amadey | d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c

Analysis

max time kernel
37s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
Size

3.1MB
MD5

ed3fa7460523c5ec9d4568e754624405
SHA1

88ad04cf36c7fe20644d48572ec2e70569c9581b
SHA256

d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c
SHA512

4ff0b5009effb0630cb3cd5dcd7291bc645cb2d59d1975eaef2cec17f379e00317c44de5ed4b07ec607745571521fff380acbfb98afe3710e5ec2dae36bd1add
SSDEEP

49152:ktPTO+1ofLg4mtu3dBRdUMqbmIZgFv2Adk1Vf7Y5XnQ96BsohwyVw:G7O+1GLotutB/UMqyIbJf7Y5XnQmBw

Score

10^/10

amadey cryptbot gcleaner lumma stealc 9c9aa5 drum discovery evasion loader persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

gcleaner

92.63.197.221

45.91.200.135

Extracted

Family

cryptbot

Extracted

Family

stealc

Botnet

drum

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

lumma

https://dare-curbys.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://formy-spill.biz/api

https://covery-mover.biz/api

https://print-vexer.biz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	23df97b84f.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	92dfd41111.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	23df97b84f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rhnew.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	aadb88ce9b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ef6d82257d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a5aebbc7a2.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rhnew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rhnew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aadb88ce9b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ef6d82257d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	23df97b84f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	23df97b84f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aadb88ce9b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	92dfd41111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	92dfd41111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ef6d82257d.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	skotes.exe

Executes dropped EXE 8 IoCs

pid	Process
1076	skotes.exe
5012	92dfd41111.exe
3364	23df97b84f.exe
2616	rhnew.exe
2628	aadb88ce9b.exe
3640	ef6d82257d.exe
2316	8cc021132a.exe
4356	a5aebbc7a2.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	23df97b84f.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	rhnew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	aadb88ce9b.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	ef6d82257d.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	a5aebbc7a2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	92dfd41111.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ef6d82257d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012472001\\ef6d82257d.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8cc021132a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012473001\\8cc021132a.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aadb88ce9b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1012471001\\aadb88ce9b.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023c4a-147.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4468	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
1076	skotes.exe
5012	92dfd41111.exe
3364	23df97b84f.exe
2616	rhnew.exe
2628	aadb88ce9b.exe
3640	ef6d82257d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23df97b84f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cc021132a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5aebbc7a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92dfd41111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef6d82257d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	8cc021132a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aadb88ce9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	8cc021132a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3220	taskkill.exe
4084	taskkill.exe
3092	taskkill.exe
1512	taskkill.exe
1360	taskkill.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4468	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
4468	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
1076	skotes.exe
1076	skotes.exe
5012	92dfd41111.exe
5012	92dfd41111.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
3364	23df97b84f.exe
2616	rhnew.exe
2616	rhnew.exe
2628	aadb88ce9b.exe
2628	aadb88ce9b.exe
3640	ef6d82257d.exe
3640	ef6d82257d.exe
2316	8cc021132a.exe
2316	8cc021132a.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	1360	taskkill.exe
Token: SeDebugPrivilege	3220	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4468	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe
2316	8cc021132a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1076	4468	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe	83
PID 4468 wrote to memory of 1076	4468	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe	83
PID 4468 wrote to memory of 1076	4468	d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe	83
PID 1076 wrote to memory of 5012	1076	skotes.exe	85
PID 1076 wrote to memory of 5012	1076	skotes.exe	85
PID 1076 wrote to memory of 5012	1076	skotes.exe	85
PID 1076 wrote to memory of 3364	1076	skotes.exe	93
PID 1076 wrote to memory of 3364	1076	skotes.exe	93
PID 1076 wrote to memory of 3364	1076	skotes.exe	93
PID 1076 wrote to memory of 2616	1076	skotes.exe	98
PID 1076 wrote to memory of 2616	1076	skotes.exe	98
PID 1076 wrote to memory of 2616	1076	skotes.exe	98
PID 1076 wrote to memory of 2628	1076	skotes.exe	100
PID 1076 wrote to memory of 2628	1076	skotes.exe	100
PID 1076 wrote to memory of 2628	1076	skotes.exe	100
PID 1076 wrote to memory of 3640	1076	skotes.exe	102
PID 1076 wrote to memory of 3640	1076	skotes.exe	102
PID 1076 wrote to memory of 3640	1076	skotes.exe	102
PID 1076 wrote to memory of 2316	1076	skotes.exe	105
PID 1076 wrote to memory of 2316	1076	skotes.exe	105
PID 1076 wrote to memory of 2316	1076	skotes.exe	105
PID 2316 wrote to memory of 3092	2316	8cc021132a.exe	107
PID 2316 wrote to memory of 3092	2316	8cc021132a.exe	107
PID 2316 wrote to memory of 3092	2316	8cc021132a.exe	107
PID 2316 wrote to memory of 1512	2316	8cc021132a.exe	110
PID 2316 wrote to memory of 1512	2316	8cc021132a.exe	110
PID 2316 wrote to memory of 1512	2316	8cc021132a.exe	110
PID 2316 wrote to memory of 1360	2316	8cc021132a.exe	112
PID 2316 wrote to memory of 1360	2316	8cc021132a.exe	112
PID 2316 wrote to memory of 1360	2316	8cc021132a.exe	112
PID 2316 wrote to memory of 3220	2316	8cc021132a.exe	114
PID 2316 wrote to memory of 3220	2316	8cc021132a.exe	114
PID 2316 wrote to memory of 3220	2316	8cc021132a.exe	114
PID 2316 wrote to memory of 4084	2316	8cc021132a.exe	116
PID 2316 wrote to memory of 4084	2316	8cc021132a.exe	116
PID 2316 wrote to memory of 4084	2316	8cc021132a.exe	116
PID 1076 wrote to memory of 4356	1076	skotes.exe	118
PID 1076 wrote to memory of 4356	1076	skotes.exe	118
PID 1076 wrote to memory of 4356	1076	skotes.exe	118
PID 2316 wrote to memory of 4384	2316	8cc021132a.exe	119
PID 2316 wrote to memory of 4384	2316	8cc021132a.exe	119
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 4384 wrote to memory of 3804	4384	firefox.exe	120
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121
PID 3804 wrote to memory of 3868	3804	firefox.exe	121

