Overview

overview

10

Static

static

3

9f93c23902...64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2024 09:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9f93c2390294158f80441dd983a60341e8a9d18f620aeed09586612ffb818064.exe

  • Size

    7.0MB

  • MD5

    0741230a5365c5420ae36cb7fdcebc69

  • SHA1

    51d11a8a170a55ed0b99f83f012ce90f49aea04d

  • SHA256

    9f93c2390294158f80441dd983a60341e8a9d18f620aeed09586612ffb818064

  • SHA512

    68c6a2fb63ceaad6917d2c943bf9f9b1b76ffc9e2cb6b5e48f37278ade1701fddf6f8c2d66b366f3d7338eaf0089cd45894ea204f5eba4cdf4cdf255a4b0bf65

  • SSDEEP

    196608:NBWDZEsZY4I582m0SZSQ/HVzPPg+DhUMOd:N4DBC4W82NW91zng+DhUMOd

Score
10/10
amadeylummastealc9c9aa5drumcollectiondiscoveryevasionpersistencestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 20 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
    collection
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3424
      • C:\Users\Admin\AppData\Local\Temp\9f93c2390294158f80441dd983a60341e8a9d18f620aeed09586612ffb818064.exe
        "C:\Users\Admin\AppData\Local\Temp\9f93c2390294158f80441dd983a60341e8a9d18f620aeed09586612ffb818064.exe"
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T9j17.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T9j17.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2060
          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Q6l63.exe
            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Q6l63.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:400
            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1K20E5.exe
              C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1K20E5.exe
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3236
              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4952
                • C:\Users\Admin\AppData\Local\Temp\1011118001\HRFuUub.exe
                  "C:\Users\Admin\AppData\Local\Temp\1011118001\HRFuUub.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4920
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
                    8⤵
                      PID:3392
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1120
                      8⤵
                      • Program crash
                      PID:2312
                  • C:\Users\Admin\AppData\Local\Temp\1011233001\tpZOod0.exe
                    "C:\Users\Admin\AppData\Local\Temp\1011233001\tpZOod0.exe"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1400
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
                      8⤵
                        PID:4808
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1128
                        8⤵
                        • Program crash
                        PID:1584
                    • C:\Users\Admin\AppData\Local\Temp\1011260001\0451458421.exe
                      "C:\Users\Admin\AppData\Local\Temp\1011260001\0451458421.exe"
                      7⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4576
                    • C:\Users\Admin\AppData\Local\Temp\1011261001\e55b334a80.exe
                      "C:\Users\Admin\AppData\Local\Temp\1011261001\e55b334a80.exe"
                      7⤵
                      • Enumerates VirtualBox registry keys
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4796
                    • C:\Users\Admin\AppData\Local\Temp\1011262001\ACkcr88.exe
                      "C:\Users\Admin\AppData\Local\Temp\1011262001\ACkcr88.exe"
                      7⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Checks computer location settings
                      • Drops startup file
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2760
                      • C:\Users\Admin\AppData\Local\Temp\StilKrip02.exe
                        "C:\Users\Admin\AppData\Local\Temp\StilKrip02.exe"
                        8⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Drops startup file
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5500
                    • C:\Users\Admin\AppData\Local\Temp\1011263001\65ebbc6d40.exe
                      "C:\Users\Admin\AppData\Local\Temp\1011263001\65ebbc6d40.exe"
                      7⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3564
                    • C:\Users\Admin\AppData\Local\Temp\1011264001\baf5e99cb0.exe
                      "C:\Users\Admin\AppData\Local\Temp\1011264001\baf5e99cb0.exe"
                      7⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5312
                    • C:\Users\Admin\AppData\Local\Temp\1011265001\9e46fd4d5e.exe
                      "C:\Users\Admin\AppData\Local\Temp\1011265001\9e46fd4d5e.exe"
                      7⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:5432
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM firefox.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5396
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM chrome.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4152
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM msedge.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5900
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM opera.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7140
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /F /IM brave.exe /T
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5604
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                        8⤵
                          PID:2860
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                            9⤵
                            • Checks processor information in registry
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:3300
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2040 -parentBuildID 20240401114208 -prefsHandle 1968 -prefMapHandle 1960 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a424701-16be-4c3e-9ae6-e8e79826a2c4} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" gpu
                              10⤵
                                PID:732
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2448 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {700ecdf0-a8d5-41ef-bf5e-8282dab2283f} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" socket
                                10⤵
                                  PID:5384
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3052 -childID 1 -isForBrowser -prefsHandle 3212 -prefMapHandle 3208 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0dc8162d-c5fd-49b0-bb64-90175e4c11a2} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" tab
                                  10⤵
                                    PID:1716
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3196 -childID 2 -isForBrowser -prefsHandle 3896 -prefMapHandle 3892 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05bf6695-c4f1-4bdb-941f-f21f91c5eb37} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" tab
                                    10⤵
                                      PID:7024
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4840 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4832 -prefMapHandle 4828 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6923af34-3bfb-4e7c-94f3-6856b7193fd7} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" utility
                                      10⤵
                                      • Checks processor information in registry
                                      PID:5564
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5216 -childID 3 -isForBrowser -prefsHandle 5144 -prefMapHandle 4740 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1659657c-3249-4f91-bea6-3a1b2daf7f5f} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" tab
                                      10⤵
                                        PID:6568
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 4 -isForBrowser -prefsHandle 5492 -prefMapHandle 5496 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42dae40d-f700-466b-855c-4d65ed23d5ce} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" tab
                                        10⤵
                                          PID:5284
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 5 -isForBrowser -prefsHandle 5716 -prefMapHandle 5724 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d14cf86-d059-4ad8-9567-3b4e9ef9fc90} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" tab
                                          10⤵
                                            PID:6464
                                    • C:\Users\Admin\AppData\Local\Temp\1011266001\11733933fa.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1011266001\11733933fa.exe"
                                      7⤵
                                      • Modifies Windows Defender Real-time Protection settings
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Windows security modification
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4856
                                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2a1144.exe
                                  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2a1144.exe
                                  5⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3000
                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3I37F.exe
                                C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3I37F.exe
                                4⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4440
                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4X366Z.exe
                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4X366Z.exe
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:8
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2020
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                            2⤵
                            • Accesses Microsoft Outlook profiles
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            • outlook_office_path
                            • outlook_win_path
                            PID:1584
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4920 -ip 4920
                          1⤵
                            PID:5016
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1400 -ip 1400
                            1⤵
                              PID:4872
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5656
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5340
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6168

