amadey | 1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
Size

1.8MB
MD5

31c94a705843278521207a619f4dc460
SHA1

353e1befeb35094b09ce400ca3614418239427d0
SHA256

1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844
SHA512

213d77ce0e833fc3286d00bd9819782518d915f4d9abfaf348b111fd2e03ed10963f7da67329f0bb7d2d6ab2e501a9140578094ca5cb104308882f0bbb09f91f
SSDEEP

49152:oF+xhTcyqhDEpZBlxpEnHwGanmLkf3ORDZIIraL84:oFWcXWjlxqH1umLklpH

Score

10^/10

amadey lumma stealc 9c9aa5 mars discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://preside-comforter.sbs

https://savvy-steereo.sbs

https://copper-replace.sbs

https://record-envyp.sbs

https://slam-whipp.sbs

https://wrench-creter.sbs

https://looky-marked.sbs

https://plastic-mitten.sbs

https://hallowed-noisy.sbs

Extracted

Family

stealc

Botnet

mars

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://hallowed-noisy.sbs/api

https://plastic-mitten.sbs/api

https://looky-marked.sbs/api

https://wrench-creter.sbs/api

https://slam-whipp.sbs/api

https://record-envyp.sbs/api

https://copper-replace.sbs/api

https://savvy-steereo.sbs/api

https://preside-comforter.sbs/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	f665ef76cd.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f665ef76cd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	517ca028f6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d8c202163b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d8c8055510.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	517ca028f6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	517ca028f6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d8c202163b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d8c8055510.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d8c8055510.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f665ef76cd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f665ef76cd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d8c202163b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	skotes.exe

Executes dropped EXE 8 IoCs

pid	Process
116	skotes.exe
2188	skotes.exe
1108	f665ef76cd.exe
2420	517ca028f6.exe
4660	d8c202163b.exe
3376	skotes.exe
2028	d8c8055510.exe
1808	776dc63105.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	f665ef76cd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	517ca028f6.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	d8c202163b.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	d8c8055510.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\776dc63105.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009708001\\776dc63105.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d8c202163b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009706001\\d8c202163b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d8c8055510.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1009707001\\d8c8055510.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0004000000000749-145.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
5020	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
116	skotes.exe
2188	skotes.exe
1108	f665ef76cd.exe
2420	517ca028f6.exe
4660	d8c202163b.exe
3376	skotes.exe
2028	d8c8055510.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5032	2420	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8c202163b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8c8055510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	776dc63105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f665ef76cd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	517ca028f6.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
532	taskkill.exe
3612	taskkill.exe
4072	taskkill.exe
3752	taskkill.exe
2708	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5020	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
5020	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
116	skotes.exe
116	skotes.exe
2188	skotes.exe
2188	skotes.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
1108	f665ef76cd.exe
2420	517ca028f6.exe
2420	517ca028f6.exe
4660	d8c202163b.exe
4660	d8c202163b.exe
3376	skotes.exe
3376	skotes.exe
2028	d8c8055510.exe
2028	d8c8055510.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	532	taskkill.exe
Token: SeDebugPrivilege	3612	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	2752	firefox.exe
Token: SeDebugPrivilege	2752	firefox.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5020	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
2752	firefox.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe
1808	776dc63105.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2752	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 116	5020	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe	83
PID 5020 wrote to memory of 116	5020	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe	83
PID 5020 wrote to memory of 116	5020	1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe	83
PID 116 wrote to memory of 1108	116	skotes.exe	101
PID 116 wrote to memory of 1108	116	skotes.exe	101
PID 116 wrote to memory of 1108	116	skotes.exe	101
PID 116 wrote to memory of 2420	116	skotes.exe	102
PID 116 wrote to memory of 2420	116	skotes.exe	102
PID 116 wrote to memory of 2420	116	skotes.exe	102
PID 116 wrote to memory of 4660	116	skotes.exe	103
PID 116 wrote to memory of 4660	116	skotes.exe	103
PID 116 wrote to memory of 4660	116	skotes.exe	103
PID 116 wrote to memory of 2028	116	skotes.exe	106
PID 116 wrote to memory of 2028	116	skotes.exe	106
PID 116 wrote to memory of 2028	116	skotes.exe	106
PID 116 wrote to memory of 1808	116	skotes.exe	112
PID 116 wrote to memory of 1808	116	skotes.exe	112
PID 116 wrote to memory of 1808	116	skotes.exe	112
PID 1808 wrote to memory of 532	1808	776dc63105.exe	113
PID 1808 wrote to memory of 532	1808	776dc63105.exe	113
PID 1808 wrote to memory of 532	1808	776dc63105.exe	113
PID 1808 wrote to memory of 3612	1808	776dc63105.exe	117
PID 1808 wrote to memory of 3612	1808	776dc63105.exe	117
PID 1808 wrote to memory of 3612	1808	776dc63105.exe	117
PID 1808 wrote to memory of 4072	1808	776dc63105.exe	119
PID 1808 wrote to memory of 4072	1808	776dc63105.exe	119
PID 1808 wrote to memory of 4072	1808	776dc63105.exe	119
PID 1808 wrote to memory of 3752	1808	776dc63105.exe	121
PID 1808 wrote to memory of 3752	1808	776dc63105.exe	121
PID 1808 wrote to memory of 3752	1808	776dc63105.exe	121
PID 1808 wrote to memory of 2708	1808	776dc63105.exe	123
PID 1808 wrote to memory of 2708	1808	776dc63105.exe	123
PID 1808 wrote to memory of 2708	1808	776dc63105.exe	123
PID 1808 wrote to memory of 4300	1808	776dc63105.exe	125
PID 1808 wrote to memory of 4300	1808	776dc63105.exe	125
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 4300 wrote to memory of 2752	4300	firefox.exe	126
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127
PID 2752 wrote to memory of 3160	2752	firefox.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe
"C:\Users\Admin\AppData\Local\Temp\1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Users\Admin\AppData\Local\Temp\1009700001\f665ef76cd.exe
    "C:\Users\Admin\AppData\Local\Temp\1009700001\f665ef76cd.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\1009701001\517ca028f6.exe
    "C:\Users\Admin\AppData\Local\Temp\1009701001\517ca028f6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1528
      4⤵
      Program crash
      PID:5032
- - C:\Users\Admin\AppData\Local\Temp\1009706001\d8c202163b.exe
    "C:\Users\Admin\AppData\Local\Temp\1009706001\d8c202163b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\1009707001\d8c8055510.exe
    "C:\Users\Admin\AppData\Local\Temp\1009707001\d8c8055510.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\1009708001\776dc63105.exe
    "C:\Users\Admin\AppData\Local\Temp\1009708001\776dc63105.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3612
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2708
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4300
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2752
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1768 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32d8494a-0a92-46b5-b821-9a0681a4da6f} 2752 "\\.\pipe\gecko-crash-server-pipe.2752" gpu
        6⤵
        
