Overview

overview

10

Static

static

3

3ae0d8cac0...5N.exe

windows7-x64

10

3ae0d8cac0...5N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2024 19:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3ae0d8cac0490f1183299570fdabe930d77493bf971ebd7c62a7f8ef5df0bb25N.exe

  • Size

    3.2MB

  • MD5

    b95bc24ab92034a945f75a5f75553600

  • SHA1

    7e4d98386717fcbdcc6e83f8120ecdc328d277fd

  • SHA256

    3ae0d8cac0490f1183299570fdabe930d77493bf971ebd7c62a7f8ef5df0bb25

  • SHA512

    255d54f4605d4c5efbcbf51f7de52cb14f67784d821761f34e54da2731aab05c038b1514bc5a6702988cfc6e1f3e0af6b7ed15b59bc47f6ea72f8e5da2e197e7

  • SSDEEP

    49152:lsCbLpXZMwV1DnyS161hGucIOnj2aWIY/r1c:lsCbtXZzNnyS161hG2OnqaWI6m

Score
10/10
amadeylummastealc397a179c9aa5stokdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://infect-crackle.cyou/api

Extracted

Family

amadey

Version

5.04

Botnet

397a17

C2

http://89.110.69.103

http://94.156.177.33
Attributes
  • install_dir

    0efeaab28d

  • install_file

    Gxtuum.exe

  • strings_key

    6dea7a0890c1d404d1b67c90aea6ece4

  • url_paths

    /Lv2D7fGdopb/index.php

    /b9kdj3s3C0/index.php

rc4.plain

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://infect-crackle.cyou/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ae0d8cac0490f1183299570fdabe930d77493bf971ebd7c62a7f8ef5df0bb25N.exe
    "C:\Users\Admin\AppData\Local\Temp\3ae0d8cac0490f1183299570fdabe930d77493bf971ebd7c62a7f8ef5df0bb25N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:64
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
        "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3700
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2404
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 9
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1372
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:868
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:3532
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 13
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:3316
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 13
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:3276
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\word.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2112
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:984
              • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3996
                • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                  "C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2084
            • C:\Users\Admin\AppData\Local\Temp\word.exe
              "C:\Users\Admin\AppData\Local\Temp\word.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1564
              • C:\Users\Admin\AppData\Local\Temp\word.exe
                "C:\Users\Admin\AppData\Local\Temp\word.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4992
      • C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe
        "C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD33.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpD33.tmp.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2960
      • C:\Users\Admin\AppData\Local\Temp\1013018001\2f807c17c6.exe
        "C:\Users\Admin\AppData\Local\Temp\1013018001\2f807c17c6.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1100
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1500
          4⤵
          • Program crash
          PID:3092
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1516
          4⤵
          • Program crash
          PID:3544
      • C:\Users\Admin\AppData\Local\Temp\1013019001\f0bbc17bab.exe
        "C:\Users\Admin\AppData\Local\Temp\1013019001\f0bbc17bab.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        PID:976
      • C:\Users\Admin\AppData\Local\Temp\1013020001\1264a5a903.exe
        "C:\Users\Admin\AppData\Local\Temp\1013020001\1264a5a903.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4028
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3960
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1680
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1440
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1032
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3456
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
            PID:3028
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:840
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06b387d7-35b5-4039-9643-5831df2638db} 840 "\\.\pipe\gecko-crash-server-pipe.840" gpu
                6⤵
                  PID:2960
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56037967-7635-43e1-99c4-315f50f4764e} 840 "\\.\pipe\gecko-crash-server-pipe.840" socket
                  6⤵
                    PID:5108
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3372 -childID 1 -isForBrowser -prefsHandle 3384 -prefMapHandle 3380 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d6f5fbb-b0c9-474e-9268-b690be16fb9a} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                    6⤵
                      PID:1688
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3732 -childID 2 -isForBrowser -prefsHandle 3716 -prefMapHandle 3692 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7bc4210-4dd7-450f-9837-22a6b2d52b24} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                      6⤵
                        PID:3432
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3716 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3920 -prefMapHandle 3940 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6108aaf2-8e56-47c5-b8a4-40a69809cb5d} 840 "\\.\pipe\gecko-crash-server-pipe.840" utility
                        6⤵
                        • Checks processor information in registry
                        PID:5820
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 3 -isForBrowser -prefsHandle 4860 -prefMapHandle 5632 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e538064-62c3-4b61-9beb-bac11d6f2d72} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                        6⤵
                          PID:412
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 4 -isForBrowser -prefsHandle 5780 -prefMapHandle 5784 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db204b4f-23fe-483f-9564-b3ae2b4de9dc} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                          6⤵
                            PID:3476
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5964 -childID 5 -isForBrowser -prefsHandle 5972 -prefMapHandle 5976 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10733ccd-6c7c-49b1-a6e2-1f8222bd500c} 840 "\\.\pipe\gecko-crash-server-pipe.840" tab
                            6⤵
                              PID:2228
                      • C:\Users\Admin\AppData\Local\Temp\1013021001\881d6814bf.exe
                        "C:\Users\Admin\AppData\Local\Temp\1013021001\881d6814bf.exe"
                        3⤵
                        • Modifies Windows Defender Real-time Protection settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4576
                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:2952
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1100 -ip 1100
                    1⤵
                      PID:1616
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1100 -ip 1100
                      1⤵
                        PID:3548
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:5472

