Overview

overview

10

Static

static

3

WPQ54_file.exe

windows7-x64

10

WPQ54_file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 23:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WPQ54_file.exe

  • Size

    1.8MB

  • MD5

    a68bd83f0cedd6b76cca22d5853ec168

  • SHA1

    ce0eae756e594d55f9a3835fb46fa82895c12c76

  • SHA256

    1c2f115d150d479f4ee5665477ccbfcb0ebda06e7767c90e87f55f23bacb6125

  • SHA512

    8441eb36925308b653caf7abdb34dbcb88799f14fd5fc9f11ba363206a46e83430c4caf804631b23c5dcb710da56bb691371fd5fc7a01461006387364baa85f0

  • SSDEEP

    49152:44ylfSD3avYUIh0+OZiq+ZrodAR2u6EuY:47lfSDfUHwrodAR2u5F

Score
10/10
amadeycryptbotstealcxworm9c9aa5marscredential_accessdiscoveryevasionexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

C2

87.120.112.33:8398

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot6673004050:AAEcDfPnnGAswDvyrn9-bkOySVSnbPqLnBU/sendMessage?chat_id=1470436579

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detect Xworm Payload 2 IoCs
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\WPQ54_file.exe
    "C:\Users\Admin\AppData\Local\Temp\WPQ54_file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5040
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe
        "C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:512
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'document.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:60
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1632
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4412
      • C:\Users\Admin\AppData\Local\Temp\1008050001\8c80f886b1.exe
        "C:\Users\Admin\AppData\Local\Temp\1008050001\8c80f886b1.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:4428
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaf21fcc40,0x7ffaf21fcc4c,0x7ffaf21fcc58
            5⤵
              PID:4516
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,6993366977066126662,5282824634004045654,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1948 /prefetch:2
              5⤵
                PID:4956
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1860,i,6993366977066126662,5282824634004045654,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2088 /prefetch:3
                5⤵
                  PID:5800
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1216,i,6993366977066126662,5282824634004045654,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2356 /prefetch:8
                  5⤵
                    PID:5892
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,6993366977066126662,5282824634004045654,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:3656
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,6993366977066126662,5282824634004045654,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3340 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:3508
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,6993366977066126662,5282824634004045654,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4576 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5600
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:6028
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:5568
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1316
                  4⤵
                  • Program crash
                  PID:5912
              • C:\Users\Admin\AppData\Local\Temp\1008051001\f97deae0d5.exe
                "C:\Users\Admin\AppData\Local\Temp\1008051001\f97deae0d5.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2816
              • C:\Users\Admin\AppData\Local\Temp\1008052001\aa34ce225a.exe
                "C:\Users\Admin\AppData\Local\Temp\1008052001\aa34ce225a.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3768
              • C:\Users\Admin\AppData\Local\Temp\1008053001\435bebf9a7.exe
                "C:\Users\Admin\AppData\Local\Temp\1008053001\435bebf9a7.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:744
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2008
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4124
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1728
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3096
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2944
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4020
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    5⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2016
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1640 -prefMapHandle 1644 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5052426a-59bf-4fc4-8c25-2df13c80a502} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" gpu
                      6⤵
                        PID:4984
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d017a4eb-49ca-45ff-9dde-fafe1fcaea9c} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" socket
                        6⤵
                          PID:4132
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2932 -childID 1 -isForBrowser -prefsHandle 1204 -prefMapHandle 2560 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd071fa6-5b7d-4763-8571-d6ed308fcfc1} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
                          6⤵
                            PID:1376
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3908 -childID 2 -isForBrowser -prefsHandle 3932 -prefMapHandle 3928 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b53778e-ac46-4f8a-80f6-15f959a631d9} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
                            6⤵
                              PID:3892
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4672 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4908 -prefMapHandle 4904 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05211cb0-2cbe-46d4-b50d-36f2ef06830e} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" utility
                              6⤵
                              • Checks processor information in registry
                              PID:5616
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 3 -isForBrowser -prefsHandle 5600 -prefMapHandle 5672 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {983ceeba-234e-47db-bb94-b98ee7d9fbc4} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
                              6⤵
                                PID:5252
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 4 -isForBrowser -prefsHandle 5812 -prefMapHandle 5816 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00b18e3f-3b34-411f-b0ae-e7f9b81ca30e} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
                                6⤵
                                  PID:5272
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 5 -isForBrowser -prefsHandle 5992 -prefMapHandle 6008 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68387288-2917-4fe1-a25b-55a78f592e9c} 2016 "\\.\pipe\gecko-crash-server-pipe.2016" tab
                                  6⤵
                                    PID:5276
                            • C:\Users\Admin\AppData\Local\Temp\1008054001\b4ec9be25d.exe
                              "C:\Users\Admin\AppData\Local\Temp\1008054001\b4ec9be25d.exe"
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1700
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1992
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:5516
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5960
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1568 -ip 1568
                            1⤵
                              PID:2636