        PID:3160
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {244fea29-4753-4d32-9efa-89bfa6f76509} 2752 "\\.\pipe\gecko-crash-server-pipe.2752" socket
        6⤵
        
        PID:3376
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3200 -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3256 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36988bf5-7e36-4815-8743-5666f10dfff2} 2752 "\\.\pipe\gecko-crash-server-pipe.2752" tab
        6⤵
        
        PID:4608
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1392 -childID 2 -isForBrowser -prefsHandle 3044 -prefMapHandle 3500 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94d90b24-e627-45dc-9639-6ea0cfd95e1c} 2752 "\\.\pipe\gecko-crash-server-pipe.2752" tab
        6⤵
        
        PID:1532
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2792 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4532 -prefMapHandle 4528 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2e638dc-6e9a-4ad4-9139-0a8820ab933c} 2752 "\\.\pipe\gecko-crash-server-pipe.2752" utility
        6⤵
        Checks processor information in registry
        
        PID:4844
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5344 -prefMapHandle 5304 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5f6ce44-b50c-4869-a1a0-65de952a2d31} 2752 "\\.\pipe\gecko-crash-server-pipe.2752" tab
        6⤵
        
        PID:5108
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 4 -isForBrowser -prefsHandle 5468 -prefMapHandle 5308 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df339408-074c-44b1-911a-e8d09122cd93} 2752 "\\.\pipe\gecko-crash-server-pipe.2752" tab
        6⤵
        
        PID:212
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 5 -isForBrowser -prefsHandle 5664 -prefMapHandle 5668 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be310d79-17df-40c3-b597-3baf7f7d2774} 2752 "\\.\pipe\gecko-crash-server-pipe.2752" tab
        6⤵
        
        PID:3092

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2188

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2420 -ip 2420
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
f90305b7b1c763353b89451156688892

