Overview

overview

10

Static

static

3

52783df94e...e9.exe

windows7-x64

10

52783df94e...e9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2024 02:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    52783df94ea5aa0f1b29c4a9ea15ecadb2c469886a02030ee86a2da56a8b43e9.exe

  • Size

    1.8MB

  • MD5

    e91bdd398e42904cbc56344331953c6a

  • SHA1

    c755e1f2c0c5de38eb5029a60129cd86ad7846ed

  • SHA256

    52783df94ea5aa0f1b29c4a9ea15ecadb2c469886a02030ee86a2da56a8b43e9

  • SHA512

    03e79400ecd6d50f9d7f694fe651235e1f7f3f6ecb632a94e719519a52c63c81cb7512510ed4c67dd207cfc65db457e9dff5ea147e18ceda2ebac241f405d9fe

  • SSDEEP

    49152:eE0/kh6mnC75ciMnJ5H9Fnxd5QhLTGDDG5tx0GefNZCKY3:WKCiiMbH9FnyhXa20Gi6T

Score
10/10
amadeycryptbotstealc9c9aa5marscredential_accessdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2996
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1740
    • C:\Users\Admin\AppData\Local\Temp\52783df94ea5aa0f1b29c4a9ea15ecadb2c469886a02030ee86a2da56a8b43e9.exe
      "C:\Users\Admin\AppData\Local\Temp\52783df94ea5aa0f1b29c4a9ea15ecadb2c469886a02030ee86a2da56a8b43e9.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Users\Admin\AppData\Local\Temp\1008582001\6ad011b27d.exe
          "C:\Users\Admin\AppData\Local\Temp\1008582001\6ad011b27d.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2808
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
            4⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:4380
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff99625cc40,0x7ff99625cc4c,0x7ff99625cc58
              5⤵
                PID:4956
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2036,i,4743910282059396495,14911387211401795756,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2032 /prefetch:2
                5⤵
                  PID:5144
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,4743910282059396495,14911387211401795756,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2580 /prefetch:3
                  5⤵
                    PID:6080
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2040,i,4743910282059396495,14911387211401795756,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2684 /prefetch:8
                    5⤵
                      PID:5188
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,4743910282059396495,14911387211401795756,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:3056
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,4743910282059396495,14911387211401795756,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3364 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:3520
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4412,i,4743910282059396495,14911387211401795756,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4444 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:2612
                  • C:\Users\Admin\AppData\Local\Temp\service123.exe
                    "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:2264
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:3572
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1320
                    4⤵
                    • Program crash
                    PID:5396
                • C:\Users\Admin\AppData\Local\Temp\1008589001\rh.exe
                  "C:\Users\Admin\AppData\Local\Temp\1008589001\rh.exe"
                  3⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3764
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 536
                    4⤵
                    • Program crash
                    PID:3712
                • C:\Users\Admin\AppData\Local\Temp\1008590001\45f57d5b9f.exe
                  "C:\Users\Admin\AppData\Local\Temp\1008590001\45f57d5b9f.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4376
                • C:\Users\Admin\AppData\Local\Temp\1008591001\cc1142f0de.exe
                  "C:\Users\Admin\AppData\Local\Temp\1008591001\cc1142f0de.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3960
                • C:\Users\Admin\AppData\Local\Temp\1008592001\d90f9652f6.exe
                  "C:\Users\Admin\AppData\Local\Temp\1008592001\d90f9652f6.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:4812
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4528
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:816
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1064
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1968
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1136
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3780
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      5⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2980
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2008 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac33c1f8-0996-4ffb-92dd-5a13c51c4f90} 2980 "\\.\pipe\gecko-crash-server-pipe.2980" gpu
                        6⤵
                          PID:4340
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d22f72a-6bca-4b66-aa4d-71f1a680cf58} 2980 "\\.\pipe\gecko-crash-server-pipe.2980" socket
                          6⤵
                            PID:2120
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3012 -childID 1 -isForBrowser -prefsHandle 2772 -prefMapHandle 2768 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce0be79c-bbe1-4d8f-a392-47b2d3763176} 2980 "\\.\pipe\gecko-crash-server-pipe.2980" tab
                            6⤵
                              PID:3756
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3932 -childID 2 -isForBrowser -prefsHandle 3924 -prefMapHandle 3920 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1e3b203-15ff-4d8c-ab24-879c05e981c8} 2980 "\\.\pipe\gecko-crash-server-pipe.2980" tab
                              6⤵
                                PID:3384
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4508 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4536 -prefMapHandle 4528 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {666b2c4d-e138-4451-855c-b93aea8fc0b2} 2980 "\\.\pipe\gecko-crash-server-pipe.2980" utility
                                6⤵
                                • Checks processor information in registry
                                PID:5320
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5124 -childID 3 -isForBrowser -prefsHandle 5216 -prefMapHandle 5212 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c47ab10d-ff07-4530-a573-9787dadded7a} 2980 "\\.\pipe\gecko-crash-server-pipe.2980" tab
                                6⤵
                                  PID:5740
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 4 -isForBrowser -prefsHandle 5232 -prefMapHandle 5236 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bedb67a-7d57-48b0-adc2-47460c5048b5} 2980 "\\.\pipe\gecko-crash-server-pipe.2980" tab
                                  6⤵
                                    PID:5756
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 5 -isForBrowser -prefsHandle 5568 -prefMapHandle 5572 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 944 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25d9d8b5-6fb8-49e2-8cab-aadba860671e} 2980 "\\.\pipe\gecko-crash-server-pipe.2980" tab
                                    6⤵
                                      PID:5776
                              • C:\Users\Admin\AppData\Local\Temp\1008593001\b76ceef9a3.exe
                                "C:\Users\Admin\AppData\Local\Temp\1008593001\b76ceef9a3.exe"
                                3⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3720
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3764 -ip 3764
                            1⤵
                              PID:3704
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2780
                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                              1⤵
                                PID:2844
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2808 -ip 2808
                                1⤵
                                  PID:1564
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3304
                                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                  C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:3764