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Defense Evasion

                            Impair Defenses

                            2
                            T1562

                            Disable or Modify Tools

                            2
                            T1562.001

                            Modify Registry

                            3
                            T1112

                            Virtualization/Sandbox Evasion

                            3
                            T1497

                            Credential Access

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Query Registry

                            8
                            T1012

                            System Information Discovery

                            4
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Virtualization/Sandbox Evasion

                            3
                            T1497

                            Lateral Movement

                            Collection

                            Email Collection

                            1
                            T1114

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\activity-stream.discovery_stream.json
                              Filesize

                              19KB

                              MD5

                              2b2e8e45efd8397d334db859437af80a

                              SHA1

                              17e00437d753a5bdd14dad9b0714514d09fc538c

                              SHA256

                              76339e86f278ab02df87abcc831982a12a7c2d383acb9bc5a186a264f5deb681

                              SHA512

                              6950331f78c6f7d3fe96206e1d19c4a2aca73881fd1154c45fe5a7e42c3544669f8766f9d220da59f759b4b67350789f1a2dd1ae4dbd471f6d1a92e7aa24a213

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                              Filesize

                              13KB

                              MD5

                              f0c4dbe421fe69c94a9c2e25d270c0f0

                              SHA1

                              efb9dab3f2e458f4c547d77de9f73c337b8db2ca

                              SHA256

                              7b45019b79833294c352d109d0cac1c122f6491d44c0349f1fbbc32575c26d0c

                              SHA512

                              1a308d718c6cdb84dbec691ad5ba7466ae7c88a8e5c4c87118722f69d6bef94ccdd5bf308eedb36704367c995245e517299c5d9deb50a158233c57de426fd049

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\lhmx4teg.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                              Filesize

                              13KB

                              MD5

                              a71b8f801e585176a6391b9b68a9736f

                              SHA1

                              17a683a9c5783e9ea2f0b3208ad88bb2197756f8

                              SHA256

                              fe04d83c16ebb674731d5741b13d846150e88c634e1f785d0e90a73cb3a24f46

                              SHA512

                              18c635d8ced49bdb08e4154094205d2e503970d6a7c5912d97c916682a8231c6260fc88763ef57f8abf09dbf15f414b2e1d115fc74652cc51a1fcc3bed6cdaf8

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011118001\HRFuUub.exe
                              Filesize