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Defense Evasion

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      3
                      T1112

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Query Registry

                      6
                      T1012

                      Remote System Discovery

                      1
                      T1018

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\word.exe.log
                        Filesize

                        1KB

                        MD5

                        7dca233df92b3884663fa5a40db8d49c

                        SHA1

                        208b8f27b708c4e06ac37f974471cc7b29c29b60

                        SHA256

                        90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c

                        SHA512

                        d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json
                        Filesize

                        19KB

                        MD5

                        d73e01f748d3ffec7d76ce5723adf90f

                        SHA1

                        094e2760a5dad63970a0a18ae0ce5fb46fee88bc

                        SHA256

                        ccae7d8107ab2a457424c10678f374cfc5e45fa345377e568a357ebb9601653b

                        SHA512

                        a89fdfa3a63d37f656a55553a0b8ecde8e4d8974f7bf2cdf8f066cd8f3c31dbae310632f4cc750381df9c608ea54325d98c0fb83a133c88501953320d78c595d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                        Filesize

                        13KB

                        MD5

                        446f362a36e159996513b1426f64335d

                        SHA1

                        3c7f55474f94979f5644de1657ab808df3a82b7d

                        SHA256

                        5b1385964c30b1689c6e0f7c7ce56ebf7f15362e6e466025d51f1cbbe5a9ee07

                        SHA512

                        21d33df4176ceb19fd1c580a439e59cea3e9854c0fda6c4101199a3c56bbadf8823cc12a39f69c401f6ee93d016f59f74b6b5fc9d4a1ff2d6c7ca73bbc786e8b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        Filesize

                        5.0MB

                        MD5

                        b183e5ff29a1532a84e5a38983ab9e4e

                        SHA1

                        230c9cbd2e14598aaf73ae78c85c998a6b923a51

                        SHA256

                        81a45f430c102365b46c663203ae5708b6befe2848f01efc7b702aff7170c901

                        SHA512

                        31be2761821fb6bc81a010a3f68fa6901aa5e9768e9c57db53b52e0495c7340abccc9191500aa39540fef159578403e78d2af31ac364b89774d5f359b54c6c1e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10000760101\vector.exe
                        Filesize

                        2.5MB

                        MD5

                        d1e3f88d0caf949d5f1b4bf4efbb95a4

                        SHA1

                        61ffd2589a1965bf9cb874833c4c9b106b3e43e8

                        SHA256

                        c505f3b2f40b8a68e7cacfe2a9925498ab0f7ef29aa7023bb472597021066b2e

                        SHA512

                        5d4c43e858371f24ebafb56388a586c081d7b0289a3b039dbb2b011e9864e8e9f5dc7037fcb3e88f4bec4259a09ce5f3ccdae3161b43dff140e0e4ca7bff96c3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1012982001\qtmPs7h.exe
                        Filesize