SHA1
585f29ba8bfbdbe2d71a679d646620ffb8184ae7

SHA256
beae39bed2df3d9c56270484cd9a1fe9f08a1034fdb3910f44d7a679af8c5ede

SHA512
b13a7c7376ac7fd51c64b3bb030efb7a5d08dc1e75317fe67c6e02c16b3c2f36d4f05ce591225e75d4362ba93f835b9eeba48a55a54a2cf2172de6083ac7aefb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ws2kncw.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

Filesize
13KB

MD5
ce08f4b5abb6b41c9c2efbd929f50118

SHA1
19a23ced6ac922c082a0ec47bf2826e2826d9aa8

SHA256
c37ac472f73dc35b48ce6a816b170741182acf4149650fa3321235363d4ed2da

SHA512
62dac71694f635728f9d753abc2dbdd5c8d2dcf056e837c1208da288d60cb73623bf0fbd64f48372eb4fea7afad3e43bbe349c1bf09bc2e99ab85b304d9d1182

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009700001\f665ef76cd.exe

Filesize
4.2MB

MD5
4bcd8434cc97b519bca80f43b1d034da

SHA1
3d79f8ffeba4b4a35a22c906a5d00e7fe9a10806

SHA256
0f84f1e318a8dae44ff42a87ac50a1a3ba377581a5e085c63273416f4869782d

SHA512
12d02ac1db593bbeb8e58bc2281c039775708c2efc98dd6729a09e695f66167f1ee6cfb054512646a8165277e5ef329e5b9234407236ee132ca32a9bba1dc49d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009701001\517ca028f6.exe

Filesize
1.9MB

MD5
6ba0ff60198b03afd07582c6aff563d7

SHA1
8dab834965d3cc0650b097cd125d2c5bc8b6c935

SHA256
412d670ac2599ddbcf3981a1792728d52c5fefdc7a3466bfca844e24c6da4cb7

SHA512
30f3f2e116119a5dee06004647b81db1e2a9c685a94d304845f475de9a351e1f665abfe3e92fc56fc1217a902a6ade76f4e933f1279d6d1a1312635d3a7cf3f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009706001\d8c202163b.exe

Filesize
1.8MB

MD5
8b37da1bb0f8d2953a81c329b8d5f88e

SHA1
d184f08cdfc764911a0adc57b86031519657efd6

SHA256
35eb71c559bf09fdb27c7a8707f6e9aaec240f24a514028f7bc5b5f064b7c6cf

SHA512
415577986654b15fceb5b98a03777866137bad972b591aeecbbf877a8f10fd9e4088e69061980431d756cb6f8f22413d3fc31bd0e8ddf1b0466240852e05aeda

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009707001\d8c8055510.exe

Filesize
1.7MB

MD5
3b7e466fd21f3c2b1e1fca4d5136dc93

SHA1
3871dc84a2202a4332e57ed02c30cbe16d33c53d

SHA256
97fba946befc5ff0f020c308a7ad04b42abc02db76908f3f3664bb61107f052b

SHA512
6faefc00ff8502afb4851a7b60b857406c2d26e9ebddcfcc54acc2475d7c182d7b09d271b425a0e6172a5be478e5482cfae2a78b1b5f946248e0c617cd671787

Download Submit
C:\Users\Admin\AppData\Local\Temp\1009708001\776dc63105.exe

Filesize
901KB

MD5
6e14b66ebcc04bfc182ccfc99ea5d697

SHA1
d712c2bc886583abea48c9d1894b18725cb8d212

SHA256
04113eb183cc5090f463c3640e1d240cf230fcd84f7b6fe7f26f6bfd134282b1

SHA512
7f03e1793726165cb5e0e5362330db1f0d33e527e95d79edbb18c1b45091657d9df02d4bd37c8bc75dba776a8599a23799ee5f88862826b5748ec59a63f352dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
1.8MB

MD5
31c94a705843278521207a619f4dc460

SHA1
353e1befeb35094b09ce400ca3614418239427d0

SHA256
1550b5a58982b5fd9ae6db9acd4e1e6f3903ca133cde8ed4fe2bd0f5c8f2a844

SHA512
213d77ce0e833fc3286d00bd9819782518d915f4d9abfaf348b111fd2e03ed10963f7da67329f0bb7d2d6ab2e501a9140578094ca5cb104308882f0bbb09f91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
6KB

