Overview

overview

10

Static

static

3

2a0efd42c2...bc.exe

windows7-x64

10

2a0efd42c2...bc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-12-2024 20:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe

  • Size

    1.8MB

  • MD5

    7f0a76732977427371079aac4e055a2e

  • SHA1

    c799adbb85ecde3ed6c2cb17c77ee989d73cc9d6

  • SHA256

    2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc

  • SHA512

    88ed5cac47d9765cde1e83e489e4f7707176fb167318343e8c58611d4fd315de77125866d79a63ef5400f8a0b51048a0ce77298874bf1b62c3bc34f110761b05

  • SSDEEP

    49152:SRom2bAxlKp9HksGRtTvd/oheTzY0/oWnWNm4jDAATj:iom2WlKppG3vt5o4D4jDj

Score
10/10
amadeygurculummamilleniumratstealc9c9aa5drumdiscoveryevasionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://ratiomun.cyou

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://ratiomun.cyou/api

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7733030005:AAEneIh4MdJeCVQCr4Pys9pel6q03FCPCi0/sendDocument?chat_id=7538374929&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7733030005:AAEneIh4MdJeCVQCr4Pys9pel6q03FCPCi0/sendMessage?chat_id=7538374929

https://api.telegram.org/bot7733030005:AAEneIh4MdJeCVQCr4Pys9pel6q03FCPCi0/getUpdates?offset=-

https://api.telegram.org/bot7733030005:AAEneIh4MdJeCVQCr4Pys9pel6q03FCPCi0/sendDocument?chat_id=7538374929&caption=%F0%9F%93%B8Screenshot%20take

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Milleniumrat family
    milleniumrat
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe
    "C:\Users\Admin\AppData\Local\Temp\2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Users\Admin\AppData\Local\Temp\1011782001\GI59vO6.exe
        "C:\Users\Admin\AppData\Local\Temp\1011782001\GI59vO6.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2400
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1556
          4⤵
          • Program crash
          PID:3308
      • C:\Users\Admin\AppData\Local\Temp\1011944001\4XYFk9r.exe
        "C:\Users\Admin\AppData\Local\Temp\1011944001\4XYFk9r.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF5D9.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpF5D9.tmp.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3752
          • C:\Windows\system32\chcp.com
            chcp 65001
            5⤵
              PID:4536
            • C:\Windows\system32\tasklist.exe
              Tasklist /fi "PID eq 1960"
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:4336
            • C:\Windows\system32\find.exe
              find ":"
              5⤵
                PID:2824
              • C:\Windows\system32\timeout.exe
                Timeout /T 1 /Nobreak
                5⤵
                • Delays execution with timeout.exe
                PID:1852
              • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
                "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4420
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5068
                  • C:\Windows\system32\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
                    7⤵
                    • Adds Run key to start application
                    • Modifies registry key
                    PID:1440
          • C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe
            "C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4856
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 1524
              4⤵
              • Program crash
              PID:2596
          • C:\Users\Admin\AppData\Local\Temp\1012123001\cfc538f1a9.exe
            "C:\Users\Admin\AppData\Local\Temp\1012123001\cfc538f1a9.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2808
          • C:\Users\Admin\AppData\Local\Temp\1012124001\3bd2fdfcbc.exe
            "C:\Users\Admin\AppData\Local\Temp\1012124001\3bd2fdfcbc.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:1504
          • C:\Users\Admin\AppData\Local\Temp\1012125001\d3b67b92a5.exe
            "C:\Users\Admin\AppData\Local\Temp\1012125001\d3b67b92a5.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:4172
          • C:\Users\Admin\AppData\Local\Temp\1012126001\d75ea3767d.exe
            "C:\Users\Admin\AppData\Local\Temp\1012126001\d75ea3767d.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3308
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2872
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4784
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4536
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4320
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2240
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1476
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:4300
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1bf7298-4e65-4bf8-a36e-c5266d7127a6} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" gpu
                  6⤵
                    PID:32
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86e7bac7-2e10-44ac-84e8-b9c300dae1f7} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" socket
                    6⤵
                      PID:2356
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 2992 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98039f98-2ccb-4e6c-a5a0-4b7e8f6507ea} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
                      6⤵
                        PID:1256
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4076 -childID 2 -isForBrowser -prefsHandle 4060 -prefMapHandle 4056 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6847d977-bae3-4fc9-ba43-e6e2430734af} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
                        6⤵
                          PID:3760
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4684 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4676 -prefMapHandle 4672 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67f139ae-a1c6-4077-b52c-ba853636050f} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" utility
                          6⤵
                          • Checks processor information in registry
                          PID:5760
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 3 -isForBrowser -prefsHandle 5536 -prefMapHandle 5240 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05ee325c-bdf8-4fa9-bf8e-d07f89316a4f} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
                          6⤵
                            PID:5828
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 4 -isForBrowser -prefsHandle 5680 -prefMapHandle 5684 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc777b02-14eb-4e6e-a1ac-17e3f477e762} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
                            6⤵
                              PID:5840
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5748 -childID 5 -isForBrowser -prefsHandle 5536 -prefMapHandle 5240 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1132 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65fa6cc5-f65b-4b20-946c-a9be706701a1} 4300 "\\.\pipe\gecko-crash-server-pipe.4300" tab
                              6⤵
                                PID:5872
                        • C:\Users\Admin\AppData\Local\Temp\1012127001\c007835371.exe
                          "C:\Users\Admin\AppData\Local\Temp\1012127001\c007835371.exe"
                          3⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3552
                        • C:\Users\Admin\AppData\Local\Temp\1012128001\acf6b6fc79.exe
                          "C:\Users\Admin\AppData\Local\Temp\1012128001\acf6b6fc79.exe"
                          3⤵
                          • Enumerates VirtualBox registry keys
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          PID:432
                        • C:\Users\Admin\AppData\Local\Temp\1012129001\rhnew.exe
                          "C:\Users\Admin\AppData\Local\Temp\1012129001\rhnew.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          PID:5456
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 1564
                            4⤵
                            • Program crash
                            PID:5852
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 1544
                            4⤵
                            • Program crash
                            PID:6012
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:312
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2400 -ip 2400
                      1⤵
                        PID:1900
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4856 -ip 4856
                        1⤵
                          PID:2312
                        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:5780
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5456 -ip 5456
                          1⤵
                            PID:2180
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5456 -ip 5456
                            1⤵
                              PID:5708
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              PID:3244

