Overview

overview

10

Static

static

3

ea5afba952...d9.exe

windows7-x64

10

ea5afba952...d9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 01:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea5afba952c7c52e7ff10d775ceca244907b4699642dde81d0dca9d6814ce3d9.exe

  • Size

    1.8MB

  • MD5

    3c271702f5eebc60e590f6803d8d2238

  • SHA1

    488b5450a017ab4f78d50a1c5adb1c5b54643458

  • SHA256

    ea5afba952c7c52e7ff10d775ceca244907b4699642dde81d0dca9d6814ce3d9

  • SHA512

    de4dff6c44ebee7a5b3bc8060a39167343cc9e5fb7d6555ff72289c6ca7c9daf25bd8e19378430509329d20035f01f9d0d9a14b22e7d756621393b53233da935

  • SSDEEP

    49152:kCSkkgCY8/d3hr9tWCT17LMUVgXHqUlOosPSYxtT972HXrKpaV4nEaEb:kmeY89DzGaUDsPZf97EXrR4EaE

Score
10/10
amadeycryptbotsmokeloaderstealc9c9aa5marsbackdoorcredential_accessdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Smokeloader family
    smokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 62 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea5afba952c7c52e7ff10d775ceca244907b4699642dde81d0dca9d6814ce3d9.exe
    "C:\Users\Admin\AppData\Local\Temp\ea5afba952c7c52e7ff10d775ceca244907b4699642dde81d0dca9d6814ce3d9.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:100
      • C:\Users\Admin\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
        "C:\Users\Admin\AppData\Local\Temp\1007643001\GuidanceConnectors.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy Frequently Frequently.cmd & Frequently.cmd
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1924
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1364
          • C:\Windows\SysWOW64\findstr.exe
            findstr /I "wrsa opssvc"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4348
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:732
          • C:\Windows\SysWOW64\findstr.exe
            findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2992
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md 390641
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2988
          • C:\Windows\SysWOW64\findstr.exe
            findstr /V "ConventionTroopsStudiedTooth" Version
            5⤵
            • System Location Discovery: System Language Discovery
            PID:700
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c copy /b ..\Accessing + ..\Entire + ..\Peripherals + ..\Et B
            5⤵
            • System Location Discovery: System Language Discovery
            PID:416
          • C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
            Imposed.com B
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4784
            • C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
              C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
              6⤵
              • Executes dropped EXE
              PID:1644
            • C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
              C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
              6⤵
              • Executes dropped EXE
              PID:3184
            • C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
              C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
              6⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:2972
          • C:\Windows\SysWOW64\choice.exe
            choice /d y /t 5
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3516
      • C:\Users\Admin\AppData\Local\Temp\1007744001\Lumma111.exe
        "C:\Users\Admin\AppData\Local\Temp\1007744001\Lumma111.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2328
      • C:\Users\Admin\AppData\Local\Temp\1007810001\dbc048db45.exe
        "C:\Users\Admin\AppData\Local\Temp\1007810001\dbc048db45.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3968
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3892
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb29d1cc40,0x7ffb29d1cc4c,0x7ffb29d1cc58
            5⤵
              PID:2920
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2108,i,17482408806749566673,4709069004674904708,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:2
              5⤵
                PID:3264
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1864,i,17482408806749566673,4709069004674904708,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2140 /prefetch:3
                5⤵
                  PID:5436
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2308,i,17482408806749566673,4709069004674904708,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2288 /prefetch:8
                  5⤵
                    PID:5532
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,17482408806749566673,4709069004674904708,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5676
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,17482408806749566673,4709069004674904708,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5820
