Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

aeffa7f6d9...20.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2024, 18:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aeffa7f6d93e105575b864dc6c89b9119bbbc71655bf12d4eda660e77c432120.exe

  • Size

    6.8MB

  • MD5

    767354c76e47044e03a8e454726da1ae

  • SHA1

    f3b4770721c8cc24075f6dd89b82d92b9fd7caf3

  • SHA256

    aeffa7f6d93e105575b864dc6c89b9119bbbc71655bf12d4eda660e77c432120

  • SHA512

    0daddc1d0e8eaad3be94d24852693808e8fc65eb43ca6ba9b1d4c4a245b3fe290250338fd6dc8cf2022853fe72c622192dae54abc90db5cb3c70a5002591e3af

  • SSDEEP

    98304:2kf7HzfcJ5fdSBe7RdW9vsqGbGnwPvL+ESjONZ72w5TM4dOJsJ3fnZktS3Midpy/:2krrc5we77WJdGKw3KE0Csw5N7fnZzY

Score
10/10
amadeycryptbotgcleanerlummastealc9c9aa5drumdiscoveryevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

cryptbot

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

gcleaner

C2

92.63.197.221

45.91.200.135

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://formy-spill.biz/api

https://covery-mover.biz/api

https://dare-curbys.biz/api

https://print-vexer.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 14 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 28 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Identifies Wine through registry keys 2 TTPs 14 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\aeffa7f6d93e105575b864dc6c89b9119bbbc71655bf12d4eda660e77c432120.exe
    "C:\Users\Admin\AppData\Local\Temp\aeffa7f6d93e105575b864dc6c89b9119bbbc71655bf12d4eda660e77c432120.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O6k20.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O6k20.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1860
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i5D85.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i5D85.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1I12M2.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1I12M2.exe
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3800
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3136
            • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
              "C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5036
              • C:\Users\Admin\AppData\Local\Temp\is-ML9O4.tmp\i1A5m12.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-ML9O4.tmp\i1A5m12.tmp" /SL5="$70284,3291517,54272,C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:376
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\system32\net.exe" pause raf_encoder_1252
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2152
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 pause raf_encoder_1252
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:8
                • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                  "C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe" -i
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:4744
            • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
              "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1776
              • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
                "C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:6720
            • C:\Users\Admin\AppData\Local\Temp\1012476001\c6c5c3867e.exe
              "C:\Users\Admin\AppData\Local\Temp\1012476001\c6c5c3867e.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3692
            • C:\Users\Admin\AppData\Local\Temp\1012477001\34be254cdc.exe
              "C:\Users\Admin\AppData\Local\Temp\1012477001\34be254cdc.exe"
              6⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3592
            • C:\Users\Admin\AppData\Local\Temp\1012478001\rhnew.exe
              "C:\Users\Admin\AppData\Local\Temp\1012478001\rhnew.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5032
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1624
                7⤵
                • Program crash
                PID:7332
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 1644
                7⤵
                • Program crash
                PID:7364
            • C:\Users\Admin\AppData\Local\Temp\1012479001\84f4fab3e5.exe
              "C:\Users\Admin\AppData\Local\Temp\1012479001\84f4fab3e5.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5408
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 1636
                7⤵
                • Program crash
                PID:4648
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 1624
                7⤵
                • Program crash
                PID:2968
            • C:\Users\Admin\AppData\Local\Temp\1012480001\d83ed17712.exe
              "C:\Users\Admin\AppData\Local\Temp\1012480001\d83ed17712.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:7140
            • C:\Users\Admin\AppData\Local\Temp\1012481001\50baf237bd.exe
              "C:\Users\Admin\AppData\Local\Temp\1012481001\50baf237bd.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:5332
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM firefox.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3568
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM chrome.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:6808
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM msedge.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:6420
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM opera.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:6768
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM brave.exe /T
                7⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3276
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                7⤵
                  PID:1016
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    8⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:6848
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2060 -parentBuildID 20240401114208 -prefsHandle 1984 -prefMapHandle 1976 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c161a2e7-efbf-4f90-9ee1-f2780f8cd998} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" gpu
                      9⤵
                        PID:5400
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2496 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2416 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {147230cd-feb2-4045-8afc-7a97bf80b969} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" socket
                        9⤵
                          PID:6256
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2812 -childID 1 -isForBrowser -prefsHandle 3296 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d17052c-f9ec-422f-8f65-fe5a1c32fca4} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" tab
                          9⤵
                            PID:6052
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3940 -childID 2 -isForBrowser -prefsHandle 3932 -prefMapHandle 3920 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cbfa368-8d7d-4227-812f-3e32af2f63c6} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" tab
                            9⤵
                              PID:3548
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4464 -prefMapHandle 4460 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1682c2c2-fb0d-4d5d-9014-cc7730ca95af} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" utility
                              9⤵
                              • Checks processor information in registry
                              PID:6132
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5188 -childID 3 -isForBrowser -prefsHandle 5180 -prefMapHandle 5176 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {595dcca1-5034-4433-8cd7-02bd828f484b} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" tab
                              9⤵
                                PID:7956
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5336 -childID 4 -isForBrowser -prefsHandle 5416 -prefMapHandle 5412 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4577964-21b7-4db9-9d19-c18ebf02722b} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" tab
                                9⤵
                                  PID:7968
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5604 -childID 5 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92e9a019-41f5-420d-97e7-b8c8cc770515} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" tab
                                  9⤵
                                    PID:7980
                            • C:\Users\Admin\AppData\Local\Temp\1012482001\c5b7002341.exe
                              "C:\Users\Admin\AppData\Local\Temp\1012482001\c5b7002341.exe"
                              6⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6696
                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2N0772.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2N0772.exe
                          4⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1556
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 1624
                            5⤵
                            • Program crash
                            PID:6192
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 1688
                            5⤵
                            • Program crash
                            PID:5224
                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3B60p.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3B60p.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:228
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p276L.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p276L.exe
                      2⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:8112
                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4544
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1556 -ip 1556
                    1⤵
                      PID:5804
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1556 -ip 1556
                      1⤵
                        PID:5372
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6984
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5032 -ip 5032
                        1⤵
                          PID:7300
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5032 -ip 5032
                          1⤵
                            PID:7304
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5408 -ip 5408
                            1⤵
                              PID:3724
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5408 -ip 5408
                              1⤵
                                PID:5532
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:6468