                              217KB

                              MD5

                              98da391545b4823ca67e6cc3a927dae9

                              SHA1

                              d2f66837884d6d65dfe21372501cc7ba1d91ef29

                              SHA256

                              12862b60140f019b0c251da7be59caf90d93eca6a30d016609cf2ff1da4652a7

                              SHA512

                              59130547c169768310d57c075f2cec01a71704e9658955ef8eb1c6b2c30a24a801623f189eac14a84357aa597f5d5c96c5c9f8e96ee4ddf7bcf911dcf6bcb7b9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011260001\0451458421.exe
                              Filesize

                              1.9MB

                              MD5

                              870c92cf89253baeaf80574aaad15adc

                              SHA1

                              feefb55fa434ceb4aa10997bedfccd5597852078

                              SHA256

                              65238eee07b00d608d030a601ebe0878656466084e1f55e9e41258bec1370b59

                              SHA512

                              fe1cf7efa897c4c4fada01ba67ef38e7491d96870ab32354b0acbf2bb0cfa32faf914d05037d6e813fcc9b1241466acdaa178adeacc2451ea371f1189e7923c6

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011261001\e55b334a80.exe
                              Filesize

                              4.2MB

                              MD5

                              818532da27c6ed97768ab94607612f66

                              SHA1

                              99216af849b745434d0e728400a5da9ea0eac96f

                              SHA256

                              0db9cd98808b856cc4e61818330ff6a1ec46621ab9b30e779078f2fb78feb36c

                              SHA512

                              ae6d4008ad40a08ad23b7b460c53af287c923171973cd8c090e5abe0b3b67f14aa291f8ece578697405e6c263c3316c5f19c8a94c64a8cbe4b7496dc345b6224

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011262001\ACkcr88.exe
                              Filesize

                              2.6MB

                              MD5

                              930aa8b0501cdff28c8c3118c114381f

                              SHA1

                              077601f341482965542cc1f640819db44ba4a6f4

                              SHA256

                              aa43b00f0dd6b8af4c0873667834c27379aeae99cd97cae41b5535422730f67a

                              SHA512

                              51e357c9b032885ac664156c4182847b7f77c176477d1110dc259ad666055ee583b053444e24812d6b44b9e65d78279a0ae1e19f54bffa0028e23aa04a656cb5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011263001\65ebbc6d40.exe
                              Filesize

                              1.8MB

                              MD5

                              6f5a7a7f9a46fd0da229545348913e5c

                              SHA1

                              d330460aba0ecc2770d8fbfc01e16872d707d3d7

                              SHA256

                              ba2afd3ee3032a75f33fc23e16baf8668d908b3aadf5409adf1a2229f650b6ca

                              SHA512

                              b5614c8f49fc5e664c56c58423eb9542d9a26e8ec46a47e44669f309aa6c7c3167fd34ff0795c9d45b4e4b9c17e4a1422b0e2720667e482c617869e6e0b4111f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011264001\baf5e99cb0.exe
                              Filesize

                              1.7MB

                              MD5

                              ba8f4e56bc87dd31c14f261fcb6fc787

                              SHA1

                              e489f9de5c0a3200c1eb0750bb780ee0ccbb5787

                              SHA256

                              b48cd4d2e3cf5422795b27120cb8e7e9d266455aa5e6b94e7f3b81dc07e50179

                              SHA512

                              14a867f735244d79844a64566b5984b77a4e24dfba7f98264e480a56771e754bbf6e0a561d8e739a5c0438235e8e774b7cc52c7a8d99c850a227206e37f49800

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011265001\9e46fd4d5e.exe
                              Filesize

                              950KB

                              MD5

                              142fda9b3135a1cbd7edf1da4fd678a3

                              SHA1

                              7b392d29d9ffdb7de8e22ed7baab4056100d6da0

                              SHA256

                              effd3f265083a3af0f420c02048dd4b9240d416dfdb32a99ae700329429592b9

                              SHA512

                              b29979ced7b55d692e5194a2cb27f810768e4dc798eac9b5bb0d63ab55a1e86913fcef7c0789968f7f3a6ff3fdbea50777f10186a55094808c21f69920c700fd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4X366Z.exe
                              Filesize

                              2.7MB

                              MD5

                              64775ade379430e762af6d894815bd24

                              SHA1

                              cb8db298ac03464f912a822f6335f9b4bdcdfa4f

                              SHA256

                              b92243b5b82aa58419dec103e84c63ec7c46149c2fab6520f041ceaf92655c71

                              SHA512

                              bff1f4e815e35a8bb512fd1dfd223d8caf79847b2d7cb319557c9dffc3090070b71656e819f5350a8c5f8d92034f0cc472e889e207279dfc12c0f0b57204f015

