Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2024, 17:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    5cc43c13e14113d07197871708ba3d6a

  • SHA1

    3fd30c8b2df49f949086aa654ca67e67bc963a08

  • SHA256

    e147291b4b3f7e51599ff3e03f07cc2f556d35d7a0fa1c8ed284498ca6efc7f2

  • SHA512

    515ca57618a4e09eaafe432e8a345f712d29488b97cc3b88299179694c1facb0a61c5bbc019e14481ee6b2258b531a0d5d4eff9ae187404e01451ed12ef5bb02

  • SSDEEP

    49152:rvlYcKpLjavBk95yL7Po+Yamr9EuBlKJUqq/yNXlxwPw:rv6vgv295yL7Po+w9EuBIuqr5w

Score
10/10
amadeylummastealc397a179c9aa5stokdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://infect-crackle.cyou/api

Extracted

Family

amadey

Version

5.04

Botnet

397a17

C2

http://89.110.69.103

http://94.156.177.33
Attributes
  • install_dir

    0efeaab28d

  • install_file

    Gxtuum.exe

  • strings_key

    6dea7a0890c1d404d1b67c90aea6ece4

  • url_paths

    /Lv2D7fGdopb/index.php

    /b9kdj3s3C0/index.php

rc4.plain

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://infect-crackle.cyou/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
        "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:3544
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 6
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:3760
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:3556
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 20
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2036
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 20
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:224
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5184
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5300
              • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3068
                • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                  "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4168
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 1248
                    9⤵
                    • Program crash
                    PID:3708
            • C:\Users\Admin\AppData\Local\Temp\word.exe
              "C:\Users\Admin\AppData\Local\Temp\word.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3792
              • C:\Users\Admin\AppData\Local\Temp\word.exe
                "C:\Users\Admin\AppData\Local\Temp\word.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:376
      • C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe
        "C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3204
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1EF.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp1EF.tmp.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2288
      • C:\Users\Admin\AppData\Local\Temp\1012993001\1974f14a95.exe
        "C:\Users\Admin\AppData\Local\Temp\1012993001\1974f14a95.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3108
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 1496
          4⤵
          • Program crash
          PID:4840
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 1516
          4⤵
          • Program crash
          PID:4952
      • C:\Users\Admin\AppData\Local\Temp\1012994001\fd93ab60ad.exe
        "C:\Users\Admin\AppData\Local\Temp\1012994001\fd93ab60ad.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4064
      • C:\Users\Admin\AppData\Local\Temp\1012995001\78762b6371.exe
        "C:\Users\Admin\AppData\Local\Temp\1012995001\78762b6371.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3864
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1628
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1304
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4968
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3756
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3468
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
            5⤵
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:4604
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1816 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {632a2d13-e9cc-422d-b8e8-f140b493487e} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" gpu
              6⤵
                PID:5084
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc83a422-ac89-43d0-b768-4be76a3015fa} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" socket
                6⤵
                  PID:1228
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3232 -childID 1 -isForBrowser -prefsHandle 3236 -prefMapHandle 3368 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f910fc09-c759-4afa-81bb-7d8880a94c2d} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab
                  6⤵
                    PID:752
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3864 -childID 2 -isForBrowser -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8c404ad-bb8d-4cf1-b272-bf5e04a16d7b} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab
                    6⤵
                      PID:1464
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4664 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4668 -prefMapHandle 3700 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4b7db5e-c230-4ae2-9115-d63f0e79bae9} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" utility
                      6⤵
                      • Checks processor information in registry
                      PID:5332
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5280 -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5240 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9851497e-ac76-439c-a364-8b6affcb15dc} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab
                      6⤵
                        PID:5868
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5420 -prefMapHandle 5424 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6553706-33e0-4511-941f-81b10c15cace} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab
                        6⤵
                          PID:5880
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5692 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5c49213-dc03-46f0-98c9-7b059cbdc570} 4604 "\\.\pipe\gecko-crash-server-pipe.4604" tab
                          6⤵
                            PID:5896
                    • C:\Users\Admin\AppData\Local\Temp\1012996001\6e96c22837.exe
                      "C:\Users\Admin\AppData\Local\Temp\1012996001\6e96c22837.exe"
                      3⤵
                      • Modifies Windows Defender Real-time Protection settings
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Windows security modification
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4776
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3108 -ip 3108
                  1⤵
                    PID:3148
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3108 -ip 3108
                    1⤵
                      PID:856
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:5464
                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:3572
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4168 -ip 4168
                      1⤵
                        PID:5132