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Defense Evasion

                            Impair Defenses

                            2
                            T1562

                            Disable or Modify Tools

                            2
                            T1562.001

                            Modify Registry

                            4
                            T1112

                            Virtualization/Sandbox Evasion

                            3
                            T1497

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Process Discovery

                            1
                            T1057

                            Query Registry

                            8
                            T1012

                            System Information Discovery

                            4
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Virtualization/Sandbox Evasion

                            3
                            T1497

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                              Filesize

                              13KB

                              MD5

                              a71159007e2a679dd69b76686dfd64e5

                              SHA1

                              e81eebebf21e40c23e1499fd9c624be88ad622f1

                              SHA256

                              52c80ef46efba0a3d012082ef4cc0238675cb728eeb7b3cb8fb8e3365bdb72f4

                              SHA512

                              3139b6c68aa431228d7206dc5c835185aaa6336a8c69e4614f2bd880c715348c7ef6b765f0ec8ab8ae725f4748b68979e1d75ab3741e670762a629c0055a9ed7

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                              Filesize

                              13KB

                              MD5

                              d670bc772c9752ac97255c9c70b373e3

                              SHA1

                              2ebf6192b803a10c71544ef06f9bc0a5fc3a823b

                              SHA256

                              35aebdf2cc6bb21b555817151e224226e849af2910294c04c15466db20e5628f

                              SHA512

                              dfa55fcfbddeed407d81dc4dcde914ae674d6f1a30c178a0a3899c084431b023032afe740066cdcf609964790b5c8f087848ce9b52bbd7a5cac82916c7573b61

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                              Filesize

                              15KB

                              MD5

                              96c542dec016d9ec1ecc4dddfcbaac66

                              SHA1

                              6199f7648bb744efa58acf7b96fee85d938389e4

                              SHA256

                              7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                              SHA512

                              cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011782001\GI59vO6.exe
                              Filesize

                              1.8MB

                              MD5

                              5fa72774e9d750628857a68d84275833

                              SHA1

                              7eebff7d14817544cc11829e354c1dfc7f603628

                              SHA256

                              a170fa6fefc8b753ef0f88384b906ca2338365d8552012ed7aa1c0c8c7cb5a56

                              SHA512

                              9ac2715f35e107effef9f4526e6430271ca141bc5a729993e88dfa50eb20f61b15502c54f64e9596cd9bb449a1bb25c1cc98f1d12d857afdda742cdce3280838

