Overview

overview

10

Static

static

3

535e90c113...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-12-2024 13:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    535e90c113fd8791382fbbbbbc2335e78f2b84cda3b9daa66eb032649b9da618.exe

  • Size

    5.5MB

  • MD5

    cc81e0839e8d017dff9f3d14157169fd

  • SHA1

    25c04b38e8d68db2555e6ea0c652e2a641dbae1c

  • SHA256

    535e90c113fd8791382fbbbbbc2335e78f2b84cda3b9daa66eb032649b9da618

  • SHA512

    1a64fc73577db7c5acbf4a15eca35287455e5609afde311268748289ebdf2d13587454c97da6fdf2787b9e267b9c6744851ee9f66ade251199eff312a4a4f4dc

  • SSDEEP

    98304:eZi9LOgBDVkvrs6Olhmh7jVdLPZqqn6AE3uAeWm6b9I3QfqV3n3enE2eFoCF:QdgBDVkvrUhmRjXd1n6AEIWxbAXunE7V

Score
10/10
amadeycryptbotgcleanerlummastealc9c9aa5drumdiscoveryevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

gcleaner

C2

92.63.197.221

45.91.200.135

Extracted

Family

cryptbot

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://formy-spill.biz/api

https://covery-mover.biz/api

https://dare-curbys.biz/api

https://print-vexer.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\535e90c113fd8791382fbbbbbc2335e78f2b84cda3b9daa66eb032649b9da618.exe
    "C:\Users\Admin\AppData\Local\Temp\535e90c113fd8791382fbbbbbc2335e78f2b84cda3b9daa66eb032649b9da618.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l3T89.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l3T89.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1A09z7.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1A09z7.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2092
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3884
          • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
            "C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:412
            • C:\Users\Admin\AppData\Local\Temp\is-PCBR0.tmp\i1A5m12.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-PCBR0.tmp\i1A5m12.tmp" /SL5="$A0228,3291517,54272,C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2408
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\system32\net.exe" pause raf_encoder_1252
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:988
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 pause raf_encoder_1252
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:3364
              • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe" -i
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:3832
          • C:\Users\Admin\AppData\Local\Temp\1012389001\19b24d64ae.exe
            "C:\Users\Admin\AppData\Local\Temp\1012389001\19b24d64ae.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4564
          • C:\Users\Admin\AppData\Local\Temp\1012390001\5ff6f686d2.exe
            "C:\Users\Admin\AppData\Local\Temp\1012390001\5ff6f686d2.exe"
            5⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4708
          • C:\Users\Admin\AppData\Local\Temp\1012391001\rhnew.exe
            "C:\Users\Admin\AppData\Local\Temp\1012391001\rhnew.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1160
          • C:\Users\Admin\AppData\Local\Temp\1012392001\426d4e4b5d.exe
            "C:\Users\Admin\AppData\Local\Temp\1012392001\426d4e4b5d.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3376
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 1628
              6⤵
              • Program crash
              PID:5172
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 1648
              6⤵
              • Program crash
              PID:5140
          • C:\Users\Admin\AppData\Local\Temp\1012393001\c7b8a5cf24.exe
            "C:\Users\Admin\AppData\Local\Temp\1012393001\c7b8a5cf24.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4172
          • C:\Users\Admin\AppData\Local\Temp\1012394001\de4e3e6a92.exe
            "C:\Users\Admin\AppData\Local\Temp\1012394001\de4e3e6a92.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4420
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1836
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2652
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2464
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3960
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:860
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              6⤵
                PID:2136
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                  7⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:3008
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f4a6f03-b329-4817-9368-52eedd04cca9} 3008 "\\.\pipe\gecko-crash-server-pipe.3008" gpu
                    8⤵
                      PID:4044
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2496 -parentBuildID 20240401114208 -prefsHandle 2464 -prefMapHandle 2460 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc1e29d3-4510-43a7-b0d8-dbdbf6314706} 3008 "\\.\pipe\gecko-crash-server-pipe.3008" socket
                      8⤵
                        PID:2356
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 3060 -prefMapHandle 3300 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6049437d-d986-4055-8289-8302230082c6} 3008 "\\.\pipe\gecko-crash-server-pipe.3008" tab
                        8⤵
                          PID:1016
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4004 -childID 2 -isForBrowser -prefsHandle 3996 -prefMapHandle 3992 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {325373d3-cc0a-4a7a-97be-6ecdbedb2e71} 3008 "\\.\pipe\gecko-crash-server-pipe.3008" tab
                          8⤵
                            PID:1604
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4672 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4656 -prefMapHandle 4652 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3d4ad37-0f14-41ca-946b-09ec12f12812} 3008 "\\.\pipe\gecko-crash-server-pipe.3008" utility
                            8⤵
                            • Checks processor information in registry
                            PID:5660
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5040 -childID 3 -isForBrowser -prefsHandle 5024 -prefMapHandle 5036 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {498a1e0f-3f3d-41ed-8d6c-5607aca7af92} 3008 "\\.\pipe\gecko-crash-server-pipe.3008" tab
                            8⤵
                              PID:7384
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4568 -childID 4 -isForBrowser -prefsHandle 5316 -prefMapHandle 5320 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a01c535-415f-43a7-a7e2-97a4d8fb9666} 3008 "\\.\pipe\gecko-crash-server-pipe.3008" tab
                              8⤵
                                PID:7460
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -childID 5 -isForBrowser -prefsHandle 5452 -prefMapHandle 5456 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1288 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {117aa5d3-083a-438c-89aa-b2405599f359} 3008 "\\.\pipe\gecko-crash-server-pipe.3008" tab
                                8⤵
                                  PID:7472
                          • C:\Users\Admin\AppData\Local\Temp\1012395001\a82240aaa0.exe
                            "C:\Users\Admin\AppData\Local\Temp\1012395001\a82240aaa0.exe"
                            5⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Windows security modification
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2492
                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2m0202.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2m0202.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3960
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1624
                          4⤵
                          • Program crash
                          PID:1804
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1652
                          4⤵
                          • Program crash
                          PID:1436
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3A73M.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3A73M.exe
                      2⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3044
                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1384
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3960 -ip 3960
                    1⤵
                      PID:4172
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3960 -ip 3960
                      1⤵
                        PID:3156
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3376 -ip 3376
                        1⤵
                          PID:5340
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3376 -ip 3376
                          1⤵
                            PID:5264
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5628
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5504