                        799KB

                        MD5

                        89bd66e4285cb7295300a941964af529

                        SHA1

                        232d9fee67a3c3652a80e1c1a258f0d789c6a6cf

                        SHA256

                        a46bf8412717f75bf098966cb1f5074836e78f5699bb5073dcc45d59ca790047

                        SHA512

                        72d1c8c4b74bacca619a58062441203c6cfea81d064dc1933af7a3cb9758d924b011a6935e8d255aad58159a4ecbb3677cc6a6e80f6daa8b135711195a5c8498

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1012992001\7qg0CPF.exe
                        Filesize

                        5.9MB

                        MD5

                        3297554944a2e2892096a8fb14c86164

                        SHA1

                        4b700666815448a1e0f4f389135fddb3612893ec

                        SHA256

                        e0a9fcd5805e66254aa20f8ddb3bdfca376a858b19222b178cc8893f914a6495

                        SHA512

                        499aa1679f019e29b4d871a472d24b89adddc68978317f85f095c7278f25f926cbf532c8520c2f468b3942a3e37e9be20aea9f83c68e8b5e0c9adbf69640ad25

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1013018001\2f807c17c6.exe
                        Filesize

                        1.8MB

                        MD5

                        4ac9141ca54abebc30ba2dbbd8202328

                        SHA1

                        0af8d99177f5a204341e92179e3df4fc7250f55b

                        SHA256

                        26617312efc260714a32d2fb9f34581833a9437197f35a0ecfd091eb48518c36

                        SHA512

                        11111f1dc8e17e935f138800ec358084a4ddc31475b2ea52af58c83539c48425f8831a7449e87bf9df2551930c4891db7a2f78fa0df1cf711f9268ef6922e720

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1013019001\f0bbc17bab.exe
                        Filesize

                        1.7MB

                        MD5

                        5d5cbdd1801035e2485e7353df38e0c3

                        SHA1

                        569f6804a09e94d2413f0239c26a7e47734178a3

                        SHA256

                        678b506795611f59eec55a7003e31a378679db301b5669cdf8d2c9b0826cfede

                        SHA512

                        36d5081f994c44774548fcb8fa05d3461f1cc823b62fab79b949bafc3e26f457a58f278bce3fccaa79d43b92607ce61d38d687fcffa8863e273321cf493c75ea

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1013020001\1264a5a903.exe
                        Filesize

                        951KB

                        MD5

                        76c2c0bba853abfff5189ac4c5bbfa7b

                        SHA1

                        5e360faf571e5623ecc24bc075dd990038689fed

                        SHA256

                        fdc3cce2d6bad9345ec450432e8456b645d73a5a9d1852da73444c5976f4488f

                        SHA512

                        739c03ebe636c78aa7d2d4da6fe2066886dcdff63bcd644150c75e52a724ae7559dc3f1e0b5425e74f9abd3873295e6b1f3ae0b7b1777222bb0b702a0cfca6ff

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1013021001\881d6814bf.exe
                        Filesize

                        2.7MB

                        MD5

                        fbb08fc5dee68a2eeaeb7c1d17493afd

                        SHA1

                        d87a00662b3348fd21ace933f094e89ba64ad377

                        SHA256

                        74d427ab9ed2d9e35230134138b929b7528054e7a1330ca4f50997746b0cd55c

                        SHA512

                        39fa6630e5f50dee9ef6216c954fdf64507fe940ee3211e2a6eb0ba659036d655b14aae8f61d88049d83fe7c3eda9c629844d8a005ad96b08efbacdd7fed2176

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\32\sqlite.interop.dll
                        Filesize