C:\Users\Admin\AppData\Local\Temp\d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe
"C:\Users\Admin\AppData\Local\Temp\d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Users\Admin\AppData\Local\Temp\1012468001\92dfd41111.exe
    "C:\Users\Admin\AppData\Local\Temp\1012468001\92dfd41111.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5012
- - C:\Users\Admin\AppData\Local\Temp\1012469001\23df97b84f.exe
    "C:\Users\Admin\AppData\Local\Temp\1012469001\23df97b84f.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3364
- - C:\Users\Admin\AppData\Local\Temp\1012470001\rhnew.exe
    "C:\Users\Admin\AppData\Local\Temp\1012470001\rhnew.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2616
- - C:\Users\Admin\AppData\Local\Temp\1012471001\aadb88ce9b.exe
    "C:\Users\Admin\AppData\Local\Temp\1012471001\aadb88ce9b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\1012472001\ef6d82257d.exe
    "C:\Users\Admin\AppData\Local\Temp\1012472001\ef6d82257d.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
- - C:\Users\Admin\AppData\Local\Temp\1012473001\8cc021132a.exe
    "C:\Users\Admin\AppData\Local\Temp\1012473001\8cc021132a.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4084
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:3804
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ff31915-723c-407b-b136-42b314c2ae02} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" gpu
        6⤵
        
        PID:3868
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2456 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af26398d-e8a0-4544-9592-b763ceade419} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" socket
        6⤵
        
        PID:1792
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2856 -childID 1 -isForBrowser -prefsHandle 3176 -prefMapHandle 3236 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3081e613-9332-4138-9a85-5caa2e4f51f1} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
        6⤵
        
        PID:3732
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3952 -childID 2 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4de6bc82-10b3-480b-9f48-13e371134fb0} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
        6⤵
        
        PID:2056
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {387ee83e-610b-43b6-be43-339d7697d880} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" utility
        6⤵
        
        PID:5864
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5220 -childID 3 -isForBrowser -prefsHandle 5212 -prefMapHandle 5200 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a48099d5-03fb-4ffd-8ba7-e39717d8cf57} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
        6⤵
        
