Overview

overview

10

Static

static

3

504f86acec...ca.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2024 17:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    504f86acec82be7ee36410b7f2c9aec444b2bb183ca3ac41ee02390defef66ca.exe

  • Size

    6.0MB

  • MD5

    ed6698a5b76010f200c8ccb8a38ff380

  • SHA1

    639770c57e4a93d6f65519e257a6636c9bb3d4f2

  • SHA256

    504f86acec82be7ee36410b7f2c9aec444b2bb183ca3ac41ee02390defef66ca

  • SHA512

    1685e5c6d0364608d0d84946072487f32be75ef130ec64fb0c97a9167d358df5702f4dda7a3a698ab4ed60c1c88680f3807da4707c53cfd3706f15db2a2c7bef

  • SSDEEP

    98304:fM5lAG+nj6tal+h2QwCOPv823glra6c36ez/POvqBfC6TWlBXzQ+2qutGdOVl7:XGbtwDzs23gFa6c3DzPOOq6TWlRQ+2LD

Score
10/10
amadeylummastealc9c9aa5talediscoveryevasionpersistencestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Extracted

Family

lumma

C2

https://founpiuer.store/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 44 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 10 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\504f86acec82be7ee36410b7f2c9aec444b2bb183ca3ac41ee02390defef66ca.exe
    "C:\Users\Admin\AppData\Local\Temp\504f86acec82be7ee36410b7f2c9aec444b2bb183ca3ac41ee02390defef66ca.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k2N37.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k2N37.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\K9r48.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\K9r48.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4236
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1u82N5.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1u82N5.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:632
            • C:\Users\Admin\AppData\Local\Temp\1004354001\sxqnmytm.exe
              "C:\Users\Admin\AppData\Local\Temp\1004354001\sxqnmytm.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2636
              • C:\Windows\Temp\{C51A8D6C-3D90-44C4-8BDB-6463AC9F0F44}\.cr\sxqnmytm.exe
                "C:\Windows\Temp\{C51A8D6C-3D90-44C4-8BDB-6463AC9F0F44}\.cr\sxqnmytm.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\1004354001\sxqnmytm.exe" -burn.filehandle.attached=672 -burn.filehandle.self=680
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2652
                • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\ActiveISO.exe
                  "C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\ActiveISO.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5840
                  • C:\Users\Admin\AppData\Roaming\remoteFastzq5\ActiveISO.exe
                    C:\Users\Admin\AppData\Roaming\remoteFastzq5\ActiveISO.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:6548
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      PID:6464
                      • C:\Users\Admin\AppData\Local\Temp\DriverProtectv1.exe
                        C:\Users\Admin\AppData\Local\Temp\DriverProtectv1.exe
                        11⤵
                        • Loads dropped DLL
                        PID:3728
            • C:\Users\Admin\AppData\Local\Temp\1004409001\sxqnmytm.exe
              "C:\Users\Admin\AppData\Local\Temp\1004409001\sxqnmytm.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1944
              • C:\Windows\Temp\{9310E198-2B9C-4775-BEE3-7A9778E6F1D1}\.cr\sxqnmytm.exe
                "C:\Windows\Temp\{9310E198-2B9C-4775-BEE3-7A9778E6F1D1}\.cr\sxqnmytm.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\1004409001\sxqnmytm.exe" -burn.filehandle.attached=804 -burn.filehandle.self=660
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4292
                • C:\Windows\Temp\{E09E949A-B953-420C-8BB8-CDF30EE69622}\.ba\ActiveISO.exe
                  "C:\Windows\Temp\{E09E949A-B953-420C-8BB8-CDF30EE69622}\.ba\ActiveISO.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6072
                  • C:\Users\Admin\AppData\Roaming\remoteFastzq5\ActiveISO.exe
                    C:\Users\Admin\AppData\Roaming\remoteFastzq5\ActiveISO.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:6492
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      PID:6288
                      • C:\Users\Admin\AppData\Local\Temp\DriverProtectv1.exe
                        C:\Users\Admin\AppData\Local\Temp\DriverProtectv1.exe
                        11⤵
                        • Loads dropped DLL
                        PID:6632
            • C:\Users\Admin\AppData\Local\Temp\1004410001\3d6b35b329.exe
              "C:\Users\Admin\AppData\Local\Temp\1004410001\3d6b35b329.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2528
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1588
                7⤵
                • Program crash
                PID:992
            • C:\Users\Admin\AppData\Local\Temp\1004411001\f59fa41fa4.exe
              "C:\Users\Admin\AppData\Local\Temp\1004411001\f59fa41fa4.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:508
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              6⤵
                PID:2800
              • C:\Users\Admin\AppData\Local\Temp\1004413001\29cc09e51f.exe
                "C:\Users\Admin\AppData\Local\Temp\1004413001\29cc09e51f.exe"
                6⤵
                • Modifies Windows Defender Real-time Protection settings
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Windows security modification
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4980
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2a8757.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2a8757.exe
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2064
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 1572
              5⤵
              • Program crash
              PID:4392
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3t18l.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3t18l.exe
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2352
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4d625l.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4d625l.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2976
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2648
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1216
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4396
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4392
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:760
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            4⤵
            • Checks processor information in registry
            PID:1800
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e462241-1b93-477b-8c39-26f2b5e9e5ab} 1800 "\\.\pipe\gecko-crash-server-pipe.1800" gpu
              5⤵
                PID:3220
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            3⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1652
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            3⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1432
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            3⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4596
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            3⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4236
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            3⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5076
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            3⤵
              PID:3196
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                4⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:4068
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 23680 -prefMapSize 244710 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98a1f949-9e90-42a7-aa7c-30222c1f0bf2} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" gpu
                  5⤵
                    PID:1588
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 24600 -prefMapSize 244710 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4b92081-932c-495f-8b9b-7cc884c0ba81} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" socket
                    5⤵
                      PID:2612
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3736 -childID 1 -isForBrowser -prefsHandle 3720 -prefMapHandle 3196 -prefsLen 22652 -prefMapSize 244710 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96b7a71c-f1b6-4b80-818f-1b4f763bc4e5} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" tab
                      5⤵
                        PID:5032
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4220 -childID 2 -isForBrowser -prefsHandle 4212 -prefMapHandle 4208 -prefsLen 29090 -prefMapSize 244710 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3cc84e7-450b-4971-9c1f-a63c698a48d9} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" tab
                        5⤵
                          PID:1804
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4900 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4848 -prefMapHandle 4864 -prefsLen 29197 -prefMapSize 244710 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af06e892-a9cc-4119-8241-e032e963930a} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" utility
                          5⤵
                          • Checks processor information in registry
                          PID:2336
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5052 -childID 3 -isForBrowser -prefsHandle 1584 -prefMapHandle 3116 -prefsLen 27051 -prefMapSize 244710 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99914ce3-87d4-4df0-98ff-f935880f6074} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" tab
                          5⤵
                            PID:2860
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5080 -childID 4 -isForBrowser -prefsHandle 1604 -prefMapHandle 1600 -prefsLen 27051 -prefMapSize 244710 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38098d78-a218-469f-bd58-1a2c8f8e782a} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" tab
                            5⤵
                              PID:3120
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5552 -childID 5 -isForBrowser -prefsHandle 5544 -prefMapHandle 5540 -prefsLen 27132 -prefMapSize 244710 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a7664d3-3966-4cb6-97f1-d40311aa8c9a} 4068 "\\.\pipe\gecko-crash-server-pipe.4068" tab
                              5⤵
                                PID:3716
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2064 -ip 2064
                        1⤵
                          PID:4524
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2064 -ip 2064
                          1⤵
                            PID:4428
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2064 -ip 2064
                            1⤵
                              PID:4596
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2528 -ip 2528
                              1⤵
                                PID:1936
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5016
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5492