                        1.4MB

                        MD5

                        6f2fdecc48e7d72ca1eb7f17a97e59ad

                        SHA1

                        fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

                        SHA256

                        70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

                        SHA512

                        fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        Filesize

                        3.2MB

                        MD5

                        b95bc24ab92034a945f75a5f75553600

                        SHA1

                        7e4d98386717fcbdcc6e83f8120ecdc328d277fd

                        SHA256

                        3ae0d8cac0490f1183299570fdabe930d77493bf971ebd7c62a7f8ef5df0bb25

                        SHA512

                        255d54f4605d4c5efbcbf51f7de52cb14f67784d821761f34e54da2731aab05c038b1514bc5a6702988cfc6e1f3e0af6b7ed15b59bc47f6ea72f8e5da2e197e7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpD33.tmp.bat
                        Filesize

                        186B

                        MD5

                        790dd6f9aab53b59e358a126dc5d59fc

                        SHA1

                        ec6bf3eb0fa5d2e37c694bf71254e0ce0be1a5fc

                        SHA256

                        7ca8c160037742b7da30366775d7aae7882a98e1fbfdbbefb743c2a93d6b1c52

                        SHA512

                        a9d819b8d771febfa027de6f201d4effaf7bdd3334255707dddceb57b2b322649698903ee5d72f0e431780d29b01abedd5250d372100e6c66c0639965f86c7ef

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\word.exe
                        Filesize

                        76KB

                        MD5

                        0e362e7005823d0bec3719b902ed6d62

                        SHA1

                        590d860b909804349e0cdc2f1662b37bd62f7463

                        SHA256

                        2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

                        SHA512

                        518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\word.txt
                        Filesize

                        91B

                        MD5

                        3a4d0315257a76b9f68c51e82774a3f2

                        SHA1

                        7caa2392d6b9339ff7cf0fb61f23a2c254d585b7

                        SHA256

                        967a4e6c3b9259e2999adfc4229c8409bbb4ac02f8c413c252f43d581a5a4d30

                        SHA512

                        55b242f8c15fc381ca3e86773e9bd2ac83cf6292ebda460d04c8a2eff5c68c93bf5e2312060a5d66756958a069cde20d3959842e0359273c10e4ffbd66100291

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\word.txt
                        Filesize

                        91B

                        MD5

                        a1d86e39eed1eb4f51f55c6741f557d2

                        SHA1

                        0fad45da5d8b8d36dcf9ada2ab7e11c5ada95eeb

                        SHA256

                        790c39788b4f3e2396675e3b8877061473f26b652ef0ec69d5d2bfd0cffe31ea

                        SHA512

                        5f203c2f06df54947e231db17392f9b4f48333de56cdf86e9bd28be873586ba96ed0fac96a39f18aa060e22348bd96285d17cbaef8583a179fe158239eeddcbc

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\AdminUserCash\CREDIT~1
                        Filesize

                        116KB

                        MD5

                        f70aa3fa04f0536280f872ad17973c3d

                        SHA1

                        50a7b889329a92de1b272d0ecf5fce87395d3123

                        SHA256

                        8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                        SHA512

                        30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                        Filesize

                        6KB

                        MD5

                        66f3b3a4355a1d8d6b1c9b756e159cf9

                        SHA1

                        ed95b96b6866a71f07ef4569bbd25d0913cc6d8f

                        SHA256

                        cb61a713cfad8e17dbfff906aa7ac7bc32f160c70b0abfb3d57d742eabdde632

                        SHA512

                        b4e15607902a32ad95e01bc5b729349cee376bd764d0150e185d605e301c4f8a216c492e8c519e1b56a1a464dee90de35856d8d28928d7876fbae0eb2281d87f

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin
                        Filesize

                        10KB

                        MD5

                        877cbfd56d5586b35ae92ceade4a44a5

                        SHA1

                        27ba70bcf773435ebef3e8e980d9ba2b137c043c

                        SHA256

                        857f163c4d51bb4bd8eb23a05000de656d26df9409bf3f73162ba7ed6a184705

                        SHA512

                        28a953496be2c5068940b0d941645c0e10187e083a0412a9134804b883472d5463b48766dc41a2e75732806b95f774e26f655b8e1be0db91acc76319c8754f5b