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Defense Evasion

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      3
                      T1112

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Query Registry

                      6
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\word.exe.log
                        Filesize

                        1KB

                        MD5

                        7dca233df92b3884663fa5a40db8d49c

                        SHA1

                        208b8f27b708c4e06ac37f974471cc7b29c29b60

                        SHA256

                        90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c

                        SHA512

                        d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
                        Filesize

                        19KB

                        MD5

                        b048733d74f9aaf4223bb17d2a5efc47

                        SHA1

                        7d6761c7114bc08bf59253016357533d3636d7c6

                        SHA256

                        36ff6e2148814c77677cf91ef519bd4d77820ac236997f6b2de200c16cd86fa3

                        SHA512

                        10bff52bb7a7c50858fa3f6f906a931ddadcb1e5327cb5e97d221ca02eef8b80f124b91efa6d3a35aa66b049d46ac66fc7d23f8cde1efc2acc6f818a7f2a3547

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                        Filesize

                        13KB

                        MD5

                        dd08d611160a269b8b31a49b8ec7c9da

                        SHA1

                        3014ffdcf800e33803089df044728a0e86d9ab5f

                        SHA256

                        bbd9a2115aa58fd234c18637f6e96717b8842a4782e6045b3fbfb34ba8ad2904

                        SHA512

                        33bc93250cab2ed64c75846073c7f45d53304a4ef5a7f21d4cb7c6a7c4d2ee7d447d62283c3f04cca912d76d67c563ccc1e4bf0ccd9b8c09b4c5cc7cfbd15ac6

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        Filesize

                        5.0MB

                        MD5

                        b183e5ff29a1532a84e5a38983ab9e4e

                        SHA1

                        230c9cbd2e14598aaf73ae78c85c998a6b923a51

                        SHA256

                        81a45f430c102365b46c663203ae5708b6befe2848f01efc7b702aff7170c901

                        SHA512

                        31be2761821fb6bc81a010a3f68fa6901aa5e9768e9c57db53b52e0495c7340abccc9191500aa39540fef159578403e78d2af31ac364b89774d5f359b54c6c1e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        Filesize

                        2.5MB

                        MD5

                        d1e3f88d0caf949d5f1b4bf4efbb95a4

                        SHA1

                        61ffd2589a1965bf9cb874833c4c9b106b3e43e8

                        SHA256

                        c505f3b2f40b8a68e7cacfe2a9925498ab0f7ef29aa7023bb472597021066b2e

                        SHA512

                        5d4c43e858371f24ebafb56388a586c081d7b0289a3b039dbb2b011e9864e8e9f5dc7037fcb3e88f4bec4259a09ce5f3ccdae3161b43dff140e0e4ca7bff96c3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
                        Filesize

                        799KB

                        MD5

                        89bd66e4285cb7295300a941964af529

                        SHA1

                        232d9fee67a3c3652a80e1c1a258f0d789c6a6cf

                        SHA256

                        a46bf8412717f75bf098966cb1f5074836e78f5699bb5073dcc45d59ca790047

                        SHA512

                        72d1c8c4b74bacca619a58062441203c6cfea81d064dc1933af7a3cb9758d924b011a6935e8d255aad58159a4ecbb3677cc6a6e80f6daa8b135711195a5c8498

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe
                        Filesize

