Analysis

  • max time kernel
    114s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2024 01:33

General

  • Target

    3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe

  • Size

    1.8MB

  • MD5

    79acf7954716778b95bce5d7892c2ab3

  • SHA1

    434c6dd4b4a6edaadc58e2dcdd0e7011c0735a92

  • SHA256

    3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366

  • SHA512

    57fd7a9e16bb501ade78a7ddec9ff786d40800e055cba7d0830c7f33f504f32deba9c23a1c0aae7ac64419ffda2d8ea4446af85c2e6eef0e7359799b119c8ebe

  • SSDEEP

    24576:9bUrK9XjlfMDRJ0sJ2h7EbPAoGl4UXN47WeG4W8jm4goiI1tLxM2mbDzznPE3U3P:9bpdBMDDlJA+TRmejLxPmbPcuL1lBbr

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2852
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3096
    • C:\Users\Admin\AppData\Local\Temp\3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe
      "C:\Users\Admin\AppData\Local\Temp\3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Users\Admin\AppData\Local\Temp\1008450001\5468191780.exe
          "C:\Users\Admin\AppData\Local\Temp\1008450001\5468191780.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1516
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4464
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1012
            4⤵
            • Program crash
            PID:5008
        • C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe
          "C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4332
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 536
            4⤵
            • Program crash
            PID:2212
        • C:\Users\Admin\AppData\Local\Temp\1008575001\2b1a83f255.exe
          "C:\Users\Admin\AppData\Local\Temp\1008575001\2b1a83f255.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:380
        • C:\Users\Admin\AppData\Local\Temp\1008576001\8c1efd131a.exe
          "C:\Users\Admin\AppData\Local\Temp\1008576001\8c1efd131a.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2360
        • C:\Users\Admin\AppData\Local\Temp\1008577001\8bc5824b0e.exe
          "C:\Users\Admin\AppData\Local\Temp\1008577001\8bc5824b0e.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4136
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4180
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2268
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4284
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1684
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:736
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3404
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:1584
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fc6d938-baee-4bdb-b19c-5777e39eca6c} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" gpu
                6⤵
                  PID:916
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac24e794-ec8a-4cbf-b229-290f74981536} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" socket
                  6⤵
                    PID:3312
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2968 -childID 1 -isForBrowser -prefsHandle 3488 -prefMapHandle 3484 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7175724-5410-4d34-a727-a0208cb49077} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab
                    6⤵
                      PID:4772
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3516 -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cda1bf25-41cc-4582-a506-79544b06e349} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab
                      6⤵
                        PID:4924
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4596 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 4824 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f01223c5-07d1-4444-ba60-4497a72a1389} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" utility
                        6⤵
                        • Checks processor information in registry
                        PID:5480
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5140 -childID 3 -isForBrowser -prefsHandle 5240 -prefMapHandle 5236 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b85551b-7b77-4f1a-835b-405084b814f2} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab
                        6⤵
                          PID:5992
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61ad1b2c-9f79-432a-9442-be0811cb59ae} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab
                          6⤵
                            PID:6004
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {226026d7-c327-4402-84f5-eb3df6cfdfb0} 1584 "\\.\pipe\gecko-crash-server-pipe.1584" tab
                            6⤵
                              PID:6016
                      • C:\Users\Admin\AppData\Local\Temp\1008578001\69ef8805d7.exe
                        "C:\Users\Admin\AppData\Local\Temp\1008578001\69ef8805d7.exe"
                        3⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5096
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1008579041\x0xqqzB.ps1"
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5796
                      • C:\Users\Admin\AppData\Local\Temp\1008581001\Pftmzoi.exe
                        "C:\Users\Admin\AppData\Local\Temp\1008581001\Pftmzoi.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:5216
                      • C:\Users\Admin\AppData\Local\Temp\1008582001\baec90ac70.exe
                        "C:\Users\Admin\AppData\Local\Temp\1008582001\baec90ac70.exe"
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Checks processor information in registry
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5820
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                          4⤵
                          • Uses browser remote debugging
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          PID:5380
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa047dcc40,0x7ffa047dcc4c,0x7ffa047dcc58
                            5⤵
                              PID:1608
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:2
                              5⤵
                                PID:3632
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1852,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2000 /prefetch:3
                                5⤵
                                  PID:3652
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2452 /prefetch:8
                                  5⤵
                                    PID:5716
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
                                    5⤵
                                    • Uses browser remote debugging
                                    PID:5816
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:1
                                    5⤵
                                    • Uses browser remote debugging
                                    PID:5828
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,16947121543556369521,10301125221097345415,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4556 /prefetch:1
                                    5⤵
                                    • Uses browser remote debugging
                                    PID:736
                                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:5444
                                • C:\Windows\SysWOW64\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1812
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 1816
                                  4⤵
                                  • Program crash
                                  PID:5984
                              • C:\Users\Admin\AppData\Local\Temp\1008583001\bDHVlW2.exe
                                "C:\Users\Admin\AppData\Local\Temp\1008583001\bDHVlW2.exe"
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5344
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1516 -ip 1516
                            1⤵
                              PID:528
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4332 -ip 4332
                              1⤵
                                PID:2832
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2248
                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                1⤵
                                  PID:2028
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1652
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5820 -ip 5820
                                  1⤵
                                    PID:2272

