf383fcf62a7736690a9701ea4e8ce867d01c15467a1e63252c65f2df159b655d656dde57b40fc263b8d5f854fb485c2a

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          5KB

                          MD5

                          5c04c980ac88b50e80c3f51f8502189a

                          SHA1

                          c82b33eb6ab190698c1aed903b938aed226f78fa

                          SHA256

                          c15fe04c4c4f66d144b2077c3d7533331e7f81fc7a4fa0b39144cf839a10c086

                          SHA512

                          ba96ec525dc14d417cd42c946ad704afa90acc5b37211bf4a3e423615b2848c82d1e3be53575c4a9007d8970411c752c408d2b4b15764d0b444c61f02d586b14

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          15KB

                          MD5

                          2c27cf88b7fda5ca28fdc063e6af972e

                          SHA1

                          3006f8bf3b867adba1137421e7c6be5e22474902

                          SHA256

                          76b252aabaf1f3c322343e59064f145493f4d0b4073483d6290abcf93f82650a

                          SHA512

                          65784f826bb09045d94a67961cad3fed5f80a1155e27558a87ae055ea424efa0f5cceb5c0f5056a247c037dc4c95bcadad831dedbe9fd598082a4c7122c03977

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                          Filesize

                          15KB

                          MD5

                          da08b1330f2300d029b250596489c49f

                          SHA1

                          c992373e4cbc78286da7426c349c57047fad33d2

                          SHA256

                          d570cdf5c9e7102e75ca1d42adbae95fc376b25004669312694c7d32bdaff461

                          SHA512

                          37c220420ad2527db52c96ef5462ab62366a69386b9de341b46821e2236dae064c348c36b42d5ca9648e90b0096d6b541857ee814d11c4bac84ee5acfcb4db63

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\a7b2371e-d105-42b8-b5a8-29df91ab4e16

                          Filesize

                          29KB

                          MD5

                          ea9dc79aabac7ad63981cad7f0803bd1

                          SHA1

                          ca5cc02535595c167efa2dd1f8eaac3dc5c03b51

                          SHA256

                          6df250b770716f7420afa6064147f902c8ef5cc1a471934e75d98e9bf202b940

                          SHA512

                          b3bc0d4e568c3eaf55b2383774ae5bf67a52253cc8a3ed09721a385edd19e403f449a2c02e9329319ed3c968b1519877ff8912a263517e509c58f7308312b677

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\c4f535ce-1658-4fb4-b8aa-03934fcfa7c9

                          Filesize

                          982B

                          MD5

                          a98cf6ea6cd75b8876ac35bab2d84210

                          SHA1

                          9d0ccd9188ee530cf89a24468f5a8df8b2598a57

                          SHA256

                          f78b615df6a0320c2b49a7c92e1c88b31dd85cd25cc09b9448c1a1b898795828

                          SHA512

                          0758674179221124edd9266f43578a952d1cfe3dc51e2961def7111580ee657c5c038e208e91eedd726cb802511b692e75080088c6c333eec193633765452b91

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\c63fd733-a5c0-4831-a315-dbefe8c75e4f

                          Filesize

                          671B

                          MD5

                          ec873776e4af79a7083f1054b07d2799

                          SHA1

                          65e21039a3e53eb637550d35cf5e2afba0ab8234

                          SHA256

                          3b04618ece88ae8e013b6d70527f2c124bc208a9c930c8baabf106d07ebea272

                          SHA512

                          9c9b4638c45244ecbd067e4e21d09061f8ea98f9c3fd460bc7f5df68f03c737cc4b8d9177ac15a05b6dd91f5e52d069c8837904174e60a4c09b9d14abf7ce7c3

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                          Filesize

                          1.1MB

                          MD5

                          842039753bf41fa5e11b3a1383061a87

                          SHA1

                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                          SHA256

                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                          SHA512

                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                          Filesize

                          116B

                          MD5

                          2a461e9eb87fd1955cea740a3444ee7a

                          SHA1

                          b10755914c713f5a4677494dbe8a686ed458c3c5

                          SHA256

                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                          SHA512

                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                          Filesize

                          372B

                          MD5

                          bf957ad58b55f64219ab3f793e374316

                          SHA1

                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                          SHA256

                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                          SHA512

                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                          Filesize

                          17.8MB

                          MD5

                          daf7ef3acccab478aaa7d6dc1c60f865

                          SHA1

                          f8246162b97ce4a945feced27b6ea114366ff2ad

                          SHA256

                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                          SHA512