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1011944001\4XYFk9r.exe
                              Filesize

                              5.6MB

                              MD5

                              23b25ce90f70ffa0435db8df6a6764f2

                              SHA1

                              72d0c052f26309704f13c090495c3cdea4ed1bf2

                              SHA256

                              9165705656ffe7608922ff366357e3b98b0e5ece8c6d39780874c7b4bd7b2dd3

                              SHA512

                              b6c81131119b95df9d789329ffd4553c1624f7d9e38c46924ac4838e59ccb59b538646f36d8c80b9361412842f8c0328aa4177e93e72e22c15077669ee9904ec

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012056001\BhD8htX.exe
                              Filesize

                              1.7MB

                              MD5

                              ff4cf493ac5f7663d1cfc243e6646eb7

                              SHA1

                              ff7184eae695580f1e86fac340925c7f01f4de6d

                              SHA256

                              72a99a945b705fc1c8fa59c3db6810be2aadeaecc34f954f5ab314574002d748

                              SHA512

                              1eef407d5bfa8b94bb98cb0a64e7c73cb94176507fa924642c6cf21192965ba8856390214379fddf192b88e19377768ead94fb4d393831e47ca230b6b168f14b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012122001\file.exe
                              Filesize

                              5KB

                              MD5

                              dbf260ec509090920a3a04a2b175fee0

                              SHA1

                              5aca9e04c1cc128a523c567ef1aa75584c4c9268

                              SHA256

                              2ba68aeb4e25c437a3b6405dbc9e8fe1a2a69925cd419113ca0d374014821b1a

                              SHA512

                              5b53145651a8a9b02d49129c8c758eb27fd4a80a0c174c11290a8370dc73551fbc5521f91fb13065e3f4104b955b1e3641f3477c466c8ddaf043dc901b546413

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012123001\cfc538f1a9.exe
                              Filesize

                              1.9MB

                              MD5

                              82d1397fb388fe6e4b7c66b0ae4bdbe4

                              SHA1

                              d979b5399d577b53b63b428c4a35abd30d6cc9de

                              SHA256

                              b3bab1d09ce9738f8bcf2c838086eaf628715df4fe99ef26c7c85b6e9b9a6443

                              SHA512

                              47de07a2595067569a1ded7dd330f81817334d9442997cf25af977ecac04df5827d4475145cca0f8cf457002d147bed789cc2fc24d275fcff129d14a41b0531a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012124001\3bd2fdfcbc.exe
                              Filesize

                              1.8MB

                              MD5

                              5e384bc6b7285a6ac5237864932b36c5

                              SHA1

                              e209c0aa850aa07a620a14c6414552496e867209

                              SHA256

                              dc71955c6330cec834ececf0776af74c62c9e0ea6278e25d0719c781000914a6

                              SHA512

                              2757a505ece762122bc28fd9763cb18c0ac375adfefc73bb22eb01c627db8b30d215064388f8acf813d36dea0fee42140f878de3085b8e3e90918e153e56e920

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012125001\d3b67b92a5.exe
                              Filesize

                              1.8MB

                              MD5

                              a8d5d653a05c2b4746988e9c1a0e5681

                              SHA1

                              67ff7060ba5430fb8c5da54a885f8f4eadae2ea4

                              SHA256

                              f8f6069c106b01977f2a7c1d222d212d57041ae76ad1709bc7d51e2316f32110

                              SHA512

                              3382733b2a70f3971b9834cc53549e0f890e04ad7ac1469b08a5bf89bfc477e79ef646ce2753c46a7c68ee63999f4d8399127cf3ea5c25b28d36d28f471e653d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012126001\d75ea3767d.exe
                              Filesize

                              944KB

                              MD5

                              259492d195d527bb189e7d637a276fb2

                              SHA1

                              51495545debde951ee59e2e6f1904084512f6611

                              SHA256

                              4b8ae3b0c2394a0f4294fede9d66d6e6c833b3bae011ba301c2ed0cfb80f4107

                              SHA512

                              d9b8bd327836019688e5fa97ae16731c861740449974e6dcad857fb5de8b39b9069011215e48aec86a8362c5f89706bff6bf11de77da9206c475846dc66ec99d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012127001\c007835371.exe
                              Filesize