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            1
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Modify Authentication Process

                            1
                            T1556

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Defense Evasion

                            Impair Defenses

                            2
                            T1562

                            Disable or Modify Tools

                            2
                            T1562.001

                            Modify Authentication Process

                            1
                            T1556

                            Modify Registry

                            3
                            T1112

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Modify Authentication Process

                            1
                            T1556

                            Steal Web Session Cookie

                            1
                            T1539

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Query Registry

                            8
                            T1012

                            System Information Discovery

                            5
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              d85ba6ff808d9e5444a4b369f5bc2730

                              SHA1

                              31aa9d96590fff6981b315e0b391b575e4c0804a

                              SHA256

                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                              SHA512

                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              62623d22bd9e037191765d5083ce16a3

                              SHA1

                              4a07da6872672f715a4780513d95ed8ddeefd259

                              SHA256

                              95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                              SHA512

                              9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              96e3b86880fedd5afc001d108732a3e5

                              SHA1

                              8fc17b39d744a9590a6d5897012da5e6757439a3

                              SHA256

                              c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294

                              SHA512

                              909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              da5c82b0e070047f7377042d08093ff4

                              SHA1

                              89d05987cd60828cca516c5c40c18935c35e8bd3

                              SHA256

                              77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

                              SHA512

                              7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                              Filesize

                              13KB

                              MD5

                              3c9448561dec412c2966efb2bde8f28a

                              SHA1

                              28ee909ba1e85a4d1a644dbc1d8b4f92ba9a086c

                              SHA256

                              b9c7a23aac209addc013b8808cc753b1d17f9e340b661a1aa617e2a96174efcf

                              SHA512

                              1a7fc4a85c63fed23bb94faceb37c99fbf198aedac4b21d67ff940365d04a8c234a8d247452dabcb9b08a9f61c51575b0f1680281305a9b10c108b89c66cd41b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1008030001\document.exe
                              Filesize

                              72KB

                              MD5

                              8d52069bd117da94e0b0b70e73e33fb0

                              SHA1

                              e8090adddff167e1bda4194af968ba4bc22a2d60

                              SHA256

                              b3e217c467cfe1e8079e82b88f2f99950a9459330a8843070ebb34bf3e2bcf38

                              SHA512

                              7a91eeb0cf3edb53d0ac3d51abe85c97bb09da5b334b387fda90144a2f3729693367c451fee9e04cb953dcf8d9d1b91ee12961bfe9f1e53c0ab06aababd696ed

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1008050001\8c80f886b1.exe
                              Filesize

                              4.2MB

                              MD5

                              7300372edfa809331d4b525a77c2a93d

                              SHA1

                              0540bbbf3b91b4ebbe67807be1c3fd1db091044c

                              SHA256

                              524c9cae1f3bbe7c51d7adf150591c598977e035f2fb86236bc588843d352507

                              SHA512

                              af1ac02b02c439cb718703a40e126583982fbc0aefbbf1992126899a099754b45f1839059332a1232be89c66af6f08fdec5aedae43c5389e5baa0d6d49c556b8

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1008051001\f97deae0d5.exe
                              Filesize

                              1.7MB

                              MD5

                              bbdcc9dddad9b362ce059565c260d570

                              SHA1

                              09a8519525564f130824b36c7245a83c8b1d05a1

                              SHA256

                              8e1a9142a9f6b7a601ff64074a7a59e370d5bc8270ef5aa17277ef4531b05bc6

                              SHA512

                              9332b1522b9fba2705970f20995ecb8141ea8965b240bd42cf09e146cd523da40b5b455cd68d0cf0825118a2e291a473ecfb91f4648a42595e2a592ae9588e2e

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1008052001\aa34ce225a.exe
                              Filesize

