Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2024, 11:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 2.8MB
  • Sample241020-nat7cavejb
  • SHA256 5cd46ce2c63dba646bbed3b8eb4a9fa1ca55c9c06ea8e0444f439cc4779deef0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylummastealc9c9aa5domadiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • lumma

C2

  • https://clearancek.site

  • https://licendfilteo.site

  • https://spirittunek.store

  • https://bathdoomgaz.store

  • https://studennotediw.store

  • https://dissapoiznw.store

  • https://eaglepawnoy.store

  • https://mobbipenju.store

Extracted

Family

  • amadey

Version

  • 4.42

Botnet

  • 9c9aa5

C2

  • http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

  • stealc

Botnet

  • doma

C2

  • http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 10 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Users\Admin\AppData\Local\Temp\IZVRZBELALU8VXMC1.exe
      "C:\Users\Admin\AppData\Local\Temp\IZVRZBELALU8VXMC1.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3392
        • C:\Users\Admin\AppData\Local\Temp\1000401001\num.exe
          "C:\Users\Admin\AppData\Local\Temp\1000401001\num.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5344
        • C:\Users\Admin\AppData\Local\Temp\1000459001\0eca8334f6.exe
          "C:\Users\Admin\AppData\Local\Temp\1000459001\0eca8334f6.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5544
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
            PID:5892
          • C:\Users\Admin\AppData\Local\Temp\1000462001\c636deec3a.exe
            "C:\Users\Admin\AppData\Local\Temp\1000462001\c636deec3a.exe"
            4⤵
            • Modifies Windows Defender Real-time Protection settings
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Windows security modification
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6024
          • C:\Users\Admin\AppData\Local\Temp\1000464001\430ac6b1a1.exe
            "C:\Users\Admin\AppData\Local\Temp\1000464001\430ac6b1a1.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5176
            • C:\Users\Admin\AppData\Local\Temp\RP45L7J6XCD9TSXOGE2EE9RPY8.exe
              "C:\Users\Admin\AppData\Local\Temp\RP45L7J6XCD9TSXOGE2EE9RPY8.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5164
            • C:\Users\Admin\AppData\Local\Temp\3B0EOUDECOACFHGN66Z0BFC622.exe
              "C:\Users\Admin\AppData\Local\Temp\3B0EOUDECOACFHGN66Z0BFC622.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4776
            • C:\Users\Admin\AppData\Local\Temp\W1DZ3R5I6VZ5TYCDRE4SKDETBFJLKI.exe
              "C:\Users\Admin\AppData\Local\Temp\W1DZ3R5I6VZ5TYCDRE4SKDETBFJLKI.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:5396
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1308
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1548
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5000
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:6020
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4732
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                6⤵
                  PID:3516
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    7⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:5528
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 27735 -prefMapSize 245214 -appDir "C:\Program Files\Mozilla Firefox\browser" - {955806fb-6a11-4f79-84d0-ce14a0d57c9a} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" gpu
                      8⤵
                        PID:5368
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 28655 -prefMapSize 245214 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c663f3d2-b8d2-4476-bfe0-f912543ee34f} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" socket
                        8⤵
                          PID:4836
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3336 -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3440 -prefsLen 25740 -prefMapSize 245214 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bec3391-dc77-44d6-9607-3e8bfad4ffd6} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                          8⤵
                            PID:5556
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4020 -childID 2 -isForBrowser -prefsHandle 4016 -prefMapHandle 4012 -prefsLen 33088 -prefMapSize 245214 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66ed04f5-6c0b-40c2-9367-e6a080f8cc04} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                            8⤵
                              PID:2308
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4736 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4704 -prefMapHandle 4700 -prefsLen 33142 -prefMapSize 245214 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bd44de0-a292-4a47-921c-654bff6d7e35} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" utility
                              8⤵
                              • Checks processor information in registry
                              PID:2496
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5236 -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5240 -prefsLen 30086 -prefMapSize 245214 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce812d28-a901-4784-9ebd-42898a96b8e5} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                              8⤵
                                PID:4112