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T9j17.exe
                              Filesize

                              5.4MB

                              MD5

                              7dc3637920b246bbd45bc03c7eaaf4ba

                              SHA1

                              1351c511a4e622be8d7a7e306f8d2ad3022db39d

                              SHA256

                              9ccf5e743ab3abd3923c8117bc89db9a92f369d1c9210dde8bf9889cd745dab3

                              SHA512

                              ab29f8581282d1a258c894ef789c816e63c376d35ced7f4272f13eff4c97e0f69a48b52781a492128b4b872dddb026d90d96b7c56e95314b85d7256a7b9d5c0c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3I37F.exe
                              Filesize

                              1.7MB

                              MD5

                              f9e8c178565263aaa83c1f3bb392bd90

                              SHA1

                              634e3b6b849af9f8a3f7192fcfd77e761a1b1b11

                              SHA256

                              bf9612df7ae108f00c42fe875dccee3da8988049d505e1ac08ab848eec5d52c3

                              SHA512

                              f8569bb10d51c701765e8c1cc381f6231bee273025aceefa6ba7afb088100a21d0ef3a14192c57658b835b86010fb05096e9a9e74104bf5a350712407e58a444

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Q6l63.exe
                              Filesize

                              3.7MB

                              MD5

                              dad0ff3abfb02527660ec174ac5e9d22

                              SHA1

                              eff96ad8e9591094a49a7664762de7876b367fb1

                              SHA256

                              bab519975df106aa65e026522bc5ff4acb60fdf7f925ceed212bbd543a2ea076

                              SHA512

                              05757ea39930cb797c39b854c20dbd33e4b4a9664840061f12487ef02536a292f4ed17d7a6412924580ebb4329573c8f61f5958cb27deffa3c368d5ff2bfa912

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1K20E5.exe
                              Filesize

                              1.8MB

                              MD5

                              1f6294fca2fa8c5e80eafb976f65aa60

                              SHA1

                              d0d52c6af42cebe1dc967635d1d4f9d2a2a40ebd

                              SHA256

                              f72dcfa8ca3dee1079c951692be0b687f51586cace5d485f29e1ae55fb0f7813

                              SHA512

                              aef446a9e5656bb820e8086e053972e70d4f2a315918d0c298def9610c1376c9575b91a7c3f4c1677788f8edb88d0acdffa854f417e03c63f0be90995d1c3257

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2a1144.exe
                              Filesize

                              1.8MB

                              MD5

                              945ee80ae4700449bfbedab4bb5fa230

                              SHA1

                              b8352840adc62f39cce6afb800b8e80b558deebf

                              SHA256

                              15330235cac3dc958d645bd2886543648c6e819a2cb5fd27fb7d1633b51fe521

                              SHA512

                              69c92c8be41de1af344f7527d553b2f409a028eb6301c4c70529f8594e0ed4b2b59cfc93842a50ecd8855cf1518ab47d12cca7e309b6868133a45f4f4947b9b0

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\StilKrip02.exe
                              Filesize

                              1.4MB

                              MD5

                              f461e01a63ac5aa5f20ed2c7d8ebba33

                              SHA1

                              1ebb48942f7479c0d66c4d6391c23fb09e11380b

                              SHA256

                              7953c3b4f3ebd559a24da37959ddaf584e4795820ddcd596a81d307451e8070b

                              SHA512

                              3ba32ea5fadc251a48fdbcccdf4543744963ad2729d7d0883752c502d46ee6ed3ce9248f5e3c2cdd9b93f21def8db6ab97928b9cf73db56bace4e429fbc061fc

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                              Filesize

                              479KB

                              MD5

                              09372174e83dbbf696ee732fd2e875bb

                              SHA1

                              ba360186ba650a769f9303f48b7200fb5eaccee1

                              SHA256

                              c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                              SHA512

                              b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                              Filesize

                              13.8MB

                              MD5

                              0a8747a2ac9ac08ae9508f36c6d75692

                              SHA1

                              b287a96fd6cc12433adb42193dfe06111c38eaf0

                              SHA256

                              32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                              SHA512

                              59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
                              Filesize

                              12KB

                              MD5

                              b7f69b1959dedc1d6bc739e1052594bb

                              SHA1

                              968e26cd37fdeadfa7ca00e54daf35bff4efad68

                              SHA256

                              d0088f1fec328e90a579c5f9585e8059c8e61c12d3b202925bcb63bbd9d4e62c

                              SHA512

                              de04f289ed85b1adf3fa3cab986068cce968b599d142d69a96e8d03a88650ea18ef0859d984ca0b9f37546887d0681d2489a0bbade14f78cae7a0d047886befc