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4508,i,17482408806749566673,4709069004674904708,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4592 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5968
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4888
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:6120
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 1252
                  4⤵
                  • Program crash
                  PID:4624
              • C:\Users\Admin\AppData\Local\Temp\1007811001\a62ca644c7.exe
                "C:\Users\Admin\AppData\Local\Temp\1007811001\a62ca644c7.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4508
              • C:\Users\Admin\AppData\Local\Temp\1007812001\d59898f0c0.exe
                "C:\Users\Admin\AppData\Local\Temp\1007812001\d59898f0c0.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4020
              • C:\Users\Admin\AppData\Local\Temp\1007813001\594b095e48.exe
                "C:\Users\Admin\AppData\Local\Temp\1007813001\594b095e48.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4684
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2776
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:456
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4428
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4540
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1668
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                    PID:4920
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      5⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:2992
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0e0a9fb-703a-4ac0-9d54-eaaf3512ac55} 2992 "\\.\pipe\gecko-crash-server-pipe.2992" gpu
                        6⤵
                          PID:3984
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8960d905-3220-41b8-9f8c-4948c4aa086c} 2992 "\\.\pipe\gecko-crash-server-pipe.2992" socket
                          6⤵
                            PID:4588
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3000 -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 3040 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad9d602f-562c-4e86-85c3-a1abaee6c270} 2992 "\\.\pipe\gecko-crash-server-pipe.2992" tab
                            6⤵
                              PID:4248
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3976 -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 2588 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3e63f85-6a4c-4a08-9780-76d5600933da} 2992 "\\.\pipe\gecko-crash-server-pipe.2992" tab
                              6⤵
                                PID:1128
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4640 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68a5fd9c-4fce-4f54-9301-145a675ce76b} 2992 "\\.\pipe\gecko-crash-server-pipe.2992" utility
                                6⤵
                                • Checks processor information in registry
                                PID:5272
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5524 -childID 3 -isForBrowser -prefsHandle 5520 -prefMapHandle 4700 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02374e62-b92c-47e3-be4b-3ce803c77b2c} 2992 "\\.\pipe\gecko-crash-server-pipe.2992" tab
                                6⤵
                                  PID:4324
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5676 -childID 4 -isForBrowser -prefsHandle 5684 -prefMapHandle 5688 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fc16d39-980a-4c87-bfd6-eb459259506c} 2992 "\\.\pipe\gecko-crash-server-pipe.2992" tab
                                  6⤵
                                    PID:4132
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5868 -childID 5 -isForBrowser -prefsHandle 5876 -prefMapHandle 5880 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 988 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bfc9b01-fb8f-40b6-9a73-ed063ec8e8c0} 2992 "\\.\pipe\gecko-crash-server-pipe.2992" tab
                                    6⤵
                                      PID:2972
                              • C:\Users\Admin\AppData\Local\Temp\1007814001\3bbc33d809.exe
                                "C:\Users\Admin\AppData\Local\Temp\1007814001\3bbc33d809.exe"
                                3⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4528
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4684
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5944
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:5840
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3968 -ip 3968
                              1⤵
                                PID:3796
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5964
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:3196