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

                                    Filesize

                                    13KB

                                    MD5

                                    6623a60b0acdb5fb2ce5e7be21fe87aa

                                    SHA1

                                    1264cfd75b2f18dd5d184e7734d6f8525ce0fc1c

                                    SHA256

                                    838e436e1c2be50025486aab443fef2f169c60ad88eaeaacac0d28fca294f021

                                    SHA512

                                    1e56cc85a9f35ebebe5cec200055720cb9f09539b5291bbcffe4f1491b8ae15919abcbd26a3f1dfa4bde482f24f6abf893366a9c01e2c49b00a20bce12cadff2

                                  • C:\Users\Admin\AppData\Local\Temp\1008450001\5468191780.exe

                                    Filesize

                                    649KB

                                    MD5

                                    e7aa83909ace3906ec75144cc33e024c

                                    SHA1

                                    333ee9d7f4c683d8e0ed05bdadfbd2baade379e3

                                    SHA256

                                    24443cd457177eeed9c584e5d5ad194303fd94269fdb0d72e0db598215a5c826

                                    SHA512

                                    508fd7984ea8b9d8c8b2cd3c7c3587941a6ee4627c7cf54fe56db7db75dbff0abdaf0db1b0c46876dc6ad0cc21735bd7a2f0351d5edeb735b2de796beef2ea72

                                  • C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe

                                    Filesize

                                    1.9MB

                                    MD5

                                    4cecb04d97630cc2d5cce80368b87fdd

                                    SHA1

                                    4f693736497e06c820b91597af84c6fece13408b

                                    SHA256

                                    51698570a9c637ec0c9bc2b3ca6acb7edf3d7804c49b8eed33e82573950877dd

                                    SHA512

                                    acdf93d12791a6a11b307fbbdc6df2b27a6e8de6b8cc015c4892304d4653e79ac58351600b53c7ea78d285d69df8e8f2e270cf9a168b187d372a3de17e84ec66

                                  • C:\Users\Admin\AppData\Local\Temp\1008575001\2b1a83f255.exe

                                    Filesize

                                    1.8MB

                                    MD5

                                    89a84eb8a83e3072365849af60f40dcc

                                    SHA1

                                    0d22977f6a49a60619e8fca8297ef92cab0ce52c

                                    SHA256

                                    6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6

                                    SHA512

                                    24c2151099b4bcd7b20c56d6e2267551b58b92714ccdae10163f611987d06bca9049c2154412943b42f7d758fe83179b357846fcde382dd6c3e066828bcb4b42