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        16KB

                        MD5

                        82586b8f347472185f2790b31f3a9950

                        SHA1

                        d508694bc95bedc6ac17461196cc626d03a5e36e

                        SHA256

                        25c567faa0f30e14cf3bc1d71ae126f632cde04113b3a5e3306a01ff050d3276

                        SHA512

                        c558eb1ba1c4c071960951265177dfdbc0b7cebb37f500fc223f627a01b4e4985f136c6aa6ef53f7ddf3f57180bac9824b30f62f8c575ee02ba42c9d709040da

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        16KB

                        MD5

                        e7e286d5d609b16bea7e50c6283c0cd6

                        SHA1

                        7f4b701fc48f2a996e87dc35dc4ec133c43f1505

                        SHA256

                        713db5e65edbef4b2fcd8c3c6790f81d9afebadbfc2da7a0c38ec794fa7b220b

                        SHA512

                        a8f1250b2e9dc578b9cf80eeb61ff0e8bac474fbd70076e371ed95894ab6a9373e61d3c5688e843a1b51f996209c2522f00d8e1c55cc42bdb764cb0b378737d3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        5KB

                        MD5

                        c66484eef378922c5add795b5264cf76

                        SHA1

                        49a252e99c014474695e8d02658107e8e49c5871

                        SHA256

                        748e1caea5589dd8bd8b5a4ad6276d4a71ae3d64edf444c47f445c3fe4ea6ea8

                        SHA512

                        d5c0a5c588bf7d13d8a835be444949e3caef8373195a544ec4cf6bb5b36222d54bda6e91ae79f6693b703d6b806a3075be753baceaa67473b8d371fb79589e18

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\05ed4a6a-ec96-43b8-9557-3c24dac5c206
                        Filesize

                        26KB

                        MD5

                        a4409723240bb1c8e474a4a1e20c97b7

                        SHA1

                        6c4faaa0e3cbbaed0b6cf1e21d1787e2531839cb

                        SHA256

                        f63d7175441e66033b1628ab5dadc944cd09ea69659f7adb36c77172497dc310

                        SHA512

                        81816ca0f004665de791fa9895ad421bfabcb591c685e6f7973fff0c9d13c51976889723a41bb2f6375c1ccf2eee7706132e2371453dbf1450b194a232f86e71

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\1f07b830-a29c-401d-b63a-ce648eeb19ba
                        Filesize

                        982B

                        MD5

                        0aee66356c34dcb77cd8e0930b162c8e

                        SHA1

                        1a7ad5dca7a6e5024f93a48fc7815fd1fd2af2b8

                        SHA256

                        51f089e105991ea47dc3cd47154fc492ce9f6d10bc7a716494dabfa393eadb79

                        SHA512

                        83fd86f5839844a59e29c44b82c0503db89ffe4d3657e2e6c369ea150b09a0fcad3903b6ed09dca35709cf8506236f9a381f8cec288e14a57331d26f133264e5

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\5e9962f3-8066-4df2-ae84-78dac2be1f68
                        Filesize

                        671B

                        MD5

                        83d56bf60ed707b46265333ff82980b0

                        SHA1

                        43ec52c3fb455fc58b6db2c4dada7da62d6d10bf

                        SHA256

                        8a65819d19c1b2b743b1da3281b2343699b6a92623cbaaf7bc9593b85c104850

                        SHA512

                        8c0940c03c1ebab7c9d196e21d608dc787602e74c1daeb84b04253d3d54ac1f0369da41d38fd854236ddeb8c6b400dc594f084f06946750c5c4e99373ee91a32

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                        Filesize

                        10KB

                        MD5

                        9eb1d0228bd4ae45823e8221d0d346c3

                        SHA1

                        16083a3e045192bb9fdf0b1c23ff96d7272b7d16

                        SHA256

                        8b26a2fc0e846b4fcc713b7fa51544b9e97a62604424c4cf456671a9ae515c0e

                        SHA512

                        2b9a924c55870142db39111e15068be9fcdc28e23c89ae7ac9c57fbd56e0dc0be14229e9c820551e61b2a80bf90bf10b08f85cbf94053c7fef8eb03d7bd6c2c0

