Overview

overview

10

Static

static

3

bba49d9c5a...b1.exe

windows7-x64

10

bba49d9c5a...b1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2024 02:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bba49d9c5a233f7916671750711049be4108a7ffae09e955bc9e90c03d2c4ab1.exe

  • Size

    1.8MB

  • MD5

    7e87644426bb54d86265dd3c83727973

  • SHA1

    5d7148bdfa59cdc79275e087aa0fc6a7659c2029

  • SHA256

    bba49d9c5a233f7916671750711049be4108a7ffae09e955bc9e90c03d2c4ab1

  • SHA512

    1e29caca935af25e29c9c5f5e927f97e1be70792300f2d5a8720e29e8de1647ee24ba4462ae13fd186d064feb83a64380a96ed202363a545c89a13dab9a08a9b

  • SSDEEP

    49152:3vkiCocWLaGUvpxuMjv1jVep2uqJAQNgLPRBfxBp8:3MiFGpjjv1xPzyRY

Score
10/10
amadeycryptbotstealc9c9aa5marscredential_accessdiscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\bba49d9c5a233f7916671750711049be4108a7ffae09e955bc9e90c03d2c4ab1.exe
    "C:\Users\Admin\AppData\Local\Temp\bba49d9c5a233f7916671750711049be4108a7ffae09e955bc9e90c03d2c4ab1.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1008595041\nig47lK.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3596
      • C:\Users\Admin\AppData\Local\Temp\1008596001\3f0d438fa2.exe
        "C:\Users\Admin\AppData\Local\Temp\1008596001\3f0d438fa2.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2948
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:5484
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff2f95cc40,0x7fff2f95cc4c,0x7fff2f95cc58
            5⤵
              PID:5552
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2276,i,7180587392691533292,3800601544344600220,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2272 /prefetch:2
              5⤵
                PID:5188
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1708,i,7180587392691533292,3800601544344600220,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2308 /prefetch:3
                5⤵
                  PID:5196
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1968,i,7180587392691533292,3800601544344600220,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2412 /prefetch:8
                  5⤵
                    PID:5204
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,7180587392691533292,3800601544344600220,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:3268
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,7180587392691533292,3800601544344600220,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3204 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:4880
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,7180587392691533292,3800601544344600220,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:2156
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5536
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:940
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 1692
                  4⤵
                  • Program crash
                  PID:3692
              • C:\Users\Admin\AppData\Local\Temp\1008597001\9791882ec9.exe
                "C:\Users\Admin\AppData\Local\Temp\1008597001\9791882ec9.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4224
              • C:\Users\Admin\AppData\Local\Temp\1008598001\0ddcad901c.exe
                "C:\Users\Admin\AppData\Local\Temp\1008598001\0ddcad901c.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3612
              • C:\Users\Admin\AppData\Local\Temp\1008599001\ff0ed4467b.exe
                "C:\Users\Admin\AppData\Local\Temp\1008599001\ff0ed4467b.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1384
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4568
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:940
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3080
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3972
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:64
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4528
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    5⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4592
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {373ef6f3-0180-40da-b782-e490eb2cdae5} 4592 "\\.\pipe\gecko-crash-server-pipe.4592" gpu
                      6⤵
                        PID:4792
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd550b40-0ef2-49de-b373-4aed33275bd8} 4592 "\\.\pipe\gecko-crash-server-pipe.4592" socket
                        6⤵
                          PID:2864
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2996 -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3108 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ff1edfb-8199-4cf7-a1c3-6d849d29e471} 4592 "\\.\pipe\gecko-crash-server-pipe.4592" tab
                          6⤵
                            PID:636
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3704 -childID 2 -isForBrowser -prefsHandle 3696 -prefMapHandle 1236 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e58153bf-097e-4ced-81f8-7b7166fc9aff} 4592 "\\.\pipe\gecko-crash-server-pipe.4592" tab
                            6⤵
                              PID:3296
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 856 -prefMapHandle 4208 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b096486-92aa-48ee-a47b-0df6cc2c48ad} 4592 "\\.\pipe\gecko-crash-server-pipe.4592" utility
                              6⤵
                              • Checks processor information in registry
                              PID:5172
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5028 -childID 3 -isForBrowser -prefsHandle 4992 -prefMapHandle 4996 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c9ddc15-ad66-4c81-976d-b6160b52f3f1} 4592 "\\.\pipe\gecko-crash-server-pipe.4592" tab
                              6⤵
                                PID:5828
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 4 -isForBrowser -prefsHandle 5280 -prefMapHandle 5288 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0cd2716-7a0d-46d7-af50-2e82090ea856} 4592 "\\.\pipe\gecko-crash-server-pipe.4592" tab
                                6⤵
                                  PID:5964
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5260 -childID 5 -isForBrowser -prefsHandle 5496 -prefMapHandle 5500 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1072 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2054377-8680-46a9-8438-a5a0d6936e67} 4592 "\\.\pipe\gecko-crash-server-pipe.4592" tab
                                  6⤵
                                    PID:5976
                            • C:\Users\Admin\AppData\Local\Temp\1008600001\56ea469ac6.exe
                              "C:\Users\Admin\AppData\Local\Temp\1008600001\56ea469ac6.exe"
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3804
                            • C:\Users\Admin\AppData\Local\Temp\1008601001\XbB7FCR.exe
                              "C:\Users\Admin\AppData\Local\Temp\1008601001\XbB7FCR.exe"
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:1404
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1772
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x140 0x2f4
                          1⤵
                            PID:1720
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:2540
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2948 -ip 2948
                              1⤵
                                PID:4492
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5696
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:3804
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4540
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2796