        PID:5324
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 4 -isForBrowser -prefsHandle 5364 -prefMapHandle 5368 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9358a656-c9ec-4893-927b-8b15acfe984b} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
        6⤵
        
        PID:5336
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 5 -isForBrowser -prefsHandle 5556 -prefMapHandle 5560 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1296 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {736e0692-92d8-4f46-8db9-c9d186f25617} 3804 "\\.\pipe\gecko-crash-server-pipe.3804" tab
        6⤵
        
        PID:5352
- - C:\Users\Admin\AppData\Local\Temp\1012474001\a5aebbc7a2.exe
    "C:\Users\Admin\AppData\Local\Temp\1012474001\a5aebbc7a2.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - System Location Discovery: System Language Discovery
    PID:4356
- - C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
    "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
    3⤵
    PID:5268

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:4428

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:6184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json.tmp

Filesize
20KB

MD5
e6734e82bdfc57e5d9c85e371938480d

SHA1
7cae7d70e4cb08ad6eef3e377fd2d4601fee4581

SHA256
91bc848236dce41421dae3420d91f1afb83ddceb03fcb940c6e1752d41316f8b

SHA512
e9c05f91ee5867dff9d3b0d2cd1dfa6db840039c4d43890352afa40b267a44283ecdbb33a440120eee8d2705493c2ba955e0ccfc1fba769d00b9fd7793b69d20

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Filesize
13KB

MD5
1c6ac0761225cd63c1b859f7627929c8

SHA1
11369962b2f237c5f75aa4fdda139e9a26e8846c

SHA256
e6899d10ebe72a2c91ec10fc5171658bf3f7bbdca330461628da6ee134a936df

SHA512
39b49d8be29c909dce3ab9fdd13ffaa6f12ab1e85d6f80a32c67842bf725767903e41480f107a4d99c17383e230930961488d7a84ce9e02190c55023bb18200e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012468001\92dfd41111.exe

Filesize
1.9MB

MD5
d37030e80f50aa7d45f15e0983fad330

SHA1
906a1885d394107acab9d41402b0df195a327f82

SHA256
a5373b0a6fb3af6cc0166168bff40c602b6a67d9404962e438b61273e874c1bc

SHA512
1a06ed2cd745c8688b756656315c3bcb8b6465c9f616cc45b347d02070e9fc035efb82e03edffbca9a6765250deea26e01adba8ff99b132cebea071241ec413a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012469001\23df97b84f.exe

Filesize
4.2MB

MD5
758ff78dfb784d7dd45d64c3414e65ab

SHA1
8867b7267b58752190b99bf8203305b2d3f88b27

SHA256
843567bec6b0f3cbace108b441cc48a352e085ddf485bc04ed47947fe759369b

SHA512
60c189db28534c4e7fd0ed7ef7283a1baae4d038c27a1ce724c0a06dbe2e66dac55ae4d66d5639ca51b5df7a3cae2bcb3a9358d90587323c4e3acbd43b07aeb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012470001\rhnew.exe

Filesize
1.8MB

MD5
90aa0042c2825073aac9d8cb97a3696d

SHA1
3bc907a5ddd6172fb9ce4b672feed48e3c2da961

SHA256
106d17aab9be8de992208dfce5f7fde982f0082d34dae389675ce1e19e168cae

SHA512
1547e0ef3dd94c4e05f430be114dadabaca8c29c589d9ca27d141e0eb3508d9b5557755cc0d081833b993397203b14d10248a947c92fcf0caf86416a07fc13f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012471001\aadb88ce9b.exe

Filesize
1.7MB

MD5
659626f9b237cc63c9312b4ee6779fe4

SHA1
28a0255714ac4f52d892d6e5c912ee35294d41b9

SHA256
46f5ccca9761ebfcaab4398177c12ce9138851f5d956ce77057b78e8e1ebcd23

SHA512
e608a5f0dc3cd39d7b5606020438cb7d3b762b00ade7de509c95cf8a1917046998f4439f6434111b4504c4bccead9a1fd6a5c4b4778800e92d34aafeb0c92ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012472001\ef6d82257d.exe