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js
                        Filesize

                        11KB

                        MD5

                        82c8d35ff5f5e884abef1738bdc3ae3b

                        SHA1

                        a82c4826ab4862ff78b1c3a1675e1cfa2d48a3c6

                        SHA256

                        d15b7e31c42ac7d0e8ef4591bbfd0567b1124aef87ee29a5e0edf4d89dd5fbf6

                        SHA512

                        9d1213b49d323f0458abff27b4406494f4f7f715eb5e535daae8ed9f95f8c60728eba975d9c4ac30cb92532804252bfbd0da0476a831f96ceb2d8017d59efb2d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                        Filesize

                        15KB

                        MD5

                        9e30f50f63ec928c8bcc311b5615e878

                        SHA1

                        3789cef614fceb33886126763b515698f8c55e8f

                        SHA256

                        3bdd86a8c05b1f8514a55f5e570a9440385ab2cafa3cfc875ba578034744ebc0

                        SHA512

                        d290bab45b79a30e58e148242737162d4881a5a387b953cc42dee585313c279c7419f185eeb63ef330af33e0b11c8e9f3433edea3fee73ccdaa2bb41552d827c

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                        Filesize

                        15KB

                        MD5

                        2bf6cc2ffa59df3d682c9311e077c6c2

                        SHA1

                        77e549e72da0536a0665c4103dfff605ad1c7497

                        SHA256

                        f792f59ad1c5feed2079bdef69d8310c64efbff8d82e181fdf228a413b1a058f

                        SHA512

                        0d4bd99fe24bf166de78d3eec47b8eca8f500897d0102e9936b13ed1e0f4885f20735d487155a2daa76f5f20be2edc8627337f8bc9ab2dbc4c790a45f4410766

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js
                        Filesize

                        10KB

                        MD5

                        4694d14a2ae74ece8d94baead61326bd

                        SHA1

                        ff4d4454f2cfbcaaeaaab7fd44b8d2941c7cfe10

                        SHA256

                        84e2f9290bec2e8d3fa46f12d776c2526b19e690b4431237d67285fddde624e5

                        SHA512

                        39698f909a1ac72f7c18cc9390026c37a1db5caa93fc21e30f879bed2382422ad466ccacc69887f70b6f7244e1d984b18d7c9bf393cf0697425cf5afbdb2ce58

                        Download Submit

                      • memory/64-3-0x0000000000460000-0x000000000078E000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/64-4-0x0000000000460000-0x000000000078E000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/64-19-0x0000000000461000-0x00000000004C9000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/64-18-0x0000000000460000-0x000000000078E000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/64-0-0x0000000000460000-0x000000000078E000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/64-2-0x0000000000461000-0x00000000004C9000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/64-1-0x0000000077014000-0x0000000077016000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/544-2808-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-51-0x00000000009A1000-0x0000000000A09000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/544-820-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-53-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-52-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-84-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-50-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-2813-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-22-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-607-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-16-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-21-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-194-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-2802-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-593-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-1773-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/544-20-0x00000000009A1000-0x0000000000A09000-memory.dmp

                        Filesize

                        416KB

                        Download

                      • memory/544-49-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/976-175-0x0000000000960000-0x0000000000FD8000-memory.dmp

                        Filesize

                        6.5MB

                        Download

                      • memory/976-163-0x0000000000960000-0x0000000000FD8000-memory.dmp

                        Filesize

                        6.5MB

                        Download

                      • memory/984-1769-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/984-1797-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/984-612-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/984-615-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/984-616-0x0000000000400000-0x0000000000473000-memory.dmp