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\AlternateServices.bin
                              Filesize

                              6KB

                              MD5

                              ecbd9e30ff324b4a1600ef6e9da7d473

                              SHA1

                              6c34908fdf7dfe1cea18fed9b88ece615f5dbb6d

                              SHA256

                              de8ca0170781ef31ac7fd172dbca96c82a037ad6819fcd1407e0fb1bad697a70

                              SHA512

                              ee06075fe009ea5ddd6be9e1590ce9ffb559447d8a420cdaff79ed7f219899889b846afd19e523c5947089ad77f79704ca352e8af84026c35898b472249c6ad0

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              15KB

                              MD5

                              f8e3ba94039f7e3fff66949b18d556bd

                              SHA1

                              dee2e4e466a5f213cb1bb2de24ae813e5bbaffae

                              SHA256

                              a9a317438ddaffd9fc25d6be1f138a1a06b5e49d1485bed5b4da6b2521a2a2e1

                              SHA512

                              82af5d3f2c4cc66258b8d4a69559a08b3ff99d321a476eb16179852e976230892825376d647cd4054addd2a4dae9f69b1efd8a64922cf5ddb0902bd406908bd7

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              15KB

                              MD5

                              ccb6f5cdc3556ae9e4c6a7cc2474b959

                              SHA1

                              c1df787da951719bf0f87557f946f00126c7cce5

                              SHA256

                              2bb1a1cc41bc96236c4332015e6b68af73334e762fc0694e38ee9e759076674c

                              SHA512

                              105fe976a98faeae49a418dd2ac33b69c220e6e358599091b6160b7262e149c4823d6c52ecec811888f141710118b6f041343d0045947b35e4957499cc46cf7b

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              15KB

                              MD5

                              fa2247309fb7fe2a23ceaedc22340e70

                              SHA1

                              04821900bd00c55d8dfb34c2fc1e357f22c9bd3c

                              SHA256

                              87427b2a3cd3a858c3ce15bdcddd9f40895b6a647be6d2602998998859043266

                              SHA512

                              01e231628520bebfbeb18e946abed9c9fce972173623c96e2e73a944e342feec6e3a48c721347354880642245d9575bee60dd28751c9e103520effcec1617165

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              6KB

                              MD5

                              e9c26c4a3994a417144cdd736a032f86

                              SHA1

                              bfd76cea37e8a3854a1edc2eab4353b680be50c5

                              SHA256

                              33fb686e2dd5beb96e43fc208cca71033ccc164caf7964fa31858a19328522f7

                              SHA512

                              e26328084540a3a9083c056522c5322c5df648c6079dedc4725c6fc21e82164e1e5654ff4e5454e3ab71caaef67fe0c1c778572c00eb5203626988b1db339010

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.bin
                              Filesize

                              23KB

                              MD5

                              599763fa1387e2ed496068693a391a9e

                              SHA1

                              47695356beb760349747f8815583d9570694150d

                              SHA256

                              0216b82de987cd81c83d9b8e0ae979ae4aa762bb8873a12300fcfb814e216612

                              SHA512

                              4119ad3b70bd7129236cbe9be95728b6cf8f82299f435a21917122e8d0086b650fbe56dabbc61162b89e77a575534c70147c1301c93fbdc9ee79e180aece9676

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              15KB

                              MD5

                              f3cb8eb85514860f79a77c789328ed7b

                              SHA1

                              356726feb835c8a51afcaa910d5677f0b13fdd1e

                              SHA256

                              dd973a1c14df34962361ace50ab49802f15e1a8988f9aad9712d4d99aa3a2642

                              SHA512

                              9ea0cf1af207fbf0b43b6f6811daf7a822e3780b6281db48c9a93a91424d4dcbfb0bfb7f67ce9ba2774a33cefdadcc6b7912dc4d353bad74d66e060f7174e580

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              5KB

                              MD5

                              8943368b2058d7b375f44a3714f5d1ff

                              SHA1

                              9ae7be5b1d8a3af5a1da26cd3d959f580f49525c

                              SHA256

                              e0dfbf137310d83e97fdd3d1df3e41be64de70306aae6212ca9445d9f98783c2

                              SHA512

                              3198880e97d91eb278ecb4b83ac1c2656c2d1142d8a7776afb8a529184acef2ca364de967ce74db8762b7989b1a9d7cab1a9a90f18076d64211330efd0815a72