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wL3EGdM.exe.log
                                Filesize

                                517B

                                MD5

                                4d737622dcf53d4cf89810ec284fdf89

                                SHA1

                                a71b0c3ac6b940047ca7730465c1f97342c8ca08

                                SHA256

                                7d5529c9d51a138cea4ae46faa32497ccf1e55d6bd5aa43f746d413ce80fa1cb

                                SHA512

                                acf53d9d2ffe5e3dd34760e3c8e138229ee9805387ddf0765266ee882268cf64f84fb4a1b79aee3f90b88b50f1a1bbf10c9ba7a1013496059b46f3abe9c859c6

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9PMCFZKU\download[1].htm
                                Filesize

                                1B

                                MD5

                                cfcd208495d565ef66e7dff9f98764da

                                SHA1

                                b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                SHA256

                                5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                SHA512

                                31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                Filesize

                                13KB

                                MD5

                                f361afd24544f289b2bb158ad73964c7

                                SHA1

                                717452db920e98d5d96e04b5360ef66b7f02a396

                                SHA256

                                05876bbf35b070163334e5db3bf2ef99cb33e9ffeeac8335460b282741b17743

                                SHA512

                                676a22b010389c2fbd198ed70cec8d0feb58dc091e66a0e40ef00b4712e93ea93dd97d4b204c302070d867f688911ca1f9f08704a65b05462461495d1652fc2a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                Filesize

                                15KB

                                MD5

                                96c542dec016d9ec1ecc4dddfcbaac66

                                SHA1

                                6199f7648bb744efa58acf7b96fee85d938389e4

                                SHA256

                                7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                SHA512

                                cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                Download Submit

                              • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\rafencoder.exe
                                Filesize