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json
                                Filesize

                                19KB

                                MD5

                                94d3d80afda076903aceea7601ffec16

                                SHA1

                                1f84ecb7de5af9b7238de3df87d386f1106073ee

                                SHA256

                                9ddeb33a3c081ab9e96c5d44e0939a3e9a03abfbf8fbe6a600f974666242266a

                                SHA512

                                3c6a0c324ba85e6b41556a54bdc2eae00d7f20d660a4e4afab2fde2132b1f2f5890a0dec26b3a33aa7f394080a924598f3bfd2fbd489d090ea0238499106d674

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99
                                Filesize

                                13KB

                                MD5

                                3a1dcb1858ce424a38538be0723baaba

                                SHA1

                                1c23fdfbe4cce3791709a0c2bc94017624fb2d78

                                SHA256

                                0235b98975d94e1b8ee0e3569240df9e7dfc89d8da78e3048c8c0e4d33233ad2

                                SHA512

                                6689c49ccdb45324604d7d5f681b8378f076e308eeba5cdeefbc21fcdaf087347d312bceb0ed4ae3c60f5b5ef4e2e09453b685637520f5228af5713932f9b2b2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\startupCache\webext.sc.lz4
                                Filesize

                                108KB

                                MD5

                                aedf8e5834e430dc14a2966105e5a12a

                                SHA1

                                3111acebe1970ac8707711a1adc283b86e216c1d

                                SHA256

                                bf9e3eab3014fc94014a6045099cc2ec3531cbfd9e7fcad5fe4aa68fd04efd2e

                                SHA512

                                1013b4eec271ab96203f64b7faa5c3bb5b640e7d6dfb5a07dd55cf9d2d1bdd7f361f15db285f4f85b4c7e7efd3d0be3a1776e4844096fa602cd93dade516c52f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1004354001\sxqnmytm.exe
                                Filesize