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4VCA4X1\download[1].htm
                            Filesize

                            1B

                            MD5

                            cfcd208495d565ef66e7dff9f98764da

                            SHA1

                            b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                            SHA256

                            5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                            SHA512

                            31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
                            Filesize

                            19KB

                            MD5

                            22e43c2c0a91f431e700f60513234283

                            SHA1

                            9f7c25247375956509a5e01b201465bcee736a75

                            SHA256

                            9a50a0797112cebaa1a8cc49731b9cec64830f1cb078db51851d43e8ce321b91

                            SHA512

                            2a1134c21e7943d31a6e2b8f718f6d60df50b88db3dd954dbbd5589c2c6d4c4f391be9de5157b9204a865ac1aa5e1fe9cf567d80077bf2971f235ff6e06cff72

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                            Filesize

                            15KB

                            MD5

                            96c542dec016d9ec1ecc4dddfcbaac66

                            SHA1

                            6199f7648bb744efa58acf7b96fee85d938389e4

                            SHA256

                            7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                            SHA512

                            cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                            Download Submit

                          • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                            Filesize

                            2.8MB

                            MD5

                            b466bf1dc60388a22cb73be01ca6bf57

                            SHA1

                            21eb9665e42d6c4a8d9e764627049b2a6e3a69a4

                            SHA256

                            e5f0f0c3383080fc2702779e3040c490ab022af69a4bc8c61bf9b1f6514ae7ad

                            SHA512

                            6cb51dae17b3bcef6254ecf6538ecc49cdd53c40c979fd743f49987b28d05c033781b1047dbf25b203b02bf70ce4205dcc1cc5bbea46119cb0e2cd0ce140cbe2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\sqlite3.dll
                            Filesize

                            630KB

                            MD5

                            e477a96c8f2b18d6b5c27bde49c990bf

                            SHA1

                            e980c9bf41330d1e5bd04556db4646a0210f7409

                            SHA256

                            16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                            SHA512