                        Filesize

                        460KB

                        Download

                      • memory/1100-195-0x0000000000360000-0x00000000007F7000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1100-583-0x0000000000360000-0x00000000007F7000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1100-196-0x0000000000360000-0x00000000007F7000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1100-106-0x0000000000360000-0x00000000007F7000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/1564-752-0x0000000000E60000-0x0000000000E7A000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/2084-2816-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2084-2819-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/2112-146-0x0000000006C80000-0x0000000006C9A000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/2112-135-0x0000000000D70000-0x0000000000E3E000-memory.dmp

                        Filesize

                        824KB

                        Download

                      • memory/2112-147-0x0000000006CA0000-0x0000000006CA6000-memory.dmp

                        Filesize

                        24KB

                        Download

                      • memory/2952-228-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/2952-198-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/3700-46-0x00000000055D0000-0x00000000055F6000-memory.dmp

                        Filesize

                        152KB

                        Download

                      • memory/3700-47-0x0000000005C70000-0x0000000005C7A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/3700-41-0x0000000072C2E000-0x0000000072C2F000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/3700-42-0x0000000000B90000-0x0000000000C5E000-memory.dmp

                        Filesize

                        824KB

                        Download

                      • memory/3700-43-0x0000000005650000-0x00000000056EC000-memory.dmp

                        Filesize

                        624KB

                        Download

                      • memory/3700-44-0x0000000005CA0000-0x0000000006244000-memory.dmp

                        Filesize

                        5.6MB

                        Download

                      • memory/3700-45-0x00000000056F0000-0x0000000005782000-memory.dmp

                        Filesize

                        584KB

                        Download

                      • memory/3996-2815-0x0000000004F40000-0x0000000004F62000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3996-2814-0x0000000005150000-0x00000000052E0000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3996-1798-0x0000000000460000-0x00000000006E2000-memory.dmp

                        Filesize

                        2.5MB

                        Download

                      • memory/4452-82-0x0000000008090000-0x000000000809A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/4452-75-0x0000000000C00000-0x00000000015DC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/4452-174-0x0000000000C00000-0x00000000015DC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/4452-103-0x00000000091F0000-0x0000000009544000-memory.dmp

                        Filesize

                        3.3MB

                        Download

                      • memory/4452-86-0x00000000090B0000-0x00000000090CE000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/4452-85-0x0000000008C30000-0x0000000008C96000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/4452-83-0x00000000083C0000-0x0000000008436000-memory.dmp

                        Filesize

                        472KB

                        Download

                      • memory/4452-139-0x000000000ACD0000-0x000000000ACE2000-memory.dmp

                        Filesize

                        72KB

                        Download

                      • memory/4452-76-0x0000000000C00000-0x00000000015DC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/4452-111-0x000000000A530000-0x000000000A56C000-memory.dmp

                        Filesize

                        240KB

                        Download

                      • memory/4452-74-0x0000000000C00000-0x00000000015DC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/4452-102-0x0000000009180000-0x00000000091EA000-memory.dmp

                        Filesize

                        424KB

                        Download

                      • memory/4452-113-0x000000000A5A0000-0x000000000A8CE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/4452-104-0x0000000009590000-0x00000000095DC000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/4452-107-0x0000000009730000-0x00000000097E2000-memory.dmp

                        Filesize

                        712KB

                        Download

                      • memory/4452-108-0x0000000009840000-0x0000000009890000-memory.dmp

                        Filesize

                        320KB

                        Download

                      • memory/4452-109-0x00000000098C0000-0x00000000098E2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/4452-112-0x000000000A4F0000-0x000000000A511000-memory.dmp

                        Filesize

                        132KB

                        Download

                      • memory/4576-606-0x0000000000DD0000-0x000000000108C000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4576-436-0x0000000000DD0000-0x000000000108C000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4576-597-0x0000000000DD0000-0x000000000108C000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4576-225-0x0000000000DD0000-0x000000000108C000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/4576-440-0x0000000000DD0000-0x000000000108C000-memory.dmp

                        Filesize

                        2.7MB

                        Download

                      • memory/5472-2811-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/5472-2810-0x00000000009A0000-0x0000000000CCE000-memory.dmp

                        Filesize

                        3.2MB

                        Download