                        5.9MB

                        MD5

                        3297554944a2e2892096a8fb14c86164

                        SHA1

                        4b700666815448a1e0f4f389135fddb3612893ec

                        SHA256

                        e0a9fcd5805e66254aa20f8ddb3bdfca376a858b19222b178cc8893f914a6495

                        SHA512

                        499aa1679f019e29b4d871a472d24b89adddc68978317f85f095c7278f25f926cbf532c8520c2f468b3942a3e37e9be20aea9f83c68e8b5e0c9adbf69640ad25

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1012993001\1974f14a95.exe
                        Filesize

                        1.8MB

                        MD5

                        d780c527e77e5d364222f238a1be814d

                        SHA1

                        f9f575fb76d0c56caa9ae40b9cb7bf138ed7a6b1

                        SHA256

                        c2d4357ca74eff5fb5d4578314a148b35b1ed049bb7b01432acfb522ec7fc023

                        SHA512

                        3eb051a61c8ffa9e3ac600b583da86a699ec4718516d4b39d13c2ed46bbc3741a9c6454173f47ef00f2a187132f1485fd3f7adcbf9b793f4cdb2308e28e529a5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1012994001\fd93ab60ad.exe
                        Filesize

                        1.7MB

                        MD5

                        498e0c93df5ed66b1831f428750dcc49

                        SHA1

                        d1742e319af6ece96b50ba929411aa67d450b4e1

                        SHA256

                        ecf34e2df6d8da5946d74ce0c53f278b44dc955c0d63f2cfba900b1505e4f1e0

                        SHA512

                        dcfdb4d9261d5527970f539435778129b2489f6fd8d3261a5ecdd61a334d60910d88b2efd18115a671d966324a3d25a8f66dc6985431c4fcb184baf06bbadec3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1012995001\78762b6371.exe
                        Filesize

                        944KB

                        MD5

                        6b1ffb69c2b316bdccf175d4670b9631

                        SHA1

                        bbad646bfd834bc5ec330510bfafab1fe23927af

                        SHA256

                        c72087743c05988bc74a22832266cf31ccc6e7d2fc568b796b69f6d4b01a7a89

                        SHA512

                        17fa2303e30bbfb300412466599189a3b2f25e56c0ec5137a7e0350950d404927f31ff31174fabcde75ec5d55484a13844266e66e1d6dd5c662b77c45d72b07a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1012996001\6e96c22837.exe
                        Filesize

                        2.7MB

                        MD5

                        52c60b0648b29aa222a28c4b56dd0143

                        SHA1

                        e89e4192c9c99e2e9aa0277dfd9d31042f8433ec

                        SHA256

                        a48f21684a63e428a08768e7e9995f3035a4b14af845b3ab2a633c9f806d338d

                        SHA512

                        72670bd733b6b3293627af1f9317a547ede9df2a62c65d16d7b7c4a3ad329ab78c32753bab63a7046c67ec0047c0a2157be42112777a9653d57c87c14c686367

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\32\sqlite.interop.dll
                        Filesize

                        1.4MB

                        MD5

                        6f2fdecc48e7d72ca1eb7f17a97e59ad

                        SHA1

                        fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

                        SHA256

                        70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

                        SHA512

                        fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        Filesize

                        3.1MB

                        MD5

                        5cc43c13e14113d07197871708ba3d6a

                        SHA1

                        3fd30c8b2df49f949086aa654ca67e67bc963a08

                        SHA256

                        e147291b4b3f7e51599ff3e03f07cc2f556d35d7a0fa1c8ed284498ca6efc7f2

                        SHA512

                        515ca57618a4e09eaafe432e8a345f712d29488b97cc3b88299179694c1facb0a61c5bbc019e14481ee6b2258b531a0d5d4eff9ae187404e01451ed12ef5bb02

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmp1EF.tmp.bat
                        Filesize