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Modify Authentication Process

                                1
                                T1556

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Defense Evasion

                                Impair Defenses

                                2
                                T1562

                                Disable or Modify Tools

                                2
                                T1562.001

                                Modify Authentication Process

                                1
                                T1556

                                Modify Registry

                                3
                                T1112

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Modify Authentication Process

                                1
                                T1556

                                Steal Web Session Cookie

                                1
                                T1539

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Query Registry

                                8
                                T1012

                                System Information Discovery

                                5
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                  Filesize

                                  2B

                                  MD5

                                  d751713988987e9331980363e24189ce

                                  SHA1

                                  97d170e1550eee4afc0af065b78cda302a97674c

                                  SHA256

                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                  SHA512

                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
                                  Filesize

                                  27KB

                                  MD5

                                  461b1719f6effd5fc40920656cebdeb0

                                  SHA1

                                  11ce6f5f1220c20ce338bf5e52e60b67c8091350

                                  SHA256

                                  c23d83ea2d81e06191829886c601fc8f4f89eee87f303aeeee86d02aecf35972

                                  SHA512

                                  c1c6ac335f50ef9907f07ba92b60acccead1e37a0d4c46ca4114fba1ca10c2f342a680980e563b4ec348b6475c64ca1e386651e00b7e660cd69fdd08945d84ad

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                                  Filesize

                                  13KB

                                  MD5

                                  11f32cd1a9cff56a697118ea1d0999c3

                                  SHA1

                                  7ac1e626ab2b4d242f4fe56528d8b582ad675e7a

                                  SHA256

                                  12089ee1c8b29eeb9a03d900c1a41f97f41e74cee653a29f1e83988300cbab61

                                  SHA512

                                  14acbd8f15107891f412e2368bd1d8ce6b1ed394c6e4e5c315a71baabd2b4abe5e278ef6eb0873e89a2be7639af06b2ef34f1ed761f12d29766a9dfe3233ddc0

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008582001\6ad011b27d.exe
                                  Filesize

                                  4.2MB

                                  MD5

                                  ce1c81d721906475fc878ebd26d09ad4

                                  SHA1

                                  2fd29c1c343af0ffc67441b448e8a101b7f7854e

                                  SHA256

                                  a80ca2e11b0eaa75711ca4b8a002d95f45e8dbaf41101e4dfc52b32ab5d9ddae

                                  SHA512

                                  af61993252d78e5da18d4826ba22e3496aebf9a14af715ff7034d9972b577b5ca4d75dfa0fab515e384dec5f74a27a53d4d25d9423500580f74dcd2c1b5be5ff