                                  • C:\Users\Admin\AppData\Local\Temp\1008576001\8c1efd131a.exe

                                    Filesize

                                    1.7MB

                                    MD5

                                    f5634fe84a0d50da553341dd8b70f55b

                                    SHA1

                                    ee0ce0583edd4b0093709fb1be3aba975e4f7780

                                    SHA256

                                    33ec7d97e387a484ca822a25143b5d01ddce8ab813200719537702f0931f9e87

                                    SHA512

                                    2211675f740494a7f34971a475281608aeccda6615ec5b709711be3b5e079fa6f64608680ff9ee483c1b2e1a8270c3510c2940a5af4a2563ef12c764ef72dc6c

                                  • C:\Users\Admin\AppData\Local\Temp\1008577001\8bc5824b0e.exe

                                    Filesize

                                    900KB

                                    MD5

                                    163c161c40d81abcf7762b5fe1e069f9

                                    SHA1

                                    69abfd5ffb416aba8ec059fd0b10b90a15f1d6e2

                                    SHA256

                                    e18eabddf7ffd031c8d469f61ef79a69c7ed5fc4c0b0b083f352306c19a53b1d

                                    SHA512

                                    d7aeed672a002d87bc8776e3cbc574e0f336b8152f199cdeeeba845054239f57c3468758205abcd29716e6c4f35a23cbec8a57d93e372b1c9b258d80623e2669

                                  • C:\Users\Admin\AppData\Local\Temp\1008578001\69ef8805d7.exe

                                    Filesize

                                    2.7MB

                                    MD5

                                    f2742a9288b543dfd082fe555fc135e7

                                    SHA1

                                    3324370e94527fcf80ef571f9c1819d59b0b2f23

                                    SHA256

                                    dace3504559fca2ba342fa83836e916775514060f4772cdeb263b91906a23d46

                                    SHA512

                                    8bcd629e3d52f6f89b068169717d060be2a2fad5230d86e5b1844a3c55d8e0830bf331a92d7f6e1e88f2f8b876823f0d9dfcc77f98f6db1ed86fd8daa1c8ad23

                                  • C:\Users\Admin\AppData\Local\Temp\1008579041\x0xqqzB.ps1

                                    Filesize

                                    612B

                                    MD5

                                    e3eb0a1df437f3f97a64aca5952c8ea0

                                    SHA1

                                    7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

                                    SHA256

                                    38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

                                    SHA512

                                    43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

                                  • C:\Users\Admin\AppData\Local\Temp\1008581001\Pftmzoi.exe

                                    Filesize

                                    307KB

                                    MD5

                                    2699448f43fe2a97c2cf07bf56fe92f3

                                    SHA1

                                    672e4bdd08082c99ed7adba3799288c22f50338e

                                    SHA256

                                    a4ac352fe49d6162961007d64b2ac23413cc5575ea17b61a91f6d808795e994b

                                    SHA512

                                    8cb00120efae52c666235edbc33412cbac8e731fd247340ed76b4ca10602532bbf97bb9b81e8af7d348e65598f4847dc59db761afc470c0ee10f1426a564aa9d

                                  • C:\Users\Admin\AppData\Local\Temp\1008582001\baec90ac70.exe

                                    Filesize

                                    4.2MB

                                    MD5

                                    ce1c81d721906475fc878ebd26d09ad4

                                    SHA1

                                    2fd29c1c343af0ffc67441b448e8a101b7f7854e

                                    SHA256

                                    a80ca2e11b0eaa75711ca4b8a002d95f45e8dbaf41101e4dfc52b32ab5d9ddae

                                    SHA512

                                    af61993252d78e5da18d4826ba22e3496aebf9a14af715ff7034d9972b577b5ca4d75dfa0fab515e384dec5f74a27a53d4d25d9423500580f74dcd2c1b5be5ff