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Modify Authentication Process

                              1
                              T1556

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Authentication Process

                              1
                              T1556

                              Modify Registry

                              3
                              T1112

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Modify Authentication Process

                              1
                              T1556

                              Steal Web Session Cookie

                              1
                              T1539

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Query Registry

                              8
                              T1012

                              System Information Discovery

                              5
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
                                Filesize

                                27KB

                                MD5

                                f242fc8ba2c68c1ad2683b89aae41d66

                                SHA1

                                e085f73578624c223b5fa934cd8cc8bfb2350319

                                SHA256

                                5b128c5ee4bcbe88e5bbdafeb72a17ff60609f45b3fab6563e7d397c1e1130c4

                                SHA512

                                59af9788e947922ca0173c72ecc89e1de8bc746ae80e0363d23c17ba7810d357b06e0fdef2d7a2148143ecd0a4e3dfe811d568080753b0c6d558bdc201337009

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                                Filesize

                                13KB

                                MD5

                                4aa18380a8c7f986fb5fc134c660c46a

                                SHA1

                                e4ff0cfa6b40d2483ba05eb2ba1c63b0fa85b5a8

                                SHA256

                                870f53f5a5f53ad3d89bb0425223815cba63197831c164c5c1ed9e9e638d3b03

                                SHA512

                                bcf78577e94633dbd84d77408a10856544bce0c1ed93936c95a7c99fdd84695db8d7105a0273596880a473628860625773f4ab4f24043c9b95720cfc76313661

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008594001\Dy0G0Gp.exe
                                Filesize

                                612B

                                MD5

                                e3eb0a1df437f3f97a64aca5952c8ea0

                                SHA1

                                7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

                                SHA256

                                38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

                                SHA512

                                43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008595041\nig47lK.ps1
                                Filesize

                                1.2MB

                                MD5

                                a00d324c74f00710ced44b8c7f1a3561

                                SHA1

                                218364f5e378c73877815755538d99250bbef5e5

                                SHA256

                                86935c2a69aa7096890dd8b72291170dfd9a5d7b22f3a83e70b6e7afcc2d75d7

                                SHA512

                                5c37f908bed65f88707f1f6d837690c3f088d46d2bddf589ce9207daf500e446bbb3293fd9f673ed320d19a8cda47032742bef132eb46827c9b6e03f1d1269db

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008596001\3f0d438fa2.exe
                                Filesize

                                4.2MB

                                MD5

                                ce1c81d721906475fc878ebd26d09ad4

                                SHA1

                                2fd29c1c343af0ffc67441b448e8a101b7f7854e

                                SHA256

                                a80ca2e11b0eaa75711ca4b8a002d95f45e8dbaf41101e4dfc52b32ab5d9ddae

                                SHA512

                                af61993252d78e5da18d4826ba22e3496aebf9a14af715ff7034d9972b577b5ca4d75dfa0fab515e384dec5f74a27a53d4d25d9423500580f74dcd2c1b5be5ff