                              1.7MB

                              MD5

                              e2fef9de68b89d7bb679918977c0f089

                              SHA1

                              19a93a049dce3c285f508aa6ead57637149917ef

                              SHA256

                              f46ec872bb777f2298dfc842b7ee4091e146ce829cb9b4174275bc393ffdfbb9

                              SHA512

                              9fc1d0301efb1d7c927713a18205a482266f17ebf207432a028cb4eda422a1f149327696d6d8f0aca0b20c4e9608cd9c93d953ccd0b612bbf457b203392069b6

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1008053001\435bebf9a7.exe
                              Filesize

                              901KB

                              MD5

                              7af2ca673b55706f83157b7ae62fcb13

                              SHA1

                              05346adf9ad30fa9ec415ac6e95087bfc2c0574a

                              SHA256

                              c62aecfa9b8b2abca7db7e93b4641ddf0462da1bfba68f7f05e86edb8a3de942

                              SHA512

                              2532f211c98d03e2920e12fa5b1d59f0e89a1591f5c705f245ea0a6769b6415f9b2a8a05995281e7912e2522f5ae88301730d099110adac3b713471f2a8fc815

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1008054001\b4ec9be25d.exe
                              Filesize

                              2.7MB

                              MD5

                              280ac654537ec60253b4f6d5a69f35a3

                              SHA1

                              9c22332d27561cb3eaaafe080170ff9bb7cfc687

                              SHA256

                              149d0c70a0919ffb52c056120c5e8b14eaf489eee9c9af52d5641273e1eb46e9

                              SHA512

                              7a679a3f20bdc4aed79175e5a9b1f19a1d0d8c9118e6769f100c0329fb2a98b84ba8413aaf15af62a4edab094334d1d29cfcd2a0f2bfb8d2bcc1a51dc78df3b6

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gun1x2tu.hsm.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              Filesize

                              1.8MB

                              MD5

                              a68bd83f0cedd6b76cca22d5853ec168

                              SHA1

                              ce0eae756e594d55f9a3835fb46fa82895c12c76

                              SHA256

                              1c2f115d150d479f4ee5665477ccbfcb0ebda06e7767c90e87f55f23bacb6125

                              SHA512

                              8441eb36925308b653caf7abdb34dbcb88799f14fd5fc9f11ba363206a46e83430c4caf804631b23c5dcb710da56bb691371fd5fc7a01461006387364baa85f0

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                              Filesize

                              479KB

                              MD5

                              09372174e83dbbf696ee732fd2e875bb

                              SHA1

                              ba360186ba650a769f9303f48b7200fb5eaccee1

                              SHA256

                              c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                              SHA512

                              b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                              Filesize

                              13.8MB

                              MD5

                              0a8747a2ac9ac08ae9508f36c6d75692

                              SHA1

                              b287a96fd6cc12433adb42193dfe06111c38eaf0

                              SHA256

                              32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                              SHA512

                              59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
                              Filesize

                              962B

                              MD5

                              7ab5f34218a10572621dcd7a0024e621

                              SHA1

                              ff843475bd65a222dcd1ea94cb71131f7cea384a

                              SHA256

                              c2a81bf1cf12ac99a8b9094154677f8b66341ba1a7f19a169d5d72d8327fb107

                              SHA512

                              7d27cf2d1fd24a21b3e00d90ddeaad53c7c0b49750d78bb6bfbc6969bacd56295793ba64259db56f536a9d106fdcc77f73576e64df96e7505cbc7da61b1a3764

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                              Filesize

                              8KB

                              MD5

                              ceb3395f5efe3db046d9b82394008b6f

                              SHA1

                              ea1d39b73af8f64222d9125cd481293933132c9e

                              SHA256

                              77f383e81148a6b7d68907190e02b01173d32254a656b727336c4ca61fbab87a

                              SHA512

                              27883c083de278c483177c7577717f00e681fbfeae7c51d2ee9c85ee7a5a048ce80e8c6bffc909d8bfa46481c70246bdf705a206c0a9c44a1dcdc0b6a6777bcb

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              15KB

                              MD5

                              eb6e179ff2cb04e966c8f3ba9c6b48e3

                              SHA1

                              d414c5eb826096b6ace34fb98acd97606fbf9879

                              SHA256

                              760b8db6587c681904badd2dca0cf53c4a6fe817d05ab9c9d2b2a7d5273fd278

                              SHA512

                              89ba195c17c108ca831d09aa3daad57c7658288a72dd26e04856dc715254d6fcee82c9ba743a1407f48701e5e734f947a2e6eb092a7d29f6d53b9d010a46928b