                                2.8MB

                                MD5

                                b466bf1dc60388a22cb73be01ca6bf57

                                SHA1

                                21eb9665e42d6c4a8d9e764627049b2a6e3a69a4

                                SHA256

                                e5f0f0c3383080fc2702779e3040c490ab022af69a4bc8c61bf9b1f6514ae7ad

                                SHA512

                                6cb51dae17b3bcef6254ecf6538ecc49cdd53c40c979fd743f49987b28d05c033781b1047dbf25b203b02bf70ce4205dcc1cc5bbea46119cb0e2cd0ce140cbe2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\RAF Encoder 1.0.1.55\sqlite3.dll
                                Filesize

                                630KB

                                MD5

                                e477a96c8f2b18d6b5c27bde49c990bf

                                SHA1

                                e980c9bf41330d1e5bd04556db4646a0210f7409

                                SHA256

                                16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                                SHA512

                                335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012382001\i1A5m12.exe
                                Filesize

                                3.4MB

                                MD5

                                3a16d0e4e4522073da3c8a5a9f9e790b

                                SHA1

                                7a42a21a348d2e49c67b426d333a5c354ed2c83e

                                SHA256

                                ccc4dd64df98c26da462a17a8df9f927d02e202d88ada8cfba92b7bbeb954c3e

                                SHA512

                                1213c3e077b660afa65133f0b5943bd866f02d736284791dc99ae4d30c6ed7705eb55999cb4a3be1cc0a394111904154bc72a2d0f1fdc453893ecf9a4a25b99a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012475001\wL3EGdM.exe
                                Filesize

                                2.7MB

                                MD5

                                0dde83e490b575981e8aeb0418bfcb95

                                SHA1

                                4ab4fa49fe9cf9d7b31bc75fcd93626c5f4660f7

                                SHA256

                                c9d1c0a0b317b2f5cdedc877109f03cd763b23151b68d51f9f095a74a579b119

                                SHA512

                                ea8ffc6e1b6f077c9345c1f32d695ce018391377a054f275c78e940163926e20877dd2f89e88d06252dfffdb7d04fe0af71a45d33b4bb1a7c056b45f11070523

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012476001\c6c5c3867e.exe
                                Filesize

                                1.9MB

                                MD5

                                d37030e80f50aa7d45f15e0983fad330

                                SHA1

                                906a1885d394107acab9d41402b0df195a327f82

                                SHA256

                                a5373b0a6fb3af6cc0166168bff40c602b6a67d9404962e438b61273e874c1bc

                                SHA512

                                1a06ed2cd745c8688b756656315c3bcb8b6465c9f616cc45b347d02070e9fc035efb82e03edffbca9a6765250deea26e01adba8ff99b132cebea071241ec413a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012477001\34be254cdc.exe
                                Filesize

                                4.2MB

                                MD5

                                758ff78dfb784d7dd45d64c3414e65ab

                                SHA1

                                8867b7267b58752190b99bf8203305b2d3f88b27

                                SHA256

                                843567bec6b0f3cbace108b441cc48a352e085ddf485bc04ed47947fe759369b

                                SHA512

                                60c189db28534c4e7fd0ed7ef7283a1baae4d038c27a1ce724c0a06dbe2e66dac55ae4d66d5639ca51b5df7a3cae2bcb3a9358d90587323c4e3acbd43b07aeb1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012478001\rhnew.exe
                                Filesize

                                1.8MB

                                MD5

                                90aa0042c2825073aac9d8cb97a3696d

                                SHA1

                                3bc907a5ddd6172fb9ce4b672feed48e3c2da961

                                SHA256

                                106d17aab9be8de992208dfce5f7fde982f0082d34dae389675ce1e19e168cae

                                SHA512

                                1547e0ef3dd94c4e05f430be114dadabaca8c29c589d9ca27d141e0eb3508d9b5557755cc0d081833b993397203b14d10248a947c92fcf0caf86416a07fc13f9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012479001\84f4fab3e5.exe
                                Filesize

                                1.8MB

                                MD5

                                604c6e384262cb46c3707b9bdcf34955

                                SHA1

                                d6b1d601d02b2ce27056807c259a69392131a43e

                                SHA256

                                08f189d51badf6326a1377e6bbdccbe1c3a6992d08606ae0957f75e9266335f3

                                SHA512

                                343c8aec256d9b3be05771f908333d74b5ead37be85b2864c1f8880a71bb8aaf59a7d5817df5dc992aa9c2f28c2353c1780a0333c81f5fad1018ee9d94ee3b79