Filesize
5.0MB

MD5
3cefe657842d51dac2bae694606dcef9

SHA1
5d1a1be06fbf467999fafa247e2d9a88d79a5164

SHA256
069a2de7d9a3cf067a8870596b6da48938a3110698dba7db83c622a3b9f74843

SHA512
2dbf96f2d2a9683be5b4976dd3054a1b96780a13d52739c7a59406dcfa0389af47575b9d5a1c7b5e3d9e924420337cb402f080bc8ab3eb4853bb79e2d9036d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012473001\8cc021132a.exe

Filesize
949KB

MD5
607b571347184731f35542f8625a85dd

SHA1
624b1a58c688cffcf2946b66c0100baca5b887fc

SHA256
12f682be3ebf7eadeca00dc0a5932c26268ff16d47760b68b44afed4e385df4c

SHA512
e885d78ec2c813e22c772ed99f09e68be16024334f867b8edacdbfbffbff527d2b02ccaf1df2f86b510bbc8e5a74d99298fec46a63a32c8678403067047d3194

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012474001\a5aebbc7a2.exe

Filesize
2.7MB

MD5
38b7f3afd27a489ce0bb5dd6013336a6

SHA1
e0bd638da4d60d4d7da4018feaf6fe2660658b3f

SHA256
ecadc37e114a2038d48c9709791157d27e9233243726a65f2099856817a0c68a

SHA512
1ee01b32c2a16a8a389c3dd435a19dd6d22d255decb18486016b35d65224f4bee217ee4db0a79c3065cdc0ca9c0dd7e24fac8a699e68a8730e82458ae69f7e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe

Filesize
3.3MB

MD5
7823e902900881094372948957825fe1

SHA1
297a663f3b64fb9863164d10ac698bef03dd3a0f

SHA256
92d36e5fb3fdbf10ad10c7880c40013c2e21b8a49e20720137d2b4851681233f

SHA512
60d4ea35cfec5154cfa3cb767de7c839ca8b3987b27599ea218ec1c47f1d111a59f193cd3cfd1266ae384434ae653f1e0a297f7222a2592e529b2b4404dd6238

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.1MB

MD5
ed3fa7460523c5ec9d4568e754624405

SHA1
88ad04cf36c7fe20644d48572ec2e70569c9581b

SHA256
d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c

SHA512
4ff0b5009effb0630cb3cd5dcd7291bc645cb2d59d1975eaef2cec17f379e00317c44de5ed4b07ec607745571521fff380acbfb98afe3710e5ec2dae36bd1add

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
18KB

MD5
780e2aabba716b146654032ee5ce2771

SHA1
d37916a94b1f0e939632c065894d86b67296f7a3

SHA256
e1576c7be3e1fc9ec0bbaf2601c8a8146f9a3eb7c9781c7cd9b839287ee3d933

SHA512
b1d1af01dd5ab5a657c88d72436feaf98696dcc48052e16760c8b07b93284ae5d6f0157ccd91dc320f809a14bef53a7b94536f4f40cd997ec8fa7d724f19ef52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
6KB

MD5
7a5df4de73a662f7319b88c66eebf4ff

SHA1
6c8a809e00ab102b9b205b95be1cb4fc2f346566

SHA256
ec6d4668693f7b5239a779a959f447a9956bc8b7b49554d469354a597f7a364f

SHA512
663d0bbe58056be54a398b12c10ef953a3d3d02f4df37164c4d2e17128ee2bb9b8b0b4ed6cf050cf0a4e77b044164b2b4eed2500347afc9f3da5c66a6a550221

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin

Filesize
8KB

MD5
1a36114901129934d707465d7924f4f3

SHA1
b3c99447a593681b5414ad360bd642afed4cf0ca

SHA256
6871833349617a417985eb0639a84f36f3ba221c3c1bb27d51e9d87443e21cb0

SHA512
7d6bf688b35ff5544311cb4ae96662c7a47b1a84a61e969fdaa962a9febabc163923d0a2df072e98c93afeebef4043f7775c477237f1239f7467b17cfb460bf9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
0d2eec6961ea7cb88fc0b623098a60ab