                        186B

                        MD5

                        790dd6f9aab53b59e358a126dc5d59fc

                        SHA1

                        ec6bf3eb0fa5d2e37c694bf71254e0ce0be1a5fc

                        SHA256

                        7ca8c160037742b7da30366775d7aae7882a98e1fbfdbbefb743c2a93d6b1c52

                        SHA512

                        a9d819b8d771febfa027de6f201d4effaf7bdd3334255707dddceb57b2b322649698903ee5d72f0e431780d29b01abedd5250d372100e6c66c0639965f86c7ef

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-2
                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\word.exe
                        Filesize

                        76KB

                        MD5

                        0e362e7005823d0bec3719b902ed6d62

                        SHA1

                        590d860b909804349e0cdc2f1662b37bd62f7463

                        SHA256

                        2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

                        SHA512

                        518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\word.txt
                        Filesize

                        91B

                        MD5

                        fa72be3794c09c3acd6b3225c636626d

                        SHA1

                        347d929e7a5db0c39775956de47893d88393abfa

                        SHA256

                        0f1cf1199fd90a1e010dd76b347b254945c2044fc73a07ba18d9a3e93b0f4009

                        SHA512

                        7239d9926bad1de4824fdf248a4baa8ebad1243a77a574d05d34deab948cb5bb2f44466ce9934df24d10e81a1a9090c789df0b49571704d1b0fa6456f277f5a4

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\word.txt
                        Filesize

                        90B

                        MD5

                        ae0cde2c6cf2b0f547992a6601bab2e9

                        SHA1

                        0dd35390ecc79da0260b91861d677690e520cbd8

                        SHA256

                        39c5e5f87c46ae5ac765b671c5f8c8572c991e6c9e3123963f9338e3b304e97c

                        SHA512

                        4e95adfe256166c41d59f980cdc35068f2cc0501abc6734b5e1e17a49b5e48539d806c434e489079cbe6e4dd9dece044787d4287cf16ec633dbd49cd20f6f5e1

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\AdminUserCash\CREDIT~1
                        Filesize

                        116KB

                        MD5

                        f70aa3fa04f0536280f872ad17973c3d

                        SHA1

                        50a7b889329a92de1b272d0ecf5fce87395d3123

                        SHA256

                        8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                        SHA512

                        30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
                        Filesize

                        6KB

                        MD5

                        66f558347e8d0cf08a9ff971cf0daf43

                        SHA1

                        ee0cb95cee985092fae29a4dd417028767d9519e

                        SHA256

                        c8beca2a7fc4d9f00dd1eb22501a78932c048111da5d8d60aa9a071d2c0f80cd

                        SHA512

                        4d4f28bb211bbd188c70603b9199f815c8c8420253fd1e26b2bd96ccf200a75c4bee49ad8f80843d0617a29b1eae44077c0c04412419bb6c0a4a3be550b40206

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
                        Filesize

                        8KB

                        MD5

                        dae20830495396879843e3fc459db129

                        SHA1

                        599f8c924b04c2dc392eed0f5c24404ded4cd57b

                        SHA256

                        4bb9c824c416515ffed6ead5de41d818ae5fa8b09e387e473aeabbeb330bb8e7

                        SHA512

                        f17f0b6d52e58f92bb7f9d2f1f48e874569825f23914d9ca44c9b2e152c7c737490947f0482684873f829927e8c6564d4d84332f6e17e02ad31f58bbfa7d029b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
                        Filesize

                        17KB

                        MD5

                        52a2a3b359f561d3220f92ca47e99587

                        SHA1

                        57262a927c9ca7f3819b2a84267e15ece382401b

                        SHA256

                        027aa32ccb73a600a0a9f398afcd202d3a6ba741188681ce62ff5cc8d06fc383

                        SHA512

                        cd2600acb83b7d63b50449ce0beda952d5722ff0b1c8a5e1b9fb74cacbf705a4b1ac40319f9695a86b658bcbd2e04db1546b506750bfbc76b4f44b78aa9e00c6