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Modify Authentication Process

                              1
                              T1556

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Authentication Process

                              1
                              T1556

                              Modify Registry

                              3
                              T1112

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Modify Authentication Process

                              1
                              T1556

                              Steal Web Session Cookie

                              1
                              T1539

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Peripheral Device Discovery

                              1
                              T1120

                              Process Discovery

                              1
                              T1057

                              Query Registry

                              9
                              T1012

                              System Information Discovery

                              6
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\234d48df-5f97-4b09-b043-445d32f26098.tmp
                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                Filesize

                                1KB

                                MD5

                                fd5a000273ea098391856b7941fd2a3a

                                SHA1

                                aa720e193a207747ccf025910df7893e55fd1def

                                SHA256

                                9dc54a4d536a29ced8348c45d3f02b0aad8fd8011cdf2b34f5238a9ea50d2049

                                SHA512

                                70124883b83588fb87a191595614e649e06611c3b1eebfe8de6b906b2adec58c1b4d34265307b0b866928c52d64dbadda5261e679f7c457057188d0d5596dae4

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                Filesize

                                356B

                                MD5

                                b907f80b7d6030001db885f77d945342

                                SHA1

                                8ef91c58a850a74f045887677f37f36c7e39301e

                                SHA256

                                29302a1cf2bec3aa9ff434f391f00b1a90f78473efdd89047d8655b74453f004

                                SHA512

                                cd7615bda0e42935daefc9c02d5447774ba5348618bbc1960376ed71d88a514bd48029a8d7bfc671b4e91a5a7eacb1cd5ef1a4d6137fd2c4486f7bc4ccba9e10

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json
                                Filesize

                                27KB

                                MD5

                                7fa346e4740fe2836732765a0096e78c

                                SHA1

                                c3b7fe0fb73ec3bbd3bde280a857460bed8df97a

                                SHA256

                                41d924d611e0bba16cc879e14636c4b6ad3bfdf26f925ad922541769a6d44024

                                SHA512

                                6eb73fa2a616e1813557f658cd155d60a0bbf22ea41ac86e1255aa88c6edbccc4e210d146e9ad067ba66ce793d54651f31771867761326c028ecb13de4bb85e0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                                Filesize

                                13KB

                                MD5

                                4958d4adaa60114891b0d7d8f5d53ecd

                                SHA1

                                ef865035d7076db8afcd678c3356a1ecd6730545

                                SHA256

                                13c8ab240c0a17e58968dbf7d1124a196dd8d783456d877d51b3a185a81a1630

                                SHA512

                                19a272b194ff2c6758a8dfac80829d00776a57da60cb9acfeef14b46b8027868a782f6aba724999e9ab0ed75c01bd100bae3fce2c4143290f80775af95f8d932

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007643001\GuidanceConnectors.exe
                                Filesize

                                741KB

                                MD5

                                211dd0cc3da148c5bc61389693fd284f

                                SHA1

                                75e6bd440e37240fee4bf7ae01109093490ac5a7

                                SHA256

                                645ee0535f2ada91b101c0029f2fb71de2a27c10a5446e84d3547968ea36eafe

                                SHA512

                                628bb927b5a85674ed1f762d4c42e8e9f55859cd626ab0f01b7d47ee4c74ff5775ceafc4a45864344d5dd13e588fe60b6a121b00dac79276689d0a9970d12e89

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007744001\Lumma111.exe
                                Filesize

                                1.8MB

                                MD5

                                90e700a3800b87f46cbbc37be3724fd5

                                SHA1

                                25e3645bca71b87dbec92b55e5648452ffca782a

                                SHA256

                                8cc02598acded7f8221865d08145297a9fc8162d626883fc9a72998c4a7f0da3

                                SHA512

                                f06adebcc7d454a31ff36a3c2e8eedfc0086a638c7ec0fea6c0b41035ee03c2e329f3cef0e001939cab243fcfaae07a634f7839dd0fbb31942a793439df4ea8d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007810001\dbc048db45.exe
                                Filesize

                                4.2MB

                                MD5

                                389910a7e7b0be062240be06d7ce5d31

                                SHA1

                                6c7f61dd43e11c3b5ee5bd21914ae5a9875adc7f

                                SHA256

                                f9fe7307aac94b1dcd354cb199243dad83dcb5c3cdf4b599e643e8321b916ef1

                                SHA512

                                231c854c70859b52f000f0a374d63077dfb00ee3af1ceabc76e53ffb289008d4a94df7dd0c6ab7482ca350ee6ee8f9ca79b20881534295a6ab7a0bfe545d66a0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007811001\a62ca644c7.exe
                                Filesize

                                1.7MB

                                MD5

                                a387bd34917033174622ded6a3bfd781

                                SHA1

                                4a83a6df052d479a8b9bfaf18c05e8bd3ad46989

                                SHA256

                                c53f5b4eb89cb540a70a6719be2bdbd18719c0acbb1363c9603d43d83a18dc9c

                                SHA512

                                99ba3da9056c4ae82acfd3ae9add555d00f1178e0c671cfb6931d872cbbfe32c27b788a90fb2ddc6dc1a1e35afedb67e45ec782fe5bc9f13b361e7a07e308ce4

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007812001\d59898f0c0.exe
                                Filesize