                            335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
                            Filesize

                            3.4MB

                            MD5

                            3a16d0e4e4522073da3c8a5a9f9e790b

                            SHA1

                            7a42a21a348d2e49c67b426d333a5c354ed2c83e

                            SHA256

                            ccc4dd64df98c26da462a17a8df9f927d02e202d88ada8cfba92b7bbeb954c3e

                            SHA512

                            1213c3e077b660afa65133f0b5943bd866f02d736284791dc99ae4d30c6ed7705eb55999cb4a3be1cc0a394111904154bc72a2d0f1fdc453893ecf9a4a25b99a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012389001\19b24d64ae.exe
                            Filesize

                            1.9MB

                            MD5

                            6d00ea43be88c32392e2a3b543d0a1f4

                            SHA1

                            1dfb0cb50425d6bf72467ae0894d614f26f0b987

                            SHA256

                            747ebc458a95ab80f371b899d4b6e54eaefba46bf5343ae39eeeafba61ba8365

                            SHA512

                            f111a1b9812891d9ddda571e798545743ff9628bcf2c258a9fcb34a89b3d5286a2882d9d635c16062d974aac4d11904ac95fcbb45ecce38aa0e314cba7e7bbbf

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012390001\5ff6f686d2.exe
                            Filesize

                            4.3MB

                            MD5

                            72950603b12d5d99f2ebcedeb3aed5d6

                            SHA1

                            3587c298d27279b481f9efa0c02be575b6a06599

                            SHA256

                            76d86e157a4fa1f1b3abf649b931cdc91af733e2b50a863cc9a1dcbb131148b4

                            SHA512

                            1fbcb1f8793eab0107924f6ec8789eb1752fd39eb4683193b6962803911abbb7ff1d05a362dec349c768e656f7f84144150b06a35e13f74d60afe422cbb407c8

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012391001\rhnew.exe
                            Filesize

                            1.8MB

                            MD5

                            f7286fef9317fe91e24cda721ec0be81

                            SHA1

                            0e0197c0f87200f7c1ebb4bba314f7bb875a638c

                            SHA256

                            4dcf1cc20990dace1f3e7c5a4b94ea7b823f90eb6de639b2b1b6494838f1cc62

                            SHA512

                            314b3f5cf1a0c15db568d33647b97887b37e987ba253ee9f5ded045446328307ebd04acd832fbdf66ad29be9510bd0c378e2fcb889509dca84df9b9106602c6e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012392001\426d4e4b5d.exe
                            Filesize

                            1.8MB

                            MD5

                            bd36d7562c72f2300c5a8aff4981792d

                            SHA1

                            8b3f7f55e5e1ba3ac2f11eba0c83b98f444c590d

                            SHA256

                            faa15db856629abcc10aaeec6b8300986940689ad8a3184c53af40390329a4be

                            SHA512

                            16c2f2ac5c41ede21027fa3a16f2cbc6d8f4fa792dbd0b7d59e4d493627d9efc35772ad78f886596687009368172dc7bf788dc634923523a52c11755982f08a9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012393001\c7b8a5cf24.exe
                            Filesize

                            5.0MB

                            MD5

                            50405b0e3ccc1050cc2345e296371015

                            SHA1

                            7c24f14abd9cee3488751c91c36f3c28a285ff1a

                            SHA256

                            f3e10ae537649e472f1a1c4aa2be9cdb9126922b95d8895031ddc5178fe36ac2

                            SHA512

                            5fd09777f9be4b383f828712e3a39e22a740178cad803d7ce141f079078f665d507727caeeb0e8c7e950313e07ff353c64fc73e6f7d223a02e4e28d98334e256

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012394001\de4e3e6a92.exe
                            Filesize

                            946KB

                            MD5

                            4d787542ab2f62216d13e350b8495515

                            SHA1

                            ab9bdbfb5bc1ad81b46a39eb622ff26b516880ed

                            SHA256

                            50e4e641608257d89ffbdd83788443fd0a5afd04d3c682049092420e32fcb963

                            SHA512

                            1ceff72feb4dea1d6b2ca5c0f15ed28494ed7ce50b2653f78ed272c053fe87277024d520c304b4eb00045b324cd366664628d3b20d803a9229e4b52c60c085b7