                                  • C:\Users\Admin\AppData\Local\Temp\1008583001\bDHVlW2.exe

                                    Filesize

                                    243KB

                                    MD5

                                    b73ecb016b35d5b7acb91125924525e5

                                    SHA1

                                    37fe45c0a85900d869a41f996dd19949f78c4ec4

                                    SHA256

                                    b3982e67820abc7b41818a7236232ce6de92689b76b6f152fab9ef302528566d

                                    SHA512

                                    0bea9890dbcd3afd2889d0e7c0f2746995169e7b424f58d4998c50bc49d2b37d30f5bd1845d3079b25f9963af2b71f136719cbd9fda37f7b85874992096b3e1d

                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_21hpex15.art.ps1

                                    Filesize

                                    60B

                                    MD5

                                    d17fe0a3f47be24a6453e9ef58c94641

                                    SHA1

                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                    SHA256

                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                    SHA512

                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                    Filesize

                                    1.8MB

                                    MD5

                                    79acf7954716778b95bce5d7892c2ab3

                                    SHA1

                                    434c6dd4b4a6edaadc58e2dcdd0e7011c0735a92

                                    SHA256

                                    3bec207b81081aa2600ef8e1d02f236b14d24722fe3360ac52cb1b69266ed366

                                    SHA512

                                    57fd7a9e16bb501ade78a7ddec9ff786d40800e055cba7d0830c7f33f504f32deba9c23a1c0aae7ac64419ffda2d8ea4446af85c2e6eef0e7359799b119c8ebe

                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                    Filesize

                                    479KB

                                    MD5

                                    09372174e83dbbf696ee732fd2e875bb

                                    SHA1

                                    ba360186ba650a769f9303f48b7200fb5eaccee1

                                    SHA256

                                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                    SHA512

                                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                    Filesize

                                    13.8MB

                                    MD5

                                    0a8747a2ac9ac08ae9508f36c6d75692

                                    SHA1

                                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                                    SHA256

                                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                    SHA512

                                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

                                    Filesize

                                    6KB

                                    MD5

                                    c0d2831bebcdd3e970ffaa1698aaeabd

                                    SHA1

                                    367d0865afe75910dc10c5ddb867b881d92febf8

                                    SHA256

                                    2a02c72f3b5a1668a8879de9e147683a0a2507a6a0b07a910fdb538d3ff4bc5e

                                    SHA512

                                    f324ddf5f51a9cf9adc1e61930493969c47b3f4e5e92250f44c7a097b1a7c01852985671740488999b87b3e86b205f23d07b87e71f7166c5efdacc092c31294d

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\AlternateServices.bin

                                    Filesize

                                    6KB

                                    MD5

                                    453dc57ff540ce6696e80c295a19af43

                                    SHA1

                                    00deb4b71228bddd6dd13dfb1cd58ac0adf10ad2

                                    SHA256

                                    7b25015c02eed19a0d0391dc47b88e0c735e6a201b20a2fc8959efd88ed63740

                                    SHA512

                                    43811f72bc2b233cc0c9e083f8207f105c464382d703d0c9c271566e43513b032104206c9848e5a8b6e9c39aa7a19f4ba37c1c4c23a87335c73fa34d1c054c1e

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

                                    Filesize

                                    22KB

                                    MD5

                                    c89ae25bbd5bf468dcc262217714caa5

                                    SHA1

                                    2ca42d4962c7734665fcea4452a299ebab4fee9f

                                    SHA256

                                    c94add620161a4d2edcbfec108352c1bc23ee8625181bdf8a5c3f6d1c8ca01d2

                                    SHA512

                                    3b6888133598329723b3b59119c31faeeab61792dfd595e2f5c927ab45aba245df9196e8dc78ed4b6454886bbe805e553a0ed7ef3fd1e7709ce8302b062f1a9f

