Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 23:09

General

  • Target

    file.exe

  • Size

    1.8MB

  • MD5

    6aed281d1464e3a53839bbd9e7190535

  • SHA1

    8ea6e9ec2eb3970e0c361538fb6dbd074e5fa6c2

  • SHA256

    a20abe49e71912d860044fdf813c7fb90f32fde51097db4b689cac9c8f7a9ac9

  • SHA512

    3d3312dbc5d3537143f8ee75097e9dfa5a88c59b3d0079461a6878ba1aafa232a131e8078dbf08d5e62bdd84f5833e900d4b8e0f37e80b3bbcab996b725e5366

  • SSDEEP

    49152:FWpKS5ThF8/65kDlsW+eN3hyN0T3VsPhGlhFr5:FWcSKUkDlsJ0q0lfr

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

C2

87.120.112.33:8398

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Detect Xworm Payload 2 IoCs
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe
        "C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2440
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'document.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1372
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4224
      • C:\Users\Admin\AppData\Local\Temp\1008050001\c70fa2ab9f.exe
        "C:\Users\Admin\AppData\Local\Temp\1008050001\c70fa2ab9f.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3584
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2128
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffde9aecc40,0x7ffde9aecc4c,0x7ffde9aecc58
            5⤵
              PID:3116
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,2702148866157431895,11683960281369304849,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:2
              5⤵
                PID:4040
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,2702148866157431895,11683960281369304849,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
                5⤵
                  PID:3128
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,2702148866157431895,11683960281369304849,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2468 /prefetch:8
                  5⤵
                    PID:5128
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,2702148866157431895,11683960281369304849,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5400
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,2702148866157431895,11683960281369304849,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5416
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4436,i,2702148866157431895,11683960281369304849,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5784
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:6084
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:1620
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 1280
                  4⤵
                  • Program crash
                  PID:3100
              • C:\Users\Admin\AppData\Local\Temp\1008051001\6bd1739f8d.exe
                "C:\Users\Admin\AppData\Local\Temp\1008051001\6bd1739f8d.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3120
              • C:\Users\Admin\AppData\Local\Temp\1008052001\e22651c314.exe
                "C:\Users\Admin\AppData\Local\Temp\1008052001\e22651c314.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:744
              • C:\Users\Admin\AppData\Local\Temp\1008053001\126cde9199.exe
                "C:\Users\Admin\AppData\Local\Temp\1008053001\126cde9199.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2764
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2000
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3792
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4644
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2616
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1532
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3404
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    5⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3048
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {041d0ddf-6341-46d5-ab74-fce1e09baa3f} 3048 "\\.\pipe\gecko-crash-server-pipe.3048" gpu
                      6⤵
                        PID:3648
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a265168b-43f7-4511-ad6b-3c48077a8f41} 3048 "\\.\pipe\gecko-crash-server-pipe.3048" socket
                        6⤵
                          PID:4992
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3124 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 3144 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {659db692-cdaa-4222-98db-8a73a210ff37} 3048 "\\.\pipe\gecko-crash-server-pipe.3048" tab
                          6⤵
                            PID:3360
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3668 -childID 2 -isForBrowser -prefsHandle 3664 -prefMapHandle 3660 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4e6a9e9-845a-4e7a-bfeb-f2af4c8935ad} 3048 "\\.\pipe\gecko-crash-server-pipe.3048" tab
                            6⤵
                              PID:2652
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4428 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4664 -prefMapHandle 4636 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cb3a78e-312b-461e-80a8-87d039d74b67} 3048 "\\.\pipe\gecko-crash-server-pipe.3048" utility
                              6⤵
                              • Checks processor information in registry
                              PID:5300
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 3 -isForBrowser -prefsHandle 5600 -prefMapHandle 5692 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc625e64-9587-4bb8-a633-79c2c75aa423} 3048 "\\.\pipe\gecko-crash-server-pipe.3048" tab
                              6⤵
                                PID:1696
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5844 -childID 4 -isForBrowser -prefsHandle 5672 -prefMapHandle 5664 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a20cc47-cc13-454d-8aa9-72e27f6ce922} 3048 "\\.\pipe\gecko-crash-server-pipe.3048" tab
                                6⤵
                                  PID:2332
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6016 -childID 5 -isForBrowser -prefsHandle 6096 -prefMapHandle 6092 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {347fdb11-4db9-4a87-bc2a-eb7d4635eb6d} 3048 "\\.\pipe\gecko-crash-server-pipe.3048" tab
                                  6⤵
                                    PID:5252
                            • C:\Users\Admin\AppData\Local\Temp\1008054001\b8f0495954.exe
                              "C:\Users\Admin\AppData\Local\Temp\1008054001\b8f0495954.exe"
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2612
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4868
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2996
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:5576
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3584 -ip 3584
                            1⤵
                              PID:4988
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                                PID:5988