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1012395001\a82240aaa0.exe
                            Filesize

                            2.6MB

                            MD5

                            d97510e06a48bc3159baac94a6299b0f

                            SHA1

                            643b173325ed519327d3892603641d367c4783a5

                            SHA256

                            7db04bed60b5c7b3812a1ea9974e4a1ee74cde8c30ac08b8ba591b58f078a1ab

                            SHA512

                            875987892ac4efa57f92a20b7ce1289295560161fe766dfceb85890e05b520f972ab95fde5178df957d651abef258f058b5d2ad997f232718345ae127d6d7d88

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3A73M.exe
                            Filesize

                            1.7MB

                            MD5

                            868914554c439b7a6b83049364992a6e

                            SHA1

                            25abe8a1a31431cdd953322af0f259b84dcdc1a2

                            SHA256

                            f2b87185d453c7a71b472af472e1fdb3bf32147990de0b1b24cff92fa1379eea

                            SHA512

                            467d51eee7390973af084fb4522871cbda0b99fa9531166f4cc92317ef7ca7969c37f8cdbfc0b27bb978becbde4b87f300ba5f3ad9958e3c3c19f6b95b331977

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l3T89.exe
                            Filesize

                            3.7MB

                            MD5

                            b0389cfecffd5eadf2bfaf26ca68089c

                            SHA1

                            4784bcb1b978f5a64a86bdfbf0d0fc46c43a9d2d

                            SHA256

                            6ddb33d628e31532740d989d72f6b94f43e0b67053d0ffed0888b0f71ddca6b5

                            SHA512

                            1932eb41fa46f1d78beb2361d5c550b5e3bc3d14e9431b2a74874257a50653fd45ed9745a199bb25c03f95ff8f183e98fa2cd27c663d66f7e4ab0fa6faf79c84

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1A09z7.exe
                            Filesize

                            1.8MB

                            MD5

                            24f49ffb121e1be75fb379d7feda6ba6

                            SHA1

                            f5c11a11464c5d8596d14fda54ddcd27edfa9552

                            SHA256

                            ce24d7881dc208db5f3143e25f74962e16e7961a399d97bf906a43851223c138

                            SHA512

                            566a4780154d8fc736bc60fd76c144aaec504988137cfff1b5eb21f31bca7632eb70fe1a37ce2312fd6016dd8550cbaca1c804d5495721402f609d7e5043b695

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2m0202.exe
                            Filesize

                            1.8MB

                            MD5

                            2426e5ac8ee0bbb03e63d7467cba1df2

                            SHA1

                            6cfd84d6f98b4a9d1b9d5bd724ec59cd4e8533c3

                            SHA256

                            4b6f652aa6df9d8078f869655c18ac854262d94c3b3a547488a2ece1b184a7b5

                            SHA512

                            5697de737cf9ee10433c57a1f0d214b0d8344ad33306b243624542ead2375e6c3a4ca5a8d4e3b806cb5bbad17b1612881b1f1064d03b18da01c5f96c57e9751c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-3JSDK.tmp\_isetup\_iscrypt.dll
                            Filesize

                            2KB

                            MD5

                            a69559718ab506675e907fe49deb71e9

                            SHA1

                            bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                            SHA256

                            2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                            SHA512

                            e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-PCBR0.tmp\i1A5m12.tmp
                            Filesize

                            689KB

                            MD5

                            e672d5907f1ce471d9784df64d8a306b

                            SHA1

                            6d094cae150d72b587c5480c15127d7059e16932

                            SHA256

                            9f9250be71bd6254790a9630990f4560d53995db3d8737b7f49986e3551283e5

                            SHA512

                            9cf10e997d8d99e6eb2f6ccac00ab365f63e03d96c2e2354fdf67683b85553a60cd9542cfb21cbea468c6a2bda454cde71937c0d21c4b738451b5e2c30690c39

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                            Filesize

                            479KB

                            MD5

                            09372174e83dbbf696ee732fd2e875bb

                            SHA1

                            ba360186ba650a769f9303f48b7200fb5eaccee1

                            SHA256

                            c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                            SHA512

                            b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                            Filesize