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        27KB

                        MD5

                        5c6aa6beedf9fa1cfafc9ea80a3a9cbd

                        SHA1

                        37bcae9c6b899183c98a08bac89ab205e2ba7248

                        SHA256

                        abd95cf8361f95f534b34323615647d1fdd0d35f4a17e63acf23011a8ec2f181

                        SHA512

                        6fd20a62801e79a458141d1743e12b26dccfbc7f5b366087dde2bd6c206e9714e3e5c1fe886747e97364b67baddef3ac1ad2c61a1098e41f67d441e927e40c17

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        27KB

                        MD5

                        c0e5fdd5a6536c9e26280ac8379ce2d1

                        SHA1

                        0414ca2e4c9795a43139a5ea83e28deef4c38bf4

                        SHA256

                        073c469d2b788bb4253091981e23505e35bbb394eca9f3164aa7687bc07c8f6a

                        SHA512

                        31fd9b5d47f49f5eb196b5324b39d9d91eb1d4d084c846b779a8a2e0f907395ca7149449a840a85dfa25c4b0d2bb56c595ff61f43610affba53e498f8fad734b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        5KB

                        MD5

                        28ac08fd0ee5cb3a4786de398379c61f

                        SHA1

                        7c2a85871a9b6572b46c8170e1754a70b9e661f2

                        SHA256

                        93f4e0ffeb3c1a98317fbb242657291d854dcf938a8a2e452687fd399d44cc1a

                        SHA512

                        1a7c39b5a1436be134f553e4d6abafac89d063a806a96c5063159ead6a537e3aec179dadb1bbf947ab91bbb52a5e72f336c250eec8fc553c7c8607878955ccc4

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        6KB

                        MD5

                        c782019d7f3e4ba021e56d2dc4b3eba9

                        SHA1

                        2e731cfc6222589098ca43cb9659394f7ebd6e4c

                        SHA256

                        a5ace5b1d6647f3c1b8d22199dbde52b1f531706af0272f710d1dda6d7f46c33

                        SHA512

                        0752e0bdebe42e0dfa515ecf97ff7bc12e5cceb7ab58b9d40e85b8e23c4f41d005de4aba9345de328755df38391b681135044098d325fdd0f0ed40a508d801e2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\1ec800d0-30ea-438e-a4c3-916c7b090fff
                        Filesize

                        982B

                        MD5

                        5c43f2384092bc356682d02013cacb66

                        SHA1

                        0a8a1e1494f13add499381e2af79c287eb96fe7f

                        SHA256

                        945fad18e91b6c41cc13c42069c022543c130d6b30ce01be9566dab2f7a4ed97

                        SHA512

                        59eb45ba5fd218103ffd5f2e20257713c0d083fa378068d829ed7919dfe88d57b75229ee4e0777e8eea0252b31ddac62918b754022c4b5a0f74d72ff865db820

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\cfdf5f91-cee2-43d1-9aa8-73cb6e47f416
                        Filesize

                        671B

                        MD5

                        31bdf89104d5af238e08838321b67152

                        SHA1

                        176b6c392a72e0dc3f117fc03d8d7add159ca25e

                        SHA256

                        d26723b1247d5e81963564ea7d930cdea6b227b0c4d66ca33cc71d22f6cfe49e

                        SHA512

                        892fc39aff0d31445f45845c9f4e8a6a272ce64cedc98ac5f1f30e099a2615e62177cc8d8425236a9dfaa2df9da0343c070e48f331ac03316c6dbe7000266665

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\f40e475c-6ed6-439a-bb52-dccd1db5fef5
                        Filesize

                        26KB

                        MD5

                        fbf551a9b95900be900fccf2a10c2f08

                        SHA1

                        39ab9edfebdab1f440a58ac2bab57cfd483425d0

                        SHA256

                        005f248b7f0963e958c55fac00274bd4f79326b646257b8d0af7d639159df03a

                        SHA512

                        239738e2f0dbe34818cc519a7c1810a06f446a8f3e99f8ddf5cc5defd48c7980736f98c8af3874ed34571876220edc9c179bba8ab01750695eb144132c0f0980

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp
                        Filesize