                                14.4MB

                                MD5

                                155422526c81faf880ec711b7044ef44

                                SHA1

                                67b6a590e3aac3cca79d849ef1ac9f51f4e6702b

                                SHA256

                                3bf4932e6121846f3303818932219f7984ac60196b65e4f62a796156923d556a

                                SHA512

                                0a53e0b00e5c32782be998a082cc33bf5b19d162f81e39104f6fd6f64b1ea4947e69298493dcb49a1386904cc345c63395044c01be2d49c89647d7890522dbdc

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1004410001\3d6b35b329.exe
                                Filesize

                                3.0MB

                                MD5

                                1491f06439d17eb179ecf90c81ef2b6f

                                SHA1

                                11fd23dc58348c2f47cca31a33051b19950c125b

                                SHA256

                                172e3763c36fecf1f8ce0674d8261e79e016d860c896daa419ee45e7ad13b825

                                SHA512

                                ed900a3951d846b71b4707869031f8ee43dd08198d23c01b0b4fb741bb8f0c9b0e7a69ab18c90aa30641b2a0071ce1becd63449311ee3df1218d4897ef10e3d2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1004411001\f59fa41fa4.exe
                                Filesize

                                2.0MB

                                MD5

                                f59fc97e77a2ffd612e859320bd26cd8

                                SHA1

                                e374e4961a48530d10f00a9695571f6308ee3256

                                SHA256

                                40fb6fc67e09a7b5332970c9fe881c277409a6892e47605c4609aca30f0dde87

                                SHA512

                                49311b6d602823130f35944b2aa05c7fbdc0fd2571121b9873d2af84d598027db3094d4b61fecad8aaf533a8434a665fb6e752bfd8f0642959cb534d2f7ffa9e

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1004413001\29cc09e51f.exe
                                Filesize

                                2.6MB

                                MD5

                                aab7c507c52a9b9532fc31454860cfc8

                                SHA1

                                a38831597a5c0afa67d85bf4c393a01ac8dfe330

                                SHA256

                                bd4ea0df7d7122f577fdebd8cd2c25766b45fcffe9e0e57db8823efc35b49085

                                SHA512

                                967e583bdd4ae827966ae2c397df9b1f81d3978ec390ce038baed6ce184e1846864175be03b87c6de0862f940fecd6ffbbd5e026257dda081623c93a21a187b5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4d625l.exe
                                Filesize

                                898KB

                                MD5

                                bfff0711dc710a768efb377ec52d8675

                                SHA1

                                cdae3316ae15804e7c9f3b5df4633cdba705e358

                                SHA256

                                349f42274af7381354ebcfe56b2a9b5603bece7ed39c62b40cba761f62c2cc73

                                SHA512

                                7bcfa71b2a38b5b58afb4ceb042ed81d28134f02129635814e3c7ef717f88dbfcf47d61bca7cf03ce50b0be51e889d8e0b9089afb7710e7e011ba581c9329a93

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k2N37.exe
                                Filesize

                                5.5MB

                                MD5

                                0372a123854297e31819ebb75dcbc937

                                SHA1

                                e1bd5ab7480e19373ebb3cfb4e8be17944233b74

                                SHA256

                                780ac9a949443dee3126b6131ff38ae6adec11d31756cc4bf3cb4e5ac5ff42e9

                                SHA512

                                cba7076b2a69168b893cd511d3d0f6984deec30601f5433a1f8698ea936282862d021fe6f5e97dcf5c927ab2cede9c40abad7ecf0c852a6303fc417e80128b51

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3t18l.exe
                                Filesize

                                2.0MB

                                MD5

                                419b00e8e66411cb60175e8d8b41d92d

                                SHA1

                                25380d5b02809bc7d24beca859fd9ef1cc5441d4

                                SHA256

                                ee65744917796f7b801c5680c7e94e96674954e1fce7bfffcfb033fd63330b18

                                SHA512

                                774332a144fd9890e364b48192b7dd0f3e8c61121fe680ea74ed981afba43c8869dfc504d54992c5351592e5408bee44e6a97ddbf151abf6caf7028f44ff637b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\K9r48.exe
                                Filesize

                                3.4MB

                                MD5

                                b97b0d42cef76914fe4320eccb930149

                                SHA1

                                a84d2031dc628b5353a47330be88a98bc441f7e8

                                SHA256

                                90778a3e7a5fdd5ed27b4910863e7013895ff4ed83d8012709b67bd96a0603fe

                                SHA512

                                8a4dc388b9b8e42142c68d90c238e4241e29f23d7418675e31d17ec6c39b6da957bb4f1b69508e9fb70fee8503a476b0749d787f36f779d14bfa09de33813953