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              6KB

                              MD5

                              2b8da5e55258d99a1006974413e78c59

                              SHA1

                              5b625dd815a903f0e0aa8a49232ffd2f7574fbd5

                              SHA256

                              0979e755385271869856d89b26068e0890677e0a3f2bea43c63df33217f24da4

                              SHA512

                              e0def2e6f70de99d25dee69f194a80b0216e230b6bbfe6b69e17a28a23b51b33e29c237b6c695e470fde45af0859f81a08521588b5ee7c112951843f96fecf98

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              5KB

                              MD5

                              5bbc3969c392ce4e4399f3ed4e357120

                              SHA1

                              ef23182186d40d64c101d0ab7bfafc7c50a2730f

                              SHA256

                              af06ebaaa53e31ee08e628efae073cb126fcd07015964606634d4066351c25f6

                              SHA512

                              e9ea53816c6a4a17c243486cfccae91428bf4735439142d30d86e6194ad2bb311efc99947ffdd25c3290ea8e5a22ec3fa7408de6e9d5eafb5223f93298a9395c

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\2c0a79ac-3d99-42f3-a431-ddfb8585eb42
                              Filesize

                              26KB

                              MD5

                              28a39199cf2759e8f8a6d0fff793355b

                              SHA1

                              d6bb161b56283f95c84789f9470d8b44031976af

                              SHA256

                              37a6cfda9b171bbcac465864edb1490468ce6f981f8b01f886bf6de24e139402

                              SHA512

                              98b2c9ccb7e78de775b6fe14e34bee80781b0773b558d7454597a309f07162b3a0aee80a8f54450e4a9c4df59cdb314c7bef728a206b9b1df812eb5a4a53db69

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\79c3f13a-4ebb-45d0-872b-ed8d06872296
                              Filesize

                              671B

                              MD5

                              d73e502bb2408b03ffbbc77aca214bfa

                              SHA1

                              90550b064bea230cda95deff3a3117e4f86a33a1

                              SHA256

                              7858aac3432900d9c2bc912abc9e29ac121572523575dedcc158a1c43914a70c

                              SHA512

                              9144ae413e8505f3cbb4708cf757342d717bc2fd5ab9c110aa9093b40beb842db3703b10022de7c99444889eaa429a12a2cc092f01a4bfda13d7a5b4bafd3ddb

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\d03628f4-c8ce-4ff4-a026-e04f934ac476
                              Filesize

                              982B

                              MD5

                              f1c6ca4fc3f5856b6d972b9f2a753d8f

                              SHA1

                              15844b5a9b3f8f93f8d306a3d19d6f6eed46c284

                              SHA256

                              37c25d958d33165e810fbf5e386c0898516aa22e35165742a39b284577310370

                              SHA512

                              bcbf28423f8a2c6c35090413527571fa42cafee1d12d890606d819c0a1bf3dacb6323a89d41f0edeaabfabe6d06043dd93c66c2afb3ee66263a600b7700985d0

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                              Filesize

                              1.1MB

                              MD5

                              842039753bf41fa5e11b3a1383061a87

                              SHA1

                              3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                              SHA256

                              d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                              SHA512

                              d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                              Filesize

                              116B

                              MD5

                              2a461e9eb87fd1955cea740a3444ee7a

                              SHA1

                              b10755914c713f5a4677494dbe8a686ed458c3c5

                              SHA256

                              4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                              SHA512

                              34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                              Filesize

                              372B

                              MD5

                              bf957ad58b55f64219ab3f793e374316

                              SHA1

                              a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                              SHA256

                              bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                              SHA512

                              79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                              Filesize

                              17.8MB

                              MD5

                              daf7ef3acccab478aaa7d6dc1c60f865

                              SHA1

                              f8246162b97ce4a945feced27b6ea114366ff2ad

                              SHA256

                              bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                              SHA512

                              5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                              Filesize

                              15KB

                              MD5

                              a19c06de4a72463fc8ddf4b120940c30

                              SHA1

                              a1596fdbe6a76c8ccb9d97e1ce3e481e45f75706

                              SHA256

                              f343e8b9e4d826ac7f8ffb319243d136d4d69e6be15723ef90df358f774d81f0

                              SHA512

                              f6cc86bfbc7b731bd652bc328304031a224b2a1043079cbfe9f58acc892faec278a40fafa4c201dc366463d5067fbc27f10d599b611eed3a6a00a67bb782792c