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 4 -isForBrowser -prefsHandle 5412 -prefMapHandle 5416 -prefsLen 30086 -prefMapSize 245214 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08ff8b47-4dd2-4857-8e32-8ee17b129340} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                                8⤵
                                  PID:3752
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5276 -prefMapHandle 5716 -prefsLen 30086 -prefMapSize 245214 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94ceb153-0cd2-4379-b487-fe6d3871d4c7} 5528 "\\.\pipe\gecko-crash-server-pipe.5528" tab
                                  8⤵
                                    PID:1804
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                            4⤵
                              PID:5408
                        • C:\Users\Admin\AppData\Local\Temp\CAPF9B1CQ0MCA3W13XACOUQWJX2QH.exe
                          "C:\Users\Admin\AppData\Local\Temp\CAPF9B1CQ0MCA3W13XACOUQWJX2QH.exe"
                          2⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2196
                        • C:\Users\Admin\AppData\Local\Temp\XVLCYFFFMPHHT72JW.exe
                          "C:\Users\Admin\AppData\Local\Temp\XVLCYFFFMPHHT72JW.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:1004
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM firefox.exe /T
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1308
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM chrome.exe /T
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3292
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM msedge.exe /T
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3604
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM opera.exe /T
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:900
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /F /IM brave.exe /T
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:920
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1448
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                              4⤵
                              • Checks processor information in registry
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1180
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2040 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {adc2883f-8cea-4342-9595-7c505f3c8362} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" gpu
                                5⤵
                                  PID:3716
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46da6805-bbb1-4043-b253-347ff3a30c7a} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" socket
                                  5⤵
                                    PID:1580
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3056 -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3128 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36b2ad4d-ce9c-440d-b4f3-aa58903f028a} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" tab
                                    5⤵
                                      PID:3016
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3880 -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 2876 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f17ccf9-2e29-4bde-ad0b-3f9b0e741e67} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" tab
                                      5⤵
                                        PID:3404
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4636 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4628 -prefMapHandle 4620 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58148ec2-5a03-4524-b130-a54f43731932} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" utility
                                        5⤵
                                        • Checks processor information in registry
                                        PID:3916
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 3 -isForBrowser -prefsHandle 5364 -prefMapHandle 5352 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c95fb4e7-0f70-4c9f-93c6-6c77e6cccfaf} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" tab
                                        5⤵
                                          PID:3056
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 4 -isForBrowser -prefsHandle 5676 -prefMapHandle 5672 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3324dec1-8912-41e1-ae1c-ea2fb15ddf5e} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" tab
                                          5⤵
                                            PID:3376
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 5 -isForBrowser -prefsHandle 5656 -prefMapHandle 5660 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bfde456b-8c8f-4439-afd3-49a9844b27d9} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" tab
                                            5⤵
                                              PID:5464
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 2040 -prefMapHandle 3264 -prefsLen 33958 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7992b5e5-9d8b-49e4-912c-cddc2cf58f63} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" gpu
                                              5⤵
                                                PID:3276
                                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                        1⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:6128
                                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                        1⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5812