SHA1
6c84bad884e24693e7b254f272280c0d1a923074

SHA256
3d814d86ce0e6ed081ffeceaecf8e4f8a8d33fc45a98a72a5b203f0665f878d5

SHA512
c8c74f93a8d32c9767ad3055b1aa467feb73fdc85520df6184851b0736afeeb3e58d9be99ae7859eefeb0aceff868e698b85a17006cc7f2242bd93d81dbb76fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
16834c9c069c8aebde6aaee954f5b325

SHA1
cb0a995c723c9dad28ddb5e67ec98056e791a7b7

SHA256
dfcaa5acac2d4d1d05bc9de60a4d2be727ffc63ab0fa29af137a033d6559f756

SHA512
dcbc2d20ed88a670f11ee1c6a848cd179eebc5299ccff09e550f56c0ad7f02873812ddba32a7934c6cb2ce99d0f4006c41ae4e42d1f2af36bc4448d4cb1c1d73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
562f61221a469d521fa5c1be8355bc61

SHA1
ed2a6ba28585452c291a244244392c797e15defd

SHA256
83cde680dca47a4f04bb2f80b23493692c1dc82f6807fa8cb2f4cbf5f6ed5278

SHA512
8bf8ea29936ccdb79a1725605d276016ddde08e29ebeae4ec9e0378d4244dfc53e7eeb5bf5776852de9b5adcee904dccb56f8c5a3615057a25b51cd53b356a69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\659b1efa-035b-466f-aa52-2a355e20021e

Filesize
671B

MD5
4a19714468bc5794d6eb6854746e6e52

SHA1
d5045963ea485ee64d691995fd419f0940383728

SHA256
c3b8029ab747483d27cdcea5c4622bcfb8c4aa68ba86c1429d754f85f4e53a6d

SHA512
bd5cc9bde80b69daf1541457c60308f57324e372f1c09e510405f1b4f8aa183cf0dfced1d1dc1ceaa131a52a61434d76e4bcf9f35b6b7868fa7d3898a916ecb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\681e680c-db9f-4d1f-8259-64615790f308

Filesize
982B

MD5
a7c09df2202cc926c10668aed4da5c0d

SHA1
6bcb1534cb88443c70ed9296fe628670ad8053fb

SHA256
2f11a6024456e4f1bb2c3e4d3e241f134d6ae2a233aa8354a6460006a064f00e

SHA512
d5d8e0c85ded5bdb43e228adb6803a66246dfb740475278cc89e528136dcc02e19d5f2f34d2cdb41b5aced38c7521029f09878536518c31629497b7ff72bffa5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\973f3339-86eb-4186-b7b2-5e73aea1bc6c

Filesize
28KB

MD5
66ae727b3d0bdae4168b7b4a1e2a0f97

SHA1
62854335a6c7b621e49bc4b4bda29e7a34870954

SHA256
451a557c36c10f7602e260b544268201282c9fc9196da3b47816963aba72900d

SHA512
ce26de2b9dab28402f5a2392cb91d2e22a4c7e9b4d780f9c31f1bcdd34fb6fe15883aa0bc0571c27a651888e6fe1c0891ce664fe096088a8af1e291030434d60

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
11KB

MD5
65c8e42e26455adb96e77acc58ba0fa3

SHA1
a846d1470643c73174ea43385e3a0b2adfdbb4ac

SHA256
44c3e42391affd2dbe1e593e1d1d2ace614c625052110c9f17518a9f0bcd9f41

SHA512
b153d9e5e792a6190de7942ca629705d8292066c2030901f0c5dcb088c008e900c0357a87380c3febb3c450e605e3629a2d32bcb9eeaac63d57641d4712ef7f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
12KB

MD5
0c3da135ce31e14bab6ec1fbc32180f7

SHA1
132df9c5eccdb65a6685c481856002a6e71252af

SHA256
baae1940f1dda23939be6ba6a60febef15f9102106a380cb9c106021ff127c56

SHA512
e73eec2e4e42fdfce06d9b630bc33a25c97021befe92fbe2c3c57de1bc70860cbb2bfc3f7bea78e18f2b9aaaad9e7a0ac2d6bf5a2d21ac8c2180c2bfc81603a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js