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012480001\d83ed17712.exe
                                Filesize

                                4.9MB

                                MD5

                                a9d4ff62bbb79f4c4e7c7d4bbff5b871

                                SHA1

                                2e81d4e9ee5693d261141bd278952e635ad76ca7

                                SHA256

                                74c6aeca05bfc6812176e26e062b8de021793426d95dfa3cda77c68fe4764f19

                                SHA512

                                7f9c670989ebc7eb6d8c74304cd7752e5ff48a39faaf64ab71f9bd894c265cf81c0326f9f35897731b26fd685c77b65939423102204ca65c5ed7b1fb39201fdb

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012481001\50baf237bd.exe
                                Filesize

                                950KB

                                MD5

                                52f09828ee90fd61b64d812e4e887f66

                                SHA1

                                258db2233eb585a94a71b798a28da4ab3f3517b0

                                SHA256

                                2f22e4294b6b76e7a6f9aebd1e336994b6a84d7a0acc13c0766716341a0b12ca

                                SHA512

                                7e14b1e763aafdf7fb54fdf189f25d3559ef71e8257f0acb6d0ce160a20ddce77e0c735e7f9521ccdd2147d17b871a068c181f26cd3bf9836cbb535fdc8eae08

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1012482001\c5b7002341.exe
                                Filesize

                                2.7MB

                                MD5

                                13d5983c5ff3cc0f94bb58259ee5e1f1

                                SHA1

                                488e70401d2770f400e078ec21e55d27b873dcc6

                                SHA256

                                1809c96f1b708ada41597ac4df56936f4ac9b54b0c229f5101c43e68373ec6a4

                                SHA512

                                003cee5dabe09af48e81fcac2bce189b772b2259aa133b785efc5bd8072d8fc804bdba987b95dc089ee34b5789c3f22647031dd1a5634ad9d4c0b035ab73f478

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4p276L.exe
                                Filesize

                                2.7MB

                                MD5

                                38b7f3afd27a489ce0bb5dd6013336a6

                                SHA1

                                e0bd638da4d60d4d7da4018feaf6fe2660658b3f

                                SHA256

                                ecadc37e114a2038d48c9709791157d27e9233243726a65f2099856817a0c68a

                                SHA512

                                1ee01b32c2a16a8a389c3dd435a19dd6d22d255decb18486016b35d65224f4bee217ee4db0a79c3065cdc0ca9c0dd7e24fac8a699e68a8730e82458ae69f7e7c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O6k20.exe
                                Filesize

                                5.2MB

                                MD5

                                3161f63851f24f8e11a1e5e3379030bc

                                SHA1

                                2e38f90a0f7b792aa3a032124fb91fb2230338e5

                                SHA256

                                7e8b7e317f4b3d12ac95ece741994a9c0a23809fecddde08f54d5cda9c7786e7

                                SHA512

                                a1a4f8081cb252f364c0bf1f98b39daceaed26666835fcfd3de129118962945c6826eb060703de5da484be7bf8d5f70bca8fdd9c117bbfa47d398f18bf62db05

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3B60p.exe
                                Filesize

                                5.0MB

                                MD5

                                3cefe657842d51dac2bae694606dcef9

                                SHA1

                                5d1a1be06fbf467999fafa247e2d9a88d79a5164

                                SHA256

                                069a2de7d9a3cf067a8870596b6da48938a3110698dba7db83c622a3b9f74843

                                SHA512

                                2dbf96f2d2a9683be5b4976dd3054a1b96780a13d52739c7a59406dcfa0389af47575b9d5a1c7b5e3d9e924420337cb402f080bc8ab3eb4853bb79e2d9036d10

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i5D85.exe
                                Filesize

                                3.5MB

                                MD5

                                9eba1d1ccf5683adc574c0e0edf1207b

                                SHA1

                                cdd28c0464e87afbbc770c161115740b0eca281e

                                SHA256

                                8fe224f4a5574a283ce641fd7f8099f4d9eaa019383fcee65efb05b548057f9e

                                SHA512

                                901b4e9c90dfe9d3b7ffd0f368f085f04768045e9b1eeedca67fe6eb3470cd4f671711c26607e3be6bd80dc4b459e0e36d752b4fcfe697898512ee3e977e200c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1I12M2.exe
                                Filesize