                              2.7MB

                              MD5

                              02ca12ec4f754b8c5a6d65e96102cac7

                              SHA1

                              fdf50b5fab6a4ad4a4b5dab0ed2e6b670f17cca5

                              SHA256

                              514deaa8dd99468f1d8e6c750641a00b8aadf4c2171b3c1fa984ec4e2e6cd097

                              SHA512

                              7cbea96a7883022a44a1ef5e14772fa7ccb1962931bd8ffd7c726e130dcca989e49ecbce844fe23be732a2c2d3cae92be53a0b0fa050651e69744a0a2aa82eae

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012128001\acf6b6fc79.exe
                              Filesize

                              4.3MB

                              MD5

                              cabe7aa4a6430daab83f5d7f37aca904

                              SHA1

                              0c8d8e4b20c857c52231b4325e808a3d90c73505

                              SHA256

                              03fe3055e0b12aa4a2186a0a89ea58dfdf6a071679ba3950202204b3e62e7c8d

                              SHA512

                              fae4b2dae145c35e0bdec6c3977186d1356f6065413b364d2f373cef5367da6bc6b7a2b31154df5ad5c0608fa3d165595115187297fbe88d621c51fbd5628159

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1012129001\rhnew.exe
                              Filesize

                              1.8MB

                              MD5

                              a84456172908e096d0ac6272b9503e08

                              SHA1

                              8b64d38bae9fc390e621323e9e91eb8f7def421c

                              SHA256

                              4f95dff270ac4172d470789c3fce9ae2c656565a3887afc86507ec49981bd128

                              SHA512

                              3237f19915957327d3debd46de1c52531622fba5dbb2e06c9685ca336bd4febf19c2f3dd533c5046b0e676d21f10ba10478b3bbe9dbb31823b7dc118a6413800

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll
                              Filesize

                              1.7MB

                              MD5

                              65ccd6ecb99899083d43f7c24eb8f869

                              SHA1

                              27037a9470cc5ed177c0b6688495f3a51996a023

                              SHA256

                              aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

                              SHA512

                              533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              Filesize

                              1.8MB

                              MD5

                              7f0a76732977427371079aac4e055a2e

                              SHA1

                              c799adbb85ecde3ed6c2cb17c77ee989d73cc9d6

                              SHA256

                              2a0efd42c22af406d984461f1226c56f65fb74a9245d5397f94cef43aedce0bc

                              SHA512

                              88ed5cac47d9765cde1e83e489e4f7707176fb167318343e8c58611d4fd315de77125866d79a63ef5400f8a0b51048a0ce77298874bf1b62c3bc34f110761b05

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpF5D9.tmp.bat
                              Filesize

                              286B

                              MD5

                              3ad8d6d2e36b06a3383e9a5f40d17060

                              SHA1

                              1f4a19db17def1107ede5fd15108749a76e32eb4

                              SHA256

                              fc844270c9d78b5e509f7042df1123be062b2d34069b95271610e53bbe1cda6f

                              SHA512

                              077f4733b4c8f598b5b057560892d7f640b3338e52a3f547c0437d3942091d6df52390f56a2bbad684bef0371908de2c95e2b43625ab8fa5b750fdc3dcf5733d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                              Filesize

                              479KB

                              MD5

                              09372174e83dbbf696ee732fd2e875bb

                              SHA1

                              ba360186ba650a769f9303f48b7200fb5eaccee1

                              SHA256

                              c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                              SHA512

                              b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                              Filesize

                              13.8MB

                              MD5

                              0a8747a2ac9ac08ae9508f36c6d75692

                              SHA1

                              b287a96fd6cc12433adb42193dfe06111c38eaf0

                              SHA256

                              32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                              SHA512

                              59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                              Filesize

                              18KB

                              MD5

                              3804429eaace39037afebd93e648dc13

                              SHA1

                              96ac7c9ec82acdb506b136e4d8f6f74435254d16

                              SHA256

                              3c679a638b08c5b4f68c86b616ccdff85775a55f79a8105e1e08505d62280d25

                              SHA512

                              93386c221b576c1225c99996bbe05b53259bb7ccd53e2acee6c7778a97c13f4ea432d1ab6e3a12f64969ff6f0e8b20a7bd3a12961f253d93c4700bb4343f5595

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                              Filesize