                                1.7MB

                                MD5

                                0157dd2ed057c6d60f978e502fbee0d8

                                SHA1

                                c55dfd3bf8e99c7925d83ac14e96b7eccec2383c

                                SHA256

                                f8806791549705d6be98d2b40314fd54bac69524369e3ff429c9d18b0acebd53

                                SHA512

                                8af621f9303824192ef1c2a8f3f94a5dc4eb4436ed14f0af970051928dba42e3ae17baea629b7889be2479dcb6ed265598ca4f73d47a59a449495427bfe327af

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007813001\594b095e48.exe
                                Filesize

                                901KB

                                MD5

                                4d01319f036290a237344700140e9dcb

                                SHA1

                                8a993be2e7474092b7565cbc11a5436d4a707d57

                                SHA256

                                f2d69993ab991c86827b9e87a737c9950912398dc17804147ab71aa5ab92568f

                                SHA512

                                bcea48fb76c13f286b44ca585b637602684cec479d2cb519e036ede16b9fadff518d2e3b37a0f1492e387f1bdbbd06895d16f3733fa492221a3a0b8221eb6030

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1007814001\3bbc33d809.exe
                                Filesize

                                2.7MB

                                MD5

                                61fe9ca456c2881848651738ab9f7148

                                SHA1

                                589e60d69861bcc653b86d76fcf2e56ccc808521

                                SHA256

                                b19e58f2f509590e8cb1f79218b9c0893130a929fcc21737b48f7238380c9c6d

                                SHA512

                                530bfa627ac2033ea6845031b1860e3d575ff8054a3406d3c41e12f75ccea510849a34681f3217d9ec72cf2b3fe847acba3e431f0885507967a1539918a6fa5f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\390641\B
                                Filesize

                                224KB

                                MD5

                                6aaa6156bca65c60437b9dcf21a8566e

                                SHA1

                                74c4917b5006a2af825ed9e9d3bdaff7884aa11c

                                SHA256

                                fe153e9df223598b0c2bba4c345b9680b52e1e5b1f7574d649e6af6f9d08be05

                                SHA512

                                02f8a158815b29cfbad62403b5177ea5e073d84103e640441d901e12b2fbc4f2cd113924d2b06b09cf045c99b58a5527f2c68e6a664d8015f646672c11567199

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\390641\Imposed.com
                                Filesize

                                921KB

                                MD5

                                78ba0653a340bac5ff152b21a83626cc

                                SHA1

                                b12da9cb5d024555405040e65ad89d16ae749502

                                SHA256

                                05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

                                SHA512

                                efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Accessing
                                Filesize

                                52KB

                                MD5

                                0487661a3be3e516ecf90432e0f1a65b

                                SHA1

                                548f56668cdfde2d71e714cd4e12e3a1419dfc31

                                SHA256

                                1dbfc503087ed424d8befd455c6554ba03aa4c4c5e77f7b388dc412b6a99a70e

                                SHA512

                                7f9027e567876bae2302652a2d63b457bc39f439ec6cd4d7d170423c5f27aa5b0479113b7d8c436cbc08ac76450b0e56c2d8dd42a219c7ad3dbbf693f935cf77

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Blade
                                Filesize

                                919KB

                                MD5

                                c09756dea58e68a563c05c98f2ee5822

                                SHA1

                                90675ae3c1a7f575dee20ceee5cbf3d761aee432

                                SHA256

                                0d43333d98724395292ff88d573ad31c6ff65a0ec117e3a605b1009478f91ac8

                                SHA512

                                c5b0bff60c4b44f62e224a58dbd508efb20f1324c85c62de13134f909a1cfd63349402d7472940992b6447685fbb665fd28929dc6693a5f3f1222173a8c477c7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Entire
                                Filesize