                                3.1MB

                                MD5

                                ed3fa7460523c5ec9d4568e754624405

                                SHA1

                                88ad04cf36c7fe20644d48572ec2e70569c9581b

                                SHA256

                                d94506b192d68e1a3e0330db62fd84d4c1b98597869a4f831a06e7f73708714c

                                SHA512

                                4ff0b5009effb0630cb3cd5dcd7291bc645cb2d59d1975eaef2cec17f379e00317c44de5ed4b07ec607745571521fff380acbfb98afe3710e5ec2dae36bd1add

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2N0772.exe
                                Filesize

                                1.7MB

                                MD5

                                659626f9b237cc63c9312b4ee6779fe4

                                SHA1

                                28a0255714ac4f52d892d6e5c912ee35294d41b9

                                SHA256

                                46f5ccca9761ebfcaab4398177c12ce9138851f5d956ce77057b78e8e1ebcd23

                                SHA512

                                e608a5f0dc3cd39d7b5606020438cb7d3b762b00ade7de509c95cf8a1917046998f4439f6434111b4504c4bccead9a1fd6a5c4b4778800e92d34aafeb0c92ffb

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-HMI6U.tmp\_isetup\_iscrypt.dll
                                Filesize

                                2KB

                                MD5

                                a69559718ab506675e907fe49deb71e9

                                SHA1

                                bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                SHA256

                                2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                SHA512

                                e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-ML9O4.tmp\i1A5m12.tmp
                                Filesize

                                689KB

                                MD5

                                e672d5907f1ce471d9784df64d8a306b

                                SHA1

                                6d094cae150d72b587c5480c15127d7059e16932

                                SHA256

                                9f9250be71bd6254790a9630990f4560d53995db3d8737b7f49986e3551283e5

                                SHA512

                                9cf10e997d8d99e6eb2f6ccac00ab365f63e03d96c2e2354fdf67683b85553a60cd9542cfb21cbea468c6a2bda454cde71937c0d21c4b738451b5e2c30690c39

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                                Filesize

                                6KB

                                MD5

                                be2bc025fa6a1de45fa8633f2f2f441e

                                SHA1

                                82d67ea537d83860c7356631e8ccc8029e15ac51

                                SHA256

                                e512c3a548f61df3ab22fb45becee64cf3d3b2c72f652da97dd10c9c288e6d07

                                SHA512

                                8de65449f5340c1e0d2361a8d14da62a2a246b29ec20bc64ea30b0ada7a8409a4dd36fee70c5a4c8ac6b1face46b97dca8cac3daa48f989eebf9abf4e71b3af8

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                                Filesize

                                10KB

                                MD5

                                c87742af1b89b67de97fb921b0f3dd4a

                                SHA1

                                4a718e1436a044d2f937a81de53691790e28ac95

                                SHA256

                                acadc5282a68f797cbc309515f008d6d912c2250123afcf4d651985727490673

                                SHA512

                                a369a31e08711c2b32bbf9e593d6e2bedf7cf2f9d78e8b69b08b7688890b38d11fc31cd21b89cedbfe9b0bdb27cab2d2a40e314fe2c0f1dfdc841b142dc07eea

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin
                                Filesize

                                18KB

                                MD5

                                67d850305d24d71436192bf5a4e7df48

                                SHA1

                                cb6f9d069e1eb289843a60aadce54c4e73c2ba53

                                SHA256

                                8ffd9551ce4d37769d7da0fe8ae2f2ee73066461a03d99674d0b10bd1179e8b3

                                SHA512

                                db79a9bd9b123e5e3099f5f31a0df3a403d8bdbbc80d00de688b7fd9d8573878ac001a8a1583dd64f8c5b456714b04af2c8de2faadf053f246bb3bf45383ad31

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                23KB

                                MD5

                                06fb0f62d5e1cbc732b62d9e7669cda0

                                SHA1

                                7079185bc1cb6e22c94b2963c2cbd98d1bfdd4b1

                                SHA256

                                e607db0840c92b0707587e19215cef1134cc34b61d517cf5c672ce8f8b52d26c

                                SHA512

                                6cf16ef47ffca973b011028646ce5fdb4de079ff6cee4a4af4adfd19bcdcf855d7d9705d40f9561ba0baa9952e1d409265e14f8bba1ffdf75cdd66abbb12cad6