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1u82N5.exe
                                Filesize

                                3.1MB

                                MD5

                                c0eb69c029d2b0e48a7a5338fc4e4fc1

                                SHA1

                                473e4b3cb7abfba1589ac422d5282145773867b9

                                SHA256

                                3f5a0e5921dd0df6d005556a63b4d711ff1301846d570b6d6a094b3a2b71bcf2

                                SHA512

                                671cfde8d99a8ab4a4516eaa803af07a00e3465df9c568c76c9a59286bfd7892305567290c4a31003d939fa65d0d244e875d2c61a6fda926cdc62b413908ce75

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2a8757.exe
                                Filesize

                                3.0MB

                                MD5

                                3ac7ecc0a4a6ed2dc30890cd47a5c030

                                SHA1

                                0c2234c4a1bdec6ce59b700a956a6833a6712289

                                SHA256

                                4fbb4d263c460c3fddf3341d79f5bf842e851c555e3637a2859b744b6078d6cb

                                SHA512

                                3c9f1e6935e3d3f1af26449f5c2b34931790c417d9ae28d559ba67f595cc813d1f44cc566166b24035af4fb6a7644552c776e1c8b0b355fbe1124e16da89cc6b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
                                Filesize

                                8KB

                                MD5

                                593d8770f1f5f291aa1977fcb186b2bc

                                SHA1

                                fae5b1d54c16f6b0f074adbeba764f1018071384

                                SHA256

                                503035a323c8da21cd965db3de2e27854f22e162b1723f1dd8bfbaa1c7c20ac0

                                SHA512

                                808d8059b3120f800d4e48ed60363df08ba82a477cd12ae0fde793b3e40a434c0a4d7119049d1eff2c90aa9d4483b78b4f9cff79ec424978700a7bca280dc84c

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
                                Filesize

                                13KB

                                MD5

                                9c5d92e7dee757131766c6347eb58df5

                                SHA1

                                8dd20e919c65a306f7566789d360ff8c63a35098

                                SHA256

                                90509495735430f44e7c9377b5c31f0447b12a1f0f41b934d0df609a0c8a65d4

                                SHA512

                                8bac568ed7f6c7a80635b51366e7b1a6cca06a20f8df0315934a66b971247677e27e2f26ea0f78d38f02265d8448b8f1f24add1ad7dd332215b395935a9f7351

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                6KB

                                MD5

                                6edd0141928fc297ea0a422e55be6c12

                                SHA1

                                fe34921ba11fc5e6ae06dfa63d193cc26a047fdc

                                SHA256

                                0fd84997cb4091bfe4bfb89b6fb5658b13021e30f7a3dd1dbef829b0cb67406a

                                SHA512

                                face061dbd9265147c876555ce13d157928b93a40e41e78d313de6a00ce9556532a05dfe7e4a0869c6f472bff742c8cf844b26fac253c52c8d738be38a7b4166

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                23KB

                                MD5

                                344c5b5fe0d38f6a2f9f9252fb78c1dc

                                SHA1

                                97c731ca9aa40588df92b01d7c8277d2cdc4a58d

                                SHA256

                                a1461f8b86b40a5ff516b976909a99221c0ff76a594c7f94810cee04d0ec9fde

                                SHA512

                                1cdb89328220833e73e0e771a27f124d221254bcabe8a245b3660e84b31f8182734b2ad201a37d7f9cfaadfae9bcb4c14e2295ec1f9ff5f76d74ec83f05b28f6

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                15KB

                                MD5

                                6392f25a4212aa60e4200897c42b3a7b

                                SHA1

                                4a3259fa4a00db50d00778e2496c625563319d08

                                SHA256

                                e808c8e336c24140eb7d7b07cda38fb1f5302a74de1596c1e5f39059eff80481

                                SHA512

                                9ab12a707b754b4a0448a5eeea7b75ab49c3833aeef3380bf43defc4bd4130b80df57ea2abd446021b2b698e1ffe71f1f0190cefbdd18bfceb3002cabaa07bf3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                5KB

                                MD5

                                65c1ee34b7d9cdae67587f3c0fa77ff3

                                SHA1

                                42862235dc0f4298909d2c7635f150689708741b

                                SHA256

                                7b233fdcb263a3da7c0f1fd67a586ac88837c4a30ff3ae8513c28e89bafaa225

                                SHA512

                                7b81b6c929dc62d17b9465ca2b590584f48ac443559ccdd2ec06dc9599f03d22e4a2e95736673697dfd4c0adbfde262ff8f9d1af90ccf999a1ecc58cbf3a7e50