                                82KB

                                MD5

                                09d17ffb85794728c964c131c287c800

                                SHA1

                                a1d7a2dea5e0763de64fb28892786617d6340a86

                                SHA256

                                f913264e2aa6be78dae1261782f192ae4ef565439c5ad68a51c0397b33ee1475

                                SHA512

                                d174de399777b691443de3abff35dde5040d84ea06f252e86ec5b76bc2c02dc0c5c430f0ed9bab83a69e128a7cea989a1a24c6f579947e448db1cc393838b1d6

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Et
                                Filesize

                                32KB

                                MD5

                                0e9173e00715288b2d6b61407a5a9154

                                SHA1

                                c7ba999483382f3c3aba56a4799113e43c3428d5

                                SHA256

                                aa4685667dd6031db9c85e93a83679051d02da5a396a1ad2ef41c0bdf91baf66

                                SHA512

                                bb13d5de52ea0a0178f8474fceb7e9fc2d633baceacb4e057b976cac9131152076544891d0959fa22fe293eeee942ae0f6a2fdd3d3a4c050a39549baa2cb5ecd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Frequently
                                Filesize

                                8KB

                                MD5

                                283c7e0a2d03ff8afe11a62e1869f2e5

                                SHA1

                                235da34690349f1c33cba69e77ead2b19e08dbc9

                                SHA256

                                38582d3231748a788012e4c27a5ac0f54f9cb0467d60ecc247a31ea165edeef9

                                SHA512

                                b9ba42910d150ce9e07542a501c4134fb668f9b4af70db1ed8fa402066c8fb5025cf4bb29abd91c877571361e71c582e1e7c5350b28c7bda18d6bf184e85273e

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Peripherals
                                Filesize

                                58KB

                                MD5

                                6337b4a0ef79ecfc7a0e70beea5d5b5b

                                SHA1

                                904aaf86b183865a6337be71971148e4ef55d548

                                SHA256

                                024ad40c289bfdbea25aa7c319381595c700e6e9e92a951bc2e5df8a21382630

                                SHA512

                                9b88533915190062002702b2b632e648a94f086b987040d3f22f1bc718a2e58fbcb6d85a9ad17c8ee34018364cd9486d52bef91d645cfc3608aa3b592fca6b48

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\Version
                                Filesize

                                1KB

                                MD5

                                51c0f6eff2d7e54810b653329e530404

                                SHA1

                                52aef28dab5ba3202341fe2a34f64744f268b991

                                SHA256

                                a8f5d7c5caed37fa9f6dc432c1f854f32564d6cf0fec70f4bede96ba4df4dcdd

                                SHA512

                                ae804726dabe115186e5ccaf7827912b48517a8a4dea8bafa2d35286bc60cb1203cbe71b6936cc269bfa82c7037bacd79d9dbb586e49909fcb1d84e99e6f3fe7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                Filesize

                                1.8MB

                                MD5

                                3c271702f5eebc60e590f6803d8d2238

                                SHA1

                                488b5450a017ab4f78d50a1c5adb1c5b54643458

                                SHA256

                                ea5afba952c7c52e7ff10d775ceca244907b4699642dde81d0dca9d6814ce3d9

                                SHA512

                                de4dff6c44ebee7a5b3bc8060a39167343cc9e5fb7d6555ff72289c6ca7c9daf25bd8e19378430509329d20035f01f9d0d9a14b22e7d756621393b53233da935

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                                Filesize

                                6KB

                                MD5

                                fd3774c5c86ff62d2bd5286acc823700

                                SHA1

                                6d28e9e0204a643b4f6196840f79d97b1ce7a67b

                                SHA256

                                3fd3198a3c25baec34a9be486e31368f741ff0409df7b246adac9fd425ef28bc

                                SHA512

                                7fd6288048fb90ebfa4a45b1acda31a48ecca81702304ddaca650449f88133387110bed24bf61b55aa8061319f34921efc17a89312832f34ff2dbe53fa1a564a

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin
                                Filesize