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008597001\9791882ec9.exe
                                Filesize

                                1.8MB

                                MD5

                                88a2e1dc5f57311dc42a7d57dc7d9827

                                SHA1

                                a26e33ea17b7d5ca3272e8a7521f141c927d1b75

                                SHA256

                                c2c829ba69f689fe392435d8b886c002e050d3bb4cc6ec8f62317ceaa7ba02da

                                SHA512

                                b4b2cdc31ced54f377e97f4b548dc128c6c7d1ee9888b6f2a5245b421f9673c9582c9a0a5981e7f70cfa1251e97672a9bec3a71b3d2bf7e7f09438a37ac69ae3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008598001\0ddcad901c.exe
                                Filesize

                                1.7MB

                                MD5

                                3feea8ff886f1fc0d57da4a2b3a109ba

                                SHA1

                                78d6302f4f09726b6a129c5fcc7cd94a474cc53a

                                SHA256

                                143e6525646d5d95639eb77420a54205cb02fb8624c6e1662b7460f58b03523f

                                SHA512

                                e5c107f29e9b2c58365df6e7cb3d7c38534e931147c92ade485f949751712ae63a375608b9cacb178593f5b25b58ebb5980b8abef3df459ea6e15d2b6f709e32

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008599001\ff0ed4467b.exe
                                Filesize

                                901KB

                                MD5

                                00ea2d526653b9beba2a5d4f3fadd366

                                SHA1

                                d41eb397685765a9ca5b973d69e60a666fb8ad4a

                                SHA256

                                0c85ff63c9613d92630d191fdd735eb0216bb64d0780e64e32e507b07a9b80b9

                                SHA512

                                459ef594400dfa1c2dc60fedd43d3a36f95a75d7f7658e2b620546b9efec44526e797b1d815c84886f5f56b4dca01a5c706069b9991533ceff0e8d3103024628

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008600001\56ea469ac6.exe
                                Filesize

                                2.7MB

                                MD5

                                92b22f14f1664cc7bb2f42daf6fd1799

                                SHA1

                                68a767dd4bcd60e310bafd7219749093bd013bc6

                                SHA256

                                85507d05a1da7659f9045ec2d969ddd0de20723fc7422b4985bd392411449fe8

                                SHA512

                                c4b30103cc0b0dff93b5deb61f7301f45b24054239592f4c2778c179312193dce01b06043885d5ff260424ad7c49bf8d18d48a9523deb1e7d7e12601745d513a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008601001\XbB7FCR.exe
                                Filesize

                                243KB

                                MD5

                                b73ecb016b35d5b7acb91125924525e5

                                SHA1

                                37fe45c0a85900d869a41f996dd19949f78c4ec4

                                SHA256

                                b3982e67820abc7b41818a7236232ce6de92689b76b6f152fab9ef302528566d

                                SHA512

                                0bea9890dbcd3afd2889d0e7c0f2746995169e7b424f58d4998c50bc49d2b37d30f5bd1845d3079b25f9963af2b71f136719cbd9fda37f7b85874992096b3e1d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wb4shzhv.qzm.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                Filesize

                                1.8MB

                                MD5

                                7e87644426bb54d86265dd3c83727973

                                SHA1

                                5d7148bdfa59cdc79275e087aa0fc6a7659c2029

                                SHA256

                                bba49d9c5a233f7916671750711049be4108a7ffae09e955bc9e90c03d2c4ab1

                                SHA512

                                1e29caca935af25e29c9c5f5e927f97e1be70792300f2d5a8720e29e8de1647ee24ba4462ae13fd186d064feb83a64380a96ed202363a545c89a13dab9a08a9b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                                Filesize

                                18KB

                                MD5

                                76affa05f53155c18181dc7a0ad50ab7

                                SHA1

                                1f31cecdcafcf0614a485a076c433252f087258b

                                SHA256

                                e71ef323cee84dcecd1c1b71ca7b465dab36e1613ded6cafbd3caab60a36aafd

                                SHA512

                                903c0fe8f57990a9119fc9caa759cbbf1a022d97a328d9e8803b7c4948c452a81d275abbec82278c110d439239675aa02eb0d41b8306c455c659ad932143347a

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                                Filesize

