Overview

overview

10

Static

static

3

2249564557...fe.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2024, 08:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    224956455743345d65f369fb11c1687cf38ccd97336f7ab48ad1848cb09bdbfe.exe

  • Size

    7.0MB

  • MD5

    d42de4fe66b16cb4796b27b490accde3

  • SHA1

    634a7c21ba87f214e4c151061006d5b8c07296f6

  • SHA256

    224956455743345d65f369fb11c1687cf38ccd97336f7ab48ad1848cb09bdbfe

  • SHA512

    ce6d89349addd395037317c18675e678f6e0055967b49f97e755b7d063403319bb1a42972fb6e91de2d8b04712b92276f2c7e0836e29a27e9e4489c953272c53

  • SSDEEP

    196608:FRO/7HdcojNO57g5+3KLtTmJhxTcRy3YxEcMY/:QbBOJY+WiJhFwcYxdMY

Score
10/10
amadeycryptbotstealc9c9aa5marscredential_accessdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2632
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2440
    • C:\Users\Admin\AppData\Local\Temp\224956455743345d65f369fb11c1687cf38ccd97336f7ab48ad1848cb09bdbfe.exe
      "C:\Users\Admin\AppData\Local\Temp\224956455743345d65f369fb11c1687cf38ccd97336f7ab48ad1848cb09bdbfe.exe"
      1⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A9I05.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A9I05.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\R1M01.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\R1M01.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1668
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1c55b9.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1c55b9.exe
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4092
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5112
              • C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe
                "C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe"
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5072
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 804
                  7⤵
                  • Program crash
                  PID:1216
              • C:\Users\Admin\AppData\Local\Temp\1008700001\779475cb3b.exe
                "C:\Users\Admin\AppData\Local\Temp\1008700001\779475cb3b.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:2024
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                  7⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:2208
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd475cc40,0x7ffcd475cc4c,0x7ffcd475cc58
                    8⤵
                      PID:808
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,11982871398031370513,14966260186176844053,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:2
                      8⤵
                        PID:5080
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2016,i,11982871398031370513,14966260186176844053,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2092 /prefetch:3
                        8⤵
                          PID:5020
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,11982871398031370513,14966260186176844053,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2360 /prefetch:8
                          8⤵
                            PID:2476
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,11982871398031370513,14966260186176844053,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:6720
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,11982871398031370513,14966260186176844053,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3288 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:6768
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,11982871398031370513,14966260186176844053,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4556 /prefetch:1
                            8⤵
                            • Uses browser remote debugging
                            PID:1348
                        • C:\Users\Admin\AppData\Local\Temp\service123.exe
                          "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                          7⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:5284
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:6372
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 1376
                          7⤵
                          • Program crash
                          PID:6480
                      • C:\Users\Admin\AppData\Local\Temp\1008709001\4cfe6c8b95.exe
                        "C:\Users\Admin\AppData\Local\Temp\1008709001\4cfe6c8b95.exe"
                        6⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4440
                      • C:\Users\Admin\AppData\Local\Temp\1008710001\bad447ac07.exe
                        "C:\Users\Admin\AppData\Local\Temp\1008710001\bad447ac07.exe"
                        6⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4188
                      • C:\Users\Admin\AppData\Local\Temp\1008711001\50c9e11801.exe
                        "C:\Users\Admin\AppData\Local\Temp\1008711001\50c9e11801.exe"
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:3188
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM firefox.exe /T
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3924
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM chrome.exe /T
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2684
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM msedge.exe /T
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4848
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM opera.exe /T
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2932
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /F /IM brave.exe /T
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1780
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                          7⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2404
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                            8⤵
                            • Checks processor information in registry
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:2280
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1936 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4632e2c-50b4-4651-9010-7e2a05fb766b} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" gpu
                              9⤵
                                PID:3688
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2460 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a481ff20-d0ee-4ffa-b45b-d2d5c18bb51a} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" socket
                                9⤵
                                  PID:2988
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2936 -childID 1 -isForBrowser -prefsHandle 2940 -prefMapHandle 3048 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5430d58c-563a-4a9f-b193-43064a4ccb8e} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" tab
                                  9⤵
                                    PID:4640
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2760 -childID 2 -isForBrowser -prefsHandle 3452 -prefMapHandle 3448 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f231bcac-eb45-4939-80da-15702561f0e7} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" tab
                                    9⤵
                                      PID:2288
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4160 -prefMapHandle 4156 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f711af4-7149-43dc-8254-f1ca5c4658c4} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" utility
                                      9⤵
                                      • Checks processor information in registry
                                      PID:6576
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5400 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0834712f-e8ce-405c-ba1c-28143147d7a5} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" tab
                                      9⤵
                                        PID:5388
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 4 -isForBrowser -prefsHandle 5344 -prefMapHandle 5396 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a377aa5-1f78-4c08-bd8a-e25d9f6680b2} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" tab
                                        9⤵
                                          PID:5404
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5584 -prefMapHandle 5588 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb479523-47f2-4d77-a9aa-2a0e89f23ddc} 2280 "\\.\pipe\gecko-crash-server-pipe.2280" tab
                                          9⤵
                                            PID:5416
                                    • C:\Users\Admin\AppData\Local\Temp\1008712001\f15e681b58.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1008712001\f15e681b58.exe"
                                      6⤵
                                      • Modifies Windows Defender Real-time Protection settings
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Windows security modification
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6088
                                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2x8097.exe
                                  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2x8097.exe
                                  4⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4868
                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p32C.exe
                                C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p32C.exe
                                3⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4684
                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4x017o.exe
                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4x017o.exe
                              2⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4408
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5072 -ip 5072
                            1⤵
                              PID:3232
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2684
                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                              1⤵
                                PID:952
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2024 -ip 2024
                                1⤵
                                  PID:6376
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1372
                                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                  C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5680
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6540
                                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                  C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:4424