                            13.8MB

                            MD5

                            0a8747a2ac9ac08ae9508f36c6d75692

                            SHA1

                            b287a96fd6cc12433adb42193dfe06111c38eaf0

                            SHA256

                            32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                            SHA512

                            59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                            Filesize

                            17KB

                            MD5

                            dbdf6bc0f97e6d06a0f37a72b9730a92

                            SHA1

                            7692f30eba1258379b0ff878f5752d052176e683

                            SHA256

                            3e9d32cd1fef588088018c383c01535d38875f46d5050a6f9ca9b21ca0d3aeee

                            SHA512

                            f7be1e3fdf39384494495ebb7cf41152961bc8506521d35d767305dd9e078eb6cb1c07dca79e4807757ef9dde0d8f79aff91f4cba9a890ce7f57e843b4d90dd2

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                            Filesize

                            6KB

                            MD5

                            44167956322934ee6379fabdeeb5a81f

                            SHA1

                            998f499ae28756b4ac2bbeccb420d6257345c323

                            SHA256

                            737099822b5b2e6a62bd3f3bc491eb563b953a2a7b3133a978fcfaeca8b5dd0b

                            SHA512

                            3307e57cc11f98c06b7646b15d3b7b1416146c62385dda2983d1410b7c2c25d9f2c0633825b74379f68e3c74d37ad979255310d3d2657d995e6d74435c1d5799

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                            Filesize

                            10KB

                            MD5

                            04ef445156caba920b844c90db13b539

                            SHA1

                            6ab6a9cf0de8fb7c0a5364b78d66b99ac484748c

                            SHA256

                            e01177e8e84aa3f79b5a1285c3421737f26b527f121aca5b7a48db12c724efef

                            SHA512

                            0d0963d2e257c0642ccf5b2a99d96119f1a50ba68ce1978cbb8a3650eccccf0ab6929279c415632e74f1cee4889635a6a1d33c57a3dff51ef4411396c6e7b576

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            24KB

                            MD5

                            495b4f9000514d61306537c42babc565

                            SHA1

                            4fff14b8339abf509dbe2dd50f0c421ec8492cf6

                            SHA256

                            125319b78e9a80aac1c002ddedfe25c080324fe65a4a0fa8a363e2c54d4ef25d

                            SHA512

                            1f7f37e1e29ebed76891527295d0af399f49d93fc437e6782647b7b0a6575889fd484a1e77c43bf40b4ed27bb088dc97b1e077ec3a60e4fe849257c8fc288a6c

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            5KB

                            MD5

                            ed767598cc3696778baa3c1a5c6ee9fc

                            SHA1

                            7bc46b673f57f119f37eddee8eaa89d057ebe10f

                            SHA256

                            fea0340eca7cff72aad180c72e0e3e95f0125525291ba0558e920ebe1f038c5b

                            SHA512

                            acd3c589a1319ad6a02390284c5515a33b84a22aae78998c881537758fbc140ff0f0135b25f1166312a295334d86bf8dfb39dbf60690458d1912a2b1f49c0f4f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.bin
                            Filesize

                            27KB

                            MD5

                            f12cc529cdc4bc6ec8b930578a29414b

                            SHA1

                            bb997a50c23e7f25f91a0e632dc5ebb958ea9a8d

                            SHA256

                            d5e9ff23d64793d28b396a239e03d1d2543fa130a615a851fe2a5a08f5fcb2fa

                            SHA512

                            cc11447065128dd493cf38742183394efcdf461cd4d8a24e3a4b81dc49d87455c89b3e5d87be178f9926896c3135168a77794a749b1c772d051f65ead829ffd5

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            28KB

                            MD5

                            ba5fe983a0434b64b5e8edaf261df6dd

                            SHA1

                            3eac71e0f9485c197429ddb67889f760fc41f4ba

                            SHA256

                            d67f564194578fffec66c756c5b0fd7c95af20a281b239d923bbf7a5592be421

                            SHA512

                            c750e2b32b83a037d901036d6dcf73eb08bbfe1ebe94e8add86e9ad947dac4e59f5a7f0b08b36a7938641064b7455fa47ab31ab74f0b55295ba89ee76d65a03f