                              8KB

                              MD5

                              79643e8a56e6822150b9354590cb28c5

                              SHA1

                              588ef75369caaa3cb1a19cdc9cf15382e7fdc9a0

                              SHA256

                              c0af4b3b6d9de61dd921b9b63bfeaae6671318bd0c24b62466d3fe45570f893e

                              SHA512

                              ddd865df08a4977f55f0fccb9cf9123c200d8d798d64ef50b2bb7db96d621366c755e2a46a6ba2af389a50e99dec3a91ae6a71d97629e2b2ced739db83d5c96f

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              15KB

                              MD5

                              7351defa0bb8f79957fff1f43155fc2f

                              SHA1

                              9d12417e3a4d0ef1ecc6dfb98f1cf9146f558339

                              SHA256

                              5e48015d8d3fc4c14a20cd624c01f2a0275dc7aba0e8e074b3ce34945fab8f3d

                              SHA512

                              0b960cc8d7f0973c169210c99fbe37b7897c78d30052ba9169d953688fad69cb46c1eebf3eb2b85b470a5f2667a3554b29c593dac0013c41bc5d9b91f6a2d43a

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              5KB

                              MD5

                              82a60808ae08fd116a337bb0226bc3aa

                              SHA1

                              182851b51e168f5d925a137facdd9ca498ee1cd2

                              SHA256

                              1008e60db1ddb727ee21b14b89a238cd1e9fc9bf0e5b6b173e98376892b9f819

                              SHA512

                              af42e2a6e7e1130be7d668841391d01dd46878790555eefbfbdf0121a0cddf1bb0f513949e286fc47fa3f0ad00a06b635e9df41560d0309820a834e98762bb06

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              15KB

                              MD5

                              43452f3759e807fe761af47bc8b63e4e

                              SHA1

                              5855ea961c002ca34d38d8922cac60689edd303e

                              SHA256

                              58d290f4eb7397893c08bfc4b8cddd3c576fd13feb5d9f8670fb7cea9b3dd307

                              SHA512

                              11fc92b0a17371a3cb976a30e7ee84c34de0ff66aae37268259bcad8a9c65cbb1df5c228b0ab1cb7fc0577312913486d7196c37e8a027c60dfc2ac7d35e0df93

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\69c9b730-f6ee-4183-80bb-8b1e09a6e8ad
                              Filesize

                              671B

                              MD5

                              70bd04474bedca52b875ba3c49c63f27

                              SHA1

                              7a068083a1e2d26f080478ed81165f56da221ba8

                              SHA256

                              109eda8c04ad48fb3a864edab62f8af01280fa4ea2ff22e9946d9e7ff432c768

                              SHA512

                              699478b12e37fcea723b897a539a1f27be8a98b47e19efcdbb2dc6e9e7dd024e50f2d2f293ef0303a24b8ce1dc59cda1f6743f91b9ed36e94eef3ce3fb7fbd38

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\d2c5814f-e968-4648-b14a-9f643dd4c7a9
                              Filesize

                              24KB

                              MD5

                              d33f6eaa4cf2ad41b1d79e478658125c

                              SHA1

                              55f52a2547f55ba26c5ff82a16c6120da23be023

                              SHA256

                              ca0ebcbf014b1c74c2dbbcab6216fa0aa99000b68bf5ad739d4c30e1fa7a7144

                              SHA512

                              b114f5453532f551ffdd9c74d71213cbcb9324b9a9b1428720b30d6ac1554284b13e45f567a52fef3ba5135115036fcf4e2fe9d489116d3e97c896bff41d6340

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\f7d4490f-645e-4a85-aa89-8badd0bde7b3
                              Filesize

                              982B

                              MD5

                              36bc9b40cc6f7af8cbb5195f3439e3d8

                              SHA1

                              47746f5ee898c1a088e1e1dfba36c564944c5c03

                              SHA256

                              4548c268fbf954b4db9aca65cbba27cf6f595f180444ae250919fd1e485f1d26

                              SHA512

                              6578367c0480e6542b55178795209e012b2bc778a5a056b6035e0afc189953843e74f39f23b26b9f87e6364c033b424a38a354b3e57d322ecb6ab5b921e252ae

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                              Filesize

                              1.1MB

                              MD5

                              842039753bf41fa5e11b3a1383061a87

                              SHA1

                              3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                              SHA256

                              d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                              SHA512

                              d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                              Filesize

                              116B

                              MD5

                              2a461e9eb87fd1955cea740a3444ee7a

                              SHA1

                              b10755914c713f5a4677494dbe8a686ed458c3c5

                              SHA256

                              4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                              SHA512