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

                                    Filesize

                                    22KB

                                    MD5

                                    186601dabd95e19c42dbbce3875ec0fa

                                    SHA1

                                    88f31940c9115fe544992c13e5ea4c28c1508ad0

                                    SHA256

                                    585caa5393ddefc649a43bd7c85b8177bc80ee192837214bb94b9d1e04ff481b

                                    SHA512

                                    f409d9b4877475c61d0a68bfefa6ebfa085934529d7914d560ba3d2b2d1e433c8c99ca9aa78c0435f24a654757b69d37d3ddcc23061b87b65844a219645ebb61

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

                                    Filesize

                                    25KB

                                    MD5

                                    7d7a7fdcf333c63c8f77d61cee93669e

                                    SHA1

                                    46900646d7c52152c82c06ba57fa1ebbc052ab1e

                                    SHA256

                                    f03626aa33fd49dbccfa6f9642b43357d9289574615433e61c8b50ff09b4ebad

                                    SHA512

                                    c57a9f2bd4c3c62b1bc28da45b3b76ab472af8ffd4ecfdd69dbf15735edafaa7be88c7ec8148450d1b4222c95b2d463837caca530a70a1fafa32441a657271f7

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

                                    Filesize

                                    21KB

                                    MD5

                                    58057185e06fd1142441fbdbb0885c84

                                    SHA1

                                    54850f10b3eb7409fbb572664196b2e54715ede7

                                    SHA256

                                    c944a3b8896328a36a505a9a62c5f3b4c96ff66e85c1a6c43195ddde9271bff0

                                    SHA512

                                    e71de507c25662e74e78f0a59f5d491bc892bcd7e85d6ae082761a793347c4ef44040cfe6da57a88e1a854f0f18b0d0296cbea54846d438a5fe762eed03a0b60

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

                                    Filesize

                                    22KB

                                    MD5

                                    b0d99d467313e78f41fa3f988dedce22

                                    SHA1

                                    1dee575276dd52d2bb799607a8eae8e36a4cf294

                                    SHA256

                                    1a9670031e91ff843f309e52d25b648ad038059842b7ba210329d2f69dd21cb2

                                    SHA512

                                    9d1932ac093e874f47da7e121efd3ce0133c8c0d5b8bfbe192072313e6726af8efa6659dcf8c0719ab24c8f37bd06f57426a2cf0ffa3fbbfdea225339b30d110

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\6814b9b9-68fd-4461-86c0-1cc735c4dee7

                                    Filesize

                                    659B

                                    MD5

                                    adc77c5c3304b8d04c5b582e9c68d77b

                                    SHA1

                                    fd896b3838bb0476b3bfd4c5ed694ffdb7357a04

                                    SHA256

                                    6627cbfa6445f38580e8b14ae0b7ac7f225055c53180e87e612cfda262d51d20

                                    SHA512

                                    93737d744d6506bd7a1aff4bbae76e207ec961e896b98b14abcdcd30ae51266fba41d0ac84f92885998ec161f94d43490ac930d6be0d56cac81c5a073b409501

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\8a7b5b5c-1e79-493b-a87c-8b5589affbb5

                                    Filesize

                                    982B

                                    MD5

                                    0ed05981ee29c4c647e868ca23919d83

                                    SHA1

                                    b02206584d6836f0509f86c0502134ff5436a52c

                                    SHA256

                                    8140e5a5bb99840a2d91ee982515b703e4fc60114a292989ef65848c269a420e

                                    SHA512

                                    240228d087e636a68aa85c954b175d442682e58a93beafaf9674a3214b5a13b77158c7c50d906f709ca18a14a7e36613741320be246e886c4c8503ad65f280d9

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                    Filesize

                                    1.1MB

                                    MD5

                                    842039753bf41fa5e11b3a1383061a87

                                    SHA1

                                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                    SHA256

                                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                    SHA512

                                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                    Filesize