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              5KB

                              MD5

                              5536b8944138249dff44daf5d1274407

                              SHA1

                              7f289d64d2c1f96e2209bb151e75e55e9e20bcee

                              SHA256

                              b7ddb300c24bf736531e66252ac8b28f89405d2fd97e29b63d2e4843e8df7e2b

                              SHA512

                              501f338234557bae0fe48130d5b83907cd6e312013b35b1d9baa1c607031f514cc6e95920955ed3080f6370b31263b7925ecf74ed9a57164253100e85e4f35fa

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              15KB

                              MD5

                              f37dc516f4b202e98d53bb6e33988a6c

                              SHA1

                              60d20fa938b55f69670538ca427feb87db4a44f9

                              SHA256

                              7f451b286b23a54d48e82dd1574728fa2e6ec6830f84839e8860c5760f3983bf

                              SHA512

                              e9028672487fb260264f61c05640c06c2a94218899338825d2919fd2635891c00497adee9181d91b0f070b2ce4d08161160f5d685229a64a75820bbd82c5b293

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              6KB

                              MD5

                              8cfc1b02c2e38ed72dc1adb2b455bd66

                              SHA1

                              436618b5a4444c397a4bd457892114f851d67112

                              SHA256

                              4cd7e63cb651dff88944dec3085186f393ecbbf7b5a2c720ea47a5e808558b5c

                              SHA512

                              7a0d3d8ea04c38d049f01448942220ec0e1a198566ed3b4b051b27066c830403063b146e04d6276f9410cc11d71b87ed80b19ca38029001ffc29644fbf3de714

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              6KB

                              MD5

                              8c7a91c9e6f7b7a35da272f96489c6bf

                              SHA1

                              3452f560b9e6935b8000978160c4c38f897daae5

                              SHA256

                              d2c943fa62e698af229a40c81c87ce02348b28aa20282c51485a26848bd57862

                              SHA512

                              cc21c76617efcb5f3b6b2b0eb671eb19141193469d35a892f0dd3115c2b7e3fe6187f48d3dfea83de9d4c4315402fdb6d30c2299e1192d0dc19b070d145f6324

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\19054759-98b7-4878-9e36-10fb87830aa9
                              Filesize

                              27KB

                              MD5

                              cd2623937573a6f9e03800d49bd3e1a7

                              SHA1

                              258918ee64f2de8edad16dbce2699f3eed8d6165

                              SHA256

                              e2a4051c50e06c20c90343652cf1257ca6208c53638d1e3a57609292f19ad222

                              SHA512

                              53aff52458a2376145aaa23dab8e64a7efa6d35641b595e87cb66226bc8209644f0344a47fb4f006614a057ce676845584f6fb88efe7d8d02ed86f0bd38214ad

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\51d4aecd-9d91-49c1-9daa-b11d479b5bdd
                              Filesize

                              671B

                              MD5

                              49f78417211e7db191ffc9349d16c15c

                              SHA1

                              77a02c0402174fc643695a7d425cc6b5b07ef9c9

                              SHA256

                              cfe98a89dca12a49a8c5af96e2faadf05cdc3302fb1d9ff138da2d0fafb0ef8b

                              SHA512

                              3000274d3ab5f70540a1e9a68114aa1cfa6551069e987ad834acef20ac577274d71a25d0bb85d7d3265c56820afa8d8fc562be96fef5b73392fa1c932adbc2e9

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\datareporting\glean\pending_pings\e63fd2a7-d5f2-4850-894c-e32df904c73b
                              Filesize

                              982B

                              MD5

                              de935f6b0911b4917a86ad3a67083247

                              SHA1

                              18abb9557a460a5247ad9fea953cd4201f7b8a7a

                              SHA256

                              acd01d6f8a635e273b9ead69fbffb340b101e792fae43134ab6812ab4c473ce8

                              SHA512

                              d48e6611875f70b6cdcc470cd30239b7d08e72649e8aa8df0f3a751123073e98d17b784a6327dab182660b0f8432c88d75e7e7ec5440e340713c68a9b203cb46

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                              Filesize

                              1.1MB

                              MD5

                              842039753bf41fa5e11b3a1383061a87

                              SHA1

                              3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                              SHA256

                              d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                              SHA512

                              d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                              Filesize

                              116B

                              MD5

                              2a461e9eb87fd1955cea740a3444ee7a

                              SHA1

                              b10755914c713f5a4677494dbe8a686ed458c3c5

                              SHA256

                              4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                              SHA512