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Modify Authentication Process

                                1
                                T1556

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Defense Evasion

                                Impair Defenses

                                2
                                T1562

                                Disable or Modify Tools

                                2
                                T1562.001

                                Modify Authentication Process

                                1
                                T1556

                                Modify Registry

                                3
                                T1112

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Modify Authentication Process

                                1
                                T1556

                                Steal Web Session Cookie

                                1
                                T1539

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Query Registry

                                8
                                T1012

                                System Information Discovery

                                5
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                  Filesize

                                  2B

                                  MD5

                                  d751713988987e9331980363e24189ce

                                  SHA1

                                  97d170e1550eee4afc0af065b78cda302a97674c

                                  SHA256

                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                  SHA512

                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json
                                  Filesize

                                  27KB

                                  MD5

                                  f22fc1c8baf2b375435026ae170ff1fb

                                  SHA1

                                  21bab8b9111338c95bd2490e00ffdd4ab662211c

                                  SHA256

                                  9fc48faeddc4c7d9104343d5888bcd664c0277fe7904744380d5939ee5dc183a

                                  SHA512

                                  bb88f8a8d89c43d25952af0b99a9f1d0350777491312ee38b26f64fdeb1a71b1b4e31431213b728dd0af2d3704188da6f4736aa330dc5b8d40f611c3f9d26b46

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                                  Filesize

                                  13KB

                                  MD5

                                  085390563349157f2ea3c8287fd9743b

                                  SHA1

                                  2b4a002bdafbf74016d62ed8442587cce8fcef99

                                  SHA256

                                  5578b0460ece6ad14026c2f19f51478b12ab5b5e0dade304efc70c11e16a17ea

                                  SHA512

                                  5a24a86ea5788498ce718a1c2f231dee1128b8f94b2a23c73330d1c4664acb8b3f1bbd0ec3070fa3105f96bfb1350258af8ed73a3748d3c89c74965f5ef372d5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe
                                  Filesize

                                  1.9MB

                                  MD5

                                  4cecb04d97630cc2d5cce80368b87fdd

                                  SHA1

                                  4f693736497e06c820b91597af84c6fece13408b

                                  SHA256

                                  51698570a9c637ec0c9bc2b3ca6acb7edf3d7804c49b8eed33e82573950877dd

                                  SHA512

                                  acdf93d12791a6a11b307fbbdc6df2b27a6e8de6b8cc015c4892304d4653e79ac58351600b53c7ea78d285d69df8e8f2e270cf9a168b187d372a3de17e84ec66