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                Filesize

                                2KB

                                MD5

                                d85ba6ff808d9e5444a4b369f5bc2730

                                SHA1

                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                SHA256

                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                SHA512

                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                944B

                                MD5

                                6d42b6da621e8df5674e26b799c8e2aa

                                SHA1

                                ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                SHA256

                                5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                SHA512

                                53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                944B

                                MD5

                                fd98baf5a9c30d41317663898985593b

                                SHA1

                                ea300b99f723d2429d75a6c40e0838bf60f17aad

                                SHA256

                                9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96

                                SHA512

                                bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                944B

                                MD5

                                dcee2c4799aaf7d786c7a18e235934c4

                                SHA1

                                92b08222812d2c4392cd5babf316c6509a1d202c

                                SHA256

                                33fb8b90e373768d57f2726dc808e2a6319dcea75ed4be819316a4bc3c2f85c1

                                SHA512

                                05986414ab12b9b52335528dc4dc1ef6fee378afa09a2858b0ea77cb0c9aaf4339ccae272bbc760ff63d31ad27e8a8206ae0152be82015f49c177cb62b515f32

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json

                                Filesize

                                22KB

                                MD5

                                142f0b59437b3444d58ab30c7f9e79ed

                                SHA1

                                5dc99c0cdb13c51f48ae894babc23545ae592b7c

                                SHA256

                                f89ab57973c6127276bd5b54d21b642b4723587ba28c0dfef2c68a46f7503ece

                                SHA512

                                1864cd5e75d068bc5fa8bf94558bb28d55e3416e29406d1c7aa8538fa739cf9a0943ec15b8a439177ced91b4a7a3235804a7e92230d9abad4327944573bcdfab

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

                                Filesize

                                13KB

                                MD5

                                0cffc1044a1cc2178c7bcc41f5d292aa

                                SHA1

                                7892d785b759ccb19b27595e69a60bf06dc6107d

                                SHA256

                                ab7f10bd8d7fcc5a0d5cb82cf15eb186863679bfebf4456856135774ded40fd1

                                SHA512

                                abb0f60546a90ae60d21214178c51a72c7e42d72b1678387f832b8d5b8b2a7a84ebe5133399cf53fa01d0af141817cfbd99ca4e6be28d25a0c6ec504a9728ccf

                              • C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe

                                Filesize

                                72KB

                                MD5

                                8d52069bd117da94e0b0b70e73e33fb0

                                SHA1

                                e8090adddff167e1bda4194af968ba4bc22a2d60

                                SHA256

                                b3e217c467cfe1e8079e82b88f2f99950a9459330a8843070ebb34bf3e2bcf38

                                SHA512

                                7a91eeb0cf3edb53d0ac3d51abe85c97bb09da5b334b387fda90144a2f3729693367c451fee9e04cb953dcf8d9d1b91ee12961bfe9f1e53c0ab06aababd696ed