                              34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                              Filesize

                              372B

                              MD5

                              bf957ad58b55f64219ab3f793e374316

                              SHA1

                              a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                              SHA256

                              bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                              SHA512

                              79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                              Filesize

                              17.8MB

                              MD5

                              daf7ef3acccab478aaa7d6dc1c60f865

                              SHA1

                              f8246162b97ce4a945feced27b6ea114366ff2ad

                              SHA256

                              bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                              SHA512

                              5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                              Filesize

                              10KB

                              MD5

                              10dd115fa19eab9655abfd9069fb7384

                              SHA1

                              cc8c7dd437d0d9e917be6d0cc7ec94122b348f7f

                              SHA256

                              6f18ddec2e22d613ef5cf00bc6e83cb1e6086fb4886a3a55fcfd714655741f06

                              SHA512

                              7b8390cab368854b7ceb7d6d735d692be8356727a567eacc1a437c6a260edb68de23764cd363258e7f75080a6860dbb4e00fd54fc475e245b66a7f57758590e7

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                              Filesize

                              12KB

                              MD5

                              52937e05aa9032788c8110a3b5bcda26

                              SHA1

                              b7229f2cabc1393b50f6c73952cbf64e9708e370

                              SHA256

                              08590730ed312fb7c9a1bd7dd43c4fd639126ea37c57b962108eb3ebe7d26909

                              SHA512

                              ddda1892c0dd2006140f016a43dc3fe7a12f69363011591b6bb8e355dcfed8ea18685e005fe0570e2dba1d34db4bc0012a998a2272c8c6d20b2f0d138fd1dff7

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                              Filesize

                              15KB

                              MD5

                              90a7ed69e034dcd75e274a652873b44e

                              SHA1

                              87ddabaababdde4ac8a5658b5ba8342db7d51af7

                              SHA256

                              1c9041be952a576d737dc9f3a2fdf13713735b1695cf0639337bf87927f7be25

                              SHA512

                              837ee51c923a27532ff3df93f5c40b8e305be67a9b11475b8242188b78d49c85458c8b503c913bbc5056d8c72258cb490bee9f6f431a8c1f1bcc75a4c29cf704

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
                              Filesize

                              11KB

                              MD5

                              92d6649fa8312412b8ae05f7398a3b4a

                              SHA1

                              ed0a54121eaa7ede59d500e314758de20379e7c4

                              SHA256

                              fdb0f64ec2463b53bbf4a3186e30efdbd6ff5288d164342b39ba76661db73901

                              SHA512

                              c2745bcf3933c3a4b7321bb5429be6f6c0e833d7bb7a515a3fd1be9d241b3fa09fe81005747c20107dfbba799d518e666d9e654b6ade67a918c988652982ea44

                              Download Submit

                            • memory/312-30-0x00000000008C1000-0x00000000008EF000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/312-25-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/312-27-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/312-26-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/312-28-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/432-978-0x0000000000750000-0x000000000141E000-memory.dmp

                              Filesize

                              12.8MB

                              Download

                            • memory/432-707-0x0000000000750000-0x000000000141E000-memory.dmp

                              Filesize

                              12.8MB

                              Download

                            • memory/432-706-0x0000000000750000-0x000000000141E000-memory.dmp

                              Filesize

                              12.8MB

                              Download

                            • memory/432-665-0x0000000000750000-0x000000000141E000-memory.dmp

                              Filesize

                              12.8MB

                              Download

                            • memory/432-1921-0x0000000000750000-0x000000000141E000-memory.dmp

                              Filesize

                              12.8MB

                              Download

                            • memory/1504-649-0x0000000000230000-0x00000000006C4000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/1504-667-0x0000000000230000-0x00000000006C4000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/1504-198-0x0000000000230000-0x00000000006C4000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/1504-241-0x0000000000230000-0x00000000006C4000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/1504-240-0x0000000000230000-0x00000000006C4000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/1960-68-0x00000203C0970000-0x00000203C0F12000-memory.dmp

                              Filesize

                              5.6MB

                              Download

                            • memory/1960-73-0x00000203DB380000-0x00000203DB3F6000-memory.dmp

                              Filesize

                              472KB

                              Download

                            • memory/1960-75-0x00000203DB320000-0x00000203DB32A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/1960-74-0x00000203DB300000-0x00000203DB31E000-memory.dmp