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008700001\779475cb3b.exe
                                  Filesize

                                  4.1MB

                                  MD5

                                  3de87de137ed1adcde5de7897a8c2c3f

                                  SHA1

                                  389fe91d75a961e11296f7c45acc9264ed581965

                                  SHA256

                                  92edd16fc04624fc69b9be59155def1c28600e9d1bb8c804df61fc4f1422e017

                                  SHA512

                                  72df63c38f986c018da256058e67814dbede64f1339e863cc51b74d4af6c2b6cc1e51eb186908d5b2b8c49ef8abd5e8dbe8fe8d26b1ace81ce7a620c303a00ec

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008709001\4cfe6c8b95.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  0a75820b356a011e9fa427d658f1e3c0

                                  SHA1

                                  a57469622af0b25fc3a07d071dcbe1526c41881f

                                  SHA256

                                  6f064372869eee9be9b504a086011c8beb3d7c753a87bd0a28c44ee5a22c6ffc

                                  SHA512

                                  37641be0b9191f3688c9dd539da7ad20729b6e1fbac770e08868e8ad3226138a58fe95390ed28cb10ec478eec44065e68b4a8c5136b5d9a638db17767f75cecb

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008710001\bad447ac07.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  cb78b3cf97d74f0540679225a564e8b0

                                  SHA1

                                  95b72e4eb9f28a6534e1d902f802f2988ad6735f

                                  SHA256

                                  3427282a0e679abf14880c48f47728c97e1c3f870d1bf3bc0116736f3abde675

                                  SHA512

                                  88f693df96058aa6f91ba582ce5c213e9c7761eeb1379b8993c4de83b106632083cd90bbd3eba98a4038b6b951adf81f7f64e7bab903eba431ee4497abd5cde6

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008711001\50c9e11801.exe
                                  Filesize

                                  901KB

                                  MD5

                                  fe36444d62aa278a9165d824f20590e4

                                  SHA1

                                  86110a64b51bf3005ad2c23e41a8146b992d28ee

                                  SHA256

                                  a2072bb2dee51b788f2f3b0adc7a316abc3c41754affb00aa40068d300c39419

                                  SHA512

                                  6cbbf342efb96b108587118def74e43aeb080642ba1b89fd15ca2f5baefa6bd1752102be17507ae0c76a4f754a37cf9278acec6c5752cbf6d3d75cc1a8b83f95

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1008712001\f15e681b58.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  f8c7e8376a3d8b22affd98f1ce37ad40

                                  SHA1

                                  cdb6712157abf20c004727e9a3a318c226331bc5

                                  SHA256

                                  ac875e32c67120a2f55ce2120782aa50edb5bca31fc9767dd808882df740091f

                                  SHA512

                                  818f8f6f18705399a2f13a3a8a828a23ae818f095996bd03e8cced23693899c7a157e672e2d17314265fb7c70a8c6ec782f66656362d73aeedc208687a7ebb45

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4x017o.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  5d3609d2ec83d15d87b45ca4c6333659

                                  SHA1

                                  d4fcc48c2f86e794bab06294a70b30133eda409d

                                  SHA256

                                  01d17f2ada1b93d1d5af1aa0b16af5eb328d4bdb68ddb137167fe26a7ee83c2b

                                  SHA512

                                  423cf45f27f3ee3976694fab7aab03f81f76c61c52c468f555edb1660a260e8d63099135d73aa6f784798dab6af5de2b5796861c56bcfa592c48348ad2cf2753

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A9I05.exe
                                  Filesize