                              • C:\Users\Admin\AppData\Local\Temp\1008050001\c70fa2ab9f.exe

                                Filesize

                                4.2MB

                                MD5

                                7300372edfa809331d4b525a77c2a93d

                                SHA1

                                0540bbbf3b91b4ebbe67807be1c3fd1db091044c

                                SHA256

                                524c9cae1f3bbe7c51d7adf150591c598977e035f2fb86236bc588843d352507

                                SHA512

                                af1ac02b02c439cb718703a40e126583982fbc0aefbbf1992126899a099754b45f1839059332a1232be89c66af6f08fdec5aedae43c5389e5baa0d6d49c556b8

                              • C:\Users\Admin\AppData\Local\Temp\1008051001\6bd1739f8d.exe

                                Filesize

                                1.7MB

                                MD5

                                bbdcc9dddad9b362ce059565c260d570

                                SHA1

                                09a8519525564f130824b36c7245a83c8b1d05a1

                                SHA256

                                8e1a9142a9f6b7a601ff64074a7a59e370d5bc8270ef5aa17277ef4531b05bc6

                                SHA512

                                9332b1522b9fba2705970f20995ecb8141ea8965b240bd42cf09e146cd523da40b5b455cd68d0cf0825118a2e291a473ecfb91f4648a42595e2a592ae9588e2e

                              • C:\Users\Admin\AppData\Local\Temp\1008052001\e22651c314.exe

                                Filesize

                                1.7MB

                                MD5

                                e2fef9de68b89d7bb679918977c0f089

                                SHA1

                                19a93a049dce3c285f508aa6ead57637149917ef

                                SHA256

                                f46ec872bb777f2298dfc842b7ee4091e146ce829cb9b4174275bc393ffdfbb9

                                SHA512

                                9fc1d0301efb1d7c927713a18205a482266f17ebf207432a028cb4eda422a1f149327696d6d8f0aca0b20c4e9608cd9c93d953ccd0b612bbf457b203392069b6

                              • C:\Users\Admin\AppData\Local\Temp\1008053001\126cde9199.exe

                                Filesize

                                901KB

                                MD5

                                7af2ca673b55706f83157b7ae62fcb13

                                SHA1

                                05346adf9ad30fa9ec415ac6e95087bfc2c0574a

                                SHA256

                                c62aecfa9b8b2abca7db7e93b4641ddf0462da1bfba68f7f05e86edb8a3de942

                                SHA512

                                2532f211c98d03e2920e12fa5b1d59f0e89a1591f5c705f245ea0a6769b6415f9b2a8a05995281e7912e2522f5ae88301730d099110adac3b713471f2a8fc815

                              • C:\Users\Admin\AppData\Local\Temp\1008054001\b8f0495954.exe

                                Filesize

                                2.7MB

                                MD5

                                280ac654537ec60253b4f6d5a69f35a3

                                SHA1

                                9c22332d27561cb3eaaafe080170ff9bb7cfc687

                                SHA256

                                149d0c70a0919ffb52c056120c5e8b14eaf489eee9c9af52d5641273e1eb46e9

                                SHA512

                                7a679a3f20bdc4aed79175e5a9b1f19a1d0d8c9118e6769f100c0329fb2a98b84ba8413aaf15af62a4edab094334d1d29cfcd2a0f2bfb8d2bcc1a51dc78df3b6

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhdw2a4e.bpl.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                Filesize

                                1.8MB

                                MD5

                                6aed281d1464e3a53839bbd9e7190535

                                SHA1

                                8ea6e9ec2eb3970e0c361538fb6dbd074e5fa6c2

                                SHA256

                                a20abe49e71912d860044fdf813c7fb90f32fde51097db4b689cac9c8f7a9ac9

                                SHA512

                                3d3312dbc5d3537143f8ee75097e9dfa5a88c59b3d0079461a6878ba1aafa232a131e8078dbf08d5e62bdd84f5833e900d4b8e0f37e80b3bbcab996b725e5366