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                6KB

                                MD5

                                878c2821a82b8a18a1c979847ea42e15

                                SHA1

                                5c2ac3854e0c62074f6a48b80bc4d2583ae2de43

                                SHA256

                                488f09b0680f36c5c4fd27e5167e79e241b13b6a50d86470cf2ab5042014e325

                                SHA512

                                0030f5972dc1e3c45453ad80bda114afde5d6e53ee5812a675606391ceb9edef5d8d4e961292b57bf45e7066308a858e714ca66a7bfa27919a6d46bcbd0ca915

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                6KB

                                MD5

                                278db0c03c94945a8799d793d92dbb2e

                                SHA1

                                fac47aa6d3b0c1f46ae51fc13d696d1af766ba25

                                SHA256

                                f448fc5a1ab0b40bf8dc4ad061fe21c0d3aad4f37c5a31fff03fb4aa06e8e1ca

                                SHA512

                                794967093ba6eae3bb556b3174e61bc629ce9fe11a647847181438e7d7b75a484c1a6d38e59d7c3d555372c4c52c79dae70d9298162408a60ce600656d6e0ade

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                15KB

                                MD5

                                c229189a754fc4e4a53e7e31d5de76a8

                                SHA1

                                5fb4a69423fc0822c53e74050a5a4dabded04c83

                                SHA256

                                a1e32fb989e333ba78948a9e1ac68af8eb5b52a837fe7296bffa5d9cfae1123b

                                SHA512

                                ded6fdb6a8688f494b341edcabed956580499f10762cf4f253c9125c8e8a0f672427ebe4c8a57cc7da7684840c88edc1f0c8060208ef6d0262c2a480f56e0618

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\2fc7b81b-c635-4863-ac9a-f9e45ba7f5aa
                                Filesize

                                982B

                                MD5

                                687f5d39cd4b4ff57d646d02c8ee0fd1

                                SHA1

                                ef6eb6b1d66641a2d0c6426f6abdb1186cba6d39

                                SHA256

                                9d7a6305faa217a2307e7c742b34aa38ad61e2d29d430fcfae71ba948347ae43

                                SHA512

                                50ce1d3e613bff9d5c7f778412ea1981e6794d96912921114736fcd7c8b0481f0125905b63ce7181dae91ac123cba3d2f1e148358453ec01671b2b464393ad72

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\403640f7-2491-43d1-b24c-b968fe0b6119
                                Filesize

                                27KB

                                MD5

                                13a64b1b2cfed9f79c4b4b2cbf16802c

                                SHA1

                                0719ef4153d54cd338487c7b7106293c496f1d6c

                                SHA256

                                4b6831f2ae1e96bf371fc65d706e3942b4b65a33b959419ba470e03797e6124d

                                SHA512

                                d3027b6f988d80593d5ca90e59ee449860065aba93c9297dd3d3b120e7376bbb16ff627ec883509dcadf405751c0f388051206a5ce4008518d948e1270ae8f85

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\4fe1c90d-bf37-485f-b131-eee46d37d7f2
                                Filesize

                                671B

                                MD5

                                0c84d08fcc4cc829f63933f8db7c2b0c

                                SHA1

                                2a69d2ec2049e69a32f978f0c0d48deb1261e6a1

                                SHA256

                                187d73d8296989b3f80832d6cedd92eea6ac918006302f6444180171a949e355

                                SHA512

                                4cee385d45a9ee0d97e3bac705aa6670ecd616aea1983e65ceb65d7ffd6148edd6a0d8fe5582759b5db7b7a9e4dc82dacfe8bd21ab987bd44c866f76c9ec4c64

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
                                Filesize

                                10KB

                                MD5

                                ee2cf688992cad7a003f188ef6f96ab9

                                SHA1

                                f69ac4767d10027021235199787a4ac7716f021f

                                SHA256

                                26ffaff41f4c0705a051cc1011dbac501fc386f512c9f793cb65b36a268aa988

                                SHA512

                                c74d545972a27def27a36011d54e89fe75d0718ae076d690178875bd590b9134f36650361dae8e8128e601b5af57f9066a7280e71976692d72d60fe31724dee9

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
                                Filesize

                                10KB

                                MD5

                                63a898b9a4aabcbef80d567edeacd225

                                SHA1

                                041730098254958cbb76c5cc630c0e339f66db99

                                SHA256

                                0840369f7e042e7661e0b83cd51f11a054614fd772461e13bc4c2be1856cfd38

                                SHA512

                                7376f73459855db302d25ecbb35e1110b27d06cd3e71a3690b0b9431a59d0c032f3d122b95e7769c16b6a6c58d59f1a10c64c9a5cbe2d221bb89ddfb61124c56