                                  5.5MB

                                  MD5

                                  1b701062211b59d25382cf39a3ef0e5a

                                  SHA1

                                  6a93c1bf7c557c6b6a5d58efce0c6ac164cd8c3a

                                  SHA256

                                  8ce44f7d3646e90dd9f183771e77d197ce4e04a58ec33d6d1c2c5187e2ecf065

                                  SHA512

                                  2c625110d695cdaf15523bd617fa9ea3efa1e420e4a520a7940b24bb2ef29f9a4a037d9c5fff88d7f2fa5934a35372ab25b39c58142e595c72f45e3f3f7901fd

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3p32C.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  6fe3130fbf57b8dfe19158188df1e915

                                  SHA1

                                  ff0e2328c167f39bab919190099086312150ff31

                                  SHA256

                                  d31217975514e9ecb073887fad050b7455c43a746a5ee3273368f48ba106d56f

                                  SHA512

                                  bbca47bf611131d0041ebd05f1758d524bbe568b28a09514afa4402c53ad009f08011f79092e8d6116895e3165bf9e584f29926bed725e3e46048dc1be44ebc0

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\R1M01.exe
                                  Filesize

                                  3.7MB

                                  MD5

                                  13c61dc8ef66a5d0ad9d8a8d8512b89f

                                  SHA1

                                  5bed7a1ed2de47403cb2e34745656f3c13f77ef3

                                  SHA256

                                  7643b31256cef12b88451f73d64e61e1c31ea5758c037dcbaaaa117d373f0911

                                  SHA512

                                  f96ffff9d4362aef85fbf9500517759cf5763e619e5f97b81ffbe0ae42a642fe79ccd495d7a7232856a6c883f92f9789b4ba638ea0bed13ccf76e33de7454e43

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1c55b9.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  a195a7d632637e49384f2139c89b38d9

                                  SHA1

                                  517f286cfcdb1bbfff41211b56e4e2fc22651c73

                                  SHA256

                                  8985dd07bb7acb95657a596c856de65c746e48f654c2fe201b3f24baefb14b41

                                  SHA512

                                  526eb0b76359719a5d9326fc1e3b6b14fbc98c6c43293ccb22bd4c4020802e63516472effa480070fe30c2a39fd3f1d2e4a5405514da25961340edc43c913ce9

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2x8097.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  ace99b08916d1db23e510939aa97ab49

                                  SHA1

                                  3891ed604b6265e288bb1cfa5f1c952d12e15bb6

                                  SHA256

                                  8682c013ec1c703d754770792b7229d40ab863d7e5c2f2e953be152b57ad138c

                                  SHA512

                                  cca1590d65e0d32ef3c2acc5159436140cef2ab48ad7bc827176daeb503af1343d50d0fc1e946add3f9c5a98c4362284fdea42fa5616967bf49355327037c619

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                  Filesize

                                  479KB

                                  MD5

                                  09372174e83dbbf696ee732fd2e875bb

                                  SHA1

                                  ba360186ba650a769f9303f48b7200fb5eaccee1

                                  SHA256

                                  c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                  SHA512

                                  b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                  Filesize

                                  13.8MB

                                  MD5

                                  0a8747a2ac9ac08ae9508f36c6d75692

                                  SHA1

                                  b287a96fd6cc12433adb42193dfe06111c38eaf0

                                  SHA256

                                  32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                  SHA512

                                  59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                                  Filesize

                                  6KB

                                  MD5

                                  45ad8e45c92cb81af5f859cbd5b9c6c5

                                  SHA1

                                  1f7b7083b40010f2dd2ba1606c7695aadee1d17e

                                  SHA256

                                  d77e65d0763f6a076b8722e683a46bdbe2c692c4645ccebe3ca1363dae503980

                                  SHA512

                                  6675206cbf27aad8cf435162cbec8f8e48cae1e3fa19a6b8107d289e0b61b379c100d3234e892fb56560b9d969a4c2042b60273e40b52369a9b787f810f1f0e9

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                                  Filesize

                                  6KB

                                  MD5

                                  132418aaf340a0cf041a8ee81396ea5e

                                  SHA1

                                  58f7c7526c00ecd37e3a9501edea8775f68ee4b7

                                  SHA256

                                  897fdbb0a92a872fee246c05a541a392eb167d84fc7c733941e29d782cc27c84

                                  SHA512

                                  1c786e6113abbe7fd63f9f0b590a5cbe272c1a494d6294b43e99d3049a80d073b30531e9b95e3456fcbd8e661741d7f8eab1b27bcb68d6a08722775fa2775872