                                6KB

                                MD5

                                88863baa5d86ee948018f8134ad2c67a

                                SHA1

                                66b56b925800b8fdbbf983a91d1ae28448350679

                                SHA256

                                676a5a5337114cbd85a702bc0d890bb1203cfc601c1dfaebd9ead5b0221a9997

                                SHA512

                                293295a6e8c9156401c05187adc207edebcdb387fb23946231bb023136c70a44d5eacdeb842314643d2924dcf4bb2ca01a718af5c4b9cb6bff7ee844b874b243

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                                Filesize

                                8KB

                                MD5

                                db4d51c5aeafce472ad0787f4334005a

                                SHA1

                                f54df406e79473441c6fdc27bc464419acb700b4

                                SHA256

                                1eb35cd5605cd918a8d7df75c23b2ef3be116961dc400290f6d6b62756746077

                                SHA512

                                c09e7cbaf2dbfeb12a3e73166051bb82cc8abf247c73e38a2226b46150f189aebb316efbc46d5e7f966d4df71db6e54d541b27b57f3feb17261f1b0f8c38ed48

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                211e28969e296a5527398eac12aee2fc

                                SHA1

                                980272bf62532d596ad71509dbbcdebe309b40dc

                                SHA256

                                2ff7c386560d63bc8097da08ef972a538fbb8d2aec5cb00347f9daaf435c55eb

                                SHA512

                                af05fdcf3c428c35cfd1f8901789dbc85ee8b0d450af06f582d031d16a473a518f76cb58bf1ba2dc16d46edcd2e70e22b2639ac3066d32da0f600e07bfdde768

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                11a7723fcf9efb8cdc1879b678bd56e8

                                SHA1

                                1db1145ddb1bd2d476153639ceeb7960d4921cc8

                                SHA256

                                3834db3abd43e219278123b913e85ae9c66565dcf9b83687b2545c630ccb0259

                                SHA512

                                85fce6b5174356b1708edac363d8e20fc0afa16a17863c4e7b348b5eeb59967c14bd5277e119af7e42db3bb460838a493e662640b59fcb4db63d10dd2e09da19

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                e3a7f841de64ab3aa19b741a9cf8843d

                                SHA1

                                f3a6a23bd7a396dae9aeb034d0ecc175631336cf

                                SHA256

                                805e9add9e2535d9ad6ed3d01b4d42479fc119a27ececa5c3b398d544c68797c

                                SHA512

                                409b3a0ddc8108ab09a145e0ba207b0f089dcfe646744e4e98e460606ae2e248f8b79c8fe5c395ac7719f8f42e1553716bc64ef9dc36735a589c3b7c31558306

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                22KB

                                MD5

                                4fc5485c40c600516a658ab83b010e2f

                                SHA1

                                72f98f38a7012d081fe9016aa75dbeb1d3bd96a3

                                SHA256

                                99f23fb161a944d79d82adbc9dcdf33a12b6c7da322180fa4b82e58b23f560a4

                                SHA512

                                2e26a450b1ff9146a0ef0ea1c91b24a3abf19ff59fc4421b23f852dbb36754be09594de03c899f743c3a36ba80b0ce111863ba51786d086ed68965be505aa7a6

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                23KB

                                MD5

                                cc0db36acda13d06e98593d9ebc21329

                                SHA1

                                9b72a97537e2c3be99253935269fc8d5db4731a4

                                SHA256

                                6038954e210af658eac3ca96e0c21e7b9fd444e3fb8f42eafafce7286a4ebc10

                                SHA512

                                f8c305cddc23e82b337ac076dc5151541dc7deec88a383a082f29795bf457dac8d09d2c7e9b9f96eeb396dd612f98b0bd3851b9f5ac59bca67d68fc881151f77

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\c28f27da-4833-4fdc-aebd-b4a268a52d42
                                Filesize

                                982B

                                MD5

                                101ea4a1806d6600e9f66d90a1174a61

                                SHA1

                                65abe8709a82b54f469480a05658e8cfef8dd9c6

                                SHA256

                                d4d43df220096ee88c8beae2858e30f1c77ab35a7096367706409f2931e42696

                                SHA512

                                093d86955fd9145f916c4d2c93bd5e592a85c7d8eba77a781f95d45fa1a283cb1eed68dd311311aab8a1d333ec86ac7ba3c12d9e51ef99bda78d954df7c244cf