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            5KB

                            MD5

                            f257a67a7cf4034fba481e43fb81c401

                            SHA1

                            bea6dbb8d982da2b030eda2c11fa149f9e0cd46c

                            SHA256

                            96bcb5be22df3f2cf3144200da9cc5cc571d2c79b8978db9900b5b8b16f25eb2

                            SHA512

                            7c719dfb0314ad4156269da42cc83e7adbcb73cc6529c11bd82fd69b4a650e32e7cbbe0ba5c82874e9e3e313b88db6b86866b24d2e808afc4dace611de82212a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            5KB

                            MD5

                            f767b4688970c0d178b1569d373f89d4

                            SHA1

                            9e97c03acbafef92e2a53fd6c2fc4abdebc3a850

                            SHA256

                            7070b019b7da47a84f5e51a2ad245ab42a7f12cb323b79172bf3b0aa1e3eb1e7

                            SHA512

                            e8c4c400a18d72307ed8692ce61b73a00a003f61487d55dec5d259fa01d120105e038dd37788f07a6b9b893fddf47e01c253157f586ea172e7249c03949c540e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            62a5e01d0b9b0f5012ae2209eacf1450

                            SHA1

                            4256bc247067890c15a0f930b406a655092631be

                            SHA256

                            b2b509bb06e989b69dabe2f4531f0a65f8189f29835912469e2ec6bbe69ff203

                            SHA512

                            57759b617f93828b4ac3ef22f3cea0d229dc1d803a78ae748eff83c057f3ba144f6ce5d5969a52e5f5f308c55d825c9894c5575c0a4848cea9fc7e106eaff7e1

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            8d6d64f65be11799da2d773c503a8f12

                            SHA1

                            caaeb388c62d74b1d1f7f0bfb22813b43532eed7

                            SHA256

                            f95d8d45f632bfbbc791597ef1b2f30842828f46fd4c0c6b76ac414c4675de42

                            SHA512

                            eb10a2c170b0a9a5f2341d7fd4a3fb9414cb90c176fe8988d900fb23928a8bd232d55bd91a404a7532e555e8f8dab9523514f5ab8ec0650a53e15262f06cd7f6

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            89e88a75d0551fc5fbbd760e3853937a

                            SHA1

                            4c589cd7bc4882f993d8c82e07943794e3aba880

                            SHA256

                            4d5d32f3961bb5807304da8f61ce23f1b39062baa613beea45b1b4e131060f66

                            SHA512

                            8479256185bd1fe289c98318522aaf760d35eccd694c2dd63c3e13d39bef8801f0036738d82dcc76a40c6798bfe8dbde59e1ce35c3a5744adc28bf209dc5d08b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                            Filesize

                            6KB

                            MD5

                            1e0d9a146e6a79398b04d848252e317f

                            SHA1

                            2869613526f83aae0abdfb0713d915f4615885dc

                            SHA256

                            3f5d530cd965839d0de432fe1f1639d3f882a6fccebaa1c7c97054f15b66c35b

                            SHA512

                            bc381ef4817c95f16a787d3dec241c3f4c7d210c150409d1df759f6aa70200ea1644de6a255cd7d205e1c1e5a8702a4e9cb84feb16c4d3fd48d8fc07ff759db8

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\05048890-23d8-4ebb-86c2-b8ef9de83bc2
                            Filesize

                            671B

                            MD5

                            e89f9bbc211e7b3bd055dcc03b569870

                            SHA1

                            64ab4e830d6c277b44090e412a9cd7992cab235a

                            SHA256

                            7f79541a54390d6221ab541ea7b9177695770e36d28074d996479c80fcae7dbf

                            SHA512

                            afd23d960cfa6fcac50d173ccb7a5447b98279be900c3b1098a4a07a3873b12a5ecaef78fac9d502f282353455bdcf5c7a9defe576e70d8bd9becf060f74f75a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\1948e501-957c-4145-a76b-fd0bc1826b30
                            Filesize

                            982B

                            MD5

                            5c7415ffd88487471ddd4b34f9e392d5

                            SHA1

                            0a1970a9636581f9c22cc4f9e78fd1d6ec44493e

                            SHA256

                            7cacfaf4e8bd3f452fd9e946beb01048528f487769cc996dbbca0d5a430b7bf0

                            SHA512

                            c09a26520dde911eeb3f95698de1e80cd5b686fd80ea099da34058268a6885124e757fdea40d5a3404d5884e96778f8b4c4d7e77b783354cac57a9312e75df9d