MD5
b1508dbf6b348a979f52d31b11823472

SHA1
0c56c90ddfdac6306a3f43b4bb4657c851e8e904

SHA256
dfac4bf58920b36a981817df93e02a08ca2fff1a761709d2077cd91ba1028e7c

SHA512
17457524bd8b98994d5006003fc0e1a93e90053d9d95aac1e94b0d5ed5d15c396ea6eaa6d078caa375c1ba32b7018dd613baf8cd15abba1309e89bf7a2b30e89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
7KB

MD5
89f569fdbe82bf59801cccd22bc50437

SHA1
5d149d0ad5a9a03091440e398379b784bf1c6c17

SHA256
74f469a338bf2024725cbf9143fb54b344408a8e913aa6d6bdb3de15f2476398

SHA512
80a2978e82f22d49bed66ac3e58e03359b8194e4e1cbc8be52b521b76939c09590f7014b7672990ca8769eb74a7e0ac0b787f7b01698c4a607383039b3ead791

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\AlternateServices.bin

Filesize
12KB

MD5
3bb670d4bf810912af45b53039e7af92

SHA1
fb0f755608e9228e888ed4c8462c0c6352b5d796

SHA256
2d81f513ee0ed9b32c0474b1ac17d4693096ba18f5c99f97e389af657c7f96e1

SHA512
ba42dbd7e020660448e7724dd3cee0afde87e4faed2a0bc58b9e6ba68db89f76f07aade8b4424331921f0ce3b48725f4ff9be16fbe0b93ce95fd0f2f708d1cbc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
bcb43390997b2cd14506bdd5afd34f1f

SHA1
5bbda9f42061ed8b60779dfa510638eae591cbe6

SHA256
805d63c074effdbb517b718f03195e0775d4d5aa89d55188618a6d816663054f

SHA512
829e8d1d06dcd8c2556f28972c7b64cb9c42985861901fd2346229f7b641ec7b32344da47e977c0f5c89975383e1f5b4191430929634dff2908eb9119df23ba1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
0a9b61122740644ba4c9211aac935836

SHA1
5f35d57c523af02fde482aef02302c7a672e70c4

SHA256
6f43cf896e103064e60d6e854ce4275d665790a6e2a05f158f6c1247fb7bc35d

SHA512
a7c77e8439aad310cf799d36431e0b725647583908fe8c78c20e5802efe6e184c8d78355cc30ce3701e9c1a29dad133e1dce8b4a565fd4c1c48f1255f65c3445

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
866fda3d7da039cb696ec12d38283c8b

SHA1
a9ed6d5be985adcf8599f42368cad6b1230c2b5a

SHA256
016b3d87fdf814dd887f0ebceb662cf624e384f4ed086577dc6778241d2a8111

SHA512
a7900cfe5b448b41fed7e80718675caf5915c60d3fe299effd836c0982204d72814ca65d06c4c79c2a4c72d092045d62703bcf57d81b5006e1ace0e3d33c8d94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\839fc09b-8ccc-4344-879b-54d73114325b

Filesize
982B

MD5
afdb0a1971d040915a9ca86546db9518

SHA1
11309e4327ee5761c03dda409b1a2df08867c18b

SHA256
65e885ba09893f5c2e382a42b044097615b7b969a88ddb50618231cca2e1e433

SHA512
ff4494f859c4fecfbbcdda79363d17b7330841cf7a93eb408e23ba9bf9683ea090854f624090d4b45bbf2d5c453983d8e614550bad1a70beb8070290ca4ea663

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\9e2b0fb7-48a6-45d9-b4f5-675643ad771a

Filesize
25KB

MD5
5f221497bca9cbe9bfd200909633d25d

SHA1
33fdf06247153735948767111594235ba4c39ac2

SHA256
9b909adccc03d9c2fae08998cf6197d681049c382b8377c9e8b0248fcacbe5e7

SHA512
9b4a7e0326d2d45e0e5f349ab60b067108013b2f9dd6d29cd61572596cf0ddb560a59800b3053ebb7727ce280e5e9cc505f1259a101cb8d4de31495cb7d9e129

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\datareporting\glean\pending_pings\d8808429-5e75-45d5-a7e0-ae22921d3146

Filesize
671B

MD5
9a8d2a50bb7c52615b009f48888946c7

SHA1
9200d0aa64ea347c82deed16ec495d300c58ed4a

SHA256
1060b59bcb815ed6fafa55a6cbd24969b73a07c279cf3c7d84796d4eac36c3d4

SHA512
590deeadd5868fa382b74fa457aeb1f5d13d8b6bbe7e5b9f9c56d249060a1ddcafb98d962c7a109876d41c2156d82c386190ad4b18ef0d2f5f025c20face3626