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                                  Filesize

                                  23KB

                                  MD5

                                  f75209b2ef584d89cce115048cc9ab51

                                  SHA1

                                  e35f6de4a5a0827f47d69d59766683da6a0382a2

                                  SHA256

                                  4ef5133de469d1e4e3d87390be48b6aba6799d09d10f91095349a7ab1a4187db

                                  SHA512

                                  9537633a7072c928bf58839d69aea41e00f0caf8b7e61188d59a90602f357f8412ba71864007c27192f33b4e2c9b71423b4f717ad8da9d3f32f755afc93e9575

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                                  Filesize

                                  5KB

                                  MD5

                                  32062debac2ff34f44640d3ecc23436a

                                  SHA1

                                  e9b7a1466c872302cd93071ad2a771a354743d3d

                                  SHA256

                                  9010e558c28393c94777cfda4e76a3a042fe818349a9f0dc16ee3aff5c442a2f

                                  SHA512

                                  fa09181ec7cca8e56bc5bebe83d4df01158d460941b24d69af5de15eb2414f148a9d97aaa19a369c5760672bae0a854cb7f7a86a14070ba888eb112e4a41bf53

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                                  Filesize

                                  14KB

                                  MD5

                                  5bc75fac0a50dde2b5d13558c1bb80e5

                                  SHA1

                                  befc3b604e0c412c5bf1cb71eda77d6507921a98

                                  SHA256

                                  ef669eff376807829e84a3394fa06fddc8fe5a947e60aff29b46cbd9c6bfad32

                                  SHA512

                                  f8a3f4a11626256eefdcc5f7ac019a4abd595f339e582669b1a98ae2dcef551376eedff750901e7a07baf1833c1d33fd099fd29936e31b2e089b538aa96a5921

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.bin
                                  Filesize

                                  6KB

                                  MD5

                                  bb17f9052c12ebec795f58b460b80295

                                  SHA1

                                  33ba69a4e89b5aef323209823fe408c771858530

                                  SHA256

                                  416fe62582243678b5d24b053dd389ba8a66fb2b0d4161c2245c780433396909

                                  SHA512

                                  4a2ec49774a3461554851e7376315080ac5fbf59490d41b612b373a59bc8e2fa6ff7206fb9290418d90f26afe8b9d54a552856438341bc1d04c77c5113b426bb

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  5KB

                                  MD5

                                  b8f6f4e044ab22b67161f5feb40f4431

                                  SHA1

                                  d0a1905941a3ada18fc0c9b0b32a163265f2d399

                                  SHA256

                                  687c6c4117dafb8ce95f73ba8c333cd4d981a99edf66c18ce21cd0bfc0a5e901

                                  SHA512

                                  a70437dae1e1a88fb49678a54fd45024edc86abd21b97f923e918a51fe5585ef0da314d7eda47ff9f9193093279617b6035713645e1d39ffa136bc5145968887

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  6KB

                                  MD5

                                  0736948d7f09983108c72cdb7f61b626

                                  SHA1

                                  f4eb0816a142dfecaf619de1b0db3da50090666c

                                  SHA256

                                  c8f24e346ff2cd81eee5e0ac3da10655b9330ce0015c3d18634f161c88cf646e

                                  SHA512

                                  d481cd63d4e9c57aaf38663eea76e7615f5f725534b5a06e414aef13f2e7687c7f8cc37fc4f8d80e39a98fd8977a997c30678fe1c110eb497482940879ae38a5

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  5KB

                                  MD5

                                  eba4271ef49b9aebd061c32d7ee0f0a5

                                  SHA1

                                  3a11451a3aef2ed10d6b3e80ff36e5aa884775e5

                                  SHA256

                                  6b408d897df26dc79c7c29ab2ebcec031d7cae264cec52949f8f77d80872fa5e

                                  SHA512

                                  4d86820d22042266792948da8798c13ea90cde313dca41490f095444e7ea2f4bc8cdb0f597f25f00f0601d0780eaca10b08eb3a5727d0f5fb8b90c56fe69f229