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                              Filesize

                              10KB

                              MD5

                              b37b0376fc62963848ea8350d436b089

                              SHA1

                              b4b5eb40164738121b58252f67d5f5506c46a7ee

                              SHA256

                              2408556e87bcbfb8b819370b6b76d5a5e1c1c980f3455deeeeb2bfbd15e124c9

                              SHA512

                              05784c0fa6127ee9160d564c90d67ce7edbae5d62ffa4be6d74438d368c180f272f3b1ca788a85e78bca6c88edd268a0e91701956cadfe364fdf823f57d105d1

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                              Filesize

                              12KB

                              MD5

                              0ae0080e1181571cd3e36227544e9261

                              SHA1

                              b0311d55b1985a0ed828e2d5111e35d453af80a8

                              SHA256

                              4573c8331222a977106c76e39bd73cdf6cba6557d19dbf04b26d9c5004b7eea2

                              SHA512

                              bd07f85da39489deb905e93290805ad333ea50270e895d7a9170ff793eb33f08f11413b5686d7e21fbbe1fa86cb68be9f0be91d2328c73affe9eedf431d2ed48

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                              Filesize

                              10KB

                              MD5

                              387a80d06d7b64bab0ab996cb8b96f30

                              SHA1

                              eb03a98a3b1cd11c3e7aedc9856391428659dec9

                              SHA256

                              815d84722314c28d7a87e7646ae33ef59ff419a1911eee96bb6e1ddd03a91246

                              SHA512

                              ec834084597e10ac71eaf44e91751dc63a34a3e3a1e4bbfb241a39788f6f78bcf845aae7d954eb38b8fbc964ea2578e5afb2326eab30feac9d43c84eceb2678a

                              Download Submit

                            • \??\pipe\crashpad_4428_BKBYCZSBYDJZZDPD
                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              Download Submit

                            • memory/512-47-0x00000214E9430000-0x00000214E9452000-memory.dmp

                              Filesize

                              136KB

                              Download

                            • memory/1308-40-0x0000000000EF0000-0x0000000000F08000-memory.dmp

                              Filesize

                              96KB

                              Download

                            • memory/1308-39-0x00007FFAE23A3000-0x00007FFAE23A5000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/1568-2432-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-149-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-3283-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-547-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-160-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-1574-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-3114-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-587-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                              Filesize

                              10.4MB

                              Download

                            • memory/1568-110-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-740-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1568-580-0x00000000004D0000-0x000000000110D000-memory.dmp

                              Filesize

                              12.2MB

                              Download

                            • memory/1700-199-0x00000000009C0000-0x0000000000C88000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/1700-200-0x00000000009C0000-0x0000000000C88000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/1700-190-0x00000000009C0000-0x0000000000C88000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/1700-570-0x00000000009C0000-0x0000000000C88000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/1700-573-0x00000000009C0000-0x0000000000C88000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/1992-130-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/1992-148-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2816-128-0x0000000000920000-0x0000000000DA2000-memory.dmp

                              Filesize

                              4.5MB

                              Download

                            • memory/2816-125-0x0000000000920000-0x0000000000DA2000-memory.dmp

                              Filesize

                              4.5MB

                              Download

                            • memory/3768-146-0x00000000007C0000-0x0000000000E45000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/3768-151-0x00000000007C0000-0x0000000000E45000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/3808-94-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-189-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-18-0x0000000000051000-0x000000000007F000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/3808-19-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-17-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-3296-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-581-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-3293-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-3290-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-3287-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-990-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-568-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-20-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-3271-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-41-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-2035-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-77-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-2835-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3808-127-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5040-1-0x00000000776C4000-0x00000000776C6000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/5040-2-0x0000000000BB1000-0x0000000000BDF000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/5040-3-0x0000000000BB0000-0x000000000104D000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5040-4-0x0000000000BB0000-0x000000000104D000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5040-16-0x0000000000BB0000-0x000000000104D000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5040-0-0x0000000000BB0000-0x000000000104D000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5960-2909-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5960-2896-0x0000000000050000-0x00000000004ED000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/6028-3288-0x0000000000240000-0x0000000000252000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/6028-3289-0x0000000073040000-0x0000000073174000-memory.dmp

                              Filesize

                              1.2MB

                              Download