                        479B

                        MD5

                        49ddb419d96dceb9069018535fb2e2fc

                        SHA1

                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                        SHA256

                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                        SHA512

                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp
                        Filesize

                        1KB

                        MD5

                        688bed3676d2104e7f17ae1cd2c59404

                        SHA1

                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                        SHA256

                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                        SHA512

                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp
                        Filesize

                        1KB

                        MD5

                        36e5ee071a6f2f03c5d3889de80b0f0d

                        SHA1

                        cf6e8ddb87660ef1ef84ae36f97548a2351ac604

                        SHA256

                        6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

                        SHA512

                        99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
                        Filesize

                        12KB

                        MD5

                        f2debf2bbf2b84a0c557edaf10e39528

                        SHA1

                        6fa67203436e68f01ba944135c63cd0bb52a89b8

                        SHA256

                        1a27a068f8a544f43c6a69cb136f6ab3efd15ecfb462f931fbe9cc4994dc6300

                        SHA512

                        1b1505b589798c71c169a15f59bf5daacd8a123bf10ce14eeb76de9b127fa4f54e15f3d045c4484565d7b4840083a768b52299671960ecb1becd3fbc98b5dc58

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
                        Filesize

                        10KB

                        MD5

                        6aacf02c911331c8d698a46e20be87fa

                        SHA1

                        ee630a9fb48dba8c6ec734d7291a39b6a88cf0c9

                        SHA256

                        448c878fa085247f2a7ab99257d45acba0c2b811ce9f47fdb8bc7ee95ad7a8e8

                        SHA512

                        06ca38d0dd3809e805e4f345f0e8d1c7d35d0566ea9a992edd69512cbd6e0c55d29360b696304ce2106df5960c0938a99d9f4718e03909ccc03a1d54fcab8ff4

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
                        Filesize

                        10KB

                        MD5

                        07c4dcb34a7c80fb51e6cf1c12523525

                        SHA1

                        a418903d793a74986f649d176b384059160375f8

                        SHA256

                        df4e17e54205903d1b2739a9aa6c4e430724d0f9d91995fe49518feba2d60a02

                        SHA512

                        8c151ab86206340a889bb6f0cb736b7fe852f104fa726b5c8989118dbad9648d70c6a2eea2475d13fed453c31b639f6f456a41deef05213776e039920b0b5365

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                        Filesize

                        2.3MB

                        MD5

                        ea76f4f3feed63096bebda5825223595

                        SHA1

                        1eb8ff495c2d4802363fe7bac0f97a8f9d59fe24

                        SHA256

                        1c0e9ca3733d15630792a8eae0a8f01d50375f4f3384a01a691b449e7374a590

                        SHA512

                        47246ae913c44632218391e985ff5c794cc89788979b5a0f17f0897b07490cba087ffab5753b5d6066e2a3ae4f3098855f73f7be6e43ffa0aab2b79f65e19377

                        Download Submit

                      • memory/1484-620-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-50-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-1914-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-2818-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-20-0x00000000006B1000-0x0000000000719000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/1484-21-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-22-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-19-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-162-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-679-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-2826-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-2825-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-2751-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-511-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-605-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-2778-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-54-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-53-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-52-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-2815-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/1484-49-0x00000000006B1000-0x0000000000719000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/1484-48-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3068-2820-0x0000000005560000-0x0000000005582000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3068-2775-0x0000000000A80000-0x0000000000D02000-memory.dmp

                        Filesize

                        2.5MB

                        Download

                      • memory/3068-2819-0x00000000059B0000-0x0000000005B40000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3108-198-0x0000000000C30000-0x00000000010E4000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3108-129-0x0000000000C30000-0x00000000010E4000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/3204-74-0x0000000000F00000-0x00000000018DC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/3204-81-0x00000000080D0000-0x00000000080DA000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/3204-93-0x0000000009AE0000-0x0000000009B1C000-memory.dmp