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\e0bdd069-b572-414c-83e4-411a147d3f7f
                                Filesize

                                659B

                                MD5

                                830ecefd449f1218fc1a31201ed1e88d

                                SHA1

                                7860e763f7bd659804269b1d7726a6a6024704a9

                                SHA256

                                d1ce88e330036b351739ffaab199df29521cece1107a06ebdc1a7042cf846fcb

                                SHA512

                                a047c8e48757c6d816921674bd0ecf93d698809274251ce1b589b404c0ed599c87f6f4002279ba98f8419db6296cfa2219195659c1e994f664977b707b64da9e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                Filesize

                                10KB

                                MD5

                                761eef4daa9a6102ee594ad28183400c

                                SHA1

                                6b7f878b9d99324aaae36dc842b3c79f36f53ea9

                                SHA256

                                05f5e154af2ef9c91a85343a1433f1a38ef3a086c53da32fdc4f1cf39329e1ed

                                SHA512

                                036115ad1998b598ff49ecffe78b949043d8b56502be1c06958ac8e444115a34f0894059f7696a8acb387368dee9d34360ade97393cb6e56ff11d21b3ea594da

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                Filesize

                                15KB

                                MD5

                                b7c9562d1d691c273edd1b358ed5c091

                                SHA1

                                01823b5c636ad111f519ede51874d274766bf6f6

                                SHA256

                                a572b422b805611d17cb81ecc51cb6e7759708e25092a013268b57b1a2f986b4

                                SHA512

                                fc88a425c87867ca2891dd9cce2cc2f1d4a69c80fba17a5058437bed8221098929368b5e130b41614dce5c4506d73b60b7c51863bb42489baf611413ebacdf64

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
                                Filesize

                                10KB

                                MD5

                                005ae5f64eee6351e335c68a0da36060

                                SHA1

                                6ca6ec90b2c9db992712d8433eefd5f71d63d869

                                SHA256

                                c6d1c1e13cb029c21db59395880428a010a4247dceef4e1a5d59709695665bb0

                                SHA512

                                bb24698ab5a3763daf76e9cd5ac22f29a1f612f944ab6da86cf5f7687e00e85e2b3e5c61db343730a46ebf3acc5de912eadf3787bad9268ddab47d98479036f6

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
                                Filesize

                                11KB

                                MD5

                                c4855f63fd7c1087f28b5371f0d8e65e

                                SHA1

                                5a71b0ed685e6e7110774195ad7b849ca072c590

                                SHA256

                                f2b2227e5083a9c6b08a10b1cd1e15fc27f69b609c0b1a2496eba6043575700f

                                SHA512

                                393ddd436ce9f5f5cd017b9f694e34a744adf89ee26af0c1a234b474e991a667adc741d41e9d7edc9b5c5e16806eab6a5b8df42bd75d9da6fb9bc35dc2b9626b

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
                                Filesize

                                15KB

                                MD5

                                7441a6462f34998698da12cd05e683e5

                                SHA1

                                a4657c5c645ff470d87b566c23a5eaa18a33a868

                                SHA256

                                6ddaf75c2755d686d043ce68f644ca10c9c017f1856980acd856c6a7a84ffc3d

                                SHA512

                                3f49519ca59eeb65cf9279598675ce75acaada33efbcb2cbb52da51dbb84d2d1391542ab082db7f6f492c47d3c8e4c5e55c9c19899ddae82f48f539aa939ae7c

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                Filesize

                                584KB

                                MD5

                                e63a64d3291e78c3f865fa2a835988e6

                                SHA1

                                1f29fb82e2ddcb0d3d4aa7d6948f2ca84cc466ff

                                SHA256

                                177eaee758f98e8d17585bba098de3ace051461202b290fe250b995e28a2f969

                                SHA512

                                399690f035974022b5b856a29d2f182015952e6eec48baac9ed612d158cad777988aeb8950e1e84d61623c34e2a287630b7c9057ad4cd98efe9b5640aa91458d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                Filesize

                                1.5MB

                                MD5

                                7942ed6ba0d97d7f47097540baea04c1

                                SHA1

                                6e71ca58ba0f6864e35e6e73338cecff3f4b2b21

                                SHA256

                                5c45b5a4259b05f331d370d3aca1b3b257c37a87a8575c98a3d6016bbee9c6af

                                SHA512

                                f1c49e613d4365154d92722fa30ca601177c9a514d53d7c0878e4e590a76f0c59e069b917165f0120a013060eb290301965aaa43ca213ab42fe2d0e38eac3881