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

                                Filesize

                                966B

                                MD5

                                65a1768e2b6316f889472fcc19034be8

                                SHA1

                                63718f79665fbcbcef96519ab6f8ef6302be1286

                                SHA256

                                f4e70c2d040b8c0ce1b5fb8b060d168a66d6cb35eb87876dd56970f4828b7719

                                SHA512

                                6a0070139b41041c4c11479703b086f9b6c95771f9bde81ab6a2df436111205f297f58a8546d89cd82de61751e2e31e2ddf2df50987956e100907b9a5e922f87

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin

                                Filesize

                                6KB

                                MD5

                                a6fa1860ca57b8bf23f65ef8d59f4ad1

                                SHA1

                                6690513104187ad201b46fde2bf0f59206fcc161

                                SHA256

                                9a741427175134bc700b0c73456b5f11a450368a114d875fe7de00307869b087

                                SHA512

                                1a4d95ae4960741b011ba9872e0c4fb17eff1b11ae6a79834325cdb8b8857768dc40fe2544269d6289619d6846c66d1d64a181f674ad137471b5b10d5228478b

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin

                                Filesize

                                13KB

                                MD5

                                00d798810c0e7eeeb7d11466833f81eb

                                SHA1

                                7a782687566579fb9ab15bc04d143931d8fcc296

                                SHA256

                                78bf253d1ce4839614e7a58fab2f7d6db10613197ada8c1196290ee9c3652e49

                                SHA512

                                5e0d7e69833a08379bb2da67ec97a61356b0cc44da49c05dad9bc8495d09d7110e4c55922f8b6557e7721e15b70677af4ac1aa242410e2d3ed4766daf19531a6

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                5KB

                                MD5

                                0f9600baaad0b023db0de1ff3acc589d

                                SHA1

                                f6d5883452199f0d9d982b29a003ea4a1f6cd8ec

                                SHA256

                                7c02b005ea837d211f9ae6bdba65ddcd2ca91bdcff20b5545f26917c540ba6f3

                                SHA512

                                77ce376321781e5f707c1359b278c8bc81a0e82039492f820103f669e98d3422837b22ccb86b27aa17705e4b252da473205460341843fd94919ea6cc07b19ad3

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                15KB

                                MD5

                                c1bdaa869bc2415cf6312de53913c6e5

                                SHA1

                                6c1b723e00bd2ba7db26cc229e736eb23efd84df

                                SHA256

                                c723d9e6a834754cbf5dd2a7c9eb5a2aaaf8febd5b149bb98218f2f400879813

                                SHA512

                                cbbecc10faeeb1ba36309bc656de4ccd4d515eeaf1e0818137aea2b1b5629fada8d7c1d8d22b527d1f8831e512006a840f9f8cf2091396e3ca6fc01f43c30661

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp

                                Filesize

                                15KB

                                MD5

                                db87f7e4cdbb64b1549b8ff0da52436a

                                SHA1

                                0fb050408e03f3c9ee87184deef06ae2ca73b1f1

                                SHA256

                                0582a434823990af8da842491c45f2f327bb5ef87b0f64ef2f8955554f898c18

                                SHA512

                                622f6b615cdd59581ef1beef1032df47df6b9157ceea9a61f95127c866ba89c6102647dfab543d715427fb5a4a7417f881bf7059feb5c42ac0c2a3c13da686a9

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\0908a36c-3580-43dc-9e95-92c74884810e

                                Filesize

                                26KB

                                MD5

                                9b418101e7368b07a6f2edc61183e41d

                                SHA1

                                6fabaa12ed35d58e08e83b34dd5732d46ca62065

                                SHA256

                                ff9ba3b2f03d297ad6e5f9f70c23ea17d59bc26ceb7cb972e6080a6ad4172ed0

                                SHA512

                                dbe291e228d873e5944df0ea2b7f738887357a9f3377f8dcb0b020523bd373961b5cc7ca69f9393912b31af4f19ec72fcc68d831a18deaec28a3dfe6e0031acd

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\d18c053e-4a8f-4c03-92ff-3d8d29795820