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
                                Filesize

                                11KB

                                MD5

                                b59e95565102137ebd496bca0aa3b08c

                                SHA1

                                d45981e3a90b819f200314d2ebf65df42c04eb0a

                                SHA256

                                dcedb5b0085c9c10051e1099dfaaf9332dffd7cd7e1feaaef814908ecda72bd2

                                SHA512

                                4681265d332ad16d3d097d39dfe65e4e31152f18e71311ac305f0f91e7d81194e8bc913f6216bc8a9bb79f0b4088644cf16053d6784a0d7f84b9e5971e2fadb7

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
                                Filesize

                                15KB

                                MD5

                                9acdb6dc70adec14a6cb8650bdb23f11

                                SHA1

                                0182ac80168df719de03dc843b471a3f27585895

                                SHA256

                                555b596dc93376b13e8626b2231e82067efc4e426085c268ccd1b7cf82bfd2a1

                                SHA512

                                d84951a57b81ece350260536836119017fbdeeeec68410c61231ebc4287c4adee79acd5aa0364804bbd82b6c00c0101cb61c8f7be25a39d73fcf2fa69bbfd0f2

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
                                Filesize

                                11KB

                                MD5

                                1510886127d09a2663de7f3e59b223e2

                                SHA1

                                415f614511ad2c8d56ea4886194570fc749ad587

                                SHA256

                                f8318250fbb28631d6cd9897d600fcbee1b5c73079bdd792a46a98752dae6915

                                SHA512

                                36d2c49ec8f7e623113ab676f883365f225e34867058ebea7926b387c9ee049d53dbb04c370818d32eb78728eb9519795fb52ec6c97c4fc7ab8622d10b9bd115

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                Filesize

                                1.6MB

                                MD5

                                efa71b60cd87fdc81e4f7d4ddf9bbce7

                                SHA1

                                cbd91850d6767a8887e17b667e004f44b9165b0f

                                SHA256

                                b2e916827cb639396e3dbf2d39e63b7573ab7ec9073943a8f7e44f443af1b4ae

                                SHA512

                                0138b01179d71717b38f40d1b37aa66a575f9269bc47d529d7618af6f192ca1ac03c5cab240b7808af53739be319be7e9c555cf9700e7454489d5ddebf8b103d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                Filesize

                                1.8MB

                                MD5

                                39b9240119bc8b45061388fc22a3aaf5

                                SHA1

                                4938f9b228af68dfd87a48b87322b513158ef6dc

                                SHA256

                                36c13c02365a93c0b8b0967c1201464799d5dd0a5548a757489dabc1fcaca39a

                                SHA512

                                47bcc76845edc195ef2f733436468f2323bb2ac6ceb072386141498eb37afe4472d28d4027da37158151c2fa3a38162777a54e19151b114c6349252f30b69df6

                                Download Submit

                              • C:\Windows\Temp\{C51A8D6C-3D90-44C4-8BDB-6463AC9F0F44}\.cr\sxqnmytm.exe
                                Filesize

                                14.3MB

                                MD5

                                73e9ab1674c64f040da642b6a4690356

                                SHA1

                                e5a508bf8a7170cbacd6e6ab0259073a2a07b3cf

                                SHA256

                                04bb4867d35e77e8e391f3829cf07a542a73815fc8be975a7733790d6e04243c

                                SHA512

                                f1df00e8f0b7b1c577429028cd550788dbf4f1da1e8aa97b8ab845e68c56663c350c562f26237a278a0b44b33f06dcb9667a50db4ddaf747da71053e4189afec

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\ActiveISO.exe
                                Filesize

                                1.2MB

                                MD5

                                b84dfabe933d1160f624693d94779ce5

                                SHA1

                                ac0133c09708fe4a3c626e3ba4cdf44d3a0e065f

                                SHA256

                                588cb61b36a001384a2833bd5df8d7982ca79d6ae17a3d83a94e01b1e79684bd

                                SHA512

                                eeaeef8d6b5fa02dedf9818babaa4b5ffdb87300521883aa290289dcc720b3d543279085ed3fc649b74654143e678502e56eb3f92c4baf53c075977de33c1b0e

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\Bichromate.dll
                                Filesize

                                1.4MB

                                MD5

                                86b7452f87b5c7f79f8b8a3ad326035e

                                SHA1

                                a81ba71c0b3f93c6bcdc004ede3f98f205dd31ca

                                SHA256

                                58a6b1fe90145f8ae431d05952d1751e705ae46a81be1c2257f5e1e0ce0292c7

                                SHA512

                                4c0e8166a8ee81c9e851fe7d25915b1d85bbe3b274e88160ff948ddb8a15f67122a52ba3906da6a090f8ba064915c8df1780103e474bf8e6f3dd673fc304ce7b