Filesize
12KB

MD5
825164375794ab8f6bc9c277ef10d432

SHA1
972de86179cd6d2a3e3fc7ef8eff254831e7dab1

SHA256
fabc1fccddc24f347e6e0526b53b5242b9b0fdc2c6afbc53a06937f0dcd89222

SHA512
eba9ae0f8c2e1df0967329c780a87ae649e311b7eaffdc4dc2f0002b00ac20e9babfa60ab8f3941546252c4c87d893269339370e723c150b420d68c79472a12b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
11KB

MD5
df03a06fa7b37025bc519e8cba82cbc2

SHA1
edc6f18a205e57efa984795dad0e898a97f41aca

SHA256
fd67e04ee9b92fc3354c68f6a7ffd20b09490e013db7b88fee7d0d2108aaa11a

SHA512
43e629bf8f0bed99b9db6c305f27eac067e578bc89a7e1021d0500fe8c4652a32784b7a7933de43cae3efca8af1e56e94eb41f66c5befa4cc20b09b565e608fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js

Filesize
10KB

MD5
e029ee78799f3eeb7d8b809a41e3023a

SHA1
279715caf1baf158d11a14f27c5e86d52049cd75

SHA256
1e2a2ec1358f325a28e0d24bd09520c1e397548f409567eb82e3b569ad94399a

SHA512
229f53ff3eb430f8a8b3a8c2ebcb9696b35da6985bc5fbcd6cc476823d276a3c683ecfc2e4457c6cb301c6cc3d8344975bd7ea7b22bc7d4847f8cac7b9abd815

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.9MB

MD5
0c3a48dbf9af2b68a9bea1a395a49521

SHA1
268cdab82eabed6485d3f0802695210d64c7b30e

SHA256
ee0e6b47fa40e92eec0c0c640022f4f035adb8eca120840595aa5c8ddedfc829

SHA512
1819438cb71d67bf4b1ff69d33f6b3118795d24066ae38b3f3fbf53b35bb89baaf0ccb997e5ba63155d798a83515d23c911ed33ff1ed41d8b37314200c079366

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
9.7MB

MD5
7e5f218d66b0250feb139bf829353959

SHA1
f2a3402d3432dc1827d2ee9a9d023a3c2399a235

SHA256
0f0f75cb68d7978df80c935f836a70aa590e9e038a8a4164dd878ee8693fcbba

SHA512
655e31452da0b38c7eed7331d83c68a61edc39cfe02dc1ef070cbbb88944d92b901c1ac584f7b4fa14daa344f13f9f8062797eb301b3b49583bd4739985f34f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
9.7MB

MD5
6d2d17d7868108f49a37e7a0b8821644

SHA1
f2cf496d999ddb86a3390761228d5994ae84eadb

SHA256
2c565d0b8531cbb28201942b506ea9eb1abf5999b59931993b9917511dd8f51f

SHA512
107e3d7e110326db002f63c34adc35111011dbdaec6cc3dce30e13d98e93e70447ad77d096d740627807e38600523a6c91f95694045c49e053f6d6abf181822b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal

Filesize
32KB

MD5
57991340e2800a09e00a52bb1ee1de37

SHA1
1b11e1030e546a5fea3f4c240553b85c096e58c3

SHA256
0aa1e1647ec0bb8455570275370cf60d51b0a8628e5b75dff2042075fc806060

SHA512
35a9bb6d3807bd0156099ca5c6f10a9805bdcea82dbb2a231583aeb99423ebd85a7de0583c23f509939d100b09bed3ef83e408facff6f38b3cddf5d1ca6d0e38

Download Submit
memory/1076-22-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/1076-158-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/1076-44-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/1076-43-0x0000000000FC1000-0x0000000001029000-memory.dmp

Filesize
416KB

Download
memory/1076-16-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/1076-20-0x0000000000FC1000-0x0000000001029000-memory.dmp

Filesize
416KB

Download
memory/1076-23-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/1076-556-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/1076-100-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/1076-21-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/1076-51-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/2616-142-0x0000000000140000-0x00000000005E9000-memory.dmp