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  5KB

                                  MD5

                                  83ad5d5dd6f34cca70fe7f9627a1a952

                                  SHA1

                                  1b400ff173b0d2f3b9a5e7eaa14a90589592e681

                                  SHA256

                                  4d1e0524a15de2e1876df62d8a3a427c6266c4ca4eab43e7091224a8a5a78d7f

                                  SHA512

                                  26c4784a795ebe81e65af05f5f01dc9b3ef5a2f0c63401eed51d4c57e4116c230b7f8802a34cbd77f3186e80452bcad0048e7e3192287d23f71f6dd744a01824

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  15KB

                                  MD5

                                  ef73924e09d87ee7aa5c3db197728a0c

                                  SHA1

                                  873c52c594ff2c345b815cc2284483749d532741

                                  SHA256

                                  e09572c28a404e5026f265797c961f6d4724dfdc91ecdaa0d6001c4d09a57fd3

                                  SHA512

                                  952162d677586d1384c1e422a6eddb2722b5679fbc952f9c267c738aac51a0dbb5a49e12fa519347dc05e80cb20454e3506674d62a4ec2da46258c435031051b

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  15KB

                                  MD5

                                  e33271d50b03df3b53b9a0dce79c003a

                                  SHA1

                                  08408035140c990103b584645746ef19a7260006

                                  SHA256

                                  0986a6b39f36ef3548c0e678a884f45af71050bf15f595b6ebb8655cf75f9e9d

                                  SHA512

                                  94a5cb52221635576c055572177dca1e8a2f866dae8b7d78eefab94afa2a6a17d324d95da32ff38a533fbc4675a8e4c4a08368381b0fc114071b308752475116

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                                  Filesize

                                  6KB

                                  MD5

                                  5ce31758dc298c4848e18a9e5f18a275

                                  SHA1

                                  74f6d0cc2cde3c9762981a9c8121ffcbee506da3

                                  SHA256

                                  455f56a3e758626697e68dc039a15a607fe2724a58fb25dbbda6d2d4d0f23a27

                                  SHA512

                                  b7952457573663b095357b0cb2b47ff2f886c1251026806cd3c10ac10dd199e58a7a9eb7875ebcf0ddd7aa7469afe5f8d64d70e90cbace56d858d682b8307ac2

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\1e7154cf-6299-48f4-bedb-c6f419a01bc9
                                  Filesize

                                  671B

                                  MD5

                                  a46b60fd31737eaacf6cf2d7f2771df3

                                  SHA1

                                  933f39e006a81758e65269f54658a83305326080

                                  SHA256

                                  a11c2af4579c1c90e2d451e8a6e797aa6dc7321370b1c24af2fe415434109e82

                                  SHA512

                                  a8a319f78086dd8c8e0c6a7950a409694cbc3d8a8fe203fb187910bc608afb01a3cec9d8df7214ab4d9b24af3eb9931af296e12e9b0c41139b7a4fb42d6fe489

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\7f4c29e0-c8bd-4381-973f-620841f668e9
                                  Filesize

                                  982B

                                  MD5

                                  62321df50a089591158ed2bacc5ede38

                                  SHA1

                                  6c44cdd59f74692d166deb68e9a1911ff3702850

                                  SHA256

                                  d39ce4c977c18e83eff5aa4f92bfc1edcdd957e44773cb8853edf0c3c6ffb94a

                                  SHA512

                                  6ecfda63ed11cc069951c6d9c0cfa423189ee3eb6760940c2a88c2c091fba02d52a1f119c815bf7702c4289c8f87f4eff265a2a9a2faae7ebe463829086b9619

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\c08cd6c8-f3f1-4c65-b111-22ff1ee8c077
                                  Filesize