                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

                          Filesize

                          10KB

                          MD5

                          5e65616f33af350f815e661a7edd3fe4

                          SHA1

                          2fd820136e4ca7766bca2b80ae78b25b52979661

                          SHA256

                          bef7510a50fd0d874eb9ef6e6ca8e33377ef6862cc7da8bce854cdffa8e895bb

                          SHA512

                          f92117ed975da915b78a9b2029cf15da8584393ce081b03044c079a1d56a91a6b920962617a83af9dcf63f42e2f76a71ecdda6c3520b5e3cc4be5c7581ac7fd4

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

                          Filesize

                          11KB

                          MD5

                          7f9c9b50b2d43161d6f717494159665a

                          SHA1

                          eb3d3ea28e986d0fb5a2ded5c0245ad315faf47c

                          SHA256

                          3a7b4221c2f4dc08723feeba11f01e72c513160985d16a6c28fa7f41fc9a5928

                          SHA512

                          e216b2bdc38833b1907b01cb00e5a4abaf895c537d671a16eedbc97723653d9fc830a0ca50ad6dfd555c421ec4f99ef33f636a30504e3c8061c29327784ec868

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

                          Filesize

                          15KB

                          MD5

                          08b8795b136d32d1ab4834d6b643de65

                          SHA1

                          0390ab77f3d7473569231a2ce28b3018bbf3a166

                          SHA256

                          bae26ab5f39ad9ae39217c57fce8763a33dd40674d012a957b311fde685a90cf

                          SHA512

                          99545828521c8d362e47476b647ce2a22761dd19ee392415832ba9cdc8cfe14fadc29e1560d2d75ba2ab5ff179dbc7858d16fe9051c3a0c336e6d8e4ece11ead

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js

                          Filesize

                          10KB

                          MD5

                          ba2b82954e7202b8e98c1e17e819da43

                          SHA1

                          8b1a24e9953714a543062aff7d9aea90b435c8bb

                          SHA256

                          e89a303877a7dcc323a843464fbea62a1f4a31419f83859c96f42b34c2410761

                          SHA512

                          5b56e347df29f751d2999fa3ec5c970e5cfd72514c15ecd2ea40d9bba607f50d9b5a2469d8eeeef5fd2aae2251de738f883400eb2dc0e5b4e3f73f2171667a53

                        • memory/468-29-0x0000000000290000-0x000000000071F000-memory.dmp

                          Filesize

                          4.6MB

                        • memory/468-30-0x0000000000290000-0x000000000071F000-memory.dmp

                          Filesize

                          4.6MB

                        • memory/1044-4191-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-65-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-1383-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-4195-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-4194-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-4193-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-4189-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-881-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-4183-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-4066-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-898-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-119-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-25-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1416-66-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/1504-81-0x0000000000F90000-0x0000000001425000-memory.dmp

                          Filesize

                          4.6MB

                        • memory/1504-83-0x0000000000F90000-0x0000000001425000-memory.dmp

                          Filesize

                          4.6MB

                        • memory/1560-99-0x0000000000590000-0x0000000000A7C000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/1560-100-0x0000000000590000-0x0000000000A7C000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/4392-10-0x0000000000CE0000-0x000000000118A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/4392-8-0x0000000076F54000-0x0000000076F56000-memory.dmp

                          Filesize

                          8KB

                        • memory/4392-7-0x0000000000CE0000-0x000000000118A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/4392-24-0x0000000000CE0000-0x000000000118A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/4392-9-0x0000000000CE1000-0x0000000000D0F000-memory.dmp

                          Filesize

                          184KB

                        • memory/4392-11-0x0000000000CE0000-0x000000000118A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/4440-49-0x00000000003F0000-0x000000000046E000-memory.dmp

                          Filesize

                          504KB

                        • memory/4604-121-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/4604-122-0x00000000006B0000-0x0000000000B5A000-memory.dmp

                          Filesize

                          4.7MB

                        • memory/7036-894-0x0000000000EE0000-0x000000000119C000-memory.dmp

                          Filesize

                          2.7MB

                        • memory/7036-765-0x0000000000EE0000-0x000000000119C000-memory.dmp

                          Filesize

                          2.7MB

                        • memory/7036-897-0x0000000000EE0000-0x000000000119C000-memory.dmp

                          Filesize

                          2.7MB

                        • memory/7036-828-0x0000000000EE0000-0x000000000119C000-memory.dmp

                          Filesize

                          2.7MB

                        • memory/7036-827-0x0000000000EE0000-0x000000000119C000-memory.dmp

                          Filesize

                          2.7MB