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin
                                Filesize

                                14KB

                                MD5

                                3123623ba63d953a0ae5f151bb3abb42

                                SHA1

                                7fe504efd37ecac49a23eec3e64501cda20acbb7

                                SHA256

                                134298ee5eb5d7df497b434b792cd3bee409dddcc29953604ab57c617259049e

                                SHA512

                                256bfa0d07894acbedc526d766578eac214452ada72f8c4bb57c2bc572ce51d565384955330079eb8e88d58c8cc935e14ca5163f114e3f82a515f78ee6505b73

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                5KB

                                MD5

                                3235c14fd1c92d2c386be3eb03add222

                                SHA1

                                4474141f5c6196173bf3d4ac67dccc4e087ece28

                                SHA256

                                67a68ff2b24987096bdaf807dd62493d740e5067d183fe77cb5aeb1a8050fada

                                SHA512

                                9ee141a832639518bf3e94965902ad1aad4d6e5da3b6146bbf40a22be3db6e8c312d3abaceaadf6f3fcfe0f8946036c5ba8da7aab2bfbd15de3956d66d59d1c8

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                6KB

                                MD5

                                390bdc172a6f52c0704cc18616b2ea35

                                SHA1

                                0f76b9616b6a824c23f72bab8b9541c28e2e708a

                                SHA256

                                b97f1aa7e2e6a05a85f8f80886888c8f52f131c6d693b59a7f6560fa5a52d9e8

                                SHA512

                                9db445d78ab032172715978a20a54588d89e1eaef2fe8692fdc96bee67b5e84f1a858e9fe36e1ce336f1a73acaa83c27b55f881ccba5bd8482d7f3fe3e1c0b5a

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                15KB

                                MD5

                                fb8cf0c3948ecbcc1666317e495d56c8

                                SHA1

                                713b0122ed8921122502a1dc3b019c21f711b973

                                SHA256

                                c9939e563a96ef010df549aaf14275b23735378a792fb3c8d1b7a5d123a1ba78

                                SHA512

                                7481a2f0c0fe553b76ec8548acb5461307102dd3f6a2f0dc846a3d225e931cdc734a24c9c4af0b88d4b02f30d34be5b109a820fcfe2c2752773e8912666ecae6

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                15KB

                                MD5

                                d247d6c6758f9d3297cb5f5e6efda35a

                                SHA1

                                72f408c23e9fe9b46eff4d72a1a24efc457f5280

                                SHA256

                                22b725fb47044fe9931213821cb2473ce85c8020348ffad5dbd053c362bdc30a

                                SHA512

                                f4c02305cfedbcd70b2a67de7b79761b639cbfb8e73e11d2f1a1e1e3b156ed18830e7e820abba0c97523081669c9bec270ef6954144efa6553ea2156840c232b

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                15KB

                                MD5

                                fc447f08442867b76576a3286b634010

                                SHA1

                                b93edd2b0a2259642ef3c23bf71ef8ddbdd6d17c

                                SHA256

                                93f2390e5beb369657ce2bc1c9fd0d8c885779c0c9cb28814c4a7dd53c437810

                                SHA512

                                b4d096c3499797b4043a92cae4b01d083ad86c32c9ff50d92cf196198969d703beed8350fd81bdfa732c1156ab329b66ee6290b1cd48f182daa0051285a21986

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\46734ccb-092e-4c97-b6f0-7be11e3e9bb0
                                Filesize

                                27KB

                                MD5

                                881233ea41763ff9e0b810d02ed09523

                                SHA1

                                ec5fd23addfc40077054f197a85fcb6d635ed409

                                SHA256

                                ed2c6c641bf3eadef3229c9aebceec189f014fdd591a6abefb33d6c38228956f

                                SHA512

                                140bef70ecf47e12766937cca088cf3333faedf573eabca4233add3bdf14f80ec6134eb4d484f0751cdb658a47589ce70906ab96b5cd907594a0e53a8ed29602

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\d48f150b-e18c-400f-87ac-020e8f9ea049
                                Filesize