                                Filesize

                                671B

                                MD5

                                5724e6149b7cff5c7c22f868c890cb6c

                                SHA1

                                3eeba8100d16cde9eb8c8b8c25d6d4ca476ae321

                                SHA256

                                df11dfde75e42b57650cefe1edcad416ed549db48902215f5cceb9f707435158

                                SHA512

                                39044946c59d63fc2df9ae7b60efa7e454f2a91eb8cdcb8e8b79d128d157df25ec2f8e2c6414c4fb9ab9c8f1a13bf0dd8312ac18e8637af315da24594e9ae3bb

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\e2fa2e9b-b031-4ca2-956c-02248236515f

                                Filesize

                                982B

                                MD5

                                d93388cca29b8e46addeb6a9f8156cc5

                                SHA1

                                85d68c34e1dc914339362480d68bc4cdac24e620

                                SHA256

                                80e87f3890c783b84c0ae71555537f28fcd6e9577f6390277a219bbecc5f3855

                                SHA512

                                88090647c7d36c9ef1d8923537adec60e3aaaa103ae6a822e8ee2f3869449527a1ba3801b9f9cc12f204e9064ac81b136ae1d8b9c3ab665b633177e53042fcd5

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js

                                Filesize

                                12KB

                                MD5

                                595175e9bef0f7b9bca15ed5637c8da7

                                SHA1

                                598afd7b8b4f1ae30b3f91b16fa2bebaa34c9fa2

                                SHA256

                                78926a4f75812b7ae76e4d38c78271c7fc69384f85f6518f95d2eb875041c34a

                                SHA512

                                9afdd7ebda7319cc91f26a855683ec66d222a1cd6737cdfe3015a83dbc91b05a4ae800fdbf236297cce0b8712c182478755803968d0f06b58e42a72496002137

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js

                                Filesize

                                15KB

                                MD5

                                020546a2138f146cd2af89953f43a652

                                SHA1

                                a9e49cc377cd44e23f58777eef3db31f7eb0a500

                                SHA256

                                123359e50b10b8b9f8d4ef8c3b6c5ce06e4adea55ccf1ebffc818529c12660f8

                                SHA512

                                7f582bd759ff3ebf9a1b4e678eaed31bc0b14f348b58337f6667626b2a336b3db4a612b73849c7c0d0826c73c7a17652d3bc87e592331795da1365029a0d4723

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js

                                Filesize

                                10KB

                                MD5

                                77efba64d39247e7d340c8c314adf1b5

                                SHA1

                                7f16545b97f510ef7f227a590c95ab30561193dd

                                SHA256

                                7959171b12580547623067955b0e60ee2f08ee20f7621f94adceab7b67c1e1dc

                                SHA512

                                2c9fbf4bb18b9d1ff01210219e38fe9f267bdce06c9756abb399b34e37db5988767b30ffa185436c26b7df9c4b0daece6ce62750d98ee0a7b50edeab08cf0db3

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js

                                Filesize

                                10KB

                                MD5

                                1acdc6c439a23ed50caa03765e4d184a

                                SHA1

                                8e84292f752d500a397f4ec64e997b55cf865b2a

                                SHA256

                                da9e7c990a61d711f1cf6178b24f253c067923c535a9d5724dc17919732d2aac

                                SHA512

                                915c2bc919af35ca99c066d8708a622412a6596109fca381b878caa54f1122beccaa98f19d391a98f16818e210d841417cbefedc960462df68f4eaeffc1e04fc

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                Filesize

                                840KB

                                MD5

                                17e9102ca0e869058317271e9d99e108

                                SHA1

                                f59c38d112160bae1a116b49c429689675a1f62a

                                SHA256

                                c46ef8469489d77e9323fae38fe3d2ffcde88d4fd5cacb616412f89007a21e07

                                SHA512

                                69ce84ae5f8a6e6b23d082d869be7d770e57c8249fc40c6528d84db94c768ace15fc6e3d4f6477a3113f462db5ee7f7574aba815c3a6c4c07af5d3d661b63a91