Filesize
4.7MB

Download
memory/2616-141-0x0000000000140000-0x00000000005E9000-memory.dmp

Filesize
4.7MB

Download
memory/2616-526-0x0000000000140000-0x00000000005E9000-memory.dmp

Filesize
4.7MB

Download
memory/2616-98-0x0000000000140000-0x00000000005E9000-memory.dmp

Filesize
4.7MB

Download
memory/2628-163-0x00000000009F0000-0x0000000000E70000-memory.dmp

Filesize
4.5MB

Download
memory/2628-540-0x00000000009F0000-0x0000000000E70000-memory.dmp

Filesize
4.5MB

Download
memory/2628-116-0x00000000009F0000-0x0000000000E70000-memory.dmp

Filesize
4.5MB

Download
memory/3364-76-0x0000000000270000-0x0000000000F23000-memory.dmp

Filesize
12.7MB

Download
memory/3364-172-0x0000000000270000-0x0000000000F23000-memory.dmp

Filesize
12.7MB

Download
memory/3364-2818-0x0000000000270000-0x0000000000F23000-memory.dmp

Filesize
12.7MB

Download
memory/3364-118-0x0000000000270000-0x0000000000F23000-memory.dmp

Filesize
12.7MB

Download
memory/3364-119-0x0000000000270000-0x0000000000F23000-memory.dmp

Filesize
12.7MB

Download
memory/3640-140-0x0000000000890000-0x0000000000D93000-memory.dmp

Filesize
5.0MB

Download
memory/3640-138-0x0000000000890000-0x0000000000D93000-memory.dmp

Filesize
5.0MB

Download
memory/4356-191-0x0000000000EE0000-0x0000000001194000-memory.dmp

Filesize
2.7MB

Download
memory/4356-183-0x0000000000EE0000-0x0000000001194000-memory.dmp

Filesize
2.7MB

Download
memory/4356-2686-0x0000000000EE0000-0x0000000001194000-memory.dmp

Filesize
2.7MB

Download
memory/4356-190-0x0000000000EE0000-0x0000000001194000-memory.dmp

Filesize
2.7MB

Download
memory/4356-1761-0x0000000000EE0000-0x0000000001194000-memory.dmp

Filesize
2.7MB

Download
memory/4428-3768-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/4428-3095-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/4468-18-0x0000000000160000-0x0000000000475000-memory.dmp

Filesize
3.1MB

Download
memory/4468-2-0x0000000000161000-0x00000000001C9000-memory.dmp

Filesize
416KB

Download
memory/4468-1-0x0000000077784000-0x0000000077786000-memory.dmp

Filesize
8KB

Download
memory/4468-3-0x0000000000160000-0x0000000000475000-memory.dmp

Filesize
3.1MB

Download
memory/4468-4-0x0000000000160000-0x0000000000475000-memory.dmp

Filesize
3.1MB

Download
memory/4468-19-0x0000000000161000-0x00000000001C9000-memory.dmp

Filesize
416KB

Download
memory/4468-0-0x0000000000160000-0x0000000000475000-memory.dmp

Filesize
3.1MB

Download
memory/5012-80-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-205-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-42-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-45-0x0000000000401000-0x0000000000427000-memory.dmp

Filesize
152KB

Download
memory/5012-47-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-11830-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-46-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-49-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-50-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-55-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/5012-73-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-77-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-78-0x0000000000401000-0x0000000000427000-memory.dmp

Filesize
152KB

Download
memory/5012-81-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5012-136-0x0000000000400000-0x0000000000C68000-memory.dmp

Filesize
8.4MB

Download
memory/5268-571-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-569-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-605-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-607-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-609-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-611-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-587-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-579-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-567-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-561-0x00000000052B0000-0x0000000005468000-memory.dmp

Filesize
1.7MB

Download
memory/5268-560-0x0000000000550000-0x00000000008AE000-memory.dmp

Filesize
3.4MB

Download
memory/5268-563-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-565-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-562-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-604-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-602-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-573-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-575-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-577-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-582-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-583-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-585-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-589-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-597-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/5268-599-0x00000000052B0000-0x0000000005462000-memory.dmp

Filesize
1.7MB

Download
memory/6184-23548-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download
memory/6184-24164-0x0000000000FC0000-0x00000000012D5000-memory.dmp

Filesize
3.1MB

Download