                              34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                              Filesize

                              372B

                              MD5

                              bf957ad58b55f64219ab3f793e374316

                              SHA1

                              a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                              SHA256

                              bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                              SHA512

                              79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                              Filesize

                              17.8MB

                              MD5

                              daf7ef3acccab478aaa7d6dc1c60f865

                              SHA1

                              f8246162b97ce4a945feced27b6ea114366ff2ad

                              SHA256

                              bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                              SHA512

                              5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
                              Filesize

                              12KB

                              MD5

                              6f058566edcecc12e0db4de390fa36e5

                              SHA1

                              7e44fc159e667b03e7630abbd2abc56a07126ca0

                              SHA256

                              669170f5ef625a40f9614ce91fe8141f34d0697761b460a08c27db34eba50341

                              SHA512

                              6589d447e52ce0f5979c52f6cdf7dbeebdd3e524313cf2c23027139efbf3e0bf3d7df527c88b33691bfe0becc458bf84c15e690b369b724f9025326085bf7f44

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
                              Filesize

                              15KB

                              MD5

                              447f2ab1c6d2cbaa27182f6987742295

                              SHA1

                              e832249fcbdc6bc2066fb3be7a10b55993aeaa71

                              SHA256

                              9687d426f691fa947baa8167266c447cf0280446a7526a74d4407a705ed6e9d9

                              SHA512

                              2db6b557aa0a1b6d611b9f000ec73fdae28ff0778cbaa2a3a5ab8a36c32bc6f12fbe932731644f5a5994c827ba339e9eb0b86d8571a142487cc94f399bfdcdae

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs-1.js
                              Filesize

                              10KB

                              MD5

                              c3c0e12a249b24db5bb8fe00c92f86c0

                              SHA1

                              d7c4877d4fc901c291899ec54d76270f1c8a039d

                              SHA256

                              898e74ab6bf038601253d402debcca6b4d8dd6c5997c938c757a6420b9e16049

                              SHA512

                              827a15208ac35cbe44938256aa832b53f35df6895ab676d5bf94b07ce094891704078831b29d8828c19a6cf2cff2a3fa7df6f2675c4f176afe2ded9b790f89b6

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\lhmx4teg.default-release\prefs.js
                              Filesize

                              11KB

                              MD5

                              2e6cdd511248709161e0b17b9dc3a823

                              SHA1

                              cb93aa52a0d0164fbaea616a660453852f91116e

                              SHA256

                              177b8f19aa1e948a79b41e616fc87c7da2529867f360d0abc02c211fe14a1ec9

                              SHA512

                              5855736c654a6d34592ce39dde336669c5554372d79f9ce676d886a3b5c5c00028e2bcca8fc56810837f80642a39dbbc8c1767c8932b1cadf9b057a5dd12ba99

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\gdi32.dll
                              Filesize

                              126KB

                              MD5

                              b48e172f02c22894ad766c52303f087a

                              SHA1

                              61da0ff26dfc3759f7cd79696430b52f85073141

                              SHA256

                              712e46f7a4f9da7fabd0b1acd5e848527bd70b6c4444dc92c8479ac108d71753

                              SHA512

                              5b8a888a9d87a4ee34f57799d3d6baf69cd556a2d1336afb109adc488a5efa1c7cd094c3785cf9af726a0c41be3a56a0ffac933b7fa7fb5dec9643f3af08bdfd

                              Download Submit

                            • memory/8-938-0x0000000000690000-0x0000000000944000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/8-338-0x0000000000690000-0x0000000000944000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/8-1031-0x0000000000690000-0x0000000000944000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/8-5588-0x0000000000690000-0x0000000000944000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/8-6688-0x0000000000690000-0x0000000000944000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/1584-4665-0x0000000005260000-0x000000000528C000-memory.dmp

                              Filesize

                              176KB

                              Download

                            • memory/1584-9735-0x00000000057E0000-0x0000000005846000-memory.dmp

                              Filesize

                              408KB

                              Download

                            • memory/1584-10361-0x00000000062B0000-0x00000000062C2000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/1584-4687-0x0000000005650000-0x0000000005742000-memory.dmp

                              Filesize

                              968KB

                              Download

                            • memory/1584-10362-0x0000000006A10000-0x0000000006A60000-memory.dmp

                              Filesize

                              320KB

                              Download

                            • memory/1584-2598-0x0000000000400000-0x000000000046E000-memory.dmp

                              Filesize

                              440KB

                              Download

                            • memory/1584-2599-0x00000000050E0000-0x0000000005178000-memory.dmp

                              Filesize

                              608KB

                              Download

                            • memory/2020-9743-0x00000000062D0000-0x00000000063B0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2020-1528-0x0000000004EB0000-0x00000000054C8000-memory.dmp