                                982B

                                MD5

                                59605a1a0fe9b2a4104d81260e2505ac

                                SHA1

                                f54134775db7d5d5c9a8f13eb880f88d984e9649

                                SHA256

                                bbe9124ab25fcda6c8506cfb34b2f4f4ad6c132a59766bd4f8550be7b3d0639a

                                SHA512

                                80d4b1fda642737d14a5b759a2f9350553a4b4fd82df52dcfb7b8753261726bce9b27d81b1ac924c6ec1687623f947013b1e5b90e3af3577b91400343df8c0f2

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\f3a68ffc-da97-45c6-9c91-8a4aa2370c75
                                Filesize

                                671B

                                MD5

                                df64a51c7be14c3a6f343ed603917f9f

                                SHA1

                                51267a81ea8683bdef7faf129bdfc012f6af0cd9

                                SHA256

                                420026a07cc9285de6aec577dd19156db9b9c7930fff1da2ad24c818828de403

                                SHA512

                                f594f7d3dac26ca3d5a98c35b686e4e134a1fab8b3c6c0494f64d857d911e8a53a7a034c74124b37b4f50f4d056c21acd9faa0e04248a541ca514a7ee16d45bc

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                                Filesize

                                10KB

                                MD5

                                78077b1ee41e6746713df22d033e9c3c

                                SHA1

                                dee3527e2b4396e66d27f8b4cf33e5d51d3859bc

                                SHA256

                                d5ef34785dfc3a544830cb5d5dcf20ba4be16de12a765da6e21a669ac7f76d4c

                                SHA512

                                b14d929bee76575bf1ddb07bcde2f0c65aecaeb6dc4904d7fdd49dfb4cdbdc44df2a3808c17751e179300e588b5f8fe316b3835c429c3708da644ad58ab78d5c

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                                Filesize

                                11KB

                                MD5

                                f3ced4a6c20121c3bc06768398a3d404

                                SHA1

                                0ed9a65eb79a944d24e34a6d16f14011a7fb6827

                                SHA256

                                e8f366de8fcc8543f768fed23e9cc85064e205c08cd95ded49737ccb6af5de71

                                SHA512

                                5806cfd604058efeab2f2c93aa98aeb817768d50ad194845bc49d66c80b4a0e1f6a8bc8e7ab33fabb99f1ee9c27af8b5c643a1cd736f321c0b8024a6a1586ba2

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                                Filesize

                                15KB

                                MD5

                                a75e0d79a4265ef51e1cc2641be7bead

                                SHA1

                                1aa6b779e312f6166a927d5a3640472d7947a0f2

                                SHA256

                                7088c59e86e5e25c80d049c6cd4d06a82316b69594deed6942aa12fe851b9822

                                SHA512

                                09932359cf0992ac5efab7bddc1035365decee54f2890eb2948b2393bc0f2621b69c3f75fe92202cd2945ee44c7a4d9787680a2480be177eab4d0fc083a19d4f

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js
                                Filesize

                                11KB

                                MD5

                                9a15c375bc51310429a6c07f302b705f

                                SHA1

                                f718e617db53ffa008e6fcea5d98bb7a46d645ce

                                SHA256

                                c3ad8563e6333d3e86a23cd60fd8ded378843a6b53f75ba0033efa58a91ea91e

                                SHA512

                                0de6fb129c48411bb7772b258376b0abaecbcae8b98f36c5381287294bce2b29f6317115375aee0a063284527a7ac3641ff2de2749d1da214153f2f5b54c724f

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js
                                Filesize

                                10KB

                                MD5

                                ad908ff89a3abdaf362cf6f38eacfe97

                                SHA1

                                7e3607d7ec39a294071f14afc7ec3a472707c574

                                SHA256

                                370dec2ba9a2f04a2e3fdbdbbed90e84122bb7cc46ca428760b71d1ef389b03b

                                SHA512

                                bca9ad5e75ed825f658bb12dc9286c0c18ba39bf626939254ae8c5dc59e31e14be0c24527fd091a3ef9c7b07dfac18ff6375c9249fb8245f19f93b4808983892

                                Download Submit

                              • memory/228-20563-0x0000000000720000-0x0000000000C23000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/228-19924-0x0000000000720000-0x0000000000C23000-memory.dmp