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Defense Evasion

                                            Impair Defenses

                                            2
                                            T1562

                                            Disable or Modify Tools

                                            2
                                            T1562.001

                                            Modify Registry

                                            3
                                            T1112

                                            Virtualization/Sandbox Evasion

                                            2
                                            T1497

                                            Credential Access

                                            Credentials from Password Stores

                                            1
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Unsecured Credentials

                                            2
                                            T1552

                                            Credentials In Files

                                            2
                                            T1552.001

                                            Discovery

                                            Browser Information Discovery

                                            1
                                            T1217

                                            Query Registry

                                            7
                                            T1012

                                            System Information Discovery

                                            4
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            Virtualization/Sandbox Evasion

                                            2
                                            T1497

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            2
                                            T1005

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            activity-stream.discovery_stream.json
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json
                                            • Size 30KB
                                            • SHA256 d760e8c9672abb5558aa3bd52afbe9fea906232c9d646f85c77d99faf5b8933e
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
                                            • Size 13KB
                                            • SHA256 af459b69614166be45221aa63a9f43ddac1595d046d3b65e68f5c5511a6d5445
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
                                            • Size 13KB
                                            • SHA256 72a597eaaf10598056a1aa98add4abd8b74df1c35ff4143d88f53f0b5f8b4965
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            254256B27E0C48CF9B80B695F0B3B8CA84610495
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495
                                            • Size 9KB
                                            • SHA256 f8f67e2a418e7597044aad0870cec158635eee3469da69b79c560c7582da7278
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            6A9401069D7CA26FCDC6674AD30D2A279D87FE98
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\6A9401069D7CA26FCDC6674AD30D2A279D87FE98
                                            • Size 23KB
                                            • SHA256 25df468f78e6994316ff1a8afcfb77965e58e1380e692d9c97877ab986c763c5
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            6D89348819C8881868053197CA0754F36784BF5F
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
                                            • Size 15KB
                                            • SHA256 179ae8d1c0243b3a1988092bcaeaad6ee087f5fa16d4bcb8048fc2bea365c9f3
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            7717837394551952245D6650F3059765C5D1E97A
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\7717837394551952245D6650F3059765C5D1E97A
                                            • Size 8KB
                                            • SHA256 d03f48d22c1eed534ac7cc0820e774a245557c4301a8fe7b30a2e6c866b4c535
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            7A248F4AFDDF375B2F33B378A9EAB404EA484511
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\7A248F4AFDDF375B2F33B378A9EAB404EA484511
                                            • Size 82KB
                                            • SHA256 7ed7925cac68db104163abab7046945cc47909965a1f7de77d7fd477b129d0e2
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            7F05CCA942E2DC38B929976BF1BAB183C61DA2CF
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\7F05CCA942E2DC38B929976BF1BAB183C61DA2CF
                                            • Size 98B
                                            • SHA256 a5febd31611cd192ff53ca9e69c918d12972a785a77fe1c03e0916caf981f5a0
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            87DF30809CA66B67BB127FD7491F6665D97085BA
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\87DF30809CA66B67BB127FD7491F6665D97085BA
                                            • Size 309B
                                            • SHA256 bedbd7c928b29cdd05b50d9bb7760617b9351b5d5fd0d3ba966e55aef48d0cbc
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            A718AAB68EA013663CB3CDE897FFC95F29D15CB0
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\A718AAB68EA013663CB3CDE897FFC95F29D15CB0
                                            • Size 16KB
                                            • SHA256 1cbf57ba114a3842b3fa6f8c7e5823dbc2927838b43d719bef38d048b7c32fc1
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            scriptCache-child.bin
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\startupCache\scriptCache-child.bin
                                            • Size 469KB
                                            • SHA256 2aa3c813af62320d33d79d971fe48ef775ff66a716658e428b043e2425e721b1
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            scriptCache.bin
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\startupCache\scriptCache.bin
                                            • Size 8.9MB
                                            • SHA256 897dcd39adfe86fb4a7963c3e6fbc6a904f753a6a086a724335eb5980395786d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            urlCache.bin
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\startupCache\urlCache.bin
                                            • Size 2KB
                                            • SHA256 c212b51280b56948afa4d407ca18295db5f998971384aab048086fee9b0c30fa
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            webext.sc.lz4
                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\startupCache\webext.sc.lz4
                                            • Size 107KB
                                            • SHA256 11f2dc055448f08c7cd7b50496f93f098fac383f50dd632529e6d221946fe7b6
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            num.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\1000401001\num.exe
                                            • Size 307KB
                                            • SHA256 27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            c636deec3a.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\1000462001\c636deec3a.exe
                                            • Size 1.6MB
                                            • SHA256 7a24c3f28a835d175c56a1966d84074abbadab3c3ae87ef348368d2133a7599d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            430ac6b1a1.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\1000464001\430ac6b1a1.exe
                                            • Size 2.8MB
                                            • SHA256 5cd46ce2c63dba646bbed3b8eb4a9fa1ca55c9c06ea8e0444f439cc4779deef0