                              Filesize

                              120KB

                              Download

                            • memory/2400-123-0x0000000000F20000-0x00000000013B3000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2400-181-0x0000000000F20000-0x00000000013B3000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2400-76-0x0000000000F20000-0x00000000013B3000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2400-46-0x0000000000F20000-0x00000000013B3000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2636-1-0x0000000077284000-0x0000000077286000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/2636-2-0x0000000000121000-0x000000000014F000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/2636-4-0x0000000000120000-0x00000000005D5000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/2636-17-0x0000000000120000-0x00000000005D5000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/2636-0-0x0000000000120000-0x00000000005D5000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/2636-3-0x0000000000120000-0x00000000005D5000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/2808-700-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-3257-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-3245-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-220-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-3019-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-3263-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-3252-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-175-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-3265-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-1874-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-575-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-826-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/2808-215-0x0000000000400000-0x0000000000C68000-memory.dmp

                              Filesize

                              8.4MB

                              Download

                            • memory/3244-3260-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/3244-3262-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/3552-270-0x0000000000E20000-0x00000000010DE000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/3552-673-0x0000000000E20000-0x00000000010DE000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/3552-271-0x0000000000E20000-0x00000000010DE000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/3552-261-0x0000000000E20000-0x00000000010DE000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/3552-693-0x0000000000E20000-0x00000000010DE000-memory.dmp

                              Filesize

                              2.7MB

                              Download

                            • memory/4172-217-0x0000000000D30000-0x00000000013D9000-memory.dmp

                              Filesize

                              6.7MB

                              Download

                            • memory/4172-219-0x0000000000D30000-0x00000000013D9000-memory.dmp

                              Filesize

                              6.7MB

                              Download

                            • memory/4420-131-0x00000273D2C20000-0x00000273D2C46000-memory.dmp

                              Filesize

                              152KB

                              Download

                            • memory/4420-127-0x00000273D2BA0000-0x00000273D2BF0000-memory.dmp

                              Filesize

                              320KB

                              Download

                            • memory/4420-128-0x00000273D2BF0000-0x00000273D2C12000-memory.dmp

                              Filesize

                              136KB

                              Download

                            • memory/4420-126-0x00000273D2AA0000-0x00000273D2B52000-memory.dmp

                              Filesize

                              712KB

                              Download

                            • memory/4420-124-0x00000273D2830000-0x00000273D289A000-memory.dmp

                              Filesize

                              424KB

                              Download

                            • memory/4420-130-0x00000273D2C60000-0x00000273D2C9A000-memory.dmp

                              Filesize

                              232KB

                              Download

                            • memory/4420-132-0x00000273D3940000-0x00000273D3C6E000-memory.dmp

                              Filesize

                              3.2MB

                              Download

                            • memory/4420-166-0x00000273D2CE0000-0x00000273D2CF2000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/4764-701-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-2026-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-3266-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-19-0x00000000008C1000-0x00000000008EF000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/4764-3264-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-179-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-48-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-853-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-47-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-20-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-96-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-21-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-3258-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-221-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-645-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-23-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-22-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-18-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-3254-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-3246-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-3238-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4764-49-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/4856-282-0x00000000007B0000-0x0000000000C3B000-memory.dmp

                              Filesize

                              4.5MB

                              Download

                            • memory/4856-173-0x00000000007B0000-0x0000000000C3B000-memory.dmp

                              Filesize

                              4.5MB

                              Download

                            • memory/4856-218-0x00000000007B0000-0x0000000000C3B000-memory.dmp

                              Filesize

                              4.5MB

                              Download

                            • memory/4856-91-0x00000000007B0000-0x0000000000C3B000-memory.dmp

                              Filesize

                              4.5MB

                              Download

                            • memory/4856-169-0x00000000007B0000-0x0000000000C3B000-memory.dmp

                              Filesize

                              4.5MB

                              Download

                            • memory/5456-2393-0x0000000000610000-0x0000000000AAF000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5456-1537-0x0000000000610000-0x0000000000AAF000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5456-690-0x0000000000610000-0x0000000000AAF000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5456-712-0x0000000000610000-0x0000000000AAF000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5456-770-0x0000000000610000-0x0000000000AAF000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5780-703-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download

                            • memory/5780-705-0x00000000008C0000-0x0000000000D75000-memory.dmp

                              Filesize

                              4.7MB

                              Download