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008589001\rh.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  4cecb04d97630cc2d5cce80368b87fdd

                                  SHA1

                                  4f693736497e06c820b91597af84c6fece13408b

                                  SHA256

                                  51698570a9c637ec0c9bc2b3ca6acb7edf3d7804c49b8eed33e82573950877dd

                                  SHA512

                                  acdf93d12791a6a11b307fbbdc6df2b27a6e8de6b8cc015c4892304d4653e79ac58351600b53c7ea78d285d69df8e8f2e270cf9a168b187d372a3de17e84ec66

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008590001\45f57d5b9f.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  88a2e1dc5f57311dc42a7d57dc7d9827

                                  SHA1

                                  a26e33ea17b7d5ca3272e8a7521f141c927d1b75

                                  SHA256

                                  c2c829ba69f689fe392435d8b886c002e050d3bb4cc6ec8f62317ceaa7ba02da

                                  SHA512

                                  b4b2cdc31ced54f377e97f4b548dc128c6c7d1ee9888b6f2a5245b421f9673c9582c9a0a5981e7f70cfa1251e97672a9bec3a71b3d2bf7e7f09438a37ac69ae3

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008591001\cc1142f0de.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  3feea8ff886f1fc0d57da4a2b3a109ba

                                  SHA1

                                  78d6302f4f09726b6a129c5fcc7cd94a474cc53a

                                  SHA256

                                  143e6525646d5d95639eb77420a54205cb02fb8624c6e1662b7460f58b03523f

                                  SHA512

                                  e5c107f29e9b2c58365df6e7cb3d7c38534e931147c92ade485f949751712ae63a375608b9cacb178593f5b25b58ebb5980b8abef3df459ea6e15d2b6f709e32

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008592001\d90f9652f6.exe
                                  Filesize

                                  901KB

                                  MD5

                                  00ea2d526653b9beba2a5d4f3fadd366

                                  SHA1

                                  d41eb397685765a9ca5b973d69e60a666fb8ad4a

                                  SHA256

                                  0c85ff63c9613d92630d191fdd735eb0216bb64d0780e64e32e507b07a9b80b9

                                  SHA512

                                  459ef594400dfa1c2dc60fedd43d3a36f95a75d7f7658e2b620546b9efec44526e797b1d815c84886f5f56b4dca01a5c706069b9991533ceff0e8d3103024628

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008593001\b76ceef9a3.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  92b22f14f1664cc7bb2f42daf6fd1799

                                  SHA1

                                  68a767dd4bcd60e310bafd7219749093bd013bc6

                                  SHA256

                                  85507d05a1da7659f9045ec2d969ddd0de20723fc7422b4985bd392411449fe8

                                  SHA512

                                  c4b30103cc0b0dff93b5deb61f7301f45b24054239592f4c2778c179312193dce01b06043885d5ff260424ad7c49bf8d18d48a9523deb1e7d7e12601745d513a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  e91bdd398e42904cbc56344331953c6a

                                  SHA1

                                  c755e1f2c0c5de38eb5029a60129cd86ad7846ed

                                  SHA256

                                  52783df94ea5aa0f1b29c4a9ea15ecadb2c469886a02030ee86a2da56a8b43e9

                                  SHA512

                                  03e79400ecd6d50f9d7f694fe651235e1f7f3f6ecb632a94e719519a52c63c81cb7512510ed4c67dd207cfc65db457e9dff5ea147e18ceda2ebac241f405d9fe

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                  Filesize

                                  479KB

                                  MD5

                                  09372174e83dbbf696ee732fd2e875bb

                                  SHA1

                                  ba360186ba650a769f9303f48b7200fb5eaccee1

                                  SHA256

                                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                  SHA512

                                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                  Filesize

                                  13.8MB

                                  MD5

                                  0a8747a2ac9ac08ae9508f36c6d75692

                                  SHA1

                                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                                  SHA256

                                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                  SHA512

                                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                                  Filesize