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
14KB

MD5
353329ddf2d2ad57989703dd0f47e2fc

SHA1
a354769bfa3846f635e8565b546c688a274b4c64

SHA256
16a8bfecb450af5cd8f4fab011fcfc9de6b2a557b5e657d66e06f0083babbd4b

SHA512
34b16643ee7cfdfa0227ad03517e9820b0c6410bd9b55950eaff869164b760567fb53d0e8b87349bf4488bf71b169c7fe6069b502a6b380c19fcaf7890b7775b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs-1.js

Filesize
11KB

MD5
068647c2457815c5324a09be00043385

SHA1
7df1752486e3b1b3109310b774e50746595f6019

SHA256
2874f9530e4da4ce1615cadaf7342a373a296dbcf4b9c021ed4b152580178534

SHA512
f459348ffaf990516b4708e9dc9034c1f8abf43c958202614a21b05ef3be50c42f252492cc31e088cf31fabfe2d34caf1ad5cdbba744c7a43395f2af1a818a83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ws2kncw.default-release\prefs.js

Filesize
10KB

MD5
59b56fc4cff957b14d33bcb7cf5f97bc

SHA1
0a9f54a0269ad08596941036d1153e8cd1ffdb5a

SHA256
21a2cb74399e7e57ccbf26a90d888fced08fd9f37805f11132d8a77016f2a8bc

SHA512
add620576fc42eb3c4400c2e4270714af5f09a08eb8883023cf4082c4fde8cf84871a068ddfdee9a508b46cb3c3c5f22de35c67935cbcfb55e7e96d713a3fb6b

Download Submit
memory/116-22-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-102-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-639-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-68-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-498-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-17-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-49-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-80-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-19-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-32-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-25-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-547-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-24-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-23-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-110-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-140-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-21-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/116-20-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/1108-48-0x0000000000190000-0x0000000000DF9000-memory.dmp

Filesize
12.4MB

Download
memory/1108-50-0x0000000000190000-0x0000000000DF9000-memory.dmp

Filesize
12.4MB

Download
memory/1108-67-0x0000000000190000-0x0000000000DF9000-memory.dmp

Filesize
12.4MB

Download
memory/2028-129-0x0000000000D80000-0x0000000001424000-memory.dmp

Filesize
6.6MB

Download
memory/2028-136-0x0000000000D80000-0x0000000001424000-memory.dmp

Filesize
6.6MB

Download
memory/2188-29-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/2188-31-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/2188-27-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/2188-28-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/2420-109-0x0000000000400000-0x00000000008B9000-memory.dmp

Filesize
4.7MB

Download
memory/2420-66-0x0000000000400000-0x00000000008B9000-memory.dmp

Filesize
4.7MB

Download
memory/2420-138-0x0000000000400000-0x00000000008B9000-memory.dmp

Filesize
4.7MB

Download
memory/2420-101-0x0000000000400000-0x00000000008B9000-memory.dmp

Filesize
4.7MB

Download
memory/2420-78-0x0000000000400000-0x00000000008B9000-memory.dmp

Filesize
4.7MB

Download
memory/2420-72-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3376-113-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/3376-112-0x00000000006D0000-0x0000000000B7F000-memory.dmp

Filesize
4.7MB

Download
memory/4660-97-0x0000000000840000-0x0000000000CDF000-memory.dmp

Filesize
4.6MB

Download
memory/4660-105-0x0000000000840000-0x0000000000CDF000-memory.dmp

Filesize
4.6MB

Download
memory/4660-114-0x0000000000840000-0x0000000000CDF000-memory.dmp

Filesize
4.6MB

Download
memory/4660-139-0x0000000000840000-0x0000000000CDF000-memory.dmp

Filesize
4.6MB

Download
memory/5020-0-0x0000000000760000-0x0000000000C0F000-memory.dmp

Filesize
4.7MB

Download
memory/5020-18-0x0000000000760000-0x0000000000C0F000-memory.dmp

Filesize
4.7MB

Download
memory/5020-4-0x0000000000760000-0x0000000000C0F000-memory.dmp

Filesize
4.7MB

Download
memory/5020-3-0x0000000000760000-0x0000000000C0F000-memory.dmp

Filesize
4.7MB

Download
memory/5020-2-0x0000000000761000-0x000000000078F000-memory.dmp

Filesize
184KB

Download
memory/5020-1-0x00000000773F4000-0x00000000773F6000-memory.dmp

Filesize
8KB

Download