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\Qt5Core.dll
                                Filesize

                                5.8MB

                                MD5

                                6e8bfe548ca4de868c82279e5d127db0

                                SHA1

                                120cbd2177493859c40b943bed3d124555cc5bd9

                                SHA256

                                f7bddcd19a740e179827a99c23cc045d6f4ab8d5b6699592b1a1e8fcb6ddc22f

                                SHA512

                                9f4736a432ea496c010a5a37a87da1fcee6bafb2c6600eacaa8a0b0e9d47eb8bf0b044cf34d6212d871d4b1bd93339d148b67c72a8226145929d117756ece6b0

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\Qt5Gui.dll
                                Filesize

                                6.2MB

                                MD5

                                34893cb3d9a2250f0edecd68aedb72c7

                                SHA1

                                37161412df2c1313a54749fe6f33e4dbf41d128a

                                SHA256

                                ca8334b2e63bc01f0749afeb9e87943c29882131efe58608ea25732961b2df34

                                SHA512

                                484e32832d69ec1799bd1bcc694418801c443c732ed59ecd76b3f67abf0b1c97d64ae123728dfa99013df846ba45be310502ef6f8da42155da2e89f2a1e8cb2c

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\Qt5Network.dll
                                Filesize

                                1.3MB

                                MD5

                                fe5ed4c5da03077f98c3efa91ecefd81

                                SHA1

                                e23e839ec0602662788f761ebe7dd4b39c018a7f

                                SHA256

                                d992aaeb21cb567113126c2912cf75e892c8e3ead5d50147a11abe704b9e2e2b

                                SHA512

                                22514732a0edf8fc2b8770139599132429080b86d2844143d21bb834cbddaaa077d763969960e39e2050a69493c1aae191600e5df6107bde90fae589a054f071

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\Qt5PrintSupport.dll
                                Filesize

                                316KB

                                MD5

                                d0634933db2745397a603d5976bee8e7

                                SHA1

                                ddec98433bcfec1d9e38557d803bc73e1ff883b6

                                SHA256

                                7d91d3d341dbba568e2d19382e9d58a42a0d78064c3ad7adfe3c7bb14742c2b1

                                SHA512

                                9271370cd22115f68bd62572640525e086a05d75f5bc768f06e20b90b48a182f29a658a07099c7bc1e99bf0ffcf1229709524e2af6745d6fed7b41c1addd09f1

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\Qt5Widgets.dll
                                Filesize

                                5.3MB

                                MD5

                                c502bb8a4a7dc3724ab09292cd3c70d6

                                SHA1

                                ff44fddeec2d335ec0eaa861714b561f899675fd

                                SHA256

                                4266918226c680789d49cf2407a7fec012b0ed872adafb84c7719e645f9b2e6d

                                SHA512

                                73bef89503ce032fba278876b7dab9eac275632df7a72c77093d433c932272da997e8fbeb431a09d84baac7b2ab2e55222ff687893311949a5603e738bfa6617

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\StarBurn.dll
                                Filesize

                                1.4MB

                                MD5

                                41e19ba2364f2c834b2487e1d02bb99a

                                SHA1

                                6c61d603dddfe384a93ad33775b70681d0a396d9

                                SHA256

                                c040a25377028b0c28db81a012de786c803a0e9d6f87ce460335a621d31f5340

                                SHA512

                                6ebf4a9e80f16c6a03ff357d2da9a34a4227bfd65eb66d1d335349a77ba066d069ba0d47d46229b3c77b59052c42d388678662f970b418d8cc3cfb1223427d8c

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\msvcp140.dll
                                Filesize

                                557KB

                                MD5

                                7db24201efea565d930b7ec3306f4308

                                SHA1

                                880c8034b1655597d0eebe056719a6f79b60e03c

                                SHA256

                                72fe4598f0b75d31ce2dc621e8ef161338c6450bb017cd06895745690603729e

                                SHA512

                                bac5729a3eb53e9bc7b680671d028cabef5ea102dfaa48a7c453b67f8ecb358db9f8fb16b3b1d9ea5a2dff34f459f6ac87f3a563c736d81d31048766198ff11e

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\vcruntime140.dll
                                Filesize

                                96KB

                                MD5

                                f12681a472b9dd04a812e16096514974

                                SHA1

                                6fd102eb3e0b0e6eef08118d71f28702d1a9067c

                                SHA256

                                d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

                                SHA512

                                7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\vcruntime140_1.dll
                                Filesize