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                Filesize

                                3.0MB

                                MD5

                                bcdb23329880aef8292ec60ea4d1f743

                                SHA1

                                79f3fdfceeaffe9b81f1a8bed7dd1bf781d14a08

                                SHA256

                                7d586be888c21096741f649fb2dc0630cd8de85214736762f25426478ac300b2

                                SHA512

                                38957d32e3c5597b938c62678c5f4151d04cdedd9bc79e8dab0a69733754f5996877d5d7a270f911e7e951952c6550f286c4a9f08ae30bc39d69153dd9afc0cc

                                Download Submit

                              • \??\pipe\crashpad_5484_UWNBKMMQZNKSUAGI
                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                Download Submit

                              • memory/1404-540-0x00000000374E0000-0x00000000374F0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/1772-27-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/1772-25-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/1772-24-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-62-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-19-0x0000000000DD1000-0x0000000000DFF000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/2696-154-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-2849-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-2498-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-64-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-1719-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-953-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-609-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-17-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-2858-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-2855-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-20-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-21-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-99-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-22-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-2861-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-36-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-2870-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-2873-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-37-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2696-595-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2796-2867-0x0000000000660000-0x0000000000672000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/2880-2-0x0000000000661000-0x000000000068F000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/2880-0-0x0000000000660000-0x0000000000B2B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2880-1-0x0000000077E54000-0x0000000077E56000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/2880-3-0x0000000000660000-0x0000000000B2B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2880-5-0x0000000000660000-0x0000000000B2B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2880-18-0x0000000000660000-0x0000000000B2B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/2948-100-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                Filesize

                                10.4MB

                                Download

                              • memory/2948-607-0x0000000000630000-0x0000000001272000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/2948-1073-0x0000000000630000-0x0000000001272000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/2948-136-0x0000000000630000-0x0000000001272000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/2948-126-0x0000000000630000-0x0000000001272000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/2948-768-0x0000000000630000-0x0000000001272000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/2948-82-0x0000000000630000-0x0000000001272000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/2948-557-0x0000000000630000-0x0000000001272000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/3596-45-0x0000000002920000-0x0000000002956000-memory.dmp

                                Filesize

                                216KB

                                Download

                              • memory/3596-61-0x0000000006280000-0x00000000062CC000-memory.dmp

                                Filesize

                                304KB

                                Download

                              • memory/3596-60-0x0000000006240000-0x000000000625E000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/3596-59-0x0000000005D50000-0x00000000060A4000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/3596-46-0x00000000053A0000-0x00000000059C8000-memory.dmp

                                Filesize

                                6.2MB

                                Download

                              • memory/3596-49-0x0000000005BE0000-0x0000000005C46000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/3596-48-0x0000000005B70000-0x0000000005BD6000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/3596-47-0x00000000059D0000-0x00000000059F2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/3612-124-0x0000000000450000-0x0000000000AE7000-memory.dmp

                                Filesize

                                6.6MB

                                Download

                              • memory/3612-125-0x0000000000450000-0x0000000000AE7000-memory.dmp

                                Filesize

                                6.6MB

                                Download

                              • memory/3804-174-0x0000000000520000-0x00000000007E0000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/3804-355-0x0000000000520000-0x00000000007E0000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/3804-354-0x0000000000520000-0x00000000007E0000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/3804-1112-0x0000000000660000-0x0000000000672000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/3804-606-0x0000000000520000-0x00000000007E0000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/3804-597-0x0000000000520000-0x00000000007E0000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/4224-127-0x0000000000BE0000-0x0000000001075000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4224-98-0x0000000000BE0000-0x0000000001075000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4540-2864-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/4540-2863-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/5536-1547-0x0000000073CC0000-0x0000000073DF4000-memory.dmp

                                Filesize

                                1.2MB

                                Download

                              • memory/5536-1546-0x0000000000660000-0x0000000000672000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/5696-1004-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download

                              • memory/5696-1026-0x0000000000DD0000-0x000000000129B000-memory.dmp

                                Filesize

                                4.8MB

                                Download