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            CAPF9B1CQ0MCA3W13XACOUQWJX2QH.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\CAPF9B1CQ0MCA3W13XACOUQWJX2QH.exe
                                            • Size 1.8MB
                                            • SHA256 e55f4b694652233cd09ef8b088132920f0760f14b546975e19ba294355954da1
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            IZVRZBELALU8VXMC1.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\IZVRZBELALU8VXMC1.exe
                                            • Size 1.8MB
                                            • SHA256 fb3dcab2bcbb65bb823de2ec109cfb215666abff645cf9d64266444827ab6422
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            XVLCYFFFMPHHT72JW.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\XVLCYFFFMPHHT72JW.exe
                                            • Size 900KB
                                            • SHA256 5986f2f4f8106e088b4e25a2f56f97d2079b5b92435bd190ddf6097bbad1809c
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tmpaddon
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                            • Size 479KB
                                            • SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tmpaddon-1
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                            • Size 13.8MB
                                            • SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AlternateServices.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                                            • Size 17KB
                                            • SHA256 409d4e9868cb0ab7124df8e679b58378a0763411a8fd7005c41f9a2fbf320f35
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AlternateServices.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                                            • Size 18KB
                                            • SHA256 29ec0b0077fffd42a02c81444e32546f58343970a3d4eb6020c5dc4343f65e15
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AlternateServices.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                                            • Size 7KB
                                            • SHA256 4bd6e6df58157626b7d87b96713d63574d3052a45398c28aed691c6c9367dddb
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            AlternateServices.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin
                                            • Size 13KB
                                            • SHA256 10509f43df615f54a2c68eae97cc6a1bb878ff6a919ccd934036e6466930549a
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            SiteSecurityServiceState.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\SiteSecurityServiceState.bin
                                            • Size 1KB
                                            • SHA256 e44356021cc4d6f88b48118e80af013c0719c591f8ed7b9cfae2457dfc444817
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            broadcast-listeners.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\broadcast-listeners.json
                                            • Size 221B
                                            • SHA256 8eba4407b9fd0b5d6641cf553a7baff0a72669d0b3e7ae20bbb791c9e915e20c
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            cert9.db
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cert9.db
                                            • Size 224KB
                                            • SHA256 7a102d8a090783a2eda6370f49959435aab79fa920e9660ce08989efdab6af1f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            cert9.db
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cert9.db
                                            • Size 224KB
                                            • SHA256 3abd9a40ee8a8a9f8c6b51874098c9c59a81a018095fe40fb72f5bbf99725ab1
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            content-prefs.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\content-prefs.sqlite
                                            • Size 256KB
                                            • SHA256 cfed019635a1e14f74ae78f2c03fb96b40ac3da37b67489bd98c144afc200f1f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            cookies.sqlite-wal
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cookies.sqlite-wal
                                            • Size 256KB
                                            • SHA256 9e524d921c2fc4841b30264532232cae84843355fcb5b38cad9b115c3297729f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data.safe.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.bin
                                            • Size 15KB
                                            • SHA256 66b813345f94fb734c17a27d8a97b880652756d51b5ddd459a74854f3c36b061
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data.safe.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                                            • Size 5KB
                                            • SHA256 ca277535b5e762afc92b8161bad41bc4b820c8a3d4b00ab1349da8e692108e77
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data.safe.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                                            • Size 6KB
                                            • SHA256 7d42418540e3fb50c56c491cc3ec4545b23107ee7c5ea7ea4e49f9ac43aaa19f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data.safe.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                                            • Size 16KB
                                            • SHA256 c12a32deb8d9b05f13a134aea67882294b7a1567355f04aeb81c03b0cedec240
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data.safe.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                                            • Size 14KB
                                            • SHA256 a1d5f7305e2c57e1f0c71383424b6af739d1a2dc68e03bd95f4db3631235f046
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data.safe.tmp
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp
                                            • Size 15KB
                                            • SHA256 4a42ea7fcd0a3a42e6ef95f8ddf3bc67acc925d73a375e9609eb33fc22012758
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            events
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\events\events
                                            • Size 438B
                                            • SHA256 8a495a2d387d33bb61ca53346c28d4439f4aaa3ef4af04feec84c2b46d49e9ae
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            pageload
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\events\pageload
                                            • Size 397B
                                            • SHA256 f5b47484a3307a5f2f45f795fefbdbdf00bef5c3ce7e76d877a06a4e64ac20d0
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            22d86df1-8a8e-48af-aeb7-5863d101417f
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\22d86df1-8a8e-48af-aeb7-5863d101417f
                                            • Size 661B
                                            • SHA256 a5c1f06cc2ae4e3759b864557943b01db4ec9178353b73c4df37313cfbbb7812
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            5f62c30d-11ec-4da6-8ade-8a67cc54ab94
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\5f62c30d-11ec-4da6-8ade-8a67cc54ab94
                                            • Size 787B
                                            • SHA256 ab64862e25da50f237be95b4c119eda177b6dcdb140926fe653b96ce0f4d8982
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            8174ba99-869e-46eb-8e97-5f2a463ca622
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\8174ba99-869e-46eb-8e97-5f2a463ca622
                                            • Size 671B
                                            • SHA256 d5e69ddd5af030d522807b6f83c4d27da412c18ca2c77f2bfc8c01d9e5bf2899
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            8cc3d879-4db8-4b85-b9c6-c9e45e929d40