                                  27KB

                                  MD5

                                  92a34ff8e7045247d164604f7b2c47de

                                  SHA1

                                  742b57c52e5d089c1b31d8a00e7eeeeb4fae1f49

                                  SHA256

                                  6be87beacdc51cf3e5355fb845fab767ff7696ccf53333802d7ca32391191352

                                  SHA512

                                  fae9c679dcc5882ca5126a2d896f2fe02ea08e86cbd142783753f93ddea3a6fa44a7c3dfa4ebd868d441dd64f2300286b7c079ba338760bc2b1528174b6b837b

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                  Filesize

                                  1.1MB

                                  MD5

                                  842039753bf41fa5e11b3a1383061a87

                                  SHA1

                                  3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                  SHA256

                                  d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                  SHA512

                                  d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                  Filesize

                                  116B

                                  MD5

                                  2a461e9eb87fd1955cea740a3444ee7a

                                  SHA1

                                  b10755914c713f5a4677494dbe8a686ed458c3c5

                                  SHA256

                                  4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                  SHA512

                                  34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                  Filesize

                                  372B

                                  MD5

                                  bf957ad58b55f64219ab3f793e374316

                                  SHA1

                                  a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                  SHA256

                                  bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                  SHA512

                                  79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                  Filesize

                                  17.8MB

                                  MD5

                                  daf7ef3acccab478aaa7d6dc1c60f865

                                  SHA1

                                  f8246162b97ce4a945feced27b6ea114366ff2ad

                                  SHA256

                                  bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                  SHA512

                                  5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                                  Filesize

                                  12KB

                                  MD5

                                  cc65febce1959fed63837332587595a7

                                  SHA1

                                  ec707de965bad5cdf33575ff32455ae608eff248

                                  SHA256

                                  7193a5f4af35d6aeb424f6e956bd680e498cb22d319f4a1604949b53071b695f

                                  SHA512

                                  67d9f0d65869cfb8d39e3d194cbfa1ce37c72e64e0f09b3b6d909b14c61ee1176a5c8148930b8767ef7ca9e247cf254a834b5210e1cb354b9879889445212a7c

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                                  Filesize

                                  10KB

                                  MD5

                                  204c19fa5053cace586d2f9a207cf724

                                  SHA1

                                  f6ae1958c88d3148813a82ad07f419da4ad0f79a

                                  SHA256

                                  71011f4aa597056576db496ac03765baa8d047377ec7a95aec2730128f568b38

                                  SHA512

                                  7ac3c5aad15b167d1be4d68a718e89a61f53786922aa9b86ade65213c91792a6c0c34b5eb4b27027acb83833d20c03c47a8b5f7bf3577b13a85f23d7b2abe110

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                                  Filesize

                                  15KB

                                  MD5

                                  0f1f970d74d119f6a521d4f18cc23028

                                  SHA1

                                  7bb44cb20007f2f1ec696730194acc6ed6ad0580

                                  SHA256

                                  23c1dfc64df8d1a708b297aa514900554caf8286cce885a18985e9b847e261a0

                                  SHA512

                                  3c5669dc920c01999666582863f966036010bef30b76682014b94f0504f28edad2e6a93495fd61c2c3bb5ece107256df81a631b0d6e3642b715f365a515c1a69

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                                  Filesize

                                  10KB

                                  MD5

                                  f908c525fda262b83a274ad9082f04ca

                                  SHA1

                                  51fb6abbe1ebbff445c4acd812920f82aef32648

                                  SHA256

                                  5657c522eeb77a0947fd016124f41fc7bceb901e5b6b6ecc91c1ba1c5de2ecb1

                                  SHA512

                                  fdcc89c788facd4c485ea37ff97492d4af6c01f5678170230ccd11f5a8bb3c1473f884f914e3751da278917deff60c06eedc2e01ef656b65f82031572ef23d2c

                                  Download Submit

                                • memory/1372-3436-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/1372-3383-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2024-105-0x0000000000440000-0x0000000001075000-memory.dmp