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\95f42b41-f3aa-4e98-82d7-5270eae8fcaa
                            Filesize

                            28KB

                            MD5

                            b1cb292ceb16304b9f28295064131929

                            SHA1

                            bf719dbd08bb16ab705a7f54172a243003e727b3

                            SHA256

                            a984860ee1d285049bfb371a8db9f2e4bd7591576df8e4d56b569f6dc40742c2

                            SHA512

                            817dc855893388ea54ad87c08898798be0518b683245b5e8b2c9aac1d9f340b5372afbf56569dbaf1c65bc0f56aa8736673b42d84be3c4641d8c21f1316bee25

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                            Filesize

                            1.1MB

                            MD5

                            842039753bf41fa5e11b3a1383061a87

                            SHA1

                            3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                            SHA256

                            d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                            SHA512

                            d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                            Filesize

                            116B

                            MD5

                            2a461e9eb87fd1955cea740a3444ee7a

                            SHA1

                            b10755914c713f5a4677494dbe8a686ed458c3c5

                            SHA256

                            4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                            SHA512

                            34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                            Filesize

                            372B

                            MD5

                            bf957ad58b55f64219ab3f793e374316

                            SHA1

                            a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                            SHA256

                            bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                            SHA512

                            79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                            Filesize

                            17.8MB

                            MD5

                            daf7ef3acccab478aaa7d6dc1c60f865

                            SHA1

                            f8246162b97ce4a945feced27b6ea114366ff2ad

                            SHA256

                            bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                            SHA512

                            5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                            Filesize

                            10KB

                            MD5

                            293cb55f880f00c3c0b586b57733f67a

                            SHA1

                            6f05dd9d881820e9f5ac64f42cec0c3025dfb53d

                            SHA256

                            796c4bdb036c9d6e402f6b11b7695b22e2ee5a1a01dc38b2ebe7bf11a5609b47

                            SHA512

                            d96fb864556db63bd3eff59f7cdf223dc06e546e63307163de1765f884e75e26b972a151cf54cd91d39c9f7cc7f8c40f614ab99891cee8bb466cb277f3a1ca77

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                            Filesize

                            11KB

                            MD5

                            8cbf13b31fd34c98b01de24071a448b2

                            SHA1

                            d932f7a47aadaad365eafb900d028645bcaca039

                            SHA256

                            7601e28918aad83605ec4ee788de77cddc15f75271689ad4a4d957307b826d7a

                            SHA512

                            6a72815c20699a6830baeb74e6df45806a8e31aeca3196d6b1c3663a29c85d2743cc16cb49d0720c510854d0231677ad45f51c20bd7daa0d3f2969dc47d94e26

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
                            Filesize

                            10KB

                            MD5

                            a81c7bfa1afedfb75f8c612ed77fe972

                            SHA1

                            0d5b8229c718dcb521b8d07482b3928e9a0f3916

                            SHA256

                            8442fbae3c1212ee63cf3d9a794e6883708adff13f7197f269193513e0ddc74e

                            SHA512

                            f3d40d0d5322a50eb6c8968321268e1cff4893a909808e322a588e4183b63fe03947ce11e0955e70d48bee08450455c2c54ef5922e8a39c824b741d3aca7c9ec

                            Download Submit

                          • memory/412-147-0x0000000000400000-0x0000000000414000-memory.dmp

                            Filesize

                            80KB

                            Download

                          • memory/412-57-0x0000000000400000-0x0000000000414000-memory.dmp

                            Filesize

                            80KB

                            Download

                          • memory/1160-212-0x00000000002A0000-0x0000000000733000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1160-195-0x00000000002A0000-0x0000000000733000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1160-175-0x00000000002A0000-0x0000000000733000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1160-241-0x00000000002A0000-0x0000000000733000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1384-37-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/1384-38-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2092-15-0x0000000077B34000-0x0000000077B36000-memory.dmp