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\8cc3d879-4db8-4b85-b9c6-c9e45e929d40
                                            • Size 982B
                                            • SHA256 200599b185d6e31970d0f06b3b2e2b829ecb008232bd81f8f0833613d8e849c2
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            c141538c-2282-4f7c-b9a5-6bd0afc460d9
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\c141538c-2282-4f7c-b9a5-6bd0afc460d9
                                            • Size 788B
                                            • SHA256 2d95272d9f7cc3c0149ff1a06e1cf064b8bf0f5d0305d05d8e8f8a8a25312306
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            db0ea90f-e2b9-4b14-9fa4-623a0114ff38
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\db0ea90f-e2b9-4b14-9fa4-623a0114ff38
                                            • Size 26KB
                                            • SHA256 d4a22ffd7f4112d27dcf0c00e33e221c4de64fa7046be9d751d4069ce184b2d8
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            dcf7c529-b310-43d8-a7bc-9e72720bda6b
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\dcf7c529-b310-43d8-a7bc-9e72720bda6b
                                            • Size 1KB
                                            • SHA256 7c9e9e012a4d684090a22f09c54f4ed8c2e8ae21b311885c2086ae02bcbf11ca
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            extensions.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\extensions.json
                                            • Size 37KB
                                            • SHA256 b36df2c6ffde672d2fe8068f52b883482ae7317d9b1686d4a55bc18be2cb87d9
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            favicons.sqlite-wal
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\favicons.sqlite-wal
                                            • Size 160KB
                                            • SHA256 79d2f989651720a65d7c0c5048b0834c7a944ad50d0f02e60cadfd1e297bf521
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            gmpopenh264.dll
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                            • Size 1.1MB
                                            • SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            gmpopenh264.info
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                            • Size 116B
                                            • SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            manifest.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                            • Size 372B
                                            • SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            widevinecdm.dll
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                            • Size 17.8MB
                                            • SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            permissions.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\permissions.sqlite
                                            • Size 96KB
                                            • SHA256 fb9d2383a93c01cd85a29bda154fff20a3f003156aff481e1ad0b62cd5828e0b
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            places.sqlite-wal
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\places.sqlite-wal
                                            • Size 2.0MB
                                            • SHA256 3be71205d9e9571cccf35bda1ae71fee935ee15dab1b1ea15b366a3412bbd986
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            prefs-1.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
                                            • Size 12KB
                                            • SHA256 0664e6f82bc41c4dd382ba297e39517db5c2aca247e57f2301141ac892e3ebef
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            prefs-1.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
                                            • Size 16KB
                                            • SHA256 1c3ac3d53e2cf1c4b43d074297531b780a81e3e96d89be25bb2b9ebbbf91d85a
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            prefs-1.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js
                                            • Size 16KB
                                            • SHA256 e600cc44a66c31624bd39ee286b23e2a072f9402039d1a4a47e8e9e77790182a
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            prefs.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
                                            • Size 10KB
                                            • SHA256 f00284fd726000e9bbde1dbdc009ff441446aa7a173afab9a569c3149b0be783
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            prefs.js
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js
                                            • Size 11KB
                                            • SHA256 f4b7659582381deba8db1c688359fed0656487dc8e6e703cd0a25ea28d077aea
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            protections.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\protections.sqlite
                                            • Size 64KB
                                            • SHA256 1a2564c1ba20b8038d35c2319258d94dc15d97914dcf753b31c48b79940dfd31
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            data.safe.bin
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\security_state\data.safe.bin
                                            • Size 237KB
                                            • SHA256 eb2f62941da4c1a04d9168ef1f1d39847ec237e2f717afd74600b89f57f88374
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            sessionCheckpoints.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionCheckpoints.json
                                            • Size 53B
                                            • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            sessionCheckpoints.json
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionCheckpoints.json
                                            • Size 90B
                                            • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            recovery.baklz4
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.baklz4
                                            • Size 5KB
                                            • SHA256 a2979b73a4c891db97efce5f56bc2dde7d608171d483e2d338eb05f7da8f22ab
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            recovery.jsonlz4
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\sessionstore-backups\recovery.jsonlz4
                                            • Size 4KB
                                            • SHA256 badfd4ccd3fb556cd365095a20415b8316ec52bda73cc4e15e1070db0fca8b80
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            storage.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage.sqlite
                                            • Size 4KB
                                            • SHA256 1f15aa35b799dc7de17cb71291a4bc96a942048fa4f8ae43934ecfe5ff6c4a1b
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 9.7MB
                                            • SHA256 5f7d7310f1dcf685e2b2eb42b5437d50973b913f8f81732f63105a84ddf5841a
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            3870112724rsegmnoittet-es.sqlite
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                            • Size 1.1MB
                                            • SHA256 d6738ff6d711554b2fe60f4df14dee4d6657720a356767144490c946ae561e6d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            memory/964-6-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/964-7-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/964-18-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/964-1-0x0000000077DD4000-0x0000000077DD6000-memory.dmp
                                            Download