                                    116B

                                    MD5

                                    2a461e9eb87fd1955cea740a3444ee7a

                                    SHA1

                                    b10755914c713f5a4677494dbe8a686ed458c3c5

                                    SHA256

                                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                    SHA512

                                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                    Filesize

                                    372B

                                    MD5

                                    bf957ad58b55f64219ab3f793e374316

                                    SHA1

                                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                    SHA256

                                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                    SHA512

                                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                    Filesize

                                    17.8MB

                                    MD5

                                    daf7ef3acccab478aaa7d6dc1c60f865

                                    SHA1

                                    f8246162b97ce4a945feced27b6ea114366ff2ad

                                    SHA256

                                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                    SHA512

                                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

                                    Filesize

                                    11KB

                                    MD5

                                    a433d713272a17669089cc0492aacd18

                                    SHA1

                                    dd594b0fd1c06be46e5609f3df2f298daadaa01d

                                    SHA256

                                    3bb3d016015b3beda081ed5522a6913890c4d49b7641ef6f35db4d15b22c75fe

                                    SHA512

                                    f25155cc5dfed99bf48388b0f1cdf09c91107f75f84e8dd67beed4a6abcaed87627682c381f26dd23849bd2031995a3f6f26238eb99bb74b7cbdf4f353e19c14

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

                                    Filesize

                                    14KB

                                    MD5

                                    9b65e831d6c778808be0f8a64bdba940

                                    SHA1

                                    80812314fe87b8ee4984bf5253de7b44d4d1e95f

                                    SHA256

                                    30271711ba4a7402c2b089643add3bdcf189aae9c18b0df9bdce7501ba3a583a

                                    SHA512

                                    faec60e4b5c0890e4360116b71ffad57972359bb5eeb882acd6ad57fa6aef71d952f89e127aa5f429a77f06949202e7fac34a0049ec7cf09dbb21842abe5869e

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

                                    Filesize

                                    10KB

                                    MD5

                                    6ab2fbb7f446cb8e8f2cfa1a979699f4

                                    SHA1

                                    9a84173e9e6632773b52a088be43c618e88389f2

                                    SHA256

                                    9b7cd1db78c5ff9a0a89b474445b2eedbc156dae2d04c64ac20adb721c301087

                                    SHA512

                                    b361b8498cd228164cb9b7815809e9fe0f86c3dfa9f0ce4fc2e31e0e23f5462b88568c61c265f3421aaa13684ac81f64696c19791a228a2efee933656c8e5776

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js

                                    Filesize

                                    10KB

                                    MD5

                                    d6cf7c81a644dd57b682b2f512bb446a

                                    SHA1

                                    f537cf3003e75caea618e555986d8ded09fc3c6c

                                    SHA256

                                    2ab8c490b65f146af82fcbe1e8bd2ce94f2acf617ccaf8c5f45c74e855588ee9

                                    SHA512

                                    9f2825b1d06f3f5700633f13ff26d5a819fc8b2fa40c5d12996518b244396c1e97d54efa804564f20c010cfc4272041b8c41fd2700ddd7400002270a3d18d3f5

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs.js

                                    Filesize

                                    10KB

                                    MD5

                                    2eff18b969286db0c513981efe6d4229

                                    SHA1

                                    b1b74fbb489ba45cd3626c3b5875dad1db2a294c

                                    SHA256

                                    2a9db7507688d5999534a798aade495b3155a546f1d446e1e86481a7d5dbd33a

                                    SHA512

                                    678e178076cc2151ba6c854608c912cdf63a0c77cc9e23a72b2adad5881c0a70ee357269da5892599c4cbd1f94eca0cb14479cb36b1289ae9a185830a75410f5

                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                    Filesize