                                Filesize

                                5.0MB

                                Download

                              • memory/1556-38-0x0000000000D50000-0x00000000011D0000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/1556-41-0x0000000000D50000-0x00000000011D0000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/1556-42-0x0000000000D50000-0x00000000011D0000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/1556-19919-0x0000000000D50000-0x00000000011D0000-memory.dmp

                                Filesize

                                4.5MB

                                Download

                              • memory/1776-168-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-130-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-136-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-144-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-128-0x00000000053D0000-0x0000000005520000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-160-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-148-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-184-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-150-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-182-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-180-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-153-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-146-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-127-0x0000000000720000-0x00000000009D0000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/1776-154-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-176-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-142-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-129-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-156-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-138-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-158-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-174-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-172-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-140-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-132-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-19963-0x0000000005940000-0x00000000059A6000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/1776-162-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-178-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-164-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-134-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-166-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1776-170-0x00000000053D0000-0x000000000551B000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/3136-34-0x0000000000600000-0x0000000000915000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/3136-40-0x0000000000600000-0x0000000000915000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/3136-39-0x0000000000600000-0x0000000000915000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/3592-8305-0x00000000006B0000-0x0000000001363000-memory.dmp

                                Filesize

                                12.7MB

                                Download

                              • memory/3592-13649-0x00000000006B0000-0x0000000001363000-memory.dmp

                                Filesize

                                12.7MB

                                Download

                              • memory/3592-20751-0x00000000006B0000-0x0000000001363000-memory.dmp

                                Filesize

                                12.7MB

                                Download

                              • memory/3692-23009-0x0000000000400000-0x0000000000C68000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/3692-7859-0x0000000000400000-0x0000000000C68000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/3692-2422-0x0000000000400000-0x0000000000C68000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/3800-32-0x0000000000E10000-0x0000000001125000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/3800-21-0x0000000000E10000-0x0000000001125000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4544-77-0x0000000000600000-0x0000000000915000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/4744-106-0x0000000000400000-0x00000000006DF000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/4744-105-0x0000000000400000-0x00000000006DF000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/4744-2259-0x0000000000400000-0x00000000006DF000-memory.dmp

                                Filesize

                                2.9MB

                                Download

                              • memory/5032-16600-0x0000000000E10000-0x00000000012B9000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5032-11180-0x0000000000E10000-0x00000000012B9000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5032-20941-0x0000000000E10000-0x00000000012B9000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5036-62-0x0000000000400000-0x0000000000414000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/5408-19715-0x0000000000860000-0x0000000000D17000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5408-21116-0x0000000000860000-0x0000000000D17000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5408-14378-0x0000000000860000-0x0000000000D17000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/6468-23002-0x0000000000600000-0x0000000000915000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/6696-19946-0x00000000005F0000-0x00000000008B4000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6696-19943-0x00000000005F0000-0x00000000008B4000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6696-20724-0x00000000005F0000-0x00000000008B4000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6696-20733-0x00000000005F0000-0x00000000008B4000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6696-19947-0x00000000005F0000-0x00000000008B4000-memory.dmp

                                Filesize

                                2.8MB

                                Download

                              • memory/6720-20711-0x00000000007A0000-0x0000000000810000-memory.dmp

                                Filesize

                                448KB

                                Download

                              • memory/6984-19961-0x0000000000600000-0x0000000000915000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/6984-20486-0x0000000000600000-0x0000000000915000-memory.dmp

                                Filesize

                                3.1MB

                                Download

                              • memory/7140-19917-0x0000000000F40000-0x0000000001433000-memory.dmp

                                Filesize

                                4.9MB

                                Download

                              • memory/7140-17614-0x0000000000F40000-0x0000000001433000-memory.dmp

                                Filesize

                                4.9MB

                                Download

                              • memory/8112-20572-0x0000000000FC0000-0x0000000001274000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/8112-20609-0x0000000000FC0000-0x0000000001274000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/8112-20610-0x0000000000FC0000-0x0000000001274000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/8112-20748-0x0000000000FC0000-0x0000000001274000-memory.dmp

                                Filesize

                                2.7MB

                                Download

                              • memory/8112-20745-0x0000000000FC0000-0x0000000001274000-memory.dmp

                                Filesize

                                2.7MB

                                Download