                                  Filesize

                                  12.2MB

                                  Download

                                • memory/2024-157-0x0000000000440000-0x0000000001075000-memory.dmp

                                  Filesize

                                  12.2MB

                                  Download

                                • memory/2024-156-0x0000000000440000-0x0000000001075000-memory.dmp

                                  Filesize

                                  12.2MB

                                  Download

                                • memory/2024-978-0x0000000000440000-0x0000000001075000-memory.dmp

                                  Filesize

                                  12.2MB

                                  Download

                                • memory/2024-1689-0x0000000000440000-0x0000000001075000-memory.dmp

                                  Filesize

                                  12.2MB

                                  Download

                                • memory/2024-844-0x0000000000440000-0x0000000001075000-memory.dmp

                                  Filesize

                                  12.2MB

                                  Download

                                • memory/2024-126-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                  Filesize

                                  10.4MB

                                  Download

                                • memory/2024-1052-0x0000000000440000-0x0000000001075000-memory.dmp

                                  Filesize

                                  12.2MB

                                  Download

                                • memory/2440-76-0x0000000075B00000-0x0000000075D15000-memory.dmp

                                  Filesize

                                  2.1MB

                                  Download

                                • memory/2440-74-0x00007FFCF2630000-0x00007FFCF2825000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/2440-73-0x0000000000E00000-0x0000000001200000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/2440-71-0x0000000000850000-0x000000000085A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/2684-88-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/2684-89-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4092-32-0x0000000000DD0000-0x0000000001282000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4092-21-0x0000000000DD0000-0x0000000001282000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/4188-155-0x0000000000500000-0x0000000000B82000-memory.dmp

                                  Filesize

                                  6.5MB

                                  Download

                                • memory/4188-148-0x0000000000500000-0x0000000000B82000-memory.dmp

                                  Filesize

                                  6.5MB

                                  Download

                                • memory/4408-85-0x00000000004C0000-0x0000000000772000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/4408-121-0x00000000004C0000-0x0000000000772000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/4408-152-0x00000000004C0000-0x0000000000772000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/4408-86-0x00000000004C0000-0x0000000000772000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/4408-82-0x00000000004C0000-0x0000000000772000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/4424-3593-0x0000000000810000-0x0000000000822000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/4440-122-0x0000000000B00000-0x0000000000F8B000-memory.dmp

                                  Filesize

                                  4.5MB

                                  Download

                                • memory/4440-154-0x0000000000B00000-0x0000000000F8B000-memory.dmp

                                  Filesize

                                  4.5MB

                                  Download

                                • memory/4684-64-0x0000000000290000-0x000000000092B000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/4684-78-0x0000000000290000-0x000000000092B000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/4868-60-0x0000000000920000-0x0000000000DC4000-memory.dmp

                                  Filesize

                                  4.6MB

                                  Download

                                • memory/4868-38-0x0000000000920000-0x0000000000DC4000-memory.dmp

                                  Filesize

                                  4.6MB

                                  Download

                                • memory/5072-84-0x00000000000A0000-0x000000000055E000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5072-68-0x00007FFCF2630000-0x00007FFCF2825000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/5072-58-0x00000000000A0000-0x000000000055E000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5072-66-0x0000000004F50000-0x0000000005350000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/5072-70-0x0000000075B00000-0x0000000075D15000-memory.dmp

                                  Filesize

                                  2.1MB

                                  Download

                                • memory/5072-65-0x0000000004F50000-0x0000000005350000-memory.dmp

                                  Filesize

                                  4.0MB

                                  Download

                                • memory/5112-3566-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-940-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-979-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-67-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-106-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-3596-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-158-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-1261-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-57-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-3587-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-2757-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-3584-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-3581-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-34-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-3577-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5112-3571-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5284-3082-0x0000000074870000-0x00000000749A4000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/5284-3081-0x0000000000810000-0x0000000000822000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/5680-3547-0x0000000000810000-0x0000000000822000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/6088-985-0x0000000000690000-0x0000000000942000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/6088-982-0x0000000000690000-0x0000000000942000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/6088-962-0x0000000000690000-0x0000000000942000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/6088-963-0x0000000000690000-0x0000000000942000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/6088-964-0x0000000000690000-0x0000000000942000-memory.dmp

                                  Filesize

                                  2.7MB

                                  Download

                                • memory/6540-3595-0x00000000004C0000-0x0000000000972000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download