                                    912KB

                                    MD5

                                    0f1bb510579ca1a8a694b2a8bd4ee584

                                    SHA1

                                    742905e0f3750e90be75ffc5eba3b31b5ec6e379

                                    SHA256

                                    f91fc1932a647f0cb51420a22f51b2183abaaf5d2182ae98da1fc4eec1b1dd5f

                                    SHA512

                                    487dcb158adc4d2b53fafe1351c7b617440970cd20f197a6df07d894e121a6e63087a1a78b748a26e8d4a08ef821694e0c03a5ac3aa4fdceff89648023670375

                                  • C:\Users\Admin\AppData\Roaming\gdi32.dll

                                    Filesize

                                    401KB

                                    MD5

                                    3535fcd3063a2965f1dd8f9b65ca8355

                                    SHA1

                                    1f5c89caf911a08415d55ce1687101b65871b122

                                    SHA256

                                    086057602eec63ed064bd97c1643b20c727aa4a557d16bd26a763716414620fe

                                    SHA512

                                    9b623500ffbe25d6dc08c3c90aeb8c123e9fc2841f0962b6fe57ca1d2ab44fb1062352e1d5ab1d506b156c0b25aaf96ca6267a36fd064c97c12df965bcd66929

                                  • memory/380-106-0x0000000000C90000-0x0000000001140000-memory.dmp

                                    Filesize

                                    4.7MB

                                  • memory/380-124-0x0000000000C90000-0x0000000001140000-memory.dmp

                                    Filesize

                                    4.7MB

                                  • memory/1076-1705-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-18-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-55-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-994-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-58-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-1063-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-125-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-425-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-56-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-588-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-3285-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-682-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-21-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-20-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-19-0x0000000000391000-0x00000000003BF000-memory.dmp

                                    Filesize

                                    184KB

                                  • memory/1076-57-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-2815-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1076-3300-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1516-40-0x000000007362E000-0x000000007362F000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1516-41-0x0000000000A60000-0x0000000000B0C000-memory.dmp

                                    Filesize

                                    688KB

                                  • memory/1516-42-0x00000000014F0000-0x00000000014F6000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/1652-2194-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/1652-2171-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/2248-148-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/2248-147-0x0000000000390000-0x0000000000850000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/2360-127-0x0000000000BB0000-0x000000000123F000-memory.dmp

                                    Filesize

                                    6.6MB

                                  • memory/2360-122-0x0000000000BB0000-0x000000000123F000-memory.dmp

                                    Filesize

                                    6.6MB

                                  • memory/3096-86-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

                                    Filesize

                                    2.0MB

                                  • memory/3096-88-0x0000000075D40000-0x0000000075F55000-memory.dmp

                                    Filesize

                                    2.1MB

                                  • memory/3096-85-0x0000000001400000-0x0000000001800000-memory.dmp

                                    Filesize

                                    4.0MB

                                  • memory/3096-83-0x0000000000E30000-0x0000000000E3A000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/4332-77-0x0000000000980000-0x0000000000E3E000-memory.dmp

                                    Filesize

                                    4.7MB

                                  • memory/4332-82-0x0000000075D40000-0x0000000075F55000-memory.dmp

                                    Filesize

                                    2.1MB

                                  • memory/4332-80-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

                                    Filesize

                                    2.0MB

                                  • memory/4332-79-0x0000000005360000-0x0000000005760000-memory.dmp

                                    Filesize

                                    4.0MB

                                  • memory/4332-78-0x0000000005360000-0x0000000005760000-memory.dmp

                                    Filesize

                                    4.0MB

                                  • memory/4332-90-0x0000000000980000-0x0000000000E3E000-memory.dmp

                                    Filesize

                                    4.7MB

                                  • memory/4464-54-0x0000000073630000-0x000000007368C000-memory.dmp

                                    Filesize

                                    368KB

                                  • memory/4464-50-0x0000000073630000-0x000000007368C000-memory.dmp

                                    Filesize

                                    368KB

                                  • memory/4464-49-0x0000000073630000-0x000000007368C000-memory.dmp

                                    Filesize

                                    368KB

                                  • memory/4816-17-0x0000000000CA0000-0x0000000001160000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/4816-4-0x0000000000CA0000-0x0000000001160000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/4816-3-0x0000000000CA0000-0x0000000001160000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/4816-2-0x0000000000CA1000-0x0000000000CCF000-memory.dmp