                                  6KB

                                  MD5

                                  2a24930722c7e75846da7fd8a3387423

                                  SHA1

                                  c7b1e7e4dea76861f48117c7858057f26b5cccab

                                  SHA256

                                  44e0f449c8728fd161e7c53e176a94d64a23dd233ae34cef47cfd370b0452bc4

                                  SHA512

                                  f7a2d7c7bc5828f22b0705c0919c9deac71c738eb2c2b23cc799b62f2c0e2f1803d65c099b3aec8331956c43073f094142d22a896385941b0d9491961225bfd9

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                                  Filesize

                                  8KB

                                  MD5

                                  ca5474d6830aab90da1d1e236dd20c58

                                  SHA1

                                  a881e6917f9d49c084fe259929f660f80461c451

                                  SHA256

                                  1d629c9c9c424419b3c76ad81fb89728d0feb1131f0318af4342b701398a312c

                                  SHA512

                                  34fb73ae675aec4ee234aef4ede42120027f08aa82d7a8e82a31e21d7cbd8165f8167d10a03a1af923eab6d50ef3c322c582660e3a503dd3fb068cf62ed85c98

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  22KB

                                  MD5

                                  ea7496adf76c7b43d7db7bb3c3e9f51c

                                  SHA1

                                  ac5d8dabad9f50b21c6a5c670cbc774a95562b8f

                                  SHA256

                                  5bd983e674de50a893997ff222f1b7625e0007763402288cd489460d85ee8d14

                                  SHA512

                                  e9b7f2a6268b090e76b07c6f4a1e2d0c4adcb286e666314c6c911993ce9e10bec08afb8e88166818a978307648f8f9e2b76b1960420dc5e2cdc4698b7f9efa84

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  23KB

                                  MD5

                                  931a64d80c641f5e717688e87ea52260

                                  SHA1

                                  e744500186fc245466dd6d06b4f75ffe924eb581

                                  SHA256

                                  72de2acb0233dd33060aae4ad49c71bbe6c9507fd028235bb525b36616c406a3

                                  SHA512

                                  5ba4e0896760d3e6ea9c80fa05ac47b73d4a4a1fde4762b5e33c8fb7ec7f8e88870d10dba5fb5373b61884cfef300afbbbaef7faa99513ad33dfb1c082e38c1c

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  25KB

                                  MD5

                                  dfc2670d3ff20dc8923503db2a72935f

                                  SHA1

                                  5c63847e9419d82312b4eb65e33d0bab3bcbec12

                                  SHA256

                                  253f3295812862fdeab283da33342cfed9f77e127d633c7201de9e9aad31196e

                                  SHA512

                                  c53b9f013040e83ac5de82e5c9f027bff669be6b816433783edf267711cded8e67337262f5d8f824223acda6de997c3bf325809b76be90a2731e81eb6dae6a4a

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  25KB

                                  MD5

                                  85b339a1cfbc88fca8d07d0d33fa3799

                                  SHA1

                                  b1dd2ca419954ffe495f44c0b9fbce9677a54391

                                  SHA256

                                  ff86c7b827db0d429819bd1e085e241e26c2011a7de8e2349bd6f85ca7c9ea62

                                  SHA512

                                  f092c5b413c123748102466a1d05a3c7e4567c84e2a3bc392119f1f13db9038b7271d103218c6472edafa0180d5ebb4a92215109bf7e48269c1c3a9e66c83641

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  25KB

                                  MD5

                                  2d4186798e8af92be0bd9f58c6c377c6

                                  SHA1

                                  46d48b3a6529dc3d4bcaddf4b9b2a80430e5509a

                                  SHA256

                                  87c0b785c1fc586ee916d7a4fc3f8dcb2a2599c443d8eb07061e02c961e78866

                                  SHA512

                                  16186c42cd14b811102181dc71a2fb845406d4ca24a65418ec43e7f8034085867808ca986eeb00f3649b0bcee449f2aa26e279add8fc03a786101cd276dcded7

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\1c37bc07-d3da-444e-8d0f-b37c8b7ca13e
                                  Filesize