                              Filesize

                              6.1MB

                              Download

                            • memory/2020-1394-0x0000000000150000-0x00000000001B0000-memory.dmp

                              Filesize

                              384KB

                              Download

                            • memory/2020-1451-0x0000000004780000-0x0000000004844000-memory.dmp

                              Filesize

                              784KB

                              Download

                            • memory/2760-202-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-210-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-174-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-149-0x00000000002C0000-0x0000000000564000-memory.dmp

                              Filesize

                              2.6MB

                              Download

                            • memory/2760-150-0x00000000052E0000-0x0000000005884000-memory.dmp

                              Filesize

                              5.6MB

                              Download

                            • memory/2760-166-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-153-0x0000000004E30000-0x0000000004EC2000-memory.dmp

                              Filesize

                              584KB

                              Download

                            • memory/2760-198-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-192-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-190-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-1371-0x0000000005CC0000-0x0000000005EB4000-memory.dmp

                              Filesize

                              2.0MB

                              Download

                            • memory/2760-161-0x0000000004EE0000-0x0000000004EEA000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/2760-1372-0x0000000005170000-0x00000000051BC000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/2760-204-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-1383-0x00000000067B0000-0x0000000006804000-memory.dmp

                              Filesize

                              336KB

                              Download

                            • memory/2760-162-0x0000000005890000-0x0000000005B14000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-168-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-172-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-163-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-176-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-206-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-170-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-178-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-188-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-200-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-194-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-218-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-208-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-180-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-182-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-184-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-220-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-216-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-186-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-214-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-212-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-164-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/2760-196-0x0000000005890000-0x0000000005B0D000-memory.dmp

                              Filesize

                              2.5MB

                              Download

                            • memory/3000-39-0x00000000006A0000-0x0000000000B46000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3000-94-0x00000000006A0000-0x0000000000B46000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3000-155-0x00000000006A0000-0x0000000000B46000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3236-21-0x0000000000C70000-0x0000000001115000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3236-34-0x0000000000C70000-0x0000000001115000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3564-9703-0x0000000000410000-0x00000000008C0000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/3564-9741-0x0000000000410000-0x00000000008C0000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/3564-1367-0x0000000000410000-0x00000000008C0000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4440-160-0x0000000000FB0000-0x000000000162D000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/4440-334-0x0000000000FB0000-0x000000000162D000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/4576-113-0x0000000000400000-0x0000000000C6C000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/4576-159-0x0000000000400000-0x0000000000C6C000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/4796-1124-0x0000000000BC0000-0x0000000001827000-memory.dmp

                              Filesize

                              12.4MB

                              Download

                            • memory/4796-965-0x0000000000BC0000-0x0000000001827000-memory.dmp

                              Filesize

                              12.4MB

                              Download

                            • memory/4796-130-0x0000000000BC0000-0x0000000001827000-memory.dmp

                              Filesize

                              12.4MB

                              Download

                            • memory/4856-10471-0x0000000000B60000-0x0000000000E14000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/4856-10479-0x0000000000B60000-0x0000000000E14000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/4856-9738-0x0000000000B60000-0x0000000000E14000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/4856-9704-0x0000000000B60000-0x0000000000E14000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/4856-9739-0x0000000000B60000-0x0000000000E14000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/4920-58-0x0000000000990000-0x00000000009D0000-memory.dmp

                              Filesize

                              256KB

                              Download

                            • memory/4920-59-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

                              Filesize

                              24KB

                              Download

                            • memory/4952-91-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4952-35-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4952-152-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4952-92-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5312-4666-0x00000000007A0000-0x0000000000E1D000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/5312-4668-0x00000000007A0000-0x0000000000E1D000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/5340-12557-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5340-12607-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5500-2588-0x0000000005B10000-0x0000000005BC6000-memory.dmp

                              Filesize

                              728KB

                              Download

                            • memory/5500-1393-0x0000000005110000-0x0000000005256000-memory.dmp

                              Filesize

                              1.3MB

                              Download

                            • memory/5500-1387-0x0000000000490000-0x00000000005F6000-memory.dmp

                              Filesize

                              1.4MB

                              Download

                            • memory/5656-1370-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5656-1003-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/6168-13158-0x0000000000730000-0x0000000000BD5000-memory.dmp

                              Filesize

                              4.6MB

                              Download