                                37KB

                                MD5

                                75e78e4bf561031d39f86143753400ff

                                SHA1

                                324c2a99e39f8992459495182677e91656a05206

                                SHA256

                                1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

                                SHA512

                                ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

                                Download Submit

                              • C:\Windows\Temp\{F18C3AE9-FDC4-4EC5-8481-A5F5CB543493}\.ba\yodpxub
                                Filesize

                                21KB

                                MD5

                                65ced4e3e5b641b3fee1e135e3604a1a

                                SHA1

                                860173020684e54f4eb9bc9e4fdab348b371214d

                                SHA256

                                1a5991a30e9d339cbb0143d4bd134509cf4effc7fead7f4f7dcc059990efd669

                                SHA512

                                cc4ec199a58a20d2c4543fd247b329422ce3ad15695c74d2aa4fc89dc780a274527b020157e6c23f8a2a4839209f5d742694881768dd12c9b80c622da17f31e6

                                Download Submit

                              • memory/508-166-0x0000000000B10000-0x0000000001240000-memory.dmp

                                Filesize

                                7.2MB

                                Download

                              • memory/508-163-0x0000000000B10000-0x0000000001240000-memory.dmp

                                Filesize

                                7.2MB

                                Download

                              • memory/632-45-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-138-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-955-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-1270-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-169-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-3356-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-3368-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-34-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-42-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-1773-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-1037-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-3343-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-3337-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-2644-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/632-3331-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/2064-38-0x0000000000470000-0x0000000000767000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/2064-39-0x0000000000470000-0x0000000000767000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/2352-46-0x00000000000A0000-0x00000000007BF000-memory.dmp

                                Filesize

                                7.1MB

                                Download

                              • memory/2352-44-0x00000000000A0000-0x00000000007BF000-memory.dmp

                                Filesize

                                7.1MB

                                Download

                              • memory/2528-171-0x0000000000FE0000-0x00000000012E5000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/2528-145-0x0000000000FE0000-0x00000000012E5000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/3728-3306-0x00007FF64B5D0000-0x00007FF64B8B3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/3728-3335-0x00007FF64B5D0000-0x00007FF64B8B3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/3728-3344-0x00007FF64B5D0000-0x00007FF64B8B3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/3728-3354-0x00007FF64B5D0000-0x00007FF64B8B3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/3728-3357-0x00007FF64B5D0000-0x00007FF64B8B3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/3728-3361-0x00007FF64B5D0000-0x00007FF64B8B3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/3728-3369-0x00007FF64B5D0000-0x00007FF64B8B3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/4160-21-0x00000000008D0000-0x0000000000BF5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4160-33-0x00000000008D0000-0x0000000000BF5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4980-1039-0x00000000008E0000-0x0000000000B90000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4980-857-0x00000000008E0000-0x0000000000B90000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4980-842-0x00000000008E0000-0x0000000000B90000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4980-204-0x00000000008E0000-0x0000000000B90000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4980-978-0x00000000008E0000-0x0000000000B90000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/5016-165-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/5016-168-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/5492-3334-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/5492-3330-0x0000000000480000-0x00000000007A5000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/5840-1000-0x00007FF8D02D0000-0x00007FF8D081E000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/5840-1022-0x00007FF8CA630000-0x00007FF8CA7A2000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/6072-1021-0x00007FF8CB530000-0x00007FF8CBA7E000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/6072-1041-0x00007FF8CA630000-0x00007FF8CA7A2000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/6288-1383-0x00007FF8EE890000-0x00007FF8EEA85000-memory.dmp

                                Filesize

                                2.0MB

                                Download

                              • memory/6464-1359-0x00007FF8EE890000-0x00007FF8EEA85000-memory.dmp

                                Filesize

                                2.0MB

                                Download

                              • memory/6464-2734-0x00000000750E0000-0x000000007525B000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/6492-1045-0x00007FF8CA630000-0x00007FF8CA7A2000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/6492-1257-0x00007FF8CA630000-0x00007FF8CA7A2000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/6492-1043-0x00007FF8CC160000-0x00007FF8CC6AE000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/6548-1040-0x00007FF8CC160000-0x00007FF8CC6AE000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/6548-1196-0x00007FF8CA630000-0x00007FF8CA7A2000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/6548-1044-0x00007FF8CA630000-0x00007FF8CA7A2000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/6632-3355-0x00007FF7C4400000-0x00007FF7C46E3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/6632-3349-0x00007FF7C4400000-0x00007FF7C46E3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/6632-3364-0x00007FF7C4400000-0x00007FF7C46E3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/6632-3332-0x00007FF7C4400000-0x00007FF7C46E3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/6632-3336-0x00007FF7C4400000-0x00007FF7C46E3000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/6632-3370-0x00007FF7C4400000-0x00007FF7C46E3000-memory.dmp

                                Filesize

                                2.9MB

                                Download