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                Filesize

                                1.8MB

                                MD5

                                3e8172c337604a0e753f675994e4d2ed

                                SHA1

                                19688344e37dd97f013ad90179ece5442920ec2c

                                SHA256

                                c875fe4ab61da6a85b0ff6630434c1808eee2b73d5be243a78e0e9f4743698dc

                                SHA512

                                6627d4ad72b420ff356a0620f85809f782a6c59e3143977b36ff006fd01ed2563fb7008a253f554c39db02de6a4560b18b4794b228284e8a3258ce0f4c5d7200

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                Filesize

                                2.6MB

                                MD5

                                3c1f796493db5458214f5531ad424fb2

                                SHA1

                                aafe174abc8edd81d90976003d1c4674ab3146bc

                                SHA256

                                d7bb385c11578233f1909240e61e1a3ce85cb6ecb691ffb5e5dc540108a01624

                                SHA512

                                cef4620594afff62a4eba49c3734cd6ee72fb39376cce693e72aa363ede83b02b989d76fac1d3787a24218506e4c24e9ad15eede2aa8bc1e3cdbe325875802ad

                              • memory/744-162-0x0000000000AB0000-0x0000000001135000-memory.dmp

                                Filesize

                                6.5MB

                              • memory/744-160-0x0000000000AB0000-0x0000000001135000-memory.dmp

                                Filesize

                                6.5MB

                              • memory/1116-633-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-19-0x0000000000391000-0x00000000003BF000-memory.dmp

                                Filesize

                                184KB

                              • memory/1116-143-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-998-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-17-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-20-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-21-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-42-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-192-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-110-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-43-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-647-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-79-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-95-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-99-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-105-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-104-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-102-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-101-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1116-100-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/2440-46-0x0000020B9A300000-0x0000020B9A322000-memory.dmp

                                Filesize

                                136KB

                              • memory/2612-635-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

                                Filesize

                                2.8MB

                              • memory/2612-211-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

                                Filesize

                                2.8MB

                              • memory/2612-217-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

                                Filesize

                                2.8MB

                              • memory/2612-638-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

                                Filesize

                                2.8MB

                              • memory/2612-216-0x0000000000BE0000-0x0000000000EA8000-memory.dmp

                                Filesize

                                2.8MB

                              • memory/2724-4-0x0000000000140000-0x000000000060A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/2724-1-0x0000000077E74000-0x0000000077E76000-memory.dmp

                                Filesize

                                8KB

                              • memory/2724-2-0x0000000000141000-0x000000000016F000-memory.dmp

                                Filesize

                                184KB

                              • memory/2724-3-0x0000000000140000-0x000000000060A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/2724-0-0x0000000000140000-0x000000000060A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/2724-18-0x0000000000140000-0x000000000060A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/2996-109-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/2996-107-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/3120-144-0x0000000000240000-0x00000000006C2000-memory.dmp

                                Filesize

                                4.5MB

                              • memory/3120-142-0x0000000000240000-0x00000000006C2000-memory.dmp

                                Filesize

                                4.5MB

                              • memory/3584-831-0x0000000000360000-0x0000000000F9D000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3584-645-0x0000000000360000-0x0000000000F9D000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3584-165-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                Filesize

                                10.4MB

                              • memory/3584-163-0x0000000000360000-0x0000000000F9D000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3584-126-0x0000000000360000-0x0000000000F9D000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3584-591-0x0000000000360000-0x0000000000F9D000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3584-183-0x0000000000360000-0x0000000000F9D000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/3584-1526-0x0000000000360000-0x0000000000F9D000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/4220-40-0x00007FFDF1413000-0x00007FFDF1415000-memory.dmp

                                Filesize

                                8KB

                              • memory/4220-41-0x0000000000D90000-0x0000000000DA8000-memory.dmp

                                Filesize

                                96KB

                              • memory/4868-97-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4868-98-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/5988-2227-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/5988-2306-0x0000000000390000-0x000000000085A000-memory.dmp

                                Filesize

                                4.8MB