                                            memory/964-2-0x0000000000311000-0x0000000000337000-memory.dmp
                                            Download

                                            memory/964-29-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/964-5-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/964-4-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/964-13-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/964-3-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/964-0-0x0000000000310000-0x000000000061F000-memory.dmp
                                            Download

                                            memory/1844-43-0x0000000000020000-0x00000000004D9000-memory.dmp
                                            Download

                                            memory/1844-11-0x0000000000020000-0x00000000004D9000-memory.dmp
                                            Download

                                            memory/1844-14-0x0000000000020000-0x00000000004D9000-memory.dmp
                                            Download

                                            memory/1844-21-0x0000000000020000-0x00000000004D9000-memory.dmp
                                            Download

                                            memory/1844-22-0x0000000000020000-0x00000000004D9000-memory.dmp
                                            Download

                                            memory/2196-30-0x0000000000A21000-0x0000000000A44000-memory.dmp
                                            Download

                                            memory/2196-46-0x0000000000A20000-0x00000000010C6000-memory.dmp
                                            Download

                                            memory/2196-19-0x0000000000A20000-0x00000000010C6000-memory.dmp
                                            Download

                                            memory/2196-31-0x0000000000A20000-0x00000000010C6000-memory.dmp
                                            Download

                                            memory/3392-44-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-422-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2034-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2033-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2032-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-813-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2042-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2037-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-1975-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-475-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2018-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2043-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-430-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2044-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/3392-2002-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/4776-954-0x00000000004B0000-0x0000000000B56000-memory.dmp
                                            Download

                                            memory/4776-1011-0x00000000004B0000-0x0000000000B56000-memory.dmp
                                            Download

                                            memory/5164-620-0x0000000000B30000-0x0000000000FE9000-memory.dmp
                                            Download

                                            memory/5164-581-0x0000000000B30000-0x0000000000FE9000-memory.dmp
                                            Download

                                            memory/5176-474-0x0000000000EF0000-0x00000000011FF000-memory.dmp
                                            Download

                                            memory/5176-1597-0x0000000000EF0000-0x00000000011FF000-memory.dmp
                                            Download

                                            memory/5176-726-0x0000000000EF0000-0x00000000011FF000-memory.dmp
                                            Download

                                            memory/5176-784-0x0000000000EF0000-0x00000000011FF000-memory.dmp
                                            Download

                                            memory/5344-395-0x0000000000430000-0x0000000000691000-memory.dmp
                                            Download

                                            memory/5344-400-0x0000000000430000-0x0000000000691000-memory.dmp
                                            Download

                                            memory/5544-423-0x0000000000BC0000-0x0000000001266000-memory.dmp
                                            Download

                                            memory/5544-429-0x0000000000BC0000-0x0000000001266000-memory.dmp
                                            Download

                                            memory/5812-2036-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/5812-2035-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/6024-458-0x00000000009C0000-0x0000000000E08000-memory.dmp
                                            Download

                                            memory/6024-491-0x00000000009C0000-0x0000000000E08000-memory.dmp
                                            Download

                                            memory/6024-457-0x00000000009C0000-0x0000000000E08000-memory.dmp
                                            Download

                                            memory/6024-531-0x00000000009C0000-0x0000000000E08000-memory.dmp
                                            Download

                                            memory/6024-532-0x00000000765C0000-0x000000007663B000-memory.dmp
                                            Download

                                            memory/6024-456-0x00000000009C0000-0x0000000000E08000-memory.dmp
                                            Download

                                            memory/6128-1908-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download

                                            memory/6128-1960-0x0000000000140000-0x00000000005F9000-memory.dmp
                                            Download