                                8KB

                                MD5

                                79d35d246d2ef84f2b4977175986f19f

                                SHA1

                                08c5e725541597c83d72e1fd438ebb5fad8d8098

                                SHA256

                                e940295a8ac86039fb0c4efb63641298796729797c4c4041567ce36b112db72e

                                SHA512

                                3cd4598cc63018d26b87e08c35adf18584910f35aaeec734dcc747b8da912bf7a7d63d6fb5146eb690cc8c995302e131c366bc38cd48c9a29f37c188f1de8271

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                21KB

                                MD5

                                52ff04875851cb87ce9b0e8a7fc17dcf

                                SHA1

                                31b7f7bfc5dff6859f2ae942096f5b57af81cd39

                                SHA256

                                213e4a31be6494925a868682bfc9a0c32c54dd7f3cefb7259dfd69548b0e148f

                                SHA512

                                c8e72b60fd75b951066fc057f41ec9edfdbfd38ed38fe3061fcefe04e06d68bd27f863a7dfa2031f652c082d7c62531472db5e727a5d27604c0931f30cbd57eb

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                1d745fffa4cbb67bb58fc4c6a0086a9e

                                SHA1

                                2bae54f73de917f6c37bf14a30af2640cb9256c9

                                SHA256

                                9927206851fc98fbc8427f556297f8f088744820cf31b3bfd64aa911042cbc77

                                SHA512

                                d3464d50f9145303781305fb35fd45150576e0b2dc351b5c6291abffd3cf9c1792604241a51758651abdf4f8749acf4133f2703b81b587422455ebbc7874136e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                088d33f61e66898c10be30fa1a8d36ae

                                SHA1

                                27cdb8a5aef6c5e5a07e75082c23c524ae74bd82

                                SHA256

                                9eee5f86663950eeb5b14833287746c54aaf64accf70a2fa730cd60f1cf4d6a6

                                SHA512

                                0f87abb9bd983d12b5b39a986dbcbb3a952502ae13eaa7020211b5d942cdf9bc8cbf9775de279e67a62c7f7dc28f6ed29c02c6928301030e2d4b4fb97f3562d4

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                b783b1122320ea05c444d83cf3040720

                                SHA1

                                70710591160327a80d8e9db83afee7ee59a7059d

                                SHA256

                                a4449b6bf281be5e9399b9434b328494457b58c0c7e2909cf7b77866031da66c

                                SHA512

                                a350a1652ece5befdc157ec325bc79f8dd3596ef4d1e5fb175f56fa42e14064c47967a29992cc1afeefa5feb03e0ded8bd6d89b4048a0354e5c4379c6b305c83

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                22KB

                                MD5

                                522add3ba1b481c3019785b5b6b351d8

                                SHA1

                                5859bb5ed7952d3609fdbd46d7dd0e56af4248ad

                                SHA256

                                5e96706deee95afda13b82bfceac2db294006dc30eea7d5b4d2fc698cf191e51

                                SHA512

                                926e0a30fa2d899c6f990df2c7cc074813f304ca5d0bc050e6c5d550aafaf8dc0f924892cde239c100c4c18131d1387f1d6a02f13a508b54ff8a1c07bb6329be

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\502b4395-a080-43ab-9623-a3b97831b1a2
                                Filesize

                                659B

                                MD5

                                90cec85501e3ed6971e3c90e000cb578

                                SHA1

                                fdafc756784a836e378e1e034e38dee6d39b14b9

                                SHA256

                                d08514e42bf087718e90fea135ea53ce5b56b4336c3721382e1c1d863f3c61d8

                                SHA512

                                6d04ddf38067c1fff81febcc60b26f5e913b713b5cf2a3b8cc5fb4cc7ad91fef7555cdffcb0bbfbfce3461aa17a360242bad5af703f94bd0db744753d7621a16

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\86a90d31-2ce0-42ef-b131-6b59579ad241
                                Filesize

                                982B

                                MD5

                                19f2c875eb107783e29722957c133e22

                                SHA1

                                272658c4ccd1a095e3c4c701708ccb8a997e68c6

                                SHA256

                                e3de237f18711f43c388340668677530168a0553d9fee730756abdb3ad083684

                                SHA512

                                6538537a025713152727f9647540ba99e57b9ad52b851c327373c1e752fda28b920d93309c65bb885b1a82b2bcb59c0c4a4913389926b6d9ed0850e911814687