                                  982B

                                  MD5

                                  93b8fc03c70e89cdfbaadf30e7ef7478

                                  SHA1

                                  6e675b43818ab62614a5fdbcaad03684418b2150

                                  SHA256

                                  a49912f4178d82bc98f4286b7c39f7570bc26125a85766494011d608c46b0ddb

                                  SHA512

                                  ce2a5f7bfaedc65551fdd7e576c29d0d9dd0df3d4bdc1f6e84ac8f089cc792025ff4dc6611d25df93efe2fc851e61875c11593be0ddec392be5c3aec6a46389b

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\7d59ed05-1f48-4c91-8689-f0a4382a9119
                                  Filesize

                                  659B

                                  MD5

                                  7152cf0ea2db66dee7ccf1840b091b30

                                  SHA1

                                  fbe478bedcd9240f8ab0726be576e81008f61ca8

                                  SHA256

                                  607d8f6b84d7fb2bb6063fcc89f4e71d27a3dc9d994abe697c3f3d31f70e95ea

                                  SHA512

                                  1b38e2369a53f1a5843ba280a57aa46354e1aa673b227a2fb35f6e3781c43153ac9f26f293255b2a2f5b6c0e2b6e116cfbd8ad83d9e2fdf2b397dcc2b7995565

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                  Filesize

                                  1.1MB

                                  MD5

                                  842039753bf41fa5e11b3a1383061a87

                                  SHA1

                                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                  SHA256

                                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                  SHA512

                                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                  Filesize

                                  116B

                                  MD5

                                  2a461e9eb87fd1955cea740a3444ee7a

                                  SHA1

                                  b10755914c713f5a4677494dbe8a686ed458c3c5

                                  SHA256

                                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                  SHA512

                                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                  Filesize

                                  372B

                                  MD5

                                  bf957ad58b55f64219ab3f793e374316

                                  SHA1

                                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                  SHA256

                                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                  SHA512

                                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                  Filesize

                                  17.8MB

                                  MD5

                                  daf7ef3acccab478aaa7d6dc1c60f865

                                  SHA1

                                  f8246162b97ce4a945feced27b6ea114366ff2ad

                                  SHA256

                                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                  SHA512

                                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                  Filesize

                                  10KB

                                  MD5

                                  514c566fc4422d73c2ffc8e5c8682b69

                                  SHA1

                                  f6c9de8f643a969bc8d186facdafbffccd399558

                                  SHA256

                                  bb705ef72295ac11375036a9207cf877299f4b3b852ceda0935c042544d89e78

                                  SHA512

                                  5d6e01d6879b890305485ef36e8285a2b64d2400b334085e955c9ba97c002254da30826b977286cdb8cb88aeff67b77b8e238a2694796369e6da8ecc9a184b06

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                  Filesize

                                  11KB

                                  MD5

                                  6f5434b30bf91e7dc38e900655ea4aa4

                                  SHA1

                                  0551c58efe0aca002b6a52ef241078cc17b895b6

                                  SHA256

                                  ac2dfd7a04f3bb73d1127767612c8b1a286ae8c18802694743cf4fdb07ac1ed2

                                  SHA512

                                  f976a2849e237e990558d35cf2a4fd59e82f4562314cb88d29950767ecfde1dd9cb4b803d992c185682ec3c43548891e9551ad49184d9291005a18e5d7b24964

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                  Filesize

                                  15KB

                                  MD5

                                  cdda440244c0626fc8639fb234a04746

                                  SHA1

                                  09922e047fcac981a0fcfc1bf0c14e36c9544b5f

                                  SHA256

                                  019cbcf51e407e5e92fd018a95d3f9bfe6c8d2388d8b93086c18644583010305

                                  SHA512

                                  aab1d1e3a5f2ff8b3098d4a1b9489e57cc893e2cfbc17d7043b68980163fcdccf9029f2f77c2521fbe2f8d9336b8604c51bb5b8ddeef4e6f61c56dc7f2967da2

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                                  Filesize

                                  15KB

                                  MD5

                                  7045dd6a5fb6f98c1c89217520a67798

                                  SHA1

                                  b09dd64f689da2f5484faeb8e4b9f2c6e11fd4b8

                                  SHA256

                                  6f9909164dfc180c295696adeeb3c2ab41602b69325198c555928373c2186ff0

                                  SHA512

                                  478c0bfcd9a9abec594f28328378aa202cafd289fc019d6347ce42c41d594c730185df42283ff7b455e4f7662793bd07a2c9de9d38031a3a57d7badfe3616a61