                                    Filesize

                                    184KB

                                  • memory/4816-0-0x0000000000CA0000-0x0000000001160000-memory.dmp

                                    Filesize

                                    4.8MB

                                  • memory/4816-1-0x0000000077A14000-0x0000000077A16000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/5096-180-0x0000000000C00000-0x0000000000EBE000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/5096-179-0x0000000000C00000-0x0000000000EBE000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/5096-546-0x0000000000C00000-0x0000000000EBE000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/5096-561-0x0000000000C00000-0x0000000000EBE000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/5096-176-0x0000000000C00000-0x0000000000EBE000-memory.dmp

                                    Filesize

                                    2.7MB

                                  • memory/5344-630-0x0000000035A50000-0x0000000035A60000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/5444-3302-0x00000000733B0000-0x00000000734E4000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/5444-3301-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/5796-503-0x0000000007670000-0x000000000767E000-memory.dmp

                                    Filesize

                                    56KB

                                  • memory/5796-496-0x00000000076E0000-0x0000000007776000-memory.dmp

                                    Filesize

                                    600KB

                                  • memory/5796-421-0x0000000005130000-0x0000000005152000-memory.dmp

                                    Filesize

                                    136KB

                                  • memory/5796-454-0x000000006FE60000-0x000000006FEAC000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/5796-453-0x00000000070B0000-0x00000000070E2000-memory.dmp

                                    Filesize

                                    200KB

                                  • memory/5796-464-0x00000000066E0000-0x00000000066FE000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/5796-423-0x0000000005A20000-0x0000000005A86000-memory.dmp

                                    Filesize

                                    408KB

                                  • memory/5796-413-0x0000000005280000-0x00000000058A8000-memory.dmp

                                    Filesize

                                    6.2MB

                                  • memory/5796-506-0x00000000076B0000-0x00000000076B8000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/5796-505-0x00000000076C0000-0x00000000076DA000-memory.dmp

                                    Filesize

                                    104KB

                                  • memory/5796-504-0x0000000007680000-0x0000000007694000-memory.dmp

                                    Filesize

                                    80KB

                                  • memory/5796-424-0x0000000005A90000-0x0000000005AF6000-memory.dmp

                                    Filesize

                                    408KB

                                  • memory/5796-438-0x0000000005B00000-0x0000000005E54000-memory.dmp

                                    Filesize

                                    3.3MB

                                  • memory/5796-465-0x00000000070F0000-0x0000000007193000-memory.dmp

                                    Filesize

                                    652KB

                                  • memory/5796-497-0x0000000007640000-0x0000000007651000-memory.dmp

                                    Filesize

                                    68KB

                                  • memory/5796-412-0x0000000004B20000-0x0000000004B56000-memory.dmp

                                    Filesize

                                    216KB

                                  • memory/5796-445-0x0000000006110000-0x000000000615C000-memory.dmp

                                    Filesize

                                    304KB

                                  • memory/5796-444-0x00000000060D0000-0x00000000060EE000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/5796-490-0x00000000074A0000-0x00000000074AA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/5796-480-0x0000000007250000-0x000000000726A000-memory.dmp

                                    Filesize

                                    104KB

                                  • memory/5796-479-0x0000000007B00000-0x000000000817A000-memory.dmp

                                    Filesize

                                    6.5MB

                                  • memory/5820-1600-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/5820-1039-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/5820-2700-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/5820-943-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/5820-3284-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/5820-671-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                    Filesize

                                    10.4MB

                                  • memory/5820-3296-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/5820-680-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/5820-681-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB

                                  • memory/5820-587-0x0000000000640000-0x0000000001282000-memory.dmp

                                    Filesize

                                    12.3MB