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                                Filesize

                                12KB

                                MD5

                                0c3d151ec04e8bf471cfc03f8c85d554

                                SHA1

                                f53bb7dc7f26a748f3a8c98c9ca8d0e932d06025

                                SHA256

                                402b951ee37dc16d4404a61ed9a2d621fb779a48f1e1887552600494032cb806

                                SHA512

                                6725242072b88de2bd58a09b8e25d21884ef6856c140a40761c0cc0e75a992e49d91aad0034b4cbb099cbdc1ade849fe03dc8c0ab86954951a0bc8e938e343be

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js
                                Filesize

                                15KB

                                MD5

                                6903b9b022f15fab27bfa2933210be80

                                SHA1

                                c66ca729f69240a11e7f84fdbb59d2e41711c580

                                SHA256

                                6e9c3ef1e4799d61425483031bddf27e362a2a4a168a57699d4df338da3fb6cd

                                SHA512

                                5534d159f5d03af06065ae58ad2e9ca307674e5608b31df76899341e8f3ae81a0545c65b2e5544102dbf5c661cf65d7642cb923044fbc663846f5edb6c8a7122

                                Download Submit

                              • \??\pipe\crashpad_3892_DFHTUVLXNSMLMCKS
                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                Download Submit

                              • memory/100-19-0x0000000000021000-0x000000000004F000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/100-245-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-3539-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-3535-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-3532-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-3522-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-836-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-3509-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-335-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-21-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-116-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-259-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-680-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-20-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-202-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-3465-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-2303-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-22-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-16-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-736-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/100-287-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/1708-0-0x0000000000C10000-0x00000000010D7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/1708-4-0x0000000000C10000-0x00000000010D7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/1708-3-0x0000000000C10000-0x00000000010D7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/1708-2-0x0000000000C11000-0x0000000000C3F000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/1708-18-0x0000000000C10000-0x00000000010D7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/1708-1-0x00000000778E4000-0x00000000778E6000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/2328-284-0x0000000000270000-0x000000000071B000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2328-283-0x0000000000270000-0x000000000071B000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2972-267-0x0000000000400000-0x000000000040B000-memory.dmp

                                Filesize

                                44KB

                                Download

                              • memory/2972-285-0x0000000000400000-0x000000000040B000-memory.dmp

                                Filesize

                                44KB

                                Download

                              • memory/3196-3544-0x00000000005F0000-0x0000000000602000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/3968-999-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-3513-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-340-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-303-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-724-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-3528-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-2325-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                Filesize

                                10.4MB

                                Download

                              • memory/3968-742-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-2798-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-339-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3968-3508-0x0000000000260000-0x0000000000EA4000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/4020-336-0x0000000000ED0000-0x000000000155C000-memory.dmp

                                Filesize

                                6.5MB

                                Download

                              • memory/4020-338-0x0000000000ED0000-0x000000000155C000-memory.dmp

                                Filesize

                                6.5MB

                                Download

                              • memory/4508-318-0x0000000000E60000-0x00000000012E4000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/4508-320-0x0000000000E60000-0x00000000012E4000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/4528-738-0x0000000000F10000-0x00000000011CC000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4528-709-0x0000000000F10000-0x00000000011CC000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4528-741-0x0000000000F10000-0x00000000011CC000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4528-713-0x0000000000F10000-0x00000000011CC000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4528-714-0x0000000000F10000-0x00000000011CC000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/4684-260-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/4684-266-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/4888-3530-0x00000000005F0000-0x0000000000602000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/4888-3531-0x00000000738D0000-0x0000000073A04000-memory.dmp

                                Filesize

                                1.2MB

                                Download

                              • memory/5944-2336-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/5964-3540-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/5964-3541-0x0000000000020000-0x00000000004E7000-memory.dmp

                                Filesize

                                4.8MB

                                Download