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
                                  Filesize

                                  10KB

                                  MD5

                                  b3bbea36c085bd74153065e28e1ab908

                                  SHA1

                                  517d517e26fe50a2d49c1d47c2070674afd9e2d0

                                  SHA256

                                  2754a332bf5b2235d02e3484adc04d889cc5b05433154ebd8cee183e5a4a19fe

                                  SHA512

                                  552f150b3ca95d7bfcb630d8126240e8d92c94ed006beea844d7b7307728aab0f443cbb58c0990435d94055bec3bb3528857fd68c232c89d067a41079d371f95

                                  Download Submit

                                • \??\pipe\crashpad_4380_THYAWBVXKQIRPUFF
                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                  Download Submit

                                • memory/1740-69-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/1740-66-0x00000000003B0000-0x00000000003BA000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/1740-68-0x0000000000C00000-0x0000000001000000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/1740-71-0x0000000075850000-0x0000000075A65000-memory.dmp

                                  Filesize

                                  2.1MB

                                  Download

                                • memory/2264-2813-0x0000000073030000-0x0000000073164000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/2264-2812-0x0000000000910000-0x0000000000922000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/2340-0-0x0000000000940000-0x0000000000DF8000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2340-3-0x0000000000940000-0x0000000000DF8000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2340-5-0x0000000000940000-0x0000000000DF8000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2340-1-0x00000000773E4000-0x00000000773E6000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/2340-17-0x0000000000940000-0x0000000000DF8000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2340-2-0x0000000000941000-0x000000000096F000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/2780-519-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2780-518-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2808-1881-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-159-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-89-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-91-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-38-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-1042-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-2804-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-2789-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-40-0x0000000000591000-0x0000000000809000-memory.dmp

                                  Filesize

                                  2.5MB

                                  Download

                                • memory/2808-2642-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-543-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/2808-1092-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                  Filesize

                                  10.4MB

                                  Download

                                • memory/2808-520-0x0000000000590000-0x00000000011D2000-memory.dmp

                                  Filesize

                                  12.3MB

                                  Download

                                • memory/3304-2806-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3304-2807-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3720-529-0x0000000000160000-0x0000000000420000-memory.dmp

                                  Filesize

                                  2.8MB

                                  Download

                                • memory/3720-150-0x0000000000160000-0x0000000000420000-memory.dmp

                                  Filesize

                                  2.8MB

                                  Download

                                • memory/3720-335-0x0000000000160000-0x0000000000420000-memory.dmp

                                  Filesize

                                  2.8MB

                                  Download

                                • memory/3720-337-0x0000000000160000-0x0000000000420000-memory.dmp

                                  Filesize

                                  2.8MB

                                  Download

                                • memory/3720-517-0x0000000000160000-0x0000000000420000-memory.dmp

                                  Filesize

                                  2.8MB

                                  Download

                                • memory/3764-59-0x0000000000240000-0x00000000006FE000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3764-65-0x0000000075850000-0x0000000075A65000-memory.dmp

                                  Filesize

                                  2.1MB

                                  Download

                                • memory/3764-2810-0x0000000000910000-0x0000000000922000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/3764-73-0x0000000000240000-0x00000000006FE000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3764-61-0x0000000004BE0000-0x0000000004FE0000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/3764-62-0x0000000004BE0000-0x0000000004FE0000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/3764-63-0x00007FF9B3A70000-0x00007FF9B3C65000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/3960-107-0x00000000005A0000-0x0000000000C37000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/3960-109-0x00000000005A0000-0x0000000000C37000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/4376-90-0x0000000000370000-0x0000000000805000-memory.dmp

                                  Filesize

                                  4.6MB

                                  Download

                                • memory/4376-110-0x0000000000370000-0x0000000000805000-memory.dmp

                                  Filesize

                                  4.6MB

                                  Download

                                • memory/4512-452-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-2817-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-1191-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-18-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-2001-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-641-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-2769-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-19-0x00000000001B1000-0x00000000001DF000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/4512-2823-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-39-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-41-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-20-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-21-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-2811-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-22-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-530-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-2814-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-108-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-2820-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4512-2790-0x00000000001B0000-0x0000000000668000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download