                        Filesize

                        240KB

                        Download

                      • memory/3204-91-0x0000000009A50000-0x0000000009A72000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3204-84-0x0000000009240000-0x000000000925E000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/3204-94-0x0000000009AA0000-0x0000000009AC1000-memory.dmp

                        Filesize

                        132KB

                        Download

                      • memory/3204-73-0x0000000000F00000-0x00000000018DC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/3204-95-0x000000000A740000-0x000000000AA6E000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/3204-136-0x000000000AD20000-0x000000000AD32000-memory.dmp

                        Filesize

                        72KB

                        Download

                      • memory/3204-86-0x0000000009380000-0x00000000096D4000-memory.dmp

                        Filesize

                        3.3MB

                        Download

                      • memory/3204-83-0x0000000008DD0000-0x0000000008E36000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/3204-75-0x0000000000F00000-0x00000000018DC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/3204-90-0x00000000099D0000-0x0000000009A20000-memory.dmp

                        Filesize

                        320KB

                        Download

                      • memory/3204-87-0x0000000009720000-0x000000000976C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/3204-89-0x00000000098C0000-0x0000000009972000-memory.dmp

                        Filesize

                        712KB

                        Download

                      • memory/3204-82-0x00000000084E0000-0x0000000008556000-memory.dmp

                        Filesize

                        472KB

                        Download

                      • memory/3204-161-0x0000000000F00000-0x00000000018DC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/3204-85-0x0000000009310000-0x000000000937A000-memory.dmp

                        Filesize

                        424KB

                        Download

                      • memory/3572-2817-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3788-18-0x0000000000B50000-0x0000000000E63000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3788-4-0x0000000000B50000-0x0000000000E63000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3788-17-0x0000000000B51000-0x0000000000BB9000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/3788-0-0x0000000000B50000-0x0000000000E63000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3788-3-0x0000000000B50000-0x0000000000E63000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3788-2-0x0000000000B51000-0x0000000000BB9000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/3788-1-0x0000000077504000-0x0000000077506000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/3792-2323-0x00000000000B0000-0x00000000000CA000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/4064-178-0x0000000000D50000-0x00000000013E1000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/4064-179-0x0000000000D50000-0x00000000013E1000-memory.dmp

                        Filesize

                        6.6MB

                        Download

                      • memory/4168-2824-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/4168-2821-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/4620-46-0x0000000005330000-0x0000000005356000-memory.dmp

                        Filesize

                        152KB

                        Download

                      • memory/4620-41-0x000000007311E000-0x000000007311F000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4620-42-0x0000000000690000-0x000000000075E000-memory.dmp

                        Filesize

                        824KB

                        Download

                      • memory/4620-43-0x0000000005290000-0x000000000532C000-memory.dmp

                        Filesize

                        624KB

                        Download

                      • memory/4620-44-0x00000000058E0000-0x0000000005E84000-memory.dmp

                        Filesize

                        5.6MB

                        Download

                      • memory/4620-45-0x00000000053D0000-0x0000000005462000-memory.dmp

                        Filesize

                        584KB

                        Download

                      • memory/4620-47-0x0000000005500000-0x000000000550A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/4776-610-0x0000000000BD0000-0x0000000000E86000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4776-577-0x0000000000BD0000-0x0000000000E86000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4776-607-0x0000000000BD0000-0x0000000000E86000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4776-568-0x0000000000BD0000-0x0000000000E86000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4776-576-0x0000000000BD0000-0x0000000000E86000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/5184-597-0x0000000006D40000-0x0000000006D5A000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/5184-596-0x0000000000980000-0x0000000000A4E000-memory.dmp

                        Filesize

                        824KB

                        Download

                      • memory/5184-598-0x0000000006D60000-0x0000000006D66000-memory.dmp

                        Filesize

                        24KB

                        Download

                      • memory/5300-1980-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/5300-2773-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/5300-2763-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/5300-1975-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/5300-2001-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/5464-612-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/5464-613-0x00000000006B0000-0x00000000009C3000-memory.dmp

                        Filesize

                        3.1MB

                        Download