                            Filesize

                            8KB

                            Download

                          • memory/2092-17-0x0000000000430000-0x00000000008F9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2092-16-0x0000000000431000-0x000000000045F000-memory.dmp

                            Filesize

                            184KB

                            Download

                          • memory/2092-18-0x0000000000430000-0x00000000008F9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2092-29-0x0000000000430000-0x00000000008F9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2092-14-0x0000000000430000-0x00000000008F9000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/2408-150-0x0000000000400000-0x00000000004BC000-memory.dmp

                            Filesize

                            752KB

                            Download

                          • memory/2492-290-0x0000000000800000-0x0000000000AAA000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2492-285-0x0000000000800000-0x0000000000AAA000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2492-291-0x0000000000800000-0x0000000000AAA000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2492-1058-0x0000000000800000-0x0000000000AAA000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/2492-1055-0x0000000000800000-0x0000000000AAA000-memory.dmp

                            Filesize

                            2.7MB

                            Download

                          • memory/3044-197-0x0000000000220000-0x00000000008BF000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/3044-191-0x0000000000220000-0x00000000008BF000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/3376-242-0x00000000007E0000-0x0000000000C72000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3376-1067-0x00000000007E0000-0x0000000000C72000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3376-239-0x00000000007E0000-0x0000000000C72000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3376-214-0x00000000007E0000-0x0000000000C72000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3376-1043-0x00000000007E0000-0x0000000000C72000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3832-1084-0x0000000000850000-0x00000000008F1000-memory.dmp

                            Filesize

                            644KB

                            Download

                          • memory/3832-98-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-152-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-153-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-218-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-183-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-1100-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-1082-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-154-0x0000000060900000-0x0000000060992000-memory.dmp

                            Filesize

                            584KB

                            Download

                          • memory/3832-1059-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-296-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3832-99-0x0000000000400000-0x00000000006DF000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/3884-1068-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-31-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-1022-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-1165-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-236-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-155-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-102-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-103-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-1088-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3884-190-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/3960-187-0x0000000000C60000-0x00000000010FF000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3960-122-0x0000000000C60000-0x00000000010FF000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3960-104-0x0000000000C60000-0x00000000010FF000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3960-157-0x0000000000C60000-0x00000000010FF000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/3960-35-0x0000000000C60000-0x00000000010FF000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/4172-237-0x00000000007D0000-0x0000000000CCF000-memory.dmp

                            Filesize

                            5.0MB

                            Download

                          • memory/4172-235-0x00000000007D0000-0x0000000000CCF000-memory.dmp

                            Filesize

                            5.0MB

                            Download

                          • memory/4564-129-0x0000000010000000-0x000000001001C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/4564-1039-0x0000000000400000-0x0000000000C78000-memory.dmp

                            Filesize

                            8.5MB

                            Download

                          • memory/4564-238-0x0000000000400000-0x0000000000C78000-memory.dmp

                            Filesize

                            8.5MB

                            Download

                          • memory/4564-1097-0x0000000000400000-0x0000000000C78000-memory.dmp

                            Filesize

                            8.5MB

                            Download

                          • memory/4564-1089-0x0000000000400000-0x0000000000C78000-memory.dmp

                            Filesize

                            8.5MB

                            Download

                          • memory/4564-159-0x0000000000400000-0x0000000000C78000-memory.dmp

                            Filesize

                            8.5MB

                            Download

                          • memory/4564-194-0x0000000000400000-0x0000000000C78000-memory.dmp

                            Filesize

                            8.5MB

                            Download

                          • memory/4564-124-0x0000000000400000-0x0000000000C78000-memory.dmp

                            Filesize

                            8.5MB

                            Download

                          • memory/4564-1069-0x0000000000400000-0x0000000000C78000-memory.dmp

                            Filesize

                            8.5MB

                            Download

                          • memory/4708-149-0x0000000000630000-0x00000000012FE000-memory.dmp

                            Filesize

                            12.8MB

                            Download

                          • memory/4708-179-0x0000000000630000-0x00000000012FE000-memory.dmp

                            Filesize

                            12.8MB

                            Download

                          • memory/5504-1243-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/5628-1073-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download

                          • memory/5628-1071-0x0000000000DD0000-0x0000000001299000-memory.dmp

                            